mirror of
https://github.com/hanzoai/team.git
synced 2026-09-30 01:57:35 +00:00
zeekay
8feb24ea1f
The server module named github.com/hanzoai/team/server/v8 — a path that resolves to the retired workspace's repository, not this one — while server/public still published github.com/mattermost/mattermost/server/public. Both are github.com/hanzoteam/server/... now, which is where this code actually lives. That second half is what made the binary unbootable. Upstream's public path stayed claimed by upstream, mattermost-plugin-ai imported it, and the build linked public/model twice; public/plugin's gob.Register then ran twice under one name and panicked at init, before main. Reverting the rename traded the brand for a working binary. Rebranding the plugin alongside it needs no such trade: the agents fork is github.com/hanzoteam/agents/v2 against our public module, so no module named mattermost/mattermost is in the graph at all. Measured: `go list -deps ./cmd/mattermost` names exactly one public/model, and it is ours.
129 lines
3.9 KiB
Go
129 lines
3.9 KiB
Go
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
package properties
|
|
|
|
import (
|
|
"net/http"
|
|
"reflect"
|
|
|
|
"github.com/hanzoteam/server/server/public/model"
|
|
"github.com/hanzoteam/server/server/public/shared/request"
|
|
)
|
|
|
|
// SessionAttributesHook keeps the seeded session_attributes schema fixed: fields
|
|
// can't be created or deleted through the public API, and updates are limited to
|
|
// the tunable Attrs (enabled, ttl_seconds, grace_period_seconds). The fields are
|
|
// not Protected (that is reserved for plugin-owned fields), so this hook is the
|
|
// enforcement instead.
|
|
type SessionAttributesHook struct {
|
|
BasePropertyHook
|
|
propertyService *PropertyService
|
|
groupID string
|
|
}
|
|
|
|
var _ PropertyHook = (*SessionAttributesHook)(nil)
|
|
|
|
func NewSessionAttributesHook(ps *PropertyService, groupID string) *SessionAttributesHook {
|
|
return &SessionAttributesHook{propertyService: ps, groupID: groupID}
|
|
}
|
|
|
|
func (h *SessionAttributesHook) manages(groupID string) bool {
|
|
return groupID == h.groupID
|
|
}
|
|
|
|
func isSystemCaller(rctx request.CTX) bool {
|
|
return rctx == nil
|
|
}
|
|
|
|
func (h *SessionAttributesHook) PreCreatePropertyField(rctx request.CTX, field *model.PropertyField) (*model.PropertyField, error) {
|
|
if field.GroupID != h.groupID || isSystemCaller(rctx) {
|
|
return field, nil
|
|
}
|
|
return nil, h.immutableErr("created")
|
|
}
|
|
|
|
func (h *SessionAttributesHook) PreDeletePropertyField(rctx request.CTX, groupID string, _ string) error {
|
|
if !h.manages(groupID) || isSystemCaller(rctx) {
|
|
return nil
|
|
}
|
|
return h.immutableErr("deleted")
|
|
}
|
|
|
|
func (h *SessionAttributesHook) PreUpdatePropertyField(rctx request.CTX, groupID string, field *model.PropertyField) (*model.PropertyField, error) {
|
|
if !h.manages(groupID) || isSystemCaller(rctx) {
|
|
return field, nil
|
|
}
|
|
if err := h.validateUpdate(field); err != nil {
|
|
return nil, err
|
|
}
|
|
return field, nil
|
|
}
|
|
|
|
func (h *SessionAttributesHook) PreUpdatePropertyFields(rctx request.CTX, groupID string, fields []*model.PropertyField) ([]*model.PropertyField, error) {
|
|
if !h.manages(groupID) || isSystemCaller(rctx) {
|
|
return fields, nil
|
|
}
|
|
for _, field := range fields {
|
|
if err := h.validateUpdate(field); err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
return fields, nil
|
|
}
|
|
|
|
func (h *SessionAttributesHook) validateUpdate(incoming *model.PropertyField) error {
|
|
existing, err := h.propertyService.getPropertyFieldFromMaster(h.groupID, incoming.ID)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if sessionAttributeIdentityChanged(existing, incoming) || !sessionAttributeAttrsEditAllowed(existing.Attrs, incoming.Attrs) {
|
|
return h.immutableErr("changed")
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (h *SessionAttributesHook) immutableErr(verb string) *model.AppError {
|
|
return model.NewAppError("SessionAttributesHook", "app.session_attributes.field_immutable.app_error",
|
|
nil, "session attribute field "+verb, http.StatusForbidden)
|
|
}
|
|
|
|
func sessionAttributeIdentityChanged(existing, incoming *model.PropertyField) bool {
|
|
if existing.Name != incoming.Name ||
|
|
existing.Type != incoming.Type ||
|
|
existing.TargetID != incoming.TargetID ||
|
|
existing.TargetType != incoming.TargetType ||
|
|
existing.ObjectType != incoming.ObjectType {
|
|
return true
|
|
}
|
|
if (existing.LinkedFieldID == nil) != (incoming.LinkedFieldID == nil) {
|
|
return true
|
|
}
|
|
return existing.LinkedFieldID != nil && *existing.LinkedFieldID != *incoming.LinkedFieldID
|
|
}
|
|
|
|
func sessionAttributeAttrsEditAllowed(existing, incoming model.StringInterface) bool {
|
|
tunable := map[string]bool{
|
|
model.SAAttrEnabled: true,
|
|
model.SAAttrTTLSeconds: true,
|
|
model.SAAttrGracePeriodSeconds: true,
|
|
}
|
|
for key, existingValue := range existing {
|
|
if tunable[key] {
|
|
continue
|
|
}
|
|
incomingValue, ok := incoming[key]
|
|
if !ok || !reflect.DeepEqual(existingValue, incomingValue) {
|
|
return false
|
|
}
|
|
}
|
|
for key := range incoming {
|
|
if !tunable[key] {
|
|
if _, ok := existing[key]; !ok {
|
|
return false
|
|
}
|
|
}
|
|
}
|
|
return true
|
|
}
|