mirror of
https://github.com/hanzoai/team.git
synced 2026-09-30 01:57:35 +00:00
zeekay
8feb24ea1f
The server module named github.com/hanzoai/team/server/v8 — a path that resolves to the retired workspace's repository, not this one — while server/public still published github.com/mattermost/mattermost/server/public. Both are github.com/hanzoteam/server/... now, which is where this code actually lives. That second half is what made the binary unbootable. Upstream's public path stayed claimed by upstream, mattermost-plugin-ai imported it, and the build linked public/model twice; public/plugin's gob.Register then ran twice under one name and panicked at init, before main. Reverting the rename traded the brand for a working binary. Rebranding the plugin alongside it needs no such trade: the agents fork is github.com/hanzoteam/agents/v2 against our public module, so no module named mattermost/mattermost is in the graph at all. Measured: `go list -deps ./cmd/mattermost` names exactly one public/model, and it is ours.
388 lines
13 KiB
Go
388 lines
13 KiB
Go
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
package remotecluster
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/mock"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/hanzoteam/server/server/public/model"
|
|
"github.com/hanzoteam/server/server/v8/channels/store/storetest/mocks"
|
|
)
|
|
|
|
// TestReceiveInviteConfirmation_TokenInvalidation tests that the invite token is properly
|
|
// invalidated after the first successful confirmation, preventing token reuse attacks.
|
|
// This addresses the security vulnerability described in MM-65152.
|
|
func TestReceiveInviteConfirmation_TokenInvalidation(t *testing.T) {
|
|
t.Run("Protocol v2+ with RefreshedToken - token is rotated", func(t *testing.T) {
|
|
// Setup
|
|
originalToken := model.NewId()
|
|
refreshedToken := model.NewId()
|
|
remoteId := model.NewId()
|
|
|
|
originalRC := &model.RemoteCluster{
|
|
RemoteId: remoteId,
|
|
Token: originalToken,
|
|
SiteURL: model.SiteURLPending + model.NewId(),
|
|
CreateAt: model.GetMillis(),
|
|
}
|
|
|
|
// Mock store
|
|
remoteClusterStoreMock := &mocks.RemoteClusterStore{}
|
|
remoteClusterStoreMock.On("Get", remoteId, false).Return(originalRC, nil)
|
|
|
|
// Capture the Update call to verify the token was rotated
|
|
var capturedRC *model.RemoteCluster
|
|
remoteClusterStoreMock.On("Update", mock.AnythingOfType("*model.RemoteCluster")).Run(func(args mock.Arguments) {
|
|
capturedRC = args.Get(0).(*model.RemoteCluster)
|
|
}).Return(func(rc *model.RemoteCluster) *model.RemoteCluster {
|
|
return rc
|
|
}, nil)
|
|
|
|
storeMock := &mocks.Store{}
|
|
storeMock.On("RemoteCluster").Return(remoteClusterStoreMock)
|
|
|
|
mockServer := newMockServerWithStore(t, storeMock)
|
|
mockApp := newMockApp(t, nil)
|
|
service, err := NewRemoteClusterService(mockServer, mockApp)
|
|
require.NoError(t, err)
|
|
|
|
// Create invite confirmation with protocol v2+ (includes RefreshedToken)
|
|
confirm := model.RemoteClusterInvite{
|
|
RemoteId: remoteId,
|
|
SiteURL: "http://example.com",
|
|
Token: model.NewId(),
|
|
RefreshedToken: refreshedToken,
|
|
Version: 3, // v3 protocol
|
|
}
|
|
|
|
// Execute
|
|
rcUpdated, err := service.ReceiveInviteConfirmation(confirm)
|
|
|
|
// Assert
|
|
require.NoError(t, err)
|
|
require.NotNil(t, rcUpdated)
|
|
require.NotNil(t, capturedRC, "Update should have been called")
|
|
|
|
assert.Equal(t, refreshedToken, capturedRC.Token, "Token should be rotated to RefreshedToken")
|
|
assert.NotEqual(t, originalToken, capturedRC.Token, "Original invite token should be invalidated")
|
|
assert.Equal(t, remoteId, capturedRC.RemoteId, "RemoteId should be preserved")
|
|
|
|
remoteClusterStoreMock.AssertExpectations(t)
|
|
})
|
|
|
|
t.Run("Protocol v1 or no RefreshedToken - token is regenerated", func(t *testing.T) {
|
|
// Setup
|
|
originalToken := model.NewId()
|
|
remoteId := model.NewId()
|
|
|
|
originalRC := &model.RemoteCluster{
|
|
RemoteId: remoteId,
|
|
Token: originalToken,
|
|
SiteURL: model.SiteURLPending + model.NewId(),
|
|
CreateAt: model.GetMillis(),
|
|
}
|
|
|
|
// Mock store
|
|
remoteClusterStoreMock := &mocks.RemoteClusterStore{}
|
|
remoteClusterStoreMock.On("Get", remoteId, false).Return(originalRC, nil)
|
|
|
|
// Capture what Update was called with for explicit assertions
|
|
var capturedRC *model.RemoteCluster
|
|
remoteClusterStoreMock.On("Update", mock.AnythingOfType("*model.RemoteCluster")).Run(func(args mock.Arguments) {
|
|
capturedRC = args.Get(0).(*model.RemoteCluster)
|
|
}).Return(func(rc *model.RemoteCluster) *model.RemoteCluster {
|
|
return rc
|
|
}, nil)
|
|
|
|
storeMock := &mocks.Store{}
|
|
storeMock.On("RemoteCluster").Return(remoteClusterStoreMock)
|
|
|
|
mockServer := newMockServerWithStore(t, storeMock)
|
|
mockApp := newMockApp(t, nil)
|
|
service, err := NewRemoteClusterService(mockServer, mockApp)
|
|
require.NoError(t, err)
|
|
|
|
// Create invite confirmation WITHOUT RefreshedToken (protocol v1)
|
|
confirm := model.RemoteClusterInvite{
|
|
RemoteId: remoteId,
|
|
SiteURL: "http://example.com",
|
|
Token: model.NewId(),
|
|
RefreshedToken: "", // No refreshed token
|
|
Version: 1, // v1 protocol
|
|
}
|
|
|
|
// Execute
|
|
rcUpdated, err := service.ReceiveInviteConfirmation(confirm)
|
|
|
|
// Assert
|
|
require.NoError(t, err)
|
|
require.NotNil(t, rcUpdated)
|
|
require.NotNil(t, capturedRC, "Update should have been called")
|
|
|
|
assert.NotEmpty(t, capturedRC.Token, "Token should be set")
|
|
assert.NotEqual(t, originalToken, capturedRC.Token, "Original invite token must be invalidated")
|
|
assert.Len(t, capturedRC.Token, 26, "New token should be a valid ID (26 chars)")
|
|
assert.Equal(t, remoteId, capturedRC.RemoteId, "RemoteId should be preserved")
|
|
|
|
remoteClusterStoreMock.AssertExpectations(t)
|
|
})
|
|
|
|
t.Run("Already confirmed cluster - returns error", func(t *testing.T) {
|
|
// Setup - cluster is already confirmed (has a real SiteURL)
|
|
remoteId := model.NewId()
|
|
confirmedRC := &model.RemoteCluster{
|
|
RemoteId: remoteId,
|
|
Token: model.NewId(),
|
|
SiteURL: "http://already-confirmed.com", // NOT a pending URL
|
|
CreateAt: model.GetMillis(),
|
|
}
|
|
|
|
// Mock store
|
|
remoteClusterStoreMock := &mocks.RemoteClusterStore{}
|
|
remoteClusterStoreMock.On("Get", remoteId, false).Return(confirmedRC, nil)
|
|
// Update should NOT be called
|
|
|
|
storeMock := &mocks.Store{}
|
|
storeMock.On("RemoteCluster").Return(remoteClusterStoreMock)
|
|
|
|
mockServer := newMockServerWithStore(t, storeMock)
|
|
mockApp := newMockApp(t, nil)
|
|
service, err := NewRemoteClusterService(mockServer, mockApp)
|
|
require.NoError(t, err)
|
|
|
|
confirm := model.RemoteClusterInvite{
|
|
RemoteId: remoteId,
|
|
SiteURL: "http://attacker.com",
|
|
Token: model.NewId(),
|
|
RefreshedToken: model.NewId(),
|
|
Version: 3,
|
|
}
|
|
|
|
// Execute
|
|
rcUpdated, err := service.ReceiveInviteConfirmation(confirm)
|
|
|
|
// Assert
|
|
require.Error(t, err, "Should return error for already confirmed cluster")
|
|
assert.Nil(t, rcUpdated)
|
|
assert.Contains(t, err.Error(), "already been confirmed",
|
|
"Error should indicate cluster is already confirmed")
|
|
|
|
// Verify Update was NOT called (token reuse prevented)
|
|
remoteClusterStoreMock.AssertNotCalled(t, "Update", mock.Anything)
|
|
})
|
|
|
|
t.Run("Token reuse scenario - second confirmation with old token fails", func(t *testing.T) {
|
|
// This test simulates the security vulnerability:
|
|
// 1. First confirmation succeeds and rotates token
|
|
// 2. Attacker tries to reuse the old token
|
|
// 3. Second confirmation should fail because token was rotated
|
|
|
|
originalToken := model.NewId()
|
|
newToken := model.NewId()
|
|
remoteId := model.NewId()
|
|
|
|
// Initial state - unconfirmed cluster
|
|
originalRC := &model.RemoteCluster{
|
|
RemoteId: remoteId,
|
|
Token: originalToken,
|
|
SiteURL: model.SiteURLPending + model.NewId(),
|
|
CreateAt: model.GetMillis(),
|
|
}
|
|
|
|
// After first confirmation - token has been rotated
|
|
confirmedRC := &model.RemoteCluster{
|
|
RemoteId: remoteId,
|
|
Token: newToken, // Token was rotated
|
|
RemoteToken: model.NewId(),
|
|
SiteURL: "http://legitimate.com",
|
|
CreateAt: model.GetMillis(),
|
|
}
|
|
|
|
// Mock store
|
|
remoteClusterStoreMock := &mocks.RemoteClusterStore{}
|
|
|
|
// First call: return unconfirmed cluster
|
|
remoteClusterStoreMock.On("Get", remoteId, false).Return(originalRC, nil).Once()
|
|
|
|
// First update: rotate token
|
|
remoteClusterStoreMock.On("Update", mock.MatchedBy(func(rc *model.RemoteCluster) bool {
|
|
return rc.RemoteId == remoteId
|
|
})).Return(confirmedRC, nil).Once()
|
|
|
|
// Second call: return confirmed cluster with new token
|
|
remoteClusterStoreMock.On("Get", remoteId, false).Return(confirmedRC, nil).Once()
|
|
|
|
storeMock := &mocks.Store{}
|
|
storeMock.On("RemoteCluster").Return(remoteClusterStoreMock)
|
|
|
|
mockServer := newMockServerWithStore(t, storeMock)
|
|
mockApp := newMockApp(t, nil)
|
|
service, err := NewRemoteClusterService(mockServer, mockApp)
|
|
require.NoError(t, err)
|
|
|
|
// First confirmation (legitimate)
|
|
confirm1 := model.RemoteClusterInvite{
|
|
RemoteId: remoteId,
|
|
SiteURL: "http://legitimate.com",
|
|
Token: model.NewId(),
|
|
RefreshedToken: newToken,
|
|
Version: 3,
|
|
}
|
|
|
|
rcUpdated, err := service.ReceiveInviteConfirmation(confirm1)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, rcUpdated)
|
|
assert.Equal(t, newToken, rcUpdated.Token, "Token should be rotated after first confirmation")
|
|
|
|
// Second confirmation attempt (attacker trying to reuse invite)
|
|
confirm2 := model.RemoteClusterInvite{
|
|
RemoteId: remoteId,
|
|
SiteURL: "http://attacker.com", // Attacker's malicious URL
|
|
Token: originalToken, // Reusing OLD token from original invite
|
|
RefreshedToken: model.NewId(),
|
|
Version: 3,
|
|
}
|
|
|
|
rcUpdated2, err := service.ReceiveInviteConfirmation(confirm2)
|
|
|
|
// Assert: Second confirmation should fail
|
|
require.Error(t, err, "Second confirmation should fail - cluster already confirmed")
|
|
assert.Nil(t, rcUpdated2, "No cluster should be returned on failed reuse attempt")
|
|
assert.Contains(t, err.Error(), "already been confirmed",
|
|
"Should indicate cluster already confirmed, preventing token reuse")
|
|
|
|
remoteClusterStoreMock.AssertExpectations(t)
|
|
})
|
|
|
|
t.Run("Protocol v2+ with RefreshedToken equal to original token - rejected (MM-67098)", func(t *testing.T) {
|
|
// Security: RefreshedToken must be different from the original invite token.
|
|
// If the remote sends back the same token, they did not actually refresh; reject.
|
|
originalToken := model.NewId()
|
|
remoteId := model.NewId()
|
|
|
|
originalRC := &model.RemoteCluster{
|
|
RemoteId: remoteId,
|
|
Token: originalToken,
|
|
SiteURL: model.SiteURLPending + model.NewId(),
|
|
CreateAt: model.GetMillis(),
|
|
}
|
|
|
|
remoteClusterStoreMock := &mocks.RemoteClusterStore{}
|
|
remoteClusterStoreMock.On("Get", remoteId, false).Return(originalRC, nil)
|
|
// Update must NOT be called when RefreshedToken == rc.Token
|
|
|
|
storeMock := &mocks.Store{}
|
|
storeMock.On("RemoteCluster").Return(remoteClusterStoreMock)
|
|
|
|
mockServer := newMockServerWithStore(t, storeMock)
|
|
mockApp := newMockApp(t, nil)
|
|
service, err := NewRemoteClusterService(mockServer, mockApp)
|
|
require.NoError(t, err)
|
|
|
|
confirm := model.RemoteClusterInvite{
|
|
RemoteId: remoteId,
|
|
SiteURL: "http://example.com",
|
|
Token: model.NewId(),
|
|
RefreshedToken: originalToken, // Same as rc.Token - invalid, must be different
|
|
Version: 3,
|
|
}
|
|
|
|
rcUpdated, err := service.ReceiveInviteConfirmation(confirm)
|
|
|
|
require.Error(t, err)
|
|
assert.Nil(t, rcUpdated)
|
|
assert.Contains(t, err.Error(), "RefreshedToken must be different from the original invite token")
|
|
remoteClusterStoreMock.AssertNotCalled(t, "Update", mock.Anything)
|
|
})
|
|
}
|
|
|
|
// TestReceiveInviteConfirmation_EdgeCases tests various edge cases
|
|
func TestReceiveInviteConfirmation_EdgeCases(t *testing.T) {
|
|
t.Run("Non-existent remote ID", func(t *testing.T) {
|
|
remoteId := model.NewId()
|
|
|
|
remoteClusterStoreMock := &mocks.RemoteClusterStore{}
|
|
remoteClusterStoreMock.On("Get", remoteId, false).Return(nil, &model.AppError{
|
|
Message: "not found",
|
|
})
|
|
|
|
storeMock := &mocks.Store{}
|
|
storeMock.On("RemoteCluster").Return(remoteClusterStoreMock)
|
|
|
|
mockServer := newMockServerWithStore(t, storeMock)
|
|
mockApp := newMockApp(t, nil)
|
|
service, err := NewRemoteClusterService(mockServer, mockApp)
|
|
require.NoError(t, err)
|
|
|
|
confirm := model.RemoteClusterInvite{
|
|
RemoteId: remoteId,
|
|
SiteURL: "http://example.com",
|
|
Token: model.NewId(),
|
|
Version: 3,
|
|
}
|
|
|
|
rcUpdated, err := service.ReceiveInviteConfirmation(confirm)
|
|
|
|
require.Error(t, err)
|
|
assert.Nil(t, rcUpdated)
|
|
assert.Contains(t, err.Error(), "cannot accept invite confirmation")
|
|
})
|
|
|
|
t.Run("Protocol v2+ with empty RefreshedToken - falls back to NewId", func(t *testing.T) {
|
|
originalToken := model.NewId()
|
|
remoteId := model.NewId()
|
|
|
|
originalRC := &model.RemoteCluster{
|
|
RemoteId: remoteId,
|
|
Token: originalToken,
|
|
SiteURL: model.SiteURLPending + model.NewId(),
|
|
CreateAt: model.GetMillis(),
|
|
}
|
|
|
|
remoteClusterStoreMock := &mocks.RemoteClusterStore{}
|
|
remoteClusterStoreMock.On("Get", remoteId, false).Return(originalRC, nil)
|
|
|
|
// Capture what Update was called with for explicit assertions
|
|
var capturedRC *model.RemoteCluster
|
|
remoteClusterStoreMock.On("Update", mock.AnythingOfType("*model.RemoteCluster")).Run(func(args mock.Arguments) {
|
|
capturedRC = args.Get(0).(*model.RemoteCluster)
|
|
}).Return(func(rc *model.RemoteCluster) *model.RemoteCluster {
|
|
return rc
|
|
}, nil)
|
|
|
|
storeMock := &mocks.Store{}
|
|
storeMock.On("RemoteCluster").Return(remoteClusterStoreMock)
|
|
|
|
mockServer := newMockServerWithStore(t, storeMock)
|
|
mockApp := newMockApp(t, nil)
|
|
service, err := NewRemoteClusterService(mockServer, mockApp)
|
|
require.NoError(t, err)
|
|
|
|
// v3 protocol but RefreshedToken is empty
|
|
confirm := model.RemoteClusterInvite{
|
|
RemoteId: remoteId,
|
|
SiteURL: "http://example.com",
|
|
Token: model.NewId(),
|
|
RefreshedToken: "", // Empty - should trigger fallback
|
|
Version: 3,
|
|
}
|
|
|
|
rcUpdated, err := service.ReceiveInviteConfirmation(confirm)
|
|
|
|
require.NoError(t, err)
|
|
require.NotNil(t, rcUpdated)
|
|
require.NotNil(t, capturedRC, "Update should have been called")
|
|
|
|
assert.NotEqual(t, originalToken, capturedRC.Token, "Original token should be invalidated")
|
|
assert.Len(t, capturedRC.Token, 26, "Should generate new token via fallback (26 chars)")
|
|
assert.Equal(t, remoteId, capturedRC.RemoteId, "RemoteId should be preserved")
|
|
|
|
remoteClusterStoreMock.AssertExpectations(t)
|
|
})
|
|
}
|