Feature scheduled messages (#28932)

* Create scheduled post api (#27920)

* Added migration files for Postgres

* Added migrations for MySQL

* Added store method

* Added API and store tests

* Renamed migration after syncing with master

* Added app layer tests

* API is ready

* API is ready

* API is ready

* Renamed migration after syncing with master

* Updated migration list

* Fixed retry layer tests

* Allowed posts with empty messages

* Review fixes

* Reverted an incorrect change

* Renamed migration and fixed ID assignment

* CI

* Send post button changes (#28019)

* added Split button

* WIP

* Added core menu options

* WIP

* WIP

* WIP

* Handled displaying error in creating scheduled post

* lint fixes

* webapp i18n fix

* Review fixes

* Fixed a webapp test

* A few more fixes

* Removed a duplicate comment

* Scheduled post job (#28088)

* Added the job function

* Added query for fetching scheduled posts for pricessing

* WIP

* WIP

* WIP

* WIP

* WIP

* WIP

* Reafactoring of scheduled post job

* Lint fixes

* Updated i18n files

* FInishing touches

* Added tests for GetScheduledPosts

* Added tests for PermanentlyDeleteScheduledPosts

* Updated all layer

* Some changes as discussed with team

* Added tests for UpdatedScheduledPost

* Code review refactoring

* Added job test

* MM-60120 - Custom time selection (#28120)

* Added a common date time picker modal and used it for post reminder

* Added a common date time picker modal and used it for post reminderggp

* Added modal for custom schedule time and fixed TZ issue

* WIP

* Removed event from useSubmit hook

* Removed event from useSubmit hook

* Added timezone handling

* fixed type error

* Updated i18n strings

* Minor cleanup

* updated snapshots

* review fixes

* Handled event

* Supported for having a DM thread open in RHS while in a regular channel

* Review fixes

* MM-60136 - Scheduled messages tab (#28133)

* WIP

* WIP

* Created Tabs and Tab wrapper with added styling

* Added API to get scheduled posts

* WIP

* Displated scheduled post count

* i18n fix

* Added tests

* Handled asetting active tab absed on URL:

* Reverted unintended change

* Added API to client ad OpenAPI specs

* Renamed file

* Adding fileinfo to schedule posts

* Partial review fixes

* Made get scheduled post API return posts by teamID

* review fixes

* Moved scheduled post redux code to MM-redux package

* Usedd selector factory

* WIP:

* WIP:

* Lint fix

* Fixed an incorrect openapi spec file

* Removed redundent permission check

* Clreaed scheduled post data on logout

* Removed unused i18n string:

* lint fix

* Render scheduled posts (#28208)

* WIP

* WIP

* Created Tabs and Tab wrapper with added styling

* Added API to get scheduled posts

* WIP

* Displated scheduled post count

* i18n fix

* Added tests

* Handled asetting active tab absed on URL:

* Reverted unintended change

* Added API to client ad OpenAPI specs

* Renamed file

* Created common component for draft list item

* WIP

* WIP

* Adding fileinfo to schedule posts

* Basic rendering

* Added count badge to tabs

* WIP

* Made the Drafts LHS iteam appear if no drafts exist but scheduled posts do

* Fixed icon size

* Partial review fixes

* Made get scheduled post API return posts by teamID

* Handled initial vs team switch load

* Displayed scheduled date in panel header

* Added error message and error indiocator

* WIP

* review fixes

* WIP Adding error reason tag

* Added error codes

* Moved scheduled post redux code to MM-redux package

* Usedd selector factory

* WIP:

* WIP:

* Lint fix

* Fixed an incorrect openapi spec file

* Removed redundent permission check

* Clreaed scheduled post data on logout

* Removed unused i18n string:

* lint fix

* Opened rescheduling modal

* Updated graphic for empty state of schduled post list

* Added delete scheduled post option and modal

* Badge and timezone fix

* WIP:

* Added send now confirmation modal

* lint

* Webapp i18n fix

* Fixed webapp test

* Fixed a bug where DM/GM scheduled posts weren't immideatly showing up in UI

* Minor fixes

* WIP

* Review fixes

* Review fixes

* Optimisations

* Fixed reducer name

* Moment optimizatin

* Updated route check

* MM-60144 - added API to update a scheduled post (#28248)

* WIP

* Added api and ap layer for update scheduled post ̛̦̄

* Added API to OpenAI specs, Go client and TS client

* removed permissio check

* Added tests

* Fixed tests

* Added PreUpdate method on scheduled post model

* MM-60131 - Reschedule post integration (#28281)

* Handled rescheduling post in webapp

* Added error handling

* MM-60146 - Delete scheduled post api (#28265)

* WIP

* Added api and ap layer for update scheduled post ̛̦̄

* Added API to OpenAI specs, Go client and TS client

* removed permissio check

* Added tests

* Fixed tests

* Added PreUpdate method on scheduled post model

* Added delete scheduled post API

* Added API to Go client and OpenAPI specs

* Added API to TS client

* Added tests

* CI

* Rmeoved two incorrect code comments

* MM-60653 - Integrated delete scheduled post API (#28296)

* Integrated delete scheduled apost API

* Lint fix

* Review fixes

* Excluded draft checks from scheduled posts (#28370)

* Excluded draft checks from scheduled posts

* Added a removed todo

* MM-60125 - Scheduled post channel indicator (#28320)

* Integrated delete scheduled apost API

* Lint fix

* Added state for storing scheduled posts by channel ID

* Refactored redux store to store scheudled posts by ID, thens tore IDs everywhere

* Refactored redux store to store scheudled posts by ID, thens tore IDs everywhere

* WIP

* Added scheduled post indiocator

* Handled single and multiple scheudled posts

* Review fixes

* Fixed styling and handled center channel, RHS and threads view

* Lint fix

* i18n fix

* Fixed a cycling dependency

* Lint fix

* Added some more comments

* Updated styling

* Review fixes

* Added common component for remote user time and scheduled post indicator

* Updated scheduled post count

* Minor change

* Moved CSS code around

* Fixed a bug where files in scheduled post didn't show up until refresh (#28359)

---------

Co-authored-by: Daniel Espino García <larkox@gmail.com>

* Scheduled post config (#28485)

* Added config

* Added config on server and webapp side

* Added config check in server and webapp

* Added license check

* Added license check

* Added placeholder help text

* Added license check to job

* Fixed job test

* Review fixes

* Updated English text

* Review fixes

* MM-60118 - Added index on ScheduledPosts table (#28579)

* Added index

* Updated indexes

* Scheduled posts misc fixes (#28625)

* Added detailed logging for scheduled post job

* Limited scheduled posts processing to 24 hours

* Marked old scheduled posts as unable to send

* Added t5ests

* converted some logs to trace level

* Fixed a bug causing error message to show up on deleting a scheduled post in a deleted thread (#28630)

* Fixed scheduled posts link in RHS (#28659)

* Fixed scheduled posts link in RHS

* Review fixes

* Fix permission name in scheduled posts by team (#28580)

* Fix permission name

* fix wording

---------

Co-authored-by: Mattermost Build <build@mattermost.com>

* FIxed width of generic modal header to fix browser channel modal (#28639)

* Only consider error-free scheduled posts for indicator in channel and RHS (#28683)

* Show only errro free scheudled posts in post box indicator

* Fixed a bug to handle no scheduled posts

* Fixed draft and scheudled post UI in mobile view (#28680)

* MM-60873 and MM-60872 - Fixed a bug with updating scheduled posts (#28656)

* Fixed a bug with updating scheduled posts

* Better selectors

* MOved shceuled post message length validation to app layer

* MM-60732 - Scheduled posts channel link now takes you to the first scheduled post in channel/thread in list (#28768)

* Ordered scheudle dposts by schgeudled at nad create at

* Ordered in client

* Added scroll to target

* Removed classname prop

* Fixed tests

* Added doc

* Import fix

* MM-60961 - Fixed a bug where API used incoming create at date for scheduled post (#28703)

* Fixed a bug where API used incoming create at date for scheduled post

* Stopped sending created at value for scheduled post

* MM-60785 - Fixed a bug where scheduled posts of channel we are no longer member of didn't show up (#28637)

* Fixed a bug where scheduled posts of channel we are no longer member of didn't show up

* Added a comment

* CI

* Used data loader to optimise laoding missing channels

* Minor refactoring

* MM-60963 - Added common checks for post and scheduled posts (#28713)

* Added commen checks for post and scheuled posts

* Sanitised scheduled posts

* Fixed tests

* Splitted post checks into app and context functions

* Added checks on scheduiled posts job as well:

* i18n fix

* Fixed a test

* Renamed a func

* removed duplicate check

* Scheduled posts UI fixes (#28828)

* Fixed send button and time picker borders

* Fixed center alignment of time picker

* Removed on for today and tomorrow

* Lint fix

* Date time modal hover state fix

* Badge fix

* Fixed a mnerge issue

* Scheduled Post send now and add schedule on draft (#28851)

* Added send now option on scheduled posts

* Minor refactoring

* WIP

* WIP

* WIP

* Lint fix

* i18n fix

* Snapshot update

* Review fixes

* Scheduled post inline editing (#28893)

* Added send now option on scheduled posts

* Minor refactoring

* WIP

* WIP

* WIP

* Lint fix

* i18n fix

* Snapshot update

* Displayed editing component in scheduled post

* Added handling for updating scheduled post

* Handle events

* Fixed escape key issue in scheudled post editing

* Fixes

* Displayed error message for editing error

* Don't show mention warning

* Handled dev mode (#28918)

* MInor fixes

* client fix

* Fixes

* CI

* Removed dev mode behaviour temperorily (#29008)

---------

Co-authored-by: Daniel Espino García <larkox@gmail.com>
Co-authored-by: Eva Sarafianou <eva.sarafianou@gmail.com>
Co-authored-by: Mattermost Build <build@mattermost.com>

server/channels/api4/api.go

@@ -337,6 +337,7 @@ func Init(srv *app.Server) (*API, error) {
 	api.InitLimits()
 	api.InitOutgoingOAuthConnection()
 	api.InitClientPerformanceMetrics()
+	api.InitScheduledPost()
 
 	// If we allow testing then listen for manual testing URL hits
 	if *srv.Config().ServiceSettings.EnableTesting {

server/channels/api4/handlers.go

@@ -239,12 +239,7 @@ func requireLicense(c *Context) *model.AppError {
 }
 
 func minimumProfessionalLicense(c *Context) *model.AppError {
-	lic := c.App.Srv().License()
-	if lic == nil || (lic.SkuShortName != model.LicenseShortSkuProfessional && lic.SkuShortName != model.LicenseShortSkuEnterprise) {
-		err := model.NewAppError("", model.NoTranslation, nil, "license is neither professional nor enterprise", http.StatusNotImplemented)
-		return err
-	}
-	return nil
+	return model.MinimumProfessionalProvidedLicense(c.App.Srv().License())
 }
 
 func setHandlerOpts(handler *web.Handler, opts ...APIHandlerOption) {

server/channels/api4/post.go

@@ -48,6 +48,26 @@ func (api *API) InitPost() {
 	api.BaseRoutes.Post.Handle("/move", api.APISessionRequired(moveThread)).Methods(http.MethodPost)
 }
 
+func createPostChecks(where string, c *Context, post *model.Post) {
+	// ***************************************************************
+	// NOTE - if you make any change here, please make sure to apply the
+	//	      same change for scheduled posts as well in the `scheduledPostChecks()` function
+	//	      in API layer.
+	// ***************************************************************
+
+	userCreatePostPermissionCheckWithContext(c, post.ChannelId)
+	if c.Err != nil {
+		return
+	}
+
+	postHardenedModeCheckWithContext(where, c, post.GetProps())
+	if c.Err != nil {
+		return
+	}
+
+	postPriorityCheckWithContext(where, c, post.GetPriority(), post.RootId)
+}
+
 func createPost(c *Context, w http.ResponseWriter, r *http.Request) {
 	var post model.Post
 	if jsonErr := json.NewDecoder(r.Body).Decode(&post); jsonErr != nil {
@@ -56,87 +76,19 @@ func createPost(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	post.SanitizeInput()
-
 	post.UserId = c.AppContext.Session().UserId
 
 	auditRec := c.MakeAuditRecord("createPost", audit.Fail)
 	defer c.LogAuditRecWithLevel(auditRec, app.LevelContent)
 	audit.AddEventParameterAuditable(auditRec, "post", &post)
 
-	hasPermission := false
-	if c.App.SessionHasPermissionToChannel(c.AppContext, *c.AppContext.Session(), post.ChannelId, model.PermissionCreatePost) {
-		hasPermission = true
-	} else if channel, err := c.App.GetChannel(c.AppContext, post.ChannelId); err == nil {
-		// Temporary permission check method until advanced permissions, please do not copy
-		if channel.Type == model.ChannelTypeOpen && c.App.SessionHasPermissionToTeam(*c.AppContext.Session(), channel.TeamId, model.PermissionCreatePostPublic) {
-			hasPermission = true
-		}
-	}
-
-	if !hasPermission {
-		c.SetPermissionError(model.PermissionCreatePost)
-		return
-	}
-	if *c.App.Config().ServiceSettings.ExperimentalEnableHardenedMode {
-		if reservedProps := post.ContainsIntegrationsReservedProps(); len(reservedProps) > 0 && !c.AppContext.Session().IsIntegration() {
-			c.SetInvalidParamWithDetails("props", fmt.Sprintf("Cannot use props reserved for integrations. props: %v", reservedProps))
-			return
-		}
-	}
-
 	if post.CreateAt != 0 && !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionManageSystem) {
 		post.CreateAt = 0
 	}
 
-	if post.GetPriority() != nil {
-		priorityForbiddenErr := model.NewAppError("Api4.createPost", "api.post.post_priority.priority_post_not_allowed_for_user.request_error", nil, "userId="+c.AppContext.Session().UserId, http.StatusForbidden)
-
-		if !c.App.IsPostPriorityEnabled() {
-			c.Err = priorityForbiddenErr
-			return
-		}
-
-		if post.RootId != "" {
-			c.Err = model.NewAppError("Api4.createPost", "api.post.post_priority.priority_post_only_allowed_for_root_post.request_error", nil, "", http.StatusBadRequest)
-			return
-		}
-
-		if ack := post.GetRequestedAck(); ack != nil && *ack {
-			licenseErr := minimumProfessionalLicense(c)
-			if licenseErr != nil {
-				c.Err = licenseErr
-				return
-			}
-		}
-
-		if notification := post.GetPersistentNotification(); notification != nil && *notification {
-			licenseErr := minimumProfessionalLicense(c)
-			if licenseErr != nil {
-				c.Err = licenseErr
-				return
-			}
-			if !c.App.IsPersistentNotificationsEnabled() {
-				c.Err = priorityForbiddenErr
-				return
-			}
-
-			if !post.IsUrgent() {
-				c.Err = model.NewAppError("Api4.createPost", "api.post.post_priority.urgent_persistent_notification_post.request_error", nil, "", http.StatusBadRequest)
-				return
-			}
-
-			if !*c.App.Config().ServiceSettings.AllowPersistentNotificationsForGuests {
-				user, err := c.App.GetUser(c.AppContext.Session().UserId)
-				if err != nil {
-					c.Err = err
-					return
-				}
-				if user.IsGuest() {
-					c.Err = priorityForbiddenErr
-					return
-				}
-			}
-		}
+	createPostChecks("Api4.createPost", c, &post)
+	if c.Err != nil {
+		return
 	}
 
 	setOnline := r.URL.Query().Get("set_online")
@@ -888,11 +840,9 @@ func updatePost(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if *c.App.Config().ServiceSettings.ExperimentalEnableHardenedMode {
-		if reservedProps := post.ContainsIntegrationsReservedProps(); len(reservedProps) > 0 && !c.AppContext.Session().IsIntegration() {
-			c.SetInvalidParamWithDetails("props", fmt.Sprintf("Cannot use props reserved for integrations. props: %v", reservedProps))
-			return
-		}
+	postHardenedModeCheckWithContext("UpdatePost", c, post.GetProps())
+	if c.Err != nil {
+		return
 	}
 
 	originalPost, err := c.App.GetSinglePost(c.AppContext, c.Params.PostId, false)
@@ -957,9 +907,9 @@ func patchPost(c *Context, w http.ResponseWriter, r *http.Request) {
 	audit.AddEventParameterAuditable(auditRec, "patch", &post)
 	defer c.LogAuditRecWithLevel(auditRec, app.LevelContent)
 
-	if *c.App.Config().ServiceSettings.ExperimentalEnableHardenedMode {
-		if reservedProps := post.ContainsIntegrationsReservedProps(); len(reservedProps) > 0 && !c.AppContext.Session().IsIntegration() {
-			c.SetInvalidParamWithDetails("props", fmt.Sprintf("Cannot use props reserved for integrations. props: %v", reservedProps))
+	if post.Props != nil {
+		postHardenedModeCheckWithContext("patchPost", c, *post.Props)
+		if c.Err != nil {
 			return
 		}
 	}

server/channels/api4/post_utils.go

@@ -0,0 +1,43 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package api4
+
+import (
+	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/mattermost/mattermost/server/v8/channels/app"
+)
+
+func userCreatePostPermissionCheckWithContext(c *Context, channelId string) {
+	hasPermission := false
+	if c.App.SessionHasPermissionToChannel(c.AppContext, *c.AppContext.Session(), channelId, model.PermissionCreatePost) {
+		hasPermission = true
+	} else if channel, err := c.App.GetChannel(c.AppContext, channelId); err == nil {
+		// Temporary permission check method until advanced permissions, please do not copy
+		if channel.Type == model.ChannelTypeOpen && c.App.SessionHasPermissionToTeam(*c.AppContext.Session(), channel.TeamId, model.PermissionCreatePostPublic) {
+			hasPermission = true
+		}
+	}
+
+	if !hasPermission {
+		c.SetPermissionError(model.PermissionCreatePost)
+		return
+	}
+}
+
+func postHardenedModeCheckWithContext(where string, c *Context, props model.StringInterface) {
+	isIntegration := c.AppContext.Session().IsIntegration()
+
+	if appErr := app.PostHardenedModeCheckWithApp(c.App, isIntegration, props); appErr != nil {
+		appErr.Where = where
+		c.Err = appErr
+	}
+}
+
+func postPriorityCheckWithContext(where string, c *Context, priority *model.PostPriority, rootId string) {
+	appErr := app.PostPriorityCheckWithApp(where, c.App, c.AppContext.Session().UserId, priority, rootId)
+	if appErr != nil {
+		appErr.Where = where
+		c.Err = appErr
+	}
+}

server/channels/api4/scheduled_post.go

@@ -0,0 +1,225 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package api4
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"github.com/gorilla/mux"
+
+	"github.com/mattermost/mattermost/server/v8/channels/app"
+	"github.com/mattermost/mattermost/server/v8/channels/audit"
+
+	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/mattermost/mattermost/server/public/shared/mlog"
+)
+
+func (api *API) InitScheduledPost() {
+	api.BaseRoutes.Posts.Handle("/schedule", api.APISessionRequired(createSchedulePost)).Methods(http.MethodPost)
+	api.BaseRoutes.Posts.Handle("/schedule/{scheduled_post_id:[A-Za-z0-9]+}", api.APISessionRequired(updateScheduledPost)).Methods(http.MethodPut)
+	api.BaseRoutes.Posts.Handle("/schedule/{scheduled_post_id:[A-Za-z0-9]+}", api.APISessionRequired(deleteScheduledPost)).Methods(http.MethodDelete)
+	api.BaseRoutes.Posts.Handle("/scheduled/team/{team_id:[A-Za-z0-9]+}", api.APISessionRequired(getTeamScheduledPosts)).Methods(http.MethodGet)
+}
+
+func scheduledPostChecks(where string, c *Context, scheduledPost *model.ScheduledPost) {
+	// ***************************************************************
+	// NOTE - if you make any change here, please make sure to apply the
+	//	      same change for scheduled posts job as well in the `canPostScheduledPost()` function
+	//	      in app layer.
+	// ***************************************************************
+
+	userCreatePostPermissionCheckWithContext(c, scheduledPost.ChannelId)
+	if c.Err != nil {
+		return
+	}
+
+	postHardenedModeCheckWithContext(where, c, scheduledPost.GetProps())
+	if c.Err != nil {
+		return
+	}
+
+	postPriorityCheckWithContext(where, c, scheduledPost.GetPriority(), scheduledPost.RootId)
+}
+
+func requireScheduledPostsEnabled(c *Context) {
+	if !*c.App.Srv().Config().ServiceSettings.ScheduledPosts {
+		c.Err = model.NewAppError("", "api.scheduled_posts.feature_disabled", nil, "", http.StatusBadRequest)
+		return
+	}
+
+	if c.App.Channels().License() == nil {
+		c.Err = model.NewAppError("", "api.scheduled_posts.license_error", nil, "", http.StatusBadRequest)
+		return
+	}
+}
+
+func createSchedulePost(c *Context, w http.ResponseWriter, r *http.Request) {
+	requireScheduledPostsEnabled(c)
+	if c.Err != nil {
+		return
+	}
+
+	var scheduledPost model.ScheduledPost
+	if err := json.NewDecoder(r.Body).Decode(&scheduledPost); err != nil {
+		c.SetInvalidParamWithErr("schedule_post", err)
+		return
+	}
+	scheduledPost.UserId = c.AppContext.Session().UserId
+	scheduledPost.SanitizeInput()
+
+	auditRec := c.MakeAuditRecord("createSchedulePost", audit.Fail)
+	defer c.LogAuditRecWithLevel(auditRec, app.LevelContent)
+	audit.AddEventParameterAuditable(auditRec, "scheduledPost", &scheduledPost)
+
+	scheduledPostChecks("Api4.createSchedulePost", c, &scheduledPost)
+	if c.Err != nil {
+		return
+	}
+
+	createdScheduledPost, appErr := c.App.SaveScheduledPost(c.AppContext, &scheduledPost)
+	if appErr != nil {
+		c.Err = appErr
+		return
+	}
+
+	auditRec.Success()
+	auditRec.AddEventResultState(createdScheduledPost)
+	auditRec.AddEventObjectType("scheduledPost")
+
+	w.WriteHeader(http.StatusCreated)
+	if err := json.NewEncoder(w).Encode(createdScheduledPost); err != nil {
+		mlog.Error("failed to encode scheduled post to return API response", mlog.Err(err))
+		return
+	}
+}
+
+func getTeamScheduledPosts(c *Context, w http.ResponseWriter, r *http.Request) {
+	requireScheduledPostsEnabled(c)
+	if c.Err != nil {
+		return
+	}
+
+	c.RequireTeamId()
+	if c.Err != nil {
+		return
+	}
+
+	if !c.App.SessionHasPermissionToTeam(*c.AppContext.Session(), c.Params.TeamId, model.PermissionViewTeam) {
+		c.SetPermissionError(model.PermissionViewTeam)
+		return
+	}
+
+	teamId := c.Params.TeamId
+	userId := c.AppContext.Session().UserId
+
+	scheduledPosts, appErr := c.App.GetUserTeamScheduledPosts(c.AppContext, userId, teamId)
+	if appErr != nil {
+		c.Err = appErr
+		return
+	}
+
+	response := map[string][]*model.ScheduledPost{}
+	response[teamId] = scheduledPosts
+
+	if r.URL.Query().Get("includeDirectChannels") == "true" {
+		directChannelScheduledPosts, appErr := c.App.GetUserTeamScheduledPosts(c.AppContext, userId, "")
+		if appErr != nil {
+			c.Err = appErr
+			return
+		}
+
+		response["directChannels"] = directChannelScheduledPosts
+	}
+
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		mlog.Error("failed to encode scheduled posts to return API response", mlog.Err(err))
+		return
+	}
+}
+
+func updateScheduledPost(c *Context, w http.ResponseWriter, r *http.Request) {
+	requireScheduledPostsEnabled(c)
+	if c.Err != nil {
+		return
+	}
+
+	scheduledPostId := mux.Vars(r)["scheduled_post_id"]
+	if scheduledPostId == "" {
+		c.SetInvalidURLParam("scheduled_post_id")
+		return
+	}
+
+	var scheduledPost model.ScheduledPost
+	if err := json.NewDecoder(r.Body).Decode(&scheduledPost); err != nil {
+		c.SetInvalidParamWithErr("schedule_post", err)
+		return
+	}
+
+	if scheduledPost.Id != scheduledPostId {
+		c.SetInvalidURLParam("scheduled_post_id")
+		return
+	}
+
+	auditRec := c.MakeAuditRecord("updateScheduledPost", audit.Fail)
+	defer c.LogAuditRecWithLevel(auditRec, app.LevelContent)
+	audit.AddEventParameterAuditable(auditRec, "scheduledPost", &scheduledPost)
+
+	scheduledPostChecks("Api4.updateScheduledPost", c, &scheduledPost)
+	if c.Err != nil {
+		return
+	}
+
+	userId := c.AppContext.Session().UserId
+	updatedScheduledPost, appErr := c.App.UpdateScheduledPost(c.AppContext, userId, &scheduledPost)
+	if appErr != nil {
+		c.Err = appErr
+		return
+	}
+
+	auditRec.Success()
+	auditRec.AddEventResultState(updatedScheduledPost)
+	auditRec.AddEventObjectType("scheduledPost")
+
+	w.WriteHeader(http.StatusCreated)
+	if err := json.NewEncoder(w).Encode(updatedScheduledPost); err != nil {
+		mlog.Error("failed to encode scheduled post to return API response", mlog.Err(err))
+		return
+	}
+}
+
+func deleteScheduledPost(c *Context, w http.ResponseWriter, r *http.Request) {
+	requireScheduledPostsEnabled(c)
+	if c.Err != nil {
+		return
+	}
+
+	scheduledPostId := mux.Vars(r)["scheduled_post_id"]
+	if scheduledPostId == "" {
+		c.SetInvalidURLParam("scheduled_post_id")
+		return
+	}
+
+	auditRec := c.MakeAuditRecord("deleteScheduledPost", audit.Fail)
+	defer c.LogAuditRecWithLevel(auditRec, app.LevelContent)
+	audit.AddEventParameter(auditRec, "scheduledPostId", scheduledPostId)
+
+	userId := c.AppContext.Session().UserId
+	connectionID := r.Header.Get(model.ConnectionId)
+	deletedScheduledPost, appErr := c.App.DeleteScheduledPost(c.AppContext, userId, scheduledPostId, connectionID)
+	if appErr != nil {
+		c.Err = appErr
+		return
+	}
+
+	auditRec.Success()
+	auditRec.AddEventResultState(deletedScheduledPost)
+	auditRec.AddEventObjectType("scheduledPost")
+
+	w.WriteHeader(http.StatusCreated)
+	if err := json.NewEncoder(w).Encode(deletedScheduledPost); err != nil {
+		mlog.Error("failed to encode scheduled post to return API response", mlog.Err(err))
+		return
+	}
+}