mirror of
https://github.com/hanzoai/team.git
synced 2026-09-30 01:57:35 +00:00
de4bcf9c66
* MM-69063 - Add team ABAC model and constants foundation * Add team ABAC store EXISTS, channel Type retrofit, policy count split, and index migration * Add team ABAC app layer: access gate, hydrators, assign/unassign, cleanup, and GetTeamMembersToRemove store * Enforce team membership ABAC on join and hide policy governed teams from non-qualifying users in the directory * Add team_ids to access policy assign/unassign, expose per-team policy GET, and support abac_match_only for not_in_team user listing * Add team ABAC client methods, websocket handler, per-team System Console policy UI, and hide policy-governed teams from non-qualifying users * Make team ABAC mode-aware: advisory on public teams, strict on private, and surface governed private teams to qualifying users in directory listings * Flag-gate team ABAC mutation/read APIs and fix policy-save error handling, member-removal limit, team-id validation, export, and audit cleanup * coderabbit feedback; Broadcast team policy enforcement updates on policy create/update and activation, not only on delete * Update team access control policy schema to allow nullable policies and enhance test cases with channel counts * Enhance access control policy tests to include team policy search alongside channel policy search * Add team membership access control feature flag to docker-compose generation * Implement team access control policy checks and refactor related components * Audit-log team ABAC policy removal on team archive and delete --------- Co-authored-by: Mattermost Build <[email protected]>
57 lines
1.8 KiB
Go
57 lines
1.8 KiB
Go
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
package sqlstore
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/mattermost/mattermost/server/public/model"
|
|
"github.com/mattermost/mattermost/server/public/shared/mlog"
|
|
)
|
|
|
|
func TestMigration000194(t *testing.T) {
|
|
logger := mlog.CreateTestLogger(t)
|
|
|
|
settings, err := makeSqlSettings(model.DatabaseDriverPostgres)
|
|
if err != nil {
|
|
t.Skip(err)
|
|
}
|
|
|
|
store, err := New(*settings, logger, nil)
|
|
require.NoError(t, err)
|
|
defer store.Close()
|
|
|
|
master := store.GetMaster()
|
|
|
|
upSQL := readMigrationSQL(t, "000194_add_type_id_index_to_access_control_policies.up.sql")
|
|
downSQL := readMigrationSQL(t, "000194_add_type_id_index_to_access_control_policies.down.sql")
|
|
|
|
indexExists := func() bool {
|
|
var exists bool
|
|
require.NoError(t, master.Get(&exists, "SELECT EXISTS (SELECT 1 FROM pg_indexes WHERE indexname = 'idx_access_control_policies_type_id')"))
|
|
return exists
|
|
}
|
|
|
|
// CONCURRENTLY cannot run inside a transaction; ExecNoTimeout runs unwrapped.
|
|
_, err = master.ExecNoTimeout(upSQL)
|
|
require.NoError(t, err, "up migration should succeed")
|
|
assert.True(t, indexExists(), "index should exist after up migration")
|
|
|
|
// IF NOT EXISTS makes a second up a safe no-op.
|
|
_, err = master.ExecNoTimeout(upSQL)
|
|
require.NoError(t, err, "up migration should be idempotent")
|
|
assert.True(t, indexExists())
|
|
|
|
_, err = master.ExecNoTimeout(downSQL)
|
|
require.NoError(t, err, "down migration should succeed")
|
|
assert.False(t, indexExists(), "index should be gone after down migration")
|
|
|
|
// IF EXISTS makes a second down a safe no-op.
|
|
_, err = master.ExecNoTimeout(downSQL)
|
|
require.NoError(t, err, "down migration should be idempotent")
|
|
}
|