mirror of
https://github.com/hanzoai/team.git
synced 2026-10-30 14:49:35 +00:00
85dc729756
* MM-69063 - Add team ABAC model and constants foundation
* Add team ABAC store EXISTS, channel Type retrofit, policy count split, and index migration
* Add team ABAC app layer: access gate, hydrators, assign/unassign, cleanup, and GetTeamMembersToRemove store
* Enforce team membership ABAC on join and hide policy governed teams from non-qualifying users in the directory
* Add team_ids to access policy assign/unassign, expose per-team policy GET, and support abac_match_only for not_in_team user listing
* Add team ABAC client methods, websocket handler, per-team System Console policy UI, and hide policy-governed teams from non-qualifying users
* Make team ABAC mode-aware: advisory on public teams, strict on private, and surface governed private teams to qualifying users in directory listings
* Flag-gate team ABAC mutation/read APIs and fix policy-save error handling, member-removal limit, team-id validation, export, and audit cleanup
* coderabbit feedback; Broadcast team policy enforcement updates on policy create/update and activation, not only on delete
* Update team access control policy schema to allow nullable policies and enhance test cases with channel counts
* Enhance access control policy tests to include team policy search alongside channel policy search
* Add team membership access control feature flag to docker-compose generation
* Implement team access control policy checks and refactor related components
* MM-69100 - add team membership ABAC sync worker with mode-aware removal and auto-add
* Add team ABAC removal/auto-add notifications, cascade audit, and team custom-rules save backend
* Add Team Settings team membership tab with custom-rules editor, auto-add toggle, save confirmation, and mode-flip sync trigger
* Add team access control policy panels, job details team list, and e2e coverage for membership tab and discoverability cards
* ix save double-submit with loading state, team privacy via updateTeamPrivacy, mode-flip count accuracy, sync trigger logic, i18n keys, and e2e test cleanup
* Add team membership policy notices to invite and add-to-team flows, team access control system messages, and a team policy attributes endpoint
* Add team membership recommended tag for qualifying users and team requirements notice in the members modal
* temp
* adjust styling, add new e2e, fix team admin job permissions issues
* e2e clean items created
* fix directory and team integration e2e tests
* Surface team sync results in the Sync Job Details modal via a Teams tab linked from the chained channel job
* code clean up, adjust styling
* Add access control attributes endpoint and enhance E2E tests for team membership
* Enhance team access control by updating permission checks and syncing jobs
* Add API-level enforcement gate tests for ABAC team membership
* Fix formatting in team channel settings component by adding missing semicolon
* Fix formatting in Client4 class by adjusting type annotations for clarity
* revert unwanted changes in package-lock
* Refactor job permission test and simplify error handling in team details component
* Update test assertions and enhance auto-add functionality in team membership tab
* Update onboarding tests to use 'Public Team' card for team access settings
* Refactor AccessSettings and TeamPolicyEditor components to replace allowOpenInviteCheckbox with public and private team buttons, and update access control job dispatching logic.
* Remove redundant state updates for channel assignments in access control policy reducer
* Implement email suppression for team membership notifications and add related tests
* Authorize ABAC team self-join by attribute match instead of the join_private_teams role
* comments clean up
* Gate team privacy type normalization behind active ABAC, keep legacy allow_open_invite-only path otherwise
* adjust job details styles
* Add team membership policy disconnect confirmation, fix linked-policy affected-member count, and polish job details modal
* Combine custom rules with system policy expressions for accurate confirm counts
* Implement child resource count stamping and deletion gating for access control policies
* Enhance team sync job triggering logic for membership changes without auto-add
* Refactor team privacy handling to align with open-directory model; update comments for clarity on allow_open_invite logic.
* Deduplicate team ABAC sync jobs per policy to prevent concurrent runs emitting duplicate DMs and audit records on HA clusters
* fix linter warnings
* Add confirmation for policy removal in TeamDetails tests
* Update delete policy message to include Teams in the warning
* Add linked teams warning to policy deletion and update translations
* Add Auto-add feature for policy selection and team management
- Enhanced PolicySelectionModal to include an Auto-add checkbox for each policy.
- Updated PolicyList to manage Auto-add state and reflect changes in the UI.
- Modified TeamAccessControl to handle Auto-add functionality and persist changes.
- Added tests to ensure Auto-add behavior works as expected in various scenarios.
- Updated translations for Auto-add related strings.
* Add team membership sync footer and enhance job fetching with policy ID
* Refactor team membership policy handling and sync footer implementation
* Add team sync channel cascade test for private channel membership
---------
(cherry picked from commit a582f03570)
Co-authored-by: Pablo Vélez <[email protected]>
145 lines
4.5 KiB
Go
145 lines
4.5 KiB
Go
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
package app
|
|
|
|
import (
|
|
"github.com/mattermost/mattermost/server/v8/einterfaces"
|
|
ejobs "github.com/mattermost/mattermost/server/v8/einterfaces/jobs"
|
|
)
|
|
|
|
var accountMigrationInterface func(*App) einterfaces.AccountMigrationInterface
|
|
|
|
func RegisterAccountMigrationInterface(f func(*App) einterfaces.AccountMigrationInterface) {
|
|
accountMigrationInterface = f
|
|
}
|
|
|
|
var complianceInterface func(*App) einterfaces.ComplianceInterface
|
|
|
|
func RegisterComplianceInterface(f func(*App) einterfaces.ComplianceInterface) {
|
|
complianceInterface = f
|
|
}
|
|
|
|
var dataRetentionInterface func(*App) einterfaces.DataRetentionInterface
|
|
|
|
func RegisterDataRetentionInterface(f func(*App) einterfaces.DataRetentionInterface) {
|
|
dataRetentionInterface = f
|
|
}
|
|
|
|
var jobsDataRetentionJobInterface func(*Server) ejobs.DataRetentionJobInterface
|
|
|
|
func RegisterJobsDataRetentionJobInterface(f func(*Server) ejobs.DataRetentionJobInterface) {
|
|
jobsDataRetentionJobInterface = f
|
|
}
|
|
|
|
var jobsMessageExportJobInterface func(*Server) ejobs.MessageExportJobInterface
|
|
|
|
func RegisterJobsMessageExportJobInterface(f func(*Server) ejobs.MessageExportJobInterface) {
|
|
jobsMessageExportJobInterface = f
|
|
}
|
|
|
|
var jobsElasticsearchAggregatorInterface func(*Server) ejobs.ElasticsearchAggregatorInterface
|
|
|
|
func RegisterJobsElasticsearchAggregatorInterface(f func(*Server) ejobs.ElasticsearchAggregatorInterface) {
|
|
jobsElasticsearchAggregatorInterface = f
|
|
}
|
|
|
|
var jobsElasticsearchIndexerInterface func(*Server) ejobs.IndexerJobInterface
|
|
|
|
func RegisterJobsElasticsearchIndexerInterface(f func(*Server) ejobs.IndexerJobInterface) {
|
|
jobsElasticsearchIndexerInterface = f
|
|
}
|
|
|
|
var jobsLdapSyncInterface func(*App) ejobs.LdapSyncInterface
|
|
|
|
func RegisterJobsLdapSyncInterface(f func(*App) ejobs.LdapSyncInterface) {
|
|
jobsLdapSyncInterface = f
|
|
}
|
|
|
|
var ldapInterface func(*App) einterfaces.LdapInterface
|
|
|
|
func RegisterLdapInterface(f func(*App) einterfaces.LdapInterface) {
|
|
ldapInterface = f
|
|
}
|
|
|
|
var messageExportInterface func(*App) einterfaces.MessageExportInterface
|
|
|
|
func RegisterMessageExportInterface(f func(*App) einterfaces.MessageExportInterface) {
|
|
messageExportInterface = f
|
|
}
|
|
|
|
var cloudInterface func(*Server) einterfaces.CloudInterface
|
|
|
|
func RegisterCloudInterface(f func(*Server) einterfaces.CloudInterface) {
|
|
cloudInterface = f
|
|
}
|
|
|
|
var samlInterface func(*App) einterfaces.SamlInterface
|
|
|
|
func RegisterSamlInterface(f func(*App) einterfaces.SamlInterface) {
|
|
samlInterface = f
|
|
}
|
|
|
|
var notificationInterface func(*App) einterfaces.NotificationInterface
|
|
|
|
func RegisterNotificationInterface(f func(*App) einterfaces.NotificationInterface) {
|
|
notificationInterface = f
|
|
}
|
|
|
|
var outgoingOauthConnectionInterface func(*App) einterfaces.OutgoingOAuthConnectionInterface
|
|
|
|
func RegisterOutgoingOAuthConnectionInterface(f func(*App) einterfaces.OutgoingOAuthConnectionInterface) {
|
|
outgoingOauthConnectionInterface = f
|
|
}
|
|
|
|
var ipFilteringInterface func(*App) einterfaces.IPFilteringInterface
|
|
|
|
func RegisterIPFilteringInterface(f func(*App) einterfaces.IPFilteringInterface) {
|
|
ipFilteringInterface = f
|
|
}
|
|
|
|
var accessControlServiceInterface func(*App) einterfaces.AccessControlServiceInterface
|
|
|
|
func RegisterAccessControlServiceInterface(f func(*App) einterfaces.AccessControlServiceInterface) {
|
|
accessControlServiceInterface = f
|
|
}
|
|
|
|
var jobsAccessControlSyncJobInterface func(*Server) ejobs.AccessControlSyncJobInterface
|
|
|
|
func RegisterJobsAccessControlSyncJobInterface(f func(*Server) ejobs.AccessControlSyncJobInterface) {
|
|
jobsAccessControlSyncJobInterface = f
|
|
}
|
|
|
|
var jobsAccessControlTeamSyncJobInterface func(*Server) ejobs.AccessControlSyncJobInterface
|
|
|
|
func RegisterJobsAccessControlTeamSyncJobInterface(f func(*Server) ejobs.AccessControlSyncJobInterface) {
|
|
jobsAccessControlTeamSyncJobInterface = f
|
|
}
|
|
|
|
var pushProxyInterface func(*App) einterfaces.PushProxyInterface
|
|
|
|
func RegisterPushProxyInterface(f func(*App) einterfaces.PushProxyInterface) {
|
|
pushProxyInterface = f
|
|
}
|
|
|
|
var autoTranslationInterface func(*Server) einterfaces.AutoTranslationInterface
|
|
|
|
func RegisterAutoTranslationInterface(f func(*Server) einterfaces.AutoTranslationInterface) {
|
|
autoTranslationInterface = f
|
|
}
|
|
|
|
var intuneInterface func(*App) einterfaces.IntuneInterface
|
|
|
|
func RegisterIntuneInterface(f func(*App) einterfaces.IntuneInterface) {
|
|
intuneInterface = f
|
|
}
|
|
|
|
func (s *Server) initEnterprise() {
|
|
if cloudInterface != nil {
|
|
s.Cloud = cloudInterface(s)
|
|
}
|
|
if autoTranslationInterface != nil {
|
|
s.AutoTranslation = autoTranslationInterface(s)
|
|
}
|
|
}
|