mirror of
https://github.com/hanzoai/team.git
synced 2026-09-30 01:57:35 +00:00
zeekay
8feb24ea1f
The server module named github.com/hanzoai/team/server/v8 — a path that resolves to the retired workspace's repository, not this one — while server/public still published github.com/mattermost/mattermost/server/public. Both are github.com/hanzoteam/server/... now, which is where this code actually lives. That second half is what made the binary unbootable. Upstream's public path stayed claimed by upstream, mattermost-plugin-ai imported it, and the build linked public/model twice; public/plugin's gob.Register then ran twice under one name and panicked at init, before main. Reverting the rename traded the brand for a working binary. Rebranding the plugin alongside it needs no such trade: the agents fork is github.com/hanzoteam/agents/v2 against our public module, so no module named mattermost/mattermost is in the graph at all. Measured: `go list -deps ./cmd/mattermost` names exactly one public/model, and it is ours.
111 lines
3.2 KiB
Go
111 lines
3.2 KiB
Go
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
package teams
|
|
|
|
import (
|
|
"slices"
|
|
"strings"
|
|
|
|
"github.com/hanzoteam/server/server/public/model"
|
|
)
|
|
|
|
// By default the list will be (not necessarily in this order):
|
|
//
|
|
// ['general', 'random']
|
|
//
|
|
// However, if TeamSettings.ExperimentalDefaultChannels contains a list of channels then that list will replace
|
|
// 'random' and be included in the return results in addition to 'general'. For example:
|
|
//
|
|
// ['general', 'game-of-thrones', 'wow']
|
|
func (ts *TeamService) DefaultChannelNames() []string {
|
|
names := []string{model.DefaultChannelName}
|
|
|
|
if len(ts.config().TeamSettings.ExperimentalDefaultChannels) == 0 {
|
|
names = append(names, model.RandomChannelName)
|
|
} else {
|
|
seenChannels := map[string]bool{model.DefaultChannelName: true}
|
|
for _, channelName := range ts.config().TeamSettings.ExperimentalDefaultChannels {
|
|
if !seenChannels[channelName] {
|
|
names = append(names, channelName)
|
|
seenChannels[channelName] = true
|
|
}
|
|
}
|
|
}
|
|
|
|
return names
|
|
}
|
|
|
|
func IsEmailAddressAllowed(email string, allowedDomains []string) bool {
|
|
for _, restriction := range allowedDomains {
|
|
domains := normalizeDomains(restriction)
|
|
if len(domains) <= 0 {
|
|
continue
|
|
}
|
|
matched := false
|
|
for _, d := range domains {
|
|
if strings.HasSuffix(email, "@"+d) {
|
|
matched = true
|
|
break
|
|
}
|
|
}
|
|
if !matched {
|
|
return false
|
|
}
|
|
}
|
|
|
|
return true
|
|
}
|
|
|
|
func (ts *TeamService) IsTeamEmailAllowed(user *model.User, team *model.Team) bool {
|
|
if user.IsBot {
|
|
return true
|
|
}
|
|
email := strings.ToLower(user.Email)
|
|
allowedDomains := ts.GetAllowedDomains(user, team)
|
|
return IsEmailAddressAllowed(email, allowedDomains)
|
|
}
|
|
|
|
func (ts *TeamService) GetAllowedDomains(user *model.User, team *model.Team) []string {
|
|
if user.IsGuest() {
|
|
return []string{*ts.config().GuestAccountsSettings.RestrictCreationToDomains}
|
|
}
|
|
// First check per team allowedDomains, then app wide restrictions
|
|
return []string{team.AllowedDomains, *ts.config().TeamSettings.RestrictCreationToDomains}
|
|
}
|
|
|
|
func (ts *TeamService) checkValidDomains(team *model.Team) error {
|
|
validDomains := normalizeDomains(*ts.config().TeamSettings.RestrictCreationToDomains)
|
|
if len(validDomains) > 0 {
|
|
for _, domain := range normalizeDomains(team.AllowedDomains) {
|
|
matched := slices.Contains(validDomains, domain)
|
|
if !matched {
|
|
return &DomainError{Domain: domain}
|
|
}
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func normalizeDomains(domains string) []string {
|
|
// commas and @ signs are optional
|
|
// can be in the form of "@corp.mattermost.com, mattermost.com mattermost.org" -> corp.mattermost.com mattermost.com mattermost.org
|
|
return strings.Fields(strings.TrimSpace(strings.ToLower(strings.Replace(strings.Replace(domains, "@", " ", -1), ",", " ", -1))))
|
|
}
|
|
|
|
// UserIsInAdminRoleGroup returns true at least one of the user's groups are configured to set the members as
|
|
// admins in the given syncable.
|
|
func (ts *TeamService) userIsInAdminRoleGroup(userID, syncableID string, syncableType model.GroupSyncableType) (bool, error) {
|
|
groupIDs, err := ts.groupStore.AdminRoleGroupsForSyncableMember(userID, syncableID, syncableType)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
if len(groupIDs) == 0 {
|
|
return false, nil
|
|
}
|
|
|
|
return true, nil
|
|
}
|