mirror of
https://github.com/hanzoai/team.git
synced 2026-09-30 01:57:35 +00:00
zeekay
8feb24ea1f
The server module named github.com/hanzoai/team/server/v8 — a path that resolves to the retired workspace's repository, not this one — while server/public still published github.com/mattermost/mattermost/server/public. Both are github.com/hanzoteam/server/... now, which is where this code actually lives. That second half is what made the binary unbootable. Upstream's public path stayed claimed by upstream, mattermost-plugin-ai imported it, and the build linked public/model twice; public/plugin's gob.Register then ran twice under one name and panicked at init, before main. Reverting the rename traded the brand for a working binary. Rebranding the plugin alongside it needs no such trade: the agents fork is github.com/hanzoteam/agents/v2 against our public module, so no module named mattermost/mattermost is in the graph at all. Measured: `go list -deps ./cmd/mattermost` names exactly one public/model, and it is ours.
96 lines
3.8 KiB
Go
96 lines
3.8 KiB
Go
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
package app
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/gob"
|
|
"encoding/json"
|
|
"testing"
|
|
|
|
"github.com/hanzoteam/server/server/public/model"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/hanzoteam/server/server/v8/einterfaces/mocks"
|
|
)
|
|
|
|
// requirePluginRPCGobSafe gob-encodes v the way the plugin RPC layer encodes
|
|
// an API reply (public/plugin's client_rpc gob registrations are active via
|
|
// the import). An unregistered concrete type inside an interface-typed field
|
|
// fails encoding, which shuts down the shared plugin RPC connection.
|
|
func requirePluginRPCGobSafe(t *testing.T, v any) {
|
|
t.Helper()
|
|
var buf bytes.Buffer
|
|
require.NoError(t, gob.NewEncoder(&buf).Encode(v),
|
|
"reply payload must gob-encode with client_rpc registrations; an unregistered concrete type inside `any` poisons the plugin RPC connection")
|
|
}
|
|
|
|
// TestPluginAccessControlGobSafety pins that every payload the plugin access
|
|
// control API can return over net/rpc survives gob encoding. The autocomplete
|
|
// subtest is the regression test for the native-attribute options bug
|
|
// (bool-select options were []map[string]string, which gob rejects).
|
|
func TestPluginAccessControlGobSafety(t *testing.T) {
|
|
th := Setup(t).InitBasic(t)
|
|
actingUserID := th.BasicUser.Id
|
|
|
|
t.Run("fields autocomplete response including native attribute fields", func(t *testing.T) {
|
|
th.App.Srv().ch.AccessControl = &mocks.AccessControlServiceInterface{}
|
|
|
|
fields, appErr := th.App.GetPluginAccessControlFieldsAutocomplete(th.Context, testAgentsPluginID, actingUserID, "", 100)
|
|
require.Nil(t, appErr)
|
|
require.NotEmpty(t, fields, "native attribute fields expected on the first page")
|
|
|
|
// Prove the payload contains a native bool-select field carrying
|
|
// options inside Attrs.
|
|
hasBoolSelect := false
|
|
for _, f := range fields {
|
|
if f.Attrs[model.PropertyFieldAttributeOptions] != nil {
|
|
hasBoolSelect = true
|
|
}
|
|
}
|
|
require.True(t, hasBoolSelect, "expected at least one native field with select options in Attrs")
|
|
|
|
requirePluginRPCGobSafe(t, fields)
|
|
})
|
|
|
|
t.Run("policy with JSON-decoded Props", func(t *testing.T) {
|
|
// Stored policies hydrate Props via json.Unmarshal, so the concrete
|
|
// types inside are exactly the ones gob accepts; pin that.
|
|
var props map[string]any
|
|
require.NoError(t, json.Unmarshal(
|
|
[]byte(`{"nested":{"k":"v"},"list":[1,"two",true],"s":"x","n":1.5,"b":true,"z":null}`), &props))
|
|
|
|
p := validPluginPolicy(model.NewId())
|
|
p.Props = props
|
|
requirePluginRPCGobSafe(t, p)
|
|
})
|
|
|
|
t.Run("visual AST with every runtime value shape", func(t *testing.T) {
|
|
// The enterprise AST→visual conversion produces these value shapes.
|
|
visual := &model.VisualExpression{Conditions: []model.Condition{
|
|
{Attribute: "user.attributes.team", Operator: "==", Value: "eng"},
|
|
{Attribute: "user.attributes.admin", Operator: "==", Value: true},
|
|
{Attribute: "user.attributes.age", Operator: ">", Value: int64(30)},
|
|
{Attribute: "user.attributes.count", Operator: "<", Value: uint64(10)},
|
|
{Attribute: "user.attributes.score", Operator: ">=", Value: 1.5},
|
|
{Attribute: "user.attributes.missing", Operator: "==", Value: nil},
|
|
{Attribute: "user.attributes.role", Operator: "in", Value: []any{"a", "b"}},
|
|
}}
|
|
requirePluginRPCGobSafe(t, visual)
|
|
})
|
|
|
|
t.Run("expression check errors", func(t *testing.T) {
|
|
requirePluginRPCGobSafe(t, []model.CELExpressionError{{Line: 1, Column: 2, Message: "boom"}})
|
|
})
|
|
|
|
t.Run("query users response with a real user", func(t *testing.T) {
|
|
requirePluginRPCGobSafe(t, &model.AccessControlPolicyTestResponse{Users: []*model.User{th.BasicUser}, Total: 1})
|
|
})
|
|
|
|
t.Run("evaluation decision carrying a context reason", func(t *testing.T) {
|
|
decision := model.NewNoPolicyAccessDecision()
|
|
requirePluginRPCGobSafe(t, &decision)
|
|
})
|
|
}
|