* Support Elasticsearch v9 alongside v8
* Add CI workflow changes for Elasticsearch v8/v9 testing
* Support Elasticsearch v7 in addition to v8/v9, add v7 CI test job
Lowers the minimum supported ES version from 8 to 7 to avoid dropping
v7 support in a dot release. Adds a dedicated CI job to verify v7
compatibility alongside the existing v8 and v9 (default) jobs.
* Fix ES7 plugin install crash on cgroup v2 hosts
* Fix ES 7 container startup on cgroup v2 Linux (GitHub Actions)
ES 7 bundles JDK 11, which crashes with a NullPointerException in
CgroupV2Subsystem.getMountPoint() on modern Linux kernels that use
cgroup v2 (including GitHub Actions ubuntu-latest runners). The flag
was already set during the Dockerfile RUN step, but not at runtime.
Adding -XX:-UseContainerSupport to ES_JAVA_OPTS in docker-compose
fixes the crash. The flag is harmless on ES 8/9 which ship JDK 17+
where the cgroup v2 bug is fixed (it simply opts out of container-aware
JVM sizing).
* Capture docker compose logs in CI test artifact
* Use ES 7.17.29 for v7 CI test; remove cgroup v2 workarounds
ES 7.17.0 bundled JDK 17.0.1 which had a cgroup v2 bug
(CgroupV2Subsystem NPE) not fixable via -XX:-UseContainerSupport.
ES 7.17.29 bundles JDK 22 where the bug is long fixed.
Reverts the -XX:-UseContainerSupport workarounds added in the
previous two commits as they were based on a wrong diagnosis
and are no longer needed.
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* Improve clarity of channel notification limit messages
- Update user-facing messages to explain performance reasoning and provide guidance
- Enhance admin setting descriptions to be more informative about user experience
- Change admin setting title to better reflect purpose
Fixes#32159
Co-authored-by: Sven Hüster <svelle@users.noreply.github.com>
* Update webapp/channels/src/i18n/en.json
Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>
* Update server/i18n/en.json
Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>
* Update server/i18n/en.json
* Update server/i18n/en.json
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Sven Hüster <svelle@users.noreply.github.com>
Co-authored-by: Carrie Warner (Mattermost) <74422101+cwarnermm@users.noreply.github.com>
Co-authored-by: Matthew Birtch <mattbirtch@gmail.com>
The `getSharedChannelsService` method was checking as well for the
Shared Channels to be active, which only the lead node of a cluster
is, so API operations that should run correctly like sharing/unsharing
a channel or inviting/uninviting a remote were returning a 400 bad
request.
This change updates the method to check for the Shared Channel service
to be active only on request, and on doing so it changes the error and
status code returned to indicate specifically that the service is
running but inactive, and returns a 500 as the situation is not an
error on the requester.
Co-authored-by: Mattermost Build <build@mattermost.com>
* MM-64299 - disable guest invite in abac channels
* filter the abac channel list for guest
* add filter in the back-end too
* add proper translation
* simplify the condition for enforced channels and add the unit tests
* enhance validation for not inviting guest users when abac enforced channel
* add missing translation
* add value to empty translation
* prevent showing the channel name if abac protected
* MM-64330 - filter abac users in channel invite
* implement cursor functionality for abac user filtering
* remove unnecessary comments
* refactor the backend implementation simplifying the functions
* refactor api to use opts as parameters, rename function
* add missing translation
* remove unnecesary test code
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* [MM-63717] LDAP Wizard skeleton (#31029)
* add ldap_wizard component to render its admin components
* i18n
* test adjustment
* keys and props fixes
* title fix
* fix placeholders
* fix value initialization
* linting
* remove all ...props (except custom component); any->unknown
* fix i18n (temp, will be changed in later PR)
* better return; simplify function checking/calling
* [MM-64259] Sections sidebar and navigation (#31059)
* initial sections list sidebar
* sidebar highlighting and scroll on click
* some tidying up
* add custom section titles for section sidebar
* i18n
* updating border on sections
* scss style lint
* color -> border-color
* simplify activeSectionKey initialization; remove trailing newline
* add useSectionNavigation; clean up ldap_wizard and scss; PR comments
* extract section of code into renderSidebar()
---------
Co-authored-by: Asaad Mahmood <asaadmahmood@users.noreply.github.com>
* [MM-64296] Add test connection for connection settings panel (#31190)
* button -> ldap test connect api
* fix console error by sanitizing value in text component
* return detailed error as error; adjust button -> primary, flushLeft
* middle of redesigning how we do hover text, first button
* add hover text to bools and file uploads
* i18n
* add LdapSettings as api type; add new endpoint to api yaml
* allow testing without first enabling LDAP and saving config
* i18n id changes
* improve TestLdapConnection to current standards
* PR comments
* safeDereference; cleaner returns
* remove hover markdown; formatting and typing simplification
* use button for "More Info"; i18n
* finish renaming help_text_hover -> help_text_more_info
* fix error output
* only send bindpassword if it has been changed
* fix: don't send blank bindPassword when it is still *****
* merge conflict
* [MM-64480] Refactor Admin Definition (#31280)
* move ldap definition to its own file for simplicity & context
* refactor admin_definition to eliminate circular dependencies
* merge conflicts
* before: buggy userHasReadPermissinOnSomeResources; after: fix incorrect snapshot
* merge conflict: new bindPasssword definition was left behind; fixed.
* merge conflict
* [MM-63765] LDAP Wizard: User filter expandable section (#31286)
* add "more info" hover to user filter help texts; make wider
* add expandable_setting type and component
* use Dislosure show/hide pattern for accessibility
* fix tooltip scss selectors
* fix hover -> more_info; make sure translation files are correct
* use join('\n\n') instead of the eslint disable line
* Revert "use join('\n\n') instead of the eslint disable line"
This reverts commit 274667e875b34703f14fee0706cd28b0125cefc9.
* [MM-64482] LDAP Wizard - Test User filters (#31312)
* initial cut at UI and backend for test filters
* api definitions; mocks
* clean up to current standards
* [MM-64512] - Test user filters UI (#31355)
* result_count -> total_count
* json cannot marshal error, returning error as string as god intended
* render errors with icon, hover text, and better feedback texts
* gather the settings that may be in expandable sections
* remove success, use error == "" to indicate success
* [MM-64536] LDAP Wizard: Test user attributes (#31373)
* LdapFilterTestResult -> LdapDiagnosticResult; FilterName -> TestName
* implement test_attributes endpoint and limited frontend (first step)
* adding EntriesWithValue
* [MM-64550] LDAP Wizard: Test user attributes UI (#31374)
* [MM-64551] LDAP Wizard: Test group attributes (#31375)
* remove Test LDAP button (not needed); reused helptext for other btn
* implement test_group_attributes endpoint; button/client-side paths
* [MM-64552] LDAP Wizard: Test group attributes UI (#31376)
* implement Test Group Attributes button
* simplify helper functions (improves useCallback dependencies)
* show the default filter that was used on the backend in the tooltip
* show the icon when there's an error (e.g. required filter/attribute)
* fix infinite rerendering
* fix error after failed save; fix navigation unlocked after save
* empty
* Adjust message feedback given we don't test the schema anymore
* improve css; don't use inline styles
* removed unneccesary pointer indirection
* improved i18n strings and logic
* combining filters/attributes/group attributes endpoints
improve types
* improve help text for User Filter (it's tricky)
* AvailableAttrs -> AvailableAttributes
* fix for e2e tests (renamed title)
* more e2e fixes
* skip broken e2e test
---------
Co-authored-by: Asaad Mahmood <asaadmahmood@users.noreply.github.com>
* enforce License.IsSeatCountEnforced if set
If a license sets `IsSeatCountEnforced`, enforce the user limit therein
as a hard cap.
Fixes: https://mattermost.atlassian.net/browse/CLD-9260
* remove duplicate tests
* Improve user limit error messages and display
- Add separate error messages for licensed vs unlicensed servers
- Licensed servers: "Server exceeds maximum licensed users. ERROR_LICENSED_USERS_LIMITS"
- Unlicensed servers: "Server exceeds safe user limit. ERROR_SAFETY_LIMITS_EXCEEDED"
- Remove redundant "Contact administrator" text from activation errors shown to admins
- Fix system console to display actual server error messages instead of generic "Failed to activate user"
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Add license nil check and test coverage
- Add license != nil check in GetServerLimits to prevent panic
- Add test case to verify graceful handling of license being set to nil
- Ensures fallback to hard-coded limits when license becomes nil
Co-authored-by: lieut-data <lieut-data@users.noreply.github.com>
* Fix user limits tests to expect license-specific error IDs
Update test expectations to use the new license-specific error IDs:
- app.user.update_active.license_user_limit.exceeded for licensed server user activation
- api.user.create_user.license_user_limits.exceeded for licensed server user creation
Also update frontend to show actual server error messages instead of generic ones in system console.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Remove redundant license nil test
The test couldn't meaningfully verify nil license behavior since it relied on
hard-coded constants that can't be modified in the test.
Co-authored-by: lieut-data <lieut-data@users.noreply.github.com>
* Fix whitespace issue in limits_test.go
Remove unnecessary trailing newline to pass style checks.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* updated i18n
* s/ERROR_LICENSED_USERS_LIMITS/ERROR_LICENSED_USERS_LIMIT_EXCEEDED/, expand warning log
* Add 5% grace period for licensed user limits
- Add calculateGraceLimit() function with 5% or +1 minimum grace
- Apply grace period only to licensed servers with seat count enforcement
- Handle zero user licenses by returning zero grace limit
- Add comprehensive test coverage for grace period scenarios
- Unlicensed servers maintain existing hard-coded limits without grace
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix TestCreateUserOrGuestSeatCountEnforcement to account for 5% grace period
The test was failing because it expected user creation to fail at exactly
the license limit, but the implementation now includes a 5% grace period
before enforcement kicks in.
Changes:
- Update test cases to create users up to the grace limit (6 for a 5-user license)
- Add comments explaining the grace period calculation
- Both regular user and guest user creation tests now properly validate
enforcement at the grace limit rather than the base license limit
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Fix TestUpdateActiveWithUserLimits to account for 5% grace period
Update test expectations to match the new grace period behavior:
- At base limit (100) but below grace limit (105): should succeed
- At grace limit (105): should fail
- Above grace limit (106): should fail
This aligns the tests with the license enforcement implementation
that includes a 5% grace period above the licensed user count.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: lieut-data <lieut-data@users.noreply.github.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
