Files
85dc729756 MM 69100 - Team ABAC Membership - members sync and end user surfaces (#37054) (#37548)
* MM-69063 - Add team ABAC model and constants foundation

* Add team ABAC store EXISTS, channel Type retrofit, policy count split, and index migration

* Add team ABAC app layer: access gate, hydrators, assign/unassign, cleanup, and  GetTeamMembersToRemove store

* Enforce team membership ABAC on join and hide policy governed teams from  non-qualifying users in the directory

* Add team_ids to access policy assign/unassign, expose per-team policy GET,  and support abac_match_only for not_in_team user listing

* Add team ABAC client methods, websocket handler, per-team System Console policy UI, and hide policy-governed teams from non-qualifying users

* Make team ABAC mode-aware: advisory on public teams, strict on private, and surface governed private teams to qualifying users in directory listings

* Flag-gate team ABAC mutation/read APIs and fix policy-save error handling, member-removal limit, team-id  validation, export, and audit cleanup

* coderabbit feedback; Broadcast team policy enforcement updates on policy create/update and activation, not only on delete

* Update team access control policy schema to allow nullable policies and enhance test cases with channel counts

* Enhance access control policy tests to include team policy search alongside channel policy search

* Add team membership access control feature flag to docker-compose generation

* Implement team access control policy checks and refactor related components

* MM-69100 - add team membership ABAC sync worker with mode-aware removal and auto-add

* Add team ABAC removal/auto-add notifications, cascade audit, and team custom-rules save backend

* Add Team Settings team membership tab with custom-rules editor, auto-add toggle, save confirmation, and mode-flip  sync trigger

* Add team access control policy panels, job details team list, and e2e coverage for membership tab and discoverability cards

* ix save double-submit with loading state, team privacy via updateTeamPrivacy, mode-flip count accuracy, sync trigger logic, i18n keys, and e2e test cleanup

* Add team membership policy notices to invite and add-to-team flows, team access control system messages, and a team policy attributes endpoint

* Add team membership recommended tag for qualifying users and team requirements notice in the members modal

* temp

* adjust styling, add new e2e, fix team admin job permissions issues

* e2e clean items created

* fix directory and team integration e2e tests

* Surface team sync results in the Sync Job Details modal via a Teams tab linked from the chained channel job

* code clean up, adjust styling

* Add access control attributes endpoint and enhance E2E tests for team membership

* Enhance team access control by updating permission checks and syncing jobs

* Add API-level enforcement gate tests for ABAC team membership

* Fix formatting in team channel settings component by adding missing semicolon

* Fix formatting in Client4 class by adjusting type annotations for clarity

* revert unwanted changes in package-lock

* Refactor job permission test and simplify error handling in team details component

* Update test assertions and enhance auto-add functionality in team membership tab

* Update onboarding tests to use 'Public Team' card for team access settings

* Refactor AccessSettings and TeamPolicyEditor components to replace allowOpenInviteCheckbox with public and private team buttons, and update access control job dispatching logic.

* Remove redundant state updates for channel assignments in access control policy reducer

* Implement email suppression for team membership notifications and add related tests

* Authorize ABAC team self-join by attribute match instead of the join_private_teams role

* comments clean up

* Gate team privacy type normalization behind active ABAC, keep legacy allow_open_invite-only path  otherwise

* adjust job details styles

* Add team membership policy disconnect confirmation, fix linked-policy affected-member count, and polish job details modal

* Combine custom rules with system policy expressions for accurate confirm counts

* Implement child resource count stamping and deletion gating for access control policies

* Enhance team sync job triggering logic for membership changes without auto-add

* Refactor team privacy handling to align with open-directory model; update comments for clarity on allow_open_invite logic.

* Deduplicate team ABAC sync jobs per policy to prevent concurrent runs emitting duplicate DMs and audit records on HA clusters

* fix linter warnings

* Add confirmation for policy removal in TeamDetails tests

* Update delete policy message to include Teams in the warning

* Add linked teams warning to policy deletion and update translations

* Add Auto-add feature for policy selection and team management

- Enhanced PolicySelectionModal to include an Auto-add checkbox for each policy.
- Updated PolicyList to manage Auto-add state and reflect changes in the UI.
- Modified TeamAccessControl to handle Auto-add functionality and persist changes.
- Added tests to ensure Auto-add behavior works as expected in various scenarios.
- Updated translations for Auto-add related strings.

* Add team membership sync footer and enhance job fetching with policy ID

* Refactor team membership policy handling and sync footer implementation

* Add team sync channel cascade test for private channel membership

---------


(cherry picked from commit a582f03570)

Co-authored-by: Pablo Vélez <[email protected]>
2026-07-17 10:39:37 +03:00

253 lines
7.7 KiB
Go

// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
// See LICENSE.txt for license information.
package model
import (
"net/http"
"github.com/mattermost/mattermost/server/public/utils/timeutils"
)
const (
JobTypeDataRetention = "data_retention"
JobTypeMessageExport = "message_export"
JobTypeCLIMessageExport = "cli_message_export"
JobTypeElasticsearchPostIndexing = "elasticsearch_post_indexing"
JobTypeElasticsearchPostAggregation = "elasticsearch_post_aggregation"
JobTypeLdapSync = "ldap_sync"
JobTypeMigrations = "migrations"
JobTypePlugins = "plugins"
JobTypeExpiryNotify = "expiry_notify"
JobTypeProductNotices = "product_notices"
JobTypeActiveUsers = "active_users"
JobTypeImportProcess = "import_process"
JobTypeImportDelete = "import_delete"
JobTypeExportProcess = "export_process"
JobTypeExportDelete = "export_delete"
JobTypeCloud = "cloud"
JobTypeResendInvitationEmail = "resend_invitation_email"
JobTypeExtractContent = "extract_content"
JobTypeLastAccessiblePost = "last_accessible_post"
JobTypeLastAccessibleFile = "last_accessible_file"
JobTypeUpgradeNotifyAdmin = "upgrade_notify_admin"
JobTypeTrialNotifyAdmin = "trial_notify_admin"
JobTypePostPersistentNotifications = "post_persistent_notifications"
JobTypeInstallPluginNotifyAdmin = "install_plugin_notify_admin"
JobTypeHostedPurchaseScreening = "hosted_purchase_screening"
JobTypeS3PathMigration = "s3_path_migration"
JobTypeCleanupDesktopTokens = "cleanup_desktop_tokens"
JobTypeDeleteEmptyDraftsMigration = "delete_empty_drafts_migration"
JobTypeRefreshMaterializedViews = "refresh_materialized_views"
JobTypeDeleteOrphanDraftsMigration = "delete_orphan_drafts_migration"
JobTypeExportUsersToCSV = "export_users_to_csv"
JobTypeDeleteDmsPreferencesMigration = "delete_dms_preferences_migration"
JobTypeMobileSessionMetadata = "mobile_session_metadata"
JobTypeAccessControlSync = "access_control_sync"
JobTypeAccessControlTeamSync = "access_control_team_sync"
JobTypePushProxyAuth = "push_proxy_auth"
JobTypeRecap = "recap"
JobTypeDeleteExpiredPosts = "delete_expired_posts"
JobTypeAutoTranslationRecovery = "autotranslation_recovery"
JobTypeCleanupExpiredAccessTokens = "cleanup_expired_access_tokens"
JobTypeNotifyExpiringAccessTokens = "notify_expiring_access_tokens"
JobStatusPending = "pending"
JobStatusInProgress = "in_progress"
JobStatusSuccess = "success"
JobStatusError = "error"
JobStatusCancelRequested = "cancel_requested"
JobStatusCanceled = "canceled"
JobStatusWarning = "warning"
)
var AllJobTypes = [...]string{
JobTypeDataRetention,
JobTypeMessageExport,
JobTypeElasticsearchPostIndexing,
JobTypeElasticsearchPostAggregation,
JobTypeLdapSync,
JobTypeMigrations,
JobTypePlugins,
JobTypeExpiryNotify,
JobTypeProductNotices,
JobTypeActiveUsers,
JobTypeImportProcess,
JobTypeImportDelete,
JobTypeExportProcess,
JobTypeExportDelete,
JobTypeCloud,
JobTypeExtractContent,
JobTypeLastAccessiblePost,
JobTypeLastAccessibleFile,
JobTypeCleanupDesktopTokens,
JobTypeCleanupExpiredAccessTokens,
JobTypeNotifyExpiringAccessTokens,
JobTypeRefreshMaterializedViews,
JobTypeMobileSessionMetadata,
}
type Job struct {
Id string `json:"id"`
Type string `json:"type"`
Priority int64 `json:"priority"`
CreateAt int64 `json:"create_at"`
StartAt int64 `json:"start_at"`
LastActivityAt int64 `json:"last_activity_at"`
Status string `json:"status"`
Progress int64 `json:"progress"`
Data StringMap `json:"data"`
}
func (j *Job) Auditable() map[string]any {
return map[string]any{
"id": j.Id,
"type": j.Type,
"priority": j.Priority,
"create_at": j.CreateAt,
"start_at": j.StartAt,
"last_activity_at": j.LastActivityAt,
"status": j.Status,
"progress": j.Progress,
"data": j.Data, // TODO do we want this here
}
}
func (j *Job) MarshalYAML() (any, error) {
return struct {
Id string `yaml:"id"`
Type string `yaml:"type"`
Priority int64 `yaml:"priority"`
CreateAt string `yaml:"create_at"`
StartAt string `yaml:"start_at"`
LastActivityAt string `yaml:"last_activity_at"`
Status string `yaml:"status"`
Progress int64 `yaml:"progress"`
Data StringMap `yaml:"data"`
}{
Id: j.Id,
Type: j.Type,
Priority: j.Priority,
CreateAt: timeutils.FormatMillis(j.CreateAt),
StartAt: timeutils.FormatMillis(j.StartAt),
LastActivityAt: timeutils.FormatMillis(j.LastActivityAt),
Status: j.Status,
Progress: j.Progress,
Data: j.Data,
}, nil
}
func (j *Job) UnmarshalYAML(unmarshal func(any) error) error {
out := struct {
Id string `yaml:"id"`
Type string `yaml:"type"`
Priority int64 `yaml:"priority"`
CreateAt string `yaml:"create_at"`
StartAt string `yaml:"start_at"`
LastActivityAt string `yaml:"last_activity_at"`
Status string `yaml:"status"`
Progress int64 `yaml:"progress"`
Data StringMap `yaml:"data"`
}{}
err := unmarshal(&out)
if err != nil {
return err
}
createAt, err := timeutils.ParseFormatedMillis(out.CreateAt)
if err != nil {
return err
}
updateAt, err := timeutils.ParseFormatedMillis(out.StartAt)
if err != nil {
return err
}
deleteAt, err := timeutils.ParseFormatedMillis(out.LastActivityAt)
if err != nil {
return err
}
*j = Job{
Id: out.Id,
Type: out.Type,
Priority: out.Priority,
CreateAt: createAt,
StartAt: updateAt,
LastActivityAt: deleteAt,
Status: out.Status,
Progress: out.Progress,
Data: out.Data,
}
return nil
}
func (j *Job) IsValid() *AppError {
if !IsValidId(j.Id) {
return NewAppError("Job.IsValid", "model.job.is_valid.id.app_error", nil, "id="+j.Id, http.StatusBadRequest)
}
if j.CreateAt == 0 {
return NewAppError("Job.IsValid", "model.job.is_valid.create_at.app_error", nil, "id="+j.Id, http.StatusBadRequest)
}
validStatus := IsValidJobStatus(j.Status)
if !validStatus {
return NewAppError("Job.IsValid", "model.job.is_valid.status.app_error", nil, "id="+j.Id, http.StatusBadRequest)
}
return nil
}
func (j *Job) IsValidStatusChange(newStatus string) bool {
currentStatus := j.Status
switch currentStatus {
case JobStatusInProgress:
return newStatus == JobStatusPending || newStatus == JobStatusCancelRequested
case JobStatusPending:
return newStatus == JobStatusCancelRequested
case JobStatusCancelRequested:
return newStatus == JobStatusCanceled
}
return false
}
func IsValidJobStatus(status string) bool {
switch status {
case JobStatusPending,
JobStatusInProgress,
JobStatusSuccess,
JobStatusError,
JobStatusWarning,
JobStatusCancelRequested,
JobStatusCanceled:
default:
return false
}
return true
}
func IsValidJobType(jobType string) bool {
for _, t := range AllJobTypes {
if t == jobType {
return true
}
}
return false
}
func (j *Job) LogClone() any {
return j.Auditable()
}
type Worker interface {
Run()
Stop()
JobChannel() chan<- Job
IsEnabled(cfg *Config) bool
}