Граф коммитов

102 Коммитов

Автор SHA1 Сообщение Дата
Pablo Vélez
e1a78d1e91 Mm 66813 sso callback metadata (#34955) (#35383)
Automatic Merge
2026-02-20 09:09:32 +02:00
Mattermost Build
f361e7d75a Automated cherry pick of #34247 (#34257)
Automatic Merge
2025-10-27 12:59:15 +02:00
JG Heithcock
375ce229f4 MM 65084 server-side (#33861) (#34006) (#34044)
* MM 65084 server-side (#33861) (#34006)

Automatic Merge

* Add ConsumeOnce method to store layers

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2025-10-06 15:20:08 -07:00
Mattermost Build
2d5cdc6e21 [MM-64896][MM-64898] Pass inviteid/tokenid to relay state/props for external auth when auto-joining a team (#33545) (#33666)
Automatic Merge
2025-08-13 13:04:00 +03:00
Mattermost Build
e14175eb65 [MM-65015] Restore Mobile redirection on oauth login (#33626) (#33633) 2025-08-07 17:47:01 +00:00
Mattermost Build
8f6b6f1d0d [MM-64911] Ensure redirect URL is validated before redirecting (#33559) (#33596)
Automatic Merge
2025-07-31 09:34:00 +03:00
Mattermost Build
07a34f02b6 MM-64531: [Shared Channels] Users on different remote servers should not communicate unless the remotes have established secure connection. (#30985) (#33434)
Automatic Merge
2025-07-15 11:58:41 +03:00
David Krauser
aaa62a40ae [MM-64686] Expose audit logging functionality via plugin API (#31204)
This commit exposes audit logging functionality to plugins via the plugin API, allowing plugins to create and log audit records. Additionally, it addresses a gob encoding issue that could cause plugin crashes when audit data contains nil pointers or unregistered types.
2025-06-25 20:37:32 -04:00
Chris Gibson
5e3a89d70c [GH-29960] Change behaviour for log messages that do not have a valid session (#30014)
Co-authored-by: Alejandro García Montoro <alejandro.garciamontoro@gmail.com>
Co-authored-by: Ben Schumacher <ben.schumacher@mattermost.com>
2025-06-11 14:15:40 +02:00
Harsh Aulakh
09a2037b61 MMCTL: Add import delete cmd for removing the import files (#29764)
Co-authored-by: Ben Schumacher <ben.schumacher@mattermost.com>
2025-06-10 12:06:38 +02:00
Ben Schumacher
e3452dce94 [MM-29049] Fix remaining errcheck errors in app, api4 and web package (#31307)
Co-authored-by: Claude <noreply@anthropic.com>
2025-06-06 07:44:43 +02:00
Ibrahim Serdar Acikgoz
a344b3225b [MM-61756] Attribute Based Access Control - Phase 1 (#30785)
Attribute Based Access Control - Base
* MM-63662

* MM-63919

* MM-63954

* MM-63955 

* MM-63425

* MM-63426

* MM-63458

* MM-63459

* MM-63603

* MM-63845

* MM-64146

* MM-64199

* MM-64201

* MM-64233

* MM-64247

* MM-64268

---------

Co-authored-by: Harshil Sharma <harshilsharma63@gmail.com>
Co-authored-by: Pablo Andrés Vélez Vidal <pablovv2012@gmail.com>
Co-authored-by: abhijit-singh <abhijitsingh0702@gmail.com>
Co-authored-by: Harrison Healey <harrisonmhealey@gmail.com>
2025-05-15 11:33:08 +02:00
Ben Cooke
b6b0c269c4 Use error from OnSamlLogin (#30745) 2025-05-12 18:41:54 -04:00
Agniva De Sarker
4803892492 MM-56906: Remove redundant calls on team switch (#30771)
On page load, we load ALL channels and channel members from all teams.
But then, on team_switch, we would again load channels and channel
members from that team. This was redundant and mainly kept
because previously the websocket events were considered unreliable.

Now with reliable websockets, and client-side pings, we can detect
broken connections faster and recover without loss.

Additionally, the getAllChannelMembers call would page through
all responses on the client side. This was inefficient and incur
extra latency. To optimize for this, we introduce server-side
streaming of the full response if page is set to -1.

This optimizes the intial response as well.

https://mattermost.atlassian.net/browse/MM-56906

```release-note
Optimize team switch operation by removing calls to get channels
and channel members.
```


Co-authored-by: Mattermost Build <build@mattermost.com>
2025-05-12 20:05:46 +05:30
Ben Schumacher
bfb15ab179 [MM-61074] Fix errcheck issues in oauth_test.go and web_test.go (#30707)
Co-authored-by: Claude <noreply@anthropic.com>
2025-05-07 12:41:10 +02:00
Ben Schumacher
b7f89984db [MM-61076] Fix errcheck issues in server/channels/web/saml.go (#30612)
Co-authored-by: Claude <noreply@anthropic.com>
2025-04-15 09:52:28 +02:00
Ben Schumacher
545de88486 [MM-61079] Fix error checking in webhook.go (#30611)
* MM-28751 Fix error checking in webhook.go

- Implement proper error checking for r.ParseForm()
- Implement proper error checking for r.ParseMultipartForm()
- Implement proper error checking for w.Write()
- Remove webhook.go exception from .golangci.yml

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* Fix translation

---------

Co-authored-by: Claude <noreply@anthropic.com>
2025-04-11 12:17:43 +02:00
Ben Cooke
ccd8a60168 Plugin groups (#30320)
* add new pluginapi methods

* SAML login hook

* set ReAddRemovedMembers to true for plugin groups

* change to DoLogin signature for SAML
2025-03-13 12:00:15 -04:00
Doug Lauder
dfca6c211d MM-63327 Config setting for ServiceSettings.FrameAncestors (#30409)
* Add Embedding page to system console, with single setting for Frame Ancestors
2025-03-05 18:01:43 -05:00
Agniva De Sarker
e7a246c065 [AI assisted]: MM-62914: Added MFA authentication for plugin requests as well (#30160)
We wipe the token if MFA authentication is enabled. Also added a test case
to lock in the functionality.

https://mattermost.atlassian.net/browse/MM-62914

```release-note
NONE
```
2025-02-17 12:20:21 +05:30
Jesús Espino
f1acdce42c Removing opentracing (#29965)
* Removing opentracing

* Fixing CI
2025-01-29 07:45:13 +01:00
enzowritescode
077d0872e3 Fix LogAuditRecWithLevel doc comment and fix typo (#29980) 2025-01-22 21:39:31 -07:00
Miguel de la Cruz
ca34c6a03f Custom profile attributes field endpoints (#29662)
* Adds the main Property System Architecture components

This change adds the necessary migrations for the Property Groups,
Fields and Values tables to be created, the store layer and a Property
Service that can be used from the app layer.

* Adds Custom Profile Attributes endpoints and app layer

* implement get and patch cpa values

* run i18n-extract

* Update property field type to use user instead of person

* Update PropertyFields to allow for unique nondeleted fields and remove redundant indexes

* Update PropertyValues to allow for unique nondeleted fields and remove redundant indexes

* Use StringMap instead of the map[string]any on property fields

* Add i18n strings

* Revert "Use StringMap instead of the map[string]any on property fields"

This reverts commit e2735ab0f8589d2524d636419ca0cb144575c4d6.

* Cast JSON binary data to string and add todo note for StringMap use

* Add mocks to the retrylayer tests

* Cast JSON binary data to string in property value store

* Check for binary parameter instead of casting to string for JSON data

* Fix bad merge

* Check property field type is one of the allowed ones

* Avoid reusing err variable to be explicit about the returned value

* Merge Property System Migrations into one file

* Adds NOT NULL to timestamps at the DB level

* Update stores to use tableSelectQuery instead of a slice var

* Update PropertyField model translations to be more explicit and avoid repetition

* Update PropertyValue model translations to be more explicit and avoid repetition

* Use ExecBuilder instead of ToSql&Exec

* Update property field errors to add context

* Ensure PerPage is greater than zero

* Update store errors to give more context

* Use ExecBuilder in the property stores where possible

* Add an on conflict suffix to the group register to avoid race conditions

* Remove user profile API documentation changes

* Update patchCPAValues endpoint and docs to return the updated information

* Merge two similar error conditions

* Use a route function for ListCPAValues

* Remove badly used translation string

* Remove unused get in register group method

* Adds input sanitization and validation to the CPA API endpoints

* Takes login outside of one test case to make it clear it affects multiple t.Runs

* Fix wrap error and return code when property field has been deleted

* Fix receiver name

* Adds comment to move the CPA group ID to the db cache

* Set the PerPage of CPA fields to the fields limit

* Update server/channels/app/custom_profile_attributes_test.go

Co-authored-by: Alejandro García Montoro <alejandro.garciamontoro@gmail.com>

* Standardize group ID access

* Avoid polluting the state between tests

* Use specific errors for the retrieval of CPA group

---------

Co-authored-by: Scott Bishel <scott.bishel@mattermost.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
Co-authored-by: Alejandro García Montoro <alejandro.garciamontoro@gmail.com>
2025-01-13 18:12:38 +01:00
Ben Schumacher
e8beefd423 Remove duplicate SAML login error message (#29767) 2025-01-09 12:41:11 +01:00
Jesús Espino
d316df6d28 Replacing interface{} with any everywhere (except generated mocks) (#29446) 2024-12-15 21:11:36 +01:00
Vishal
746eb70e01 [MM-60689] Add Webhook ID in the logs (#28846)
* add webhook id to logs

* Move hook_id context to api level from app level.

* pass errCtx to other references of same app-error-id

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2024-11-21 13:53:10 +05:30
TheoForger
4bb4f9814b [MM-61077] Fix errcheck issues in server/channels/web/static.go (#29285)
Co-authored-by: Ben Schumacher <ben.schumacher@mattermost.com>
2024-11-20 14:44:22 +01:00
Agniva De Sarker
d83156027a Fix race condition in the web package (#29288)
Essentially applying the fix for https://github.com/mattermost/mattermost/pull/29214
to the web package. It seems like the app.StoreOverrideWithCache
function was never used in this package.

Just a small highlight of how much boilerplate is repeated
in multiple packages
```release-note
NONE
```

Co-authored-by: Mattermost Build <build@mattermost.com>
2024-11-15 11:30:56 +02:00
TheInvincible
be7a8a17c0 Fix errcheck issue in oauth.go (#28795) 2024-11-04 09:07:04 +01:00
Arya Khochare
e0e5dbd36e Prevent HEAD requests to a sub-path from infinite redirects (#28285)
* adding test

```release-note
NONE
```

---------

Co-authored-by: Agniva De Sarker <agnivade@yahoo.co.in>
Co-authored-by: Mattermost Build <build@mattermost.com>
2024-10-29 19:57:20 +05:30
Ranjana761
5dba6e082d Fix errcheck issues in server/channels/web/web.go (#28911) 2024-10-29 08:45:40 +01:00
RuhiJain
49be26ebc4 Fix errcheck issues in server/channels/web/response_writer_wrapper_te… (#28902) 2024-10-25 11:26:08 +02:00
Agniva De Sarker
6075b1cd4e MM-61225: Revert session pooling (#28901)
This originated from https://github.com/mattermost/mattermost/issues/15249.

However, the original idea was discarded https://github.com/mattermost/mattermost/issues/15249#issuecomment-709713065
as being too complicated to implement. Then I had another
idea to implement it just for session objects.

My thinking was that since every single request allocates a new
session struct, it would be good to use a sync.Pool for that.

However, 4 years later, now we know that the primary bottleneck
in app performance comes from websocket event marshalling.
Therefore, while it would be good to do this, it is difficult
to do it correctly (as shown by the numerous racy tests).

Hence, reverting this.

```release-note
NONE
```
2024-10-24 22:50:44 +05:30
TheInvincible
0cb2475ea4 Fix errcheck issue in handlers.go (#28794) 2024-10-17 12:37:41 +02:00
Miguel de la Cruz
7a0019b63a Allow shared channel remotes endpoint to be filtered by confirmation status (#28213)
* Allow shared channel remotes endpoint to be filtered by confirmation status

* Adds tests
2024-09-18 13:36:43 +02:00
Ben Schumacher
d9e47522a0 Remove unnecessary copies of loop variables (#28138) 2024-09-11 16:51:30 +02:00
Miguel de la Cruz
3dc0e63c03 Adds Shared Channel related API endpoints (#27436)
* Adds Shared Channel management API endpoints

New endpoints for the following routes are added:

- Get Shared Channel Remotes by Remote Cluster at `GET
/api/v4/remotecluster/{remote_id}/sharedchannelremotes`
- Invite Remote Cluster to Channel at `POST
/api/v4/remotecluster/{remote_id}/channels/invite`
- Uninvite Remote Cluster to Channel at `POST
/api/v4/remotecluster/{remote_id}/channels/uninvite`

These endpoints are planned to be used from the system console, and
gated through the `manage_secure_connections` permission.

* Adds i18n messages for API errors

* Fix pagination flaky test

* Fix linter

* Adds the posibility of filtering shared channel remotes by home

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2024-08-29 12:46:37 +02:00
Harshil Sharma
c2c37cea20 MM-60269: Removed an incorrect return that caused missing API timing metrics for 4xx and 5xx errors (#28049)
* removed an incorretc return that caused missing API timing metrics for 4xx and 5xx errors

* Added tests and recorded metric for URL length limit as well

* Status code fix
2024-08-26 16:21:47 +02:00
Ben Cooke
0d6b1070a2 [MM-58549] Desktop login (#27732)
* desktop oauth and saml login
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
2024-08-21 18:00:19 -04:00
enzowritescode
91d4bc627d Remove redundant check and fix language in comment (#27991)
* Remove redundant if statement

* Fix language in comment per IDE recommendation
2024-08-15 14:13:44 -06:00
Ben Schumacher
fc1a111b06 [MM-38131] Remove deprecated pageSize query parameter (#27957) 2024-08-13 22:18:22 +02:00
Agniva De Sarker
540febd866 MM-56876: Redis: first introduction (#27752)
```release-note
NONE
```

---------

Co-authored-by: Jesús Espino <jespinog@gmail.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
2024-08-06 09:28:41 +05:30
Agniva De Sarker
c3ed07e679 OSF: Used model.NewPointer everywhere (#27838)
```release-note
NONE
```
2024-08-06 09:15:00 +05:30
Harshil Sharma
79480494d0 Prominent payload limit error and configurable URL length limit (#27747)
* Added context error handler for MaxBytesError

* Made URL length limit configurable

* Added tests

* Removed an unused function

* Typo
2024-07-25 09:09:58 +00:00
enzowritescode
d44c3d5d45 Replace Hard-coded HTTP Verbs with Constants (#27219)
* Replace hard-coded HTTP verbs with constants in `net/http`
2024-07-15 08:52:03 -06:00
Christopher Poile
9b2f20210b [MM-56339] Audit logs: on login add UserId and SessionId to audit's Actor field (#27446)
* on login add UserId and SessionId to audit's Actor field to match logout

* lint

* simplify to add only userId and sessionId

* AddToEventActor -> AddUser/SessionToEventActor

* fill in missing session data when logging the audit record

* why did it bump that? reverting.

* make modules-tidy

* trigger build

* add more context to the comment
2024-07-08 18:56:54 -04:00
Miguel de la Cruz
809ad4f76d Adds Remote Cluster related API endpoints (#27432)
* Adds Remote Cluster related API endpoints

New endpoints for the following routes are added:

- Get Remote Clusters at `GET /api/v4/remotecluster`
- Create Remote Cluster at `POST /api/v4/remotecluster`
- Accept Remote Cluster invite at `POST
/api/v4/remotecluster/accept_invite`
- Generate Remote Cluster invite at `POST
/api/v4/remotecluster/{remote_id}/generate_invite`
- Get Remote Cluster at `GET /api/v4/remotecluster/{remote_id}`
- Patch Remote Cluster at `PATCH /api/v4/remotecluster/{remote_id}`
- Delete Remote Cluster at `DELETE /api/v4/remotecluster/{remote_id}`

These endpoints are planned to be used from the system console, and
gated through the `manage_secure_connections` permission.

* Update server/channels/api4/remote_cluster_test.go

Co-authored-by: Doug Lauder <wiggin77@warpmail.net>

* Fix AppError names

---------

Co-authored-by: Doug Lauder <wiggin77@warpmail.net>
Co-authored-by: Mattermost Build <build@mattermost.com>
2024-07-04 10:35:26 +02:00
Ben Schumacher
31015a971e [MM-56340] Add audit events for OAuth logins (#25859)
* Add audit events for OAuth logins

* Fix test

* Fix auth record

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2024-05-06 17:31:16 +02:00
Nick Misasi
f1019d076e [CLD-7567] Deprecate Self Serve: Second Pass (#26853)
* Deprecate Self Serve: First Pass

* Fix ci

* Fix more ci

* Remmove outdated server tests

* Fix a missed spot opening purchase modal in Self Hosted

* Fix i18n

* Clean up some more server code, fix webapp test

* Fix alignment of button

* Fix linter

* Fix i18n server side

* Deprecate in product true up

* Add back translation

* Remove client functions

* Put back client functions

* webapp deprecation

* Deprecate Self Serve: Second Pass

* Fix various pipeline issues

* Fix linter

* Fix pipelines

* Fix handlers_test.go

* Fix console.error around hostedCustomer in reducer

* PICKY LINTER PLEASE

* Fix webapp tests, various other fixes for the CI pipelines

* Fix i18n

* Updates to accomadate enterprise code removal

* Fix mocks

* More removal

* Fix

* Adjustments from PR

* Fixes for QA Feedback

* Update

* Add migrations to remove true up review history

* Fix migrations check

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
Co-authored-by: maria.nunez <maria.nunez@mattermost.com>
2024-05-02 09:15:15 -04:00
Ben Schumacher
30d450c4d8 Cleanup usage of global logger (#26835) 2024-04-24 11:52:33 +02:00