Allows creating new remote clusters without providing a password (#27864)

* Allows creating new remote clusters without providing a password

If the endpoint receives a request with no password, it will generate
one internally and return it in the response, so the frotend can show
it to the user.

* Use a random string instead of a UUID for the generated password

* Update function name to avoid CString reference and adds assertion

* Update server/channels/utils/textgeneration.go

Co-authored-by: Eva Sarafianou <eva.sarafianou@gmail.com>

* Extends the charset

---------

Co-authored-by: Eva Sarafianou <eva.sarafianou@gmail.com>

server/channels/api4/remote_cluster.go

@@ -13,6 +13,7 @@ import (
 	"github.com/mattermost/mattermost/server/public/shared/mlog"
 	"github.com/mattermost/mattermost/server/v8/channels/app"
 	"github.com/mattermost/mattermost/server/v8/channels/audit"
+	"github.com/mattermost/mattermost/server/v8/channels/utils"
 	"github.com/mattermost/mattermost/server/v8/platform/services/remotecluster"
 )
 
@@ -366,11 +367,6 @@ func createRemoteCluster(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if rcWithTeamAndPassword.Password == "" {
-		c.SetInvalidParam("password")
-		return
-	}
-
 	url := c.App.GetSiteURL()
 	if url == "" {
 		c.Err = model.NewAppError("createRemoteCluster", "api.get_site_url_error", nil, "", http.StatusUnprocessableEntity)
@@ -398,7 +394,12 @@ func createRemoteCluster(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 	rcSaved.Sanitize()
 
-	inviteCode, iErr := c.App.CreateRemoteClusterInvite(rcSaved.RemoteId, url, rcSaved.Token, rcWithTeamAndPassword.Password)
+	password := rcWithTeamAndPassword.Password
+	if password == "" {
+		password = utils.SecureRandString(16)
+	}
+
+	inviteCode, iErr := c.App.CreateRemoteClusterInvite(rcSaved.RemoteId, url, rcSaved.Token, password)
 	if iErr != nil {
 		c.Err = iErr
 		return
@@ -408,7 +409,12 @@ func createRemoteCluster(c *Context, w http.ResponseWriter, r *http.Request) {
 	auditRec.AddEventResultState(rcSaved)
 	auditRec.AddEventObjectType("remotecluster")
 
-	b, err := json.Marshal(model.RemoteClusterWithInvite{RemoteCluster: rcSaved, Invite: inviteCode})
+	resp := model.RemoteClusterWithInvite{RemoteCluster: rcSaved, Invite: inviteCode}
+	if rcWithTeamAndPassword.Password == "" {
+		resp.Password = password
+	}
+
+	b, err := json.Marshal(resp)
 	if err != nil {
 		c.Err = model.NewAppError("createRemoteCluster", "api.marshal_error", nil, "", http.StatusInternalServerError).Wrap(err)
 		return

server/channels/api4/remote_cluster_test.go

@@ -195,17 +195,35 @@ func TestCreateRemoteCluster(t *testing.T) {
 
 	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.SiteURL = "http://localhost:8065" })
 
-	t.Run("Should enforce the presence of the password", func(t *testing.T) {
+	t.Run("Should generate a password if none is given", func(t *testing.T) {
 		// clean the password and check the response
-		rcWithTeamAndPassword.Password = ""
+		rcWithTeamNoPassword := &model.RemoteClusterWithPassword{
+			RemoteCluster: &model.RemoteCluster{
+				Name:    "remotecluster-nopasswd",
+				SiteURL: "http://no-passwd.example.com",
+				Token:   model.NewId(),
+			},
+			Password: "",
+		}
 
-		rcWithInvite, resp, err := th.SystemAdminClient.CreateRemoteCluster(context.Background(), rcWithTeamAndPassword)
-		CheckBadRequestStatus(t, resp)
-		require.Error(t, err)
-		require.Empty(t, rcWithInvite)
+		rcWithInvite, resp, err := th.SystemAdminClient.CreateRemoteCluster(context.Background(), rcWithTeamNoPassword)
+		CheckCreatedStatus(t, resp)
+		require.NoError(t, err)
+		require.NotZero(t, rcWithInvite.Invite)
+		// when the password is not provided, it is returned as part
+		// of the response
+		require.NotZero(t, rcWithInvite.Password)
+		require.Len(t, rcWithInvite.Password, 16)
 
-		// reset password for the next tests
-		rcWithTeamAndPassword.Password = "mysupersecret"
+		rc, appErr := th.App.GetRemoteCluster(rcWithInvite.RemoteCluster.RemoteId)
+		require.Nil(t, appErr)
+		require.Equal(t, rcWithTeamNoPassword.Name, rc.Name)
+
+		rci, appErr := th.App.DecryptRemoteClusterInvite(rcWithInvite.Invite, rcWithInvite.Password)
+		require.Nil(t, appErr)
+		require.Equal(t, rc.RemoteId, rci.RemoteId)
+		require.Equal(t, rc.RemoteToken, rci.Token)
+		require.Equal(t, th.App.GetSiteURL(), rci.SiteURL)
 	})
 
 	t.Run("Should return a sanitized remote cluster and its invite", func(t *testing.T) {
@@ -216,6 +234,9 @@ func TestCreateRemoteCluster(t *testing.T) {
 		require.NotZero(t, rcWithInvite.Invite)
 		require.Zero(t, rcWithInvite.RemoteCluster.Token)
 		require.Zero(t, rcWithInvite.RemoteCluster.RemoteToken)
+		// when the password is provided as an input, is not returned
+		// by the endpoint
+		require.Zero(t, rcWithInvite.Password)
 
 		rc, appErr := th.App.GetRemoteCluster(rcWithInvite.RemoteCluster.RemoteId)
 		require.Nil(t, appErr)