mirror of
https://github.com/hanzoai/team.git
synced 2026-10-30 14:49:35 +00:00
b1799e1882
* [MM-64634] Improve license error for wrong service environment When a cryptographically valid license is uploaded to a server running a different service environment (e.g. a production license on a test/dev server, or vice versa), ValidateLicense now retries verification against the alternate environment's public key. On success it returns a distinct error that callers surface as the new WrongEnvironmentLicenseError, giving admins an actionable message instead of the generic "Invalid license file." Genuinely corrupt licenses still return the existing InvalidLicenseError. Co-authored-by: mattermost-code <[email protected]> * [MM-64634] Add tests for wrong-environment license error mapping Cover SaveLicense (the System Console upload entry point) returning WrongEnvironmentLicenseError for a license signed for another service environment, and add a direct unit test for NewLicenseValidationAppError. Co-authored-by: mattermost-code <[email protected]> * Add audit logging for wrong-environment license upload failures Handle WrongEnvironmentLicenseError in addLicense and localAddLicense so environment mismatches are logged distinctly instead of falling through to the generic unable-to-save message. Co-authored-by: mattermost-code <[email protected]> * Log wrong-environment audit in LicenseFromBytes error path addLicense validates the license before SaveLicense, so WrongEnvironmentLicenseError is returned from LicenseFromBytes and never reaches the SaveLicense audit handler. Co-authored-by: mattermost-code <[email protected]> * Address PR feedback: remove license validation audit logging from addLicense Per review feedback, the per-error-id audit logging added to the LicenseFromBytes failure path in addLicense doesn't belong in the audit logs. Remove it to clean up the diff; the AppError is still returned to the caller unchanged. Resolves: 1 change request * Remove wrong-environment license audit logging Per review feedback, the wrong-environment license classification does not belong in the audit logs. Revert the audit logging additions in both the cloud and local license upload handlers. * Split wrong-environment license error by direction Per review feedback, distinguish between a production license uploaded to a test/dev server and a test/dev license uploaded to a production server. Each case now maps to its own AppError ID and user-facing message instead of a single generic wrong-environment error. * Restrict wrong-environment license fallback to signature failures Only treat alternate-key verification success as a wrong-environment mismatch when the primary key failed with rsa.ErrVerification. Other primary-key failures (e.g. malformed key material) are now surfaced unchanged instead of being masked as a wrong-environment license, and non-verification errors from the alternate-key check are no longer discarded. * Regenerate store layers and mocks for SessionStore --------- Co-authored-by: mattermost-code <[email protected]> Co-authored-by: Mattermost Build <[email protected]> Co-authored-by: Hanzo Dev <[email protected]>
146 lines
4.0 KiB
Go
146 lines
4.0 KiB
Go
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
package platform
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/mattermost/mattermost/server/public/model"
|
|
"github.com/mattermost/mattermost/server/public/plugin/plugintest/mock"
|
|
"github.com/mattermost/mattermost/server/v8/channels/utils"
|
|
mocks2 "github.com/mattermost/mattermost/server/v8/channels/utils/mocks"
|
|
"github.com/mattermost/mattermost/server/v8/channels/utils/testutils"
|
|
)
|
|
|
|
func TestLoadLicense(t *testing.T) {
|
|
mainHelper.Parallel(t)
|
|
th := Setup(t)
|
|
|
|
th.Service.LoadLicense()
|
|
require.Nil(t, th.Service.License(), "shouldn't have a valid license")
|
|
}
|
|
|
|
func TestSaveLicense(t *testing.T) {
|
|
mainHelper.Parallel(t)
|
|
th := Setup(t)
|
|
|
|
b1 := []byte("junk")
|
|
|
|
_, err := th.Service.SaveLicense(b1)
|
|
require.NotNil(t, err, "shouldn't have saved license")
|
|
}
|
|
|
|
func TestSaveLicenseWrongEnvironment(t *testing.T) {
|
|
// t.Setenv prevents t.Parallel — the service environment has no config equivalent.
|
|
th := Setup(t)
|
|
|
|
t.Setenv("MM_SERVICEENVIRONMENT", model.ServiceEnvironmentProduction)
|
|
|
|
// validTestLicense is signed with the test key, so uploading it to a server running
|
|
// in the production service environment must report an environment mismatch rather
|
|
// than the generic invalid-license error.
|
|
_, appErr := th.Service.SaveLicense(validTestLicense)
|
|
require.NotNil(t, appErr, "shouldn't have saved a license signed for another environment")
|
|
require.Equal(t, model.WrongEnvironmentTestLicenseError, appErr.Id)
|
|
require.Equal(t, http.StatusBadRequest, appErr.StatusCode)
|
|
}
|
|
|
|
func TestSaveEnterpriseAdvancedLicense(t *testing.T) {
|
|
th := Setup(t)
|
|
|
|
defer testutils.ResetLicenseValidator()
|
|
mockLicenseValidator := mocks2.LicenseValidatorIface{}
|
|
|
|
license := &model.License{
|
|
Id: model.NewId(),
|
|
Features: &model.Features{
|
|
Users: new(100),
|
|
},
|
|
Customer: &model.Customer{
|
|
Name: "TestName",
|
|
Email: "[email protected]",
|
|
},
|
|
SkuName: "SKU NAME",
|
|
SkuShortName: model.LicenseShortSkuEnterpriseAdvanced,
|
|
StartsAt: model.GetMillis() - 1000,
|
|
ExpiresAt: model.GetMillis() + 100000,
|
|
}
|
|
|
|
mockLicenseValidator.On("LicenseFromBytes", mock.Anything).Return(license, nil).Once()
|
|
licenseBytes, err := json.Marshal(license)
|
|
require.NoError(t, err)
|
|
|
|
mockLicenseValidator.On("ValidateLicense", mock.Anything).Return(string(licenseBytes), nil)
|
|
utils.LicenseValidator = &mockLicenseValidator
|
|
|
|
_, appErr := th.Service.SaveLicense(licenseBytes)
|
|
|
|
require.Nil(t, appErr, "should have saved license")
|
|
}
|
|
|
|
func TestRemoveLicense(t *testing.T) {
|
|
mainHelper.Parallel(t)
|
|
th := Setup(t)
|
|
|
|
err := th.Service.RemoveLicense()
|
|
require.Nil(t, err, "should have removed license")
|
|
}
|
|
|
|
func TestSetLicense(t *testing.T) {
|
|
mainHelper.Parallel(t)
|
|
th := Setup(t)
|
|
|
|
l1 := &model.License{}
|
|
l1.Features = &model.Features{}
|
|
l1.Customer = &model.Customer{}
|
|
l1.StartsAt = model.GetMillis() - 1000
|
|
l1.ExpiresAt = model.GetMillis() + 100000
|
|
ok := th.Service.SetLicense(l1)
|
|
require.True(t, ok, "license should have worked")
|
|
|
|
l3 := &model.License{}
|
|
l3.Features = &model.Features{}
|
|
l3.Customer = &model.Customer{}
|
|
l3.StartsAt = model.GetMillis() + 10000
|
|
l3.ExpiresAt = model.GetMillis() + 100000
|
|
ok = th.Service.SetLicense(l3)
|
|
require.True(t, ok, "license should have passed")
|
|
}
|
|
|
|
func TestGetSanitizedClientLicense(t *testing.T) {
|
|
mainHelper.Parallel(t)
|
|
th := Setup(t)
|
|
|
|
setLicense(th, nil)
|
|
|
|
m := th.Service.GetSanitizedClientLicense()
|
|
|
|
_, ok := m["Name"]
|
|
assert.False(t, ok)
|
|
_, ok = m["SkuName"]
|
|
assert.False(t, ok)
|
|
}
|
|
|
|
func setLicense(th *TestHelper, customer *model.Customer) {
|
|
l1 := &model.License{}
|
|
l1.Features = &model.Features{}
|
|
if customer != nil {
|
|
l1.Customer = customer
|
|
} else {
|
|
l1.Customer = &model.Customer{}
|
|
l1.Customer.Name = "TestName"
|
|
l1.Customer.Email = "[email protected]"
|
|
}
|
|
l1.SkuName = "SKU NAME"
|
|
l1.SkuShortName = "SKU SHORT NAME"
|
|
l1.StartsAt = model.GetMillis() - 1000
|
|
l1.ExpiresAt = model.GetMillis() + 100000
|
|
th.Service.SetLicense(l1)
|
|
}
|