33 Коммитов

Автор SHA1 Сообщение Дата
Maria A Nunez
5563e09593 MM-68983: Tighten OAuth token issuance and cleanup on user deactivation (#36743) (#36853)
Automatic Merge
2026-06-03 08:54:16 +02:00
Ben Cooke
8ef7f78d8d fix conflicts (#35699)
Automatic Merge
2026-03-20 09:00:55 +01:00
Christopher Poile
452bad21e9 manual cherry-pick: [MM-67202] Validate auth method in account switch (#34981) (#35143)
* fix account authorization type switch

* improve test clarity

* refactor tests for clarity
2026-01-30 16:36:57 +02:00
Mattermost Build
46b5c436bb MM-66372: Improve OAuth state token validation (#34296) (#34300) 2025-10-28 00:46:33 +00:00
Mattermost Build
f361e7d75a Automated cherry pick of #34247 (#34257)
Automatic Merge
2025-10-27 12:59:15 +02:00
Mattermost Build
27fadafead Constant time comparison (#33588) (#33822)
Automatic Merge
2025-09-01 16:34:06 +03:00
Mattermost Build
2d5cdc6e21 [MM-64896][MM-64898] Pass inviteid/tokenid to relay state/props for external auth when auto-joining a team (#33545) (#33666)
Automatic Merge
2025-08-13 13:04:00 +03:00
kasyap dharanikota
ddb4c4360c fix errcheck in server/channels/app/platform/session.go (#30595)
Co-authored-by: Ben Schumacher <ben.schumacher@mattermost.com>
2025-05-05 12:18:47 +02:00
Ben Schumacher
354d7aeb72 Consistent error wrapping (#30600) 2025-04-09 11:38:36 +02:00
Vishal
cc5b3a2f69 [MM-37585] (#28634)
* add tests

* pass userID to the function instead of the user object.

* remove concurrent login simulation

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2024-10-22 12:21:36 +05:30
Agniva De Sarker
c3ed07e679 OSF: Used model.NewPointer everywhere (#27838)
```release-note
NONE
```
2024-08-06 09:15:00 +05:30
Ben Schumacher
30d450c4d8 Cleanup usage of global logger (#26835) 2024-04-24 11:52:33 +02:00
Ben Schumacher
b336fb9a45 Fix MM-57090 (#26589) 2024-04-12 17:15:01 +02:00
Christopher Poile
17d11db395 MM-55320 - Limit length of browser user agent version; ratelimit the /sessions endpoint (#25900)
* add ratelimit to /sessions; cap userAgent version length; tests

* add MaxSessionsLimit; remove oldest session first; tests

* can't use slices in 1.20; improve test

* nits

* add GetLRUSessions; move limiting to CreateSession; remove rate limiting

* use queryBuilder

* mysql needs a limit when using offset

* update i18n

* refactor into limitNumberOfSessions; protect createSessionForUserAccessToken

* add comment to GetLRUSessions

* add limit to oauth path; PR comments
2024-03-21 08:48:24 -04:00
Ben Cooke
9d4d5366a1 [MM-56088] Adding extra logs for openId state failures (#25663)
* adding extra logs for openId failures
2024-03-05 13:12:33 -05:00
Ben Cooke
fe47e75b92 MM-56752 (#26100)
* using token

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2024-02-09 11:17:28 -05:00
Ben Schumacher
b2ec1ff8ae [MM-55595] Use annotated logger in search layer (#25468) 2023-12-04 18:34:57 +01:00
Pantelis Vratsalis
d9f5cd2740 [MM-52445] Fix double url encoding of oauth redirect URI params (#23176)
* [MM-52445] Fix double url encoding of oauth redirect URI params

* Additional test based on code review

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2023-11-09 19:18:24 +01:00
KIMBOH LOVETTE
a6ba7163c8 [GH-21566] Add request context and logger to all public methods in server/channels/app/authentication.go (#25270) 2023-11-08 14:39:09 +01:00
Ben Schumacher
c7461751f2 Use request.CTX instead of *request.Context (#24877)
* Use request.CTX instead of *request.Context

* Fix tests
2023-10-30 16:33:37 +01:00
Ben Schumacher
13c05a571f Migrate store methods to use request.Context instead of context.Context (#24836) 2023-10-11 13:08:55 +02:00
Ben Schumacher
aad25be4e1 [MM-54434] Use job.Logger to capture ldap logs (#24493) 2023-10-06 22:43:21 +02:00
Agniva De Sarker
acdfefe456 Revert "MM-53879: Fix recursive loading of license (#24200)" (#24498)
This reverts commit dd73c2af0f.
2023-09-07 20:58:20 +05:30
Felipe Martin
9f7521d003 Move request package into public/shared folder (#24420)
* move request package to public/shared

* updated app-layers

* update app layer

* remove original package location
2023-09-05 09:47:30 +02:00
Devin Binnie
a3b194581f [MM-37984] Allow Desktop App to authenticate via external providers outside of the app on supported servers (#24140)
* [MM-37984] Allow Desktop App to authenticate via external providers outside of the app on supported servers

* PR feedback

* Add support for mattermost-dev protocol for development use

* Update server/channels/db/migrations/postgres/000110_create_desktop_tokens.up.sql

* Fix silly typo

* Update server/channels/db/migrations/postgres/000110_create_desktop_tokens.up.sql

* Remove storage of client token, only validate it on the client

* Update migrations

* Add concurrently create index

* Remove CONCURRENTLY for now

* Fix issue with changing history

* Remove old migration

* Use idempotent statement to drop old index

* Remove reference to old table
2023-08-30 11:21:43 -04:00
Agniva De Sarker
dd73c2af0f MM-53879: Fix recursive loading of license (#24200)
There were multiple problems with loading of a license.

1. It was called from inside app/server.go and app/platform/service.go. The first one wasn't really needed anymore, so we remove it.

2. To make loading of a license work across a cluster, the license load action was attached along with the `InvalidateAllCachesSkipSend` method. But the problem with that was that it would even get called in the caller node as well, putting it in a recursive loop.

```
LoadLicense -> SaveLicense -> InvalidateAllCaches -> InvalidateAllCachesSkipSend -> LoadLicense
```

To fix this, we create a dedicated loadLicense cluster event and move it away from the `InvalidateAllCachesSkipSend` method. And then from the caller side, we just trigger this action.

3. We also remove the first call to check license expiration which would load the license again. This is unnecessary because if the license is expired, server wouldn't start at all.

While here, we also make some other improvements like removing unnecessary goroutine spawning while publishing websocket events. They are already handled asynchronously, so there is no need
to create a goroutine for that.

We also remove

```
ps.ReloadConfig()
ps.InvalidateAllCaches()
```

from requestTrialLicense as they are already called from inside `*PlatformService.SaveLicense`.

And lastly, we remove the `*model.AppError` return from `*PlatformService.InvalidateAllCaches` because there was nothing to return at all.

https://mattermost.atlassian.net/browse/MM-53879

```release-note
Fix several issues with loading of a license
```
2023-08-21 20:17:16 +05:30
Devin Binnie
823ef27d6c Revert "[MM-37984] Allow Desktop App to authenticate via external providers outside of the app on supported servers (#23795)" (#24039)
This reverts commit abdf4e58c3.
2023-07-17 10:54:53 -04:00
Devin Binnie
abdf4e58c3 [MM-37984] Allow Desktop App to authenticate via external providers outside of the app on supported servers (#23795)
* WIP

* Add rate limiting for desktop token API

* Missing mocks

* Style fixes

* Update snapshots

* Maybe use an actual redirect link :P

* Refactoring for tests

* Add tests for server

* Fix lint issue

* Fix tests

* Fix lint

* Add front-end screen component

* Component logic

* Style changes

* Quick style fix

* Lint fixes

* Initial PR feedback

* Enable logging into the browser as well when completing the login process

* Refactor to push more logic to the other component

* Remove unnecessary helper code

* Fix i18n

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2023-07-12 09:25:05 -04:00
Agniva De Sarker
efaa6264cc MM-53032: Fix module path after repo rename (#23689)
It was a good decision in hindsight to keep the public module as 0.x
because this would have been a breaking change again.

https://mattermost.atlassian.net/browse/MM-53032
```release-note
Changed the Go module path from github.com/mattermost/mattermost-server/server/v8 to github.com/mattermost/mattermost/server/v8.

For the public facing module, it's path is also changed from github.com/mattermost/mattermost-server/server/public to github.com/mattermost/mattermost/server/public
```
2023-06-11 10:54:35 +05:30
Jesse Hallam
bb02b35048 Expose public/ API as submodule (#23345)
* model -> public/model

* plugin -> public/plugin

* public/model/utils -> public/utils

* platform/shared/mlog -> public/shared/mlog

* platform/shared/i18n -> public/shared/i18n

* platform/shared/markdown -> public/shared/markdown

* platform/services/timezones -> public/shared/timezones

* channels/einterfaces -> einterfaces

* expose public/ submodule

* go mod tidy

* .github: cache-dependency-path, setup-go-work

* modules-tidy for public/ too

* remove old gomodtidy
2023-05-10 13:07:02 -03:00
Agniva De Sarker
b200a07881 v8.0 module release (#22975)
https://mattermost.atlassian.net/browse/MM-52079

```release-note
We upgrade the module version to 8.0. The new module path is github.com/mattermost-server/server/v8.
```


Co-authored-by: Doug Lauder <wiggin77@warpmail.net>
2023-04-18 11:05:28 +05:30
Rohitesh Gupta
7325c38c39 Fixes MM-50733 (#22784) 2023-04-05 21:58:21 +02:00
Doug Lauder
c943ed6859 Mono repo -> Master (#22553)
Combines the following repositories into one:

https://github.com/mattermost/mattermost-server
https://github.com/mattermost/mattermost-webapp
https://github.com/mattermost/focalboard
https://github.com/mattermost/mattermost-plugin-playbooks
2023-03-22 17:22:27 -04:00