[CLD-6324] Cloud IP Filtering (#24726)

* Initial comit for ip filtering service implementation

* Add audit logs for IP Filters

* start of webapp work

* Stashing

* Updates based on Agniva's feedback around service vs einterface

* Updates completed

* Commit before refactoring, everything's working

* First pass of cleanup complete, front-end tests added

* actually add files

* Updates to some translation strings, running i18n-extract

* Lock everything behind a feature flag

* Fix tests, try to fix some linter stuff

* Fixed linter for JS, on to scss

* Fixed linter for scss

* Fix linter

* More fixes for pipeline

* Support for IPV6

* Remove tsx file that was removed in masteR

* Revert package.json and package-lock.json to master, add cidr-regex dep into channels/package.json

* Another commit to force fix Github

* Fixes around IPV6. Some suggestions from Matt re: UX review. Fixing pipelines for tests and types on new cidr-regex package

* Changes to address Matt's feedback

* A few more changes for clean up

* Add support for permissions

* Fix vet for OpenAPI spec

* Actually add the yaml file for openapi

* Add permission migration to allow support for IP Filtering

* Fix tests

* Final fixes from Matt

* Remove cancel button from page, update link outs to documentation

* Update test to account for removed cancel button

* Adjustments based on feedback from Harrison

* More fixes from PR feedback

* Add a t to fix translations that doesn't seem to be breaking anyone else?

* More fix

* updates for PR feedback

* Fix linter

* Fix types

* Now fix the linter again

* Add back tests because Harrison was able to get them running

* Adjustments for PR feedback

* Remove admin_definition.jsx

* Fix linter

* [CLD-6453] IP Filtering notification email for sysadmins (#25224)

* Initial commit for IP filtering alert email

* Updates to style for email, addition of ip_filtering email:

* Fix pipelines

* Adjustments from Matt's feedback

* Padding changes

* template diff (#25249)

Co-authored-by: Gabe Jackson <3694686+gabrieljackson@users.noreply.github.com>

* Fix hardcoded true, remove bool return value

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
Co-authored-by: Gabe Jackson <3694686+gabrieljackson@users.noreply.github.com>

* Lock feature behind enterprise license. Drop cidr-regex in favour of ipaddr.js dependency. Refactor isIpAddressWithinRanges to use ipaddr.js

* Add a couple server tests

* fix linter

* Fix types from merge conflicts

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
Co-authored-by: Gabe Jackson <3694686+gabrieljackson@users.noreply.github.com>

server/einterfaces/cloud.go

@@ -53,4 +53,7 @@ type CloudInterface interface {
 
 	// Used only for when a customer has telemetry disabled. In this scenario, true up review telemetry will be submitted via CWS.
 	SubmitTrueUpReview(userID string, trueUpReviewProfile map[string]any) error
+
+	ApplyIPFilters(userID string, ranges *model.AllowedIPRanges) (*model.AllowedIPRanges, error)
+	GetIPFilters(userID string) (*model.AllowedIPRanges, error)
 }

server/einterfaces/ip_filtering.go

@@ -0,0 +1,11 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package einterfaces
+
+import "github.com/mattermost/mattermost/server/public/model"
+
+type IPFilteringInterface interface {
+	ApplyIPFilters(allowedIPRanges *model.AllowedIPRanges) (*model.AllowedIPRanges, error)
+	GetIPFilters() (*model.AllowedIPRanges, error)
+}

server/einterfaces/mocks/CloudInterface.go

@@ -15,6 +15,32 @@ type CloudInterface struct {
 	mock.Mock
 }
 
+// ApplyIPFilters provides a mock function with given fields: userID, ranges
+func (_m *CloudInterface) ApplyIPFilters(userID string, ranges *model.AllowedIPRanges) (*model.AllowedIPRanges, error) {
+	ret := _m.Called(userID, ranges)
+
+	var r0 *model.AllowedIPRanges
+	var r1 error
+	if rf, ok := ret.Get(0).(func(string, *model.AllowedIPRanges) (*model.AllowedIPRanges, error)); ok {
+		return rf(userID, ranges)
+	}
+	if rf, ok := ret.Get(0).(func(string, *model.AllowedIPRanges) *model.AllowedIPRanges); ok {
+		r0 = rf(userID, ranges)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*model.AllowedIPRanges)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(string, *model.AllowedIPRanges) error); ok {
+		r1 = rf(userID, ranges)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 // BootstrapSelfHostedSignup provides a mock function with given fields: req
 func (_m *CloudInterface) BootstrapSelfHostedSignup(req model.BootstrapSelfHostedSignupRequest) (*model.BootstrapSelfHostedSignupResponse, error) {
 	ret := _m.Called(req)
@@ -343,6 +369,32 @@ func (_m *CloudInterface) GetCloudProducts(userID string, includeLegacyProducts
 	return r0, r1
 }
 
+// GetIPFilters provides a mock function with given fields: userID
+func (_m *CloudInterface) GetIPFilters(userID string) (*model.AllowedIPRanges, error) {
+	ret := _m.Called(userID)
+
+	var r0 *model.AllowedIPRanges
+	var r1 error
+	if rf, ok := ret.Get(0).(func(string) (*model.AllowedIPRanges, error)); ok {
+		return rf(userID)
+	}
+	if rf, ok := ret.Get(0).(func(string) *model.AllowedIPRanges); ok {
+		r0 = rf(userID)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*model.AllowedIPRanges)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(string) error); ok {
+		r1 = rf(userID)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 // GetInvoicePDF provides a mock function with given fields: userID, invoiceID
 func (_m *CloudInterface) GetInvoicePDF(userID string, invoiceID string) ([]byte, string, error) {
 	ret := _m.Called(userID, invoiceID)

server/einterfaces/mocks/IPFilteringInterface.go

@@ -0,0 +1,82 @@
+// Code generated by mockery v2.23.2. DO NOT EDIT.
+
+// Regenerate this file using `make einterfaces-mocks`.
+
+package mocks
+
+import (
+	model "github.com/mattermost/mattermost/server/public/model"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// IPFilteringInterface is an autogenerated mock type for the IPFilteringInterface type
+type IPFilteringInterface struct {
+	mock.Mock
+}
+
+// ApplyIPFilters provides a mock function with given fields: allowedIPRanges
+func (_m *IPFilteringInterface) ApplyIPFilters(allowedIPRanges *model.AllowedIPRanges) (*model.AllowedIPRanges, error) {
+	ret := _m.Called(allowedIPRanges)
+
+	var r0 *model.AllowedIPRanges
+	var r1 error
+	if rf, ok := ret.Get(0).(func(*model.AllowedIPRanges) (*model.AllowedIPRanges, error)); ok {
+		return rf(allowedIPRanges)
+	}
+	if rf, ok := ret.Get(0).(func(*model.AllowedIPRanges) *model.AllowedIPRanges); ok {
+		r0 = rf(allowedIPRanges)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*model.AllowedIPRanges)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(*model.AllowedIPRanges) error); ok {
+		r1 = rf(allowedIPRanges)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetIPFilters provides a mock function with given fields:
+func (_m *IPFilteringInterface) GetIPFilters() (*model.AllowedIPRanges, error) {
+	ret := _m.Called()
+
+	var r0 *model.AllowedIPRanges
+	var r1 error
+	if rf, ok := ret.Get(0).(func() (*model.AllowedIPRanges, error)); ok {
+		return rf()
+	}
+	if rf, ok := ret.Get(0).(func() *model.AllowedIPRanges); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*model.AllowedIPRanges)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func() error); ok {
+		r1 = rf()
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+type mockConstructorTestingTNewIPFilteringInterface interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewIPFilteringInterface creates a new instance of IPFilteringInterface. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewIPFilteringInterface(t mockConstructorTestingTNewIPFilteringInterface) *IPFilteringInterface {
+	mock := &IPFilteringInterface{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}