Files
team/server/channels/app/user_limits_test.go
9ed85b6850 Cherry-pick Go 1.25.8 upgrade and FIPS password fixes to release-11.4 (#36123)
* ci: shard server Postgres tests into 4 parallel runners (#35739)

Cherry-pick of 00296f9b49 from master.

* updated go to version 1.25.8 (#35817)

Cherry-pick of 32a10bac62 from master.

* Move password hashers from server/v8 to server/public (#35805)

Cherry-pick of cca3f08574 from master.

* Generate instead of hard-coding test passwords, enforce new minimum for FIPS, shard CI, fix FIPS builds (#35905)

Cherry-pick of 1bdd985b41 from master.

* upgrade golangci-lint (#35845)

Cherry-pick of 157e0400b2 from master.

On release-11.4 (unlike 11.5), UpdatePostsChannelTypeByChannelId and
BackfillPostsChannelType exist in the elasticsearch/opensearch files,
so the imports they require (fmt, updatebyquery, scriptlanguage) must
be added — they were not in the cherry-pick diff since they already
existed on master.

Also updates html2text/tablewriter/olekukonko deps to fix a workspace
conflict where enterprise's Go 1.25.8 bump pulled in a newer html2text
that requires tablewriter ≥ 1.1 (was pinned to 0.0.5 via a replace
directive). Matches the subset of 866f759e4b (Mm 66662 bump deps)
relevant to this incompatibility.

* Fix FIPS-incompatible passwords and config in e2e test suites (#36001)

Cherry-pick of b51b4a8937 from master.

release-11.4 differences vs release-11.5:
- demo_plugin_installation.spec.ts also deleted (modify/delete conflict, git rm)
- authentication_2_spec.ts conflict: HEAD missing check() call; took
  incoming (check + FIPS-length passwords)
- member_invitation_ui_spec.ts: HEAD has 'Create Account' (capital A)
  matching release-11.4 button text; kept HEAD's button text with
  incoming's newTestPassword()

* fix(cypress): demo plugin (#36056)

Cherry-pick of 39f1979aa5 from master.

demo_plugin_installation.spec.ts was deleted in step 10 (modify/delete);
re-created here with both the FIPS-password change and the URL fix.

* test: clean up channel store data after TestChannelStore (#36066)

TestChannelStore sub-tests create channels, members, and team members
using fake TeamIds and UserIds (model.NewId() for non-existent rows).
These records are left in the database and cause integrity tests
(TestCheck*) running in the same binary to fail their full-table scans.

Register a t.Cleanup on TestChannelStore that purges the affected
tables entirely. A blanket purge is safe: the schema enforces no FK
constraints, and every test suite creates its own data independently.

* Fix command injection in server-test-template workflow (#36080)

Cherry-pick of 9223935f16 from master.

* fix(ci): restore testname format in sharded gotestsum runs (#36078)

run-shard-tests.sh called gotestsum directly without --format, so it
fell back to gotestsum's default (pkgname) instead of the testname
format set by the Makefile. Pass --format "${GOTESTSUM_FORMAT:-testname}"
to match the Makefile default.

Co-authored-by: Mattermost Build <[email protected]>

* fixup: drop demo_plugin playwright specs — master-only APIs

demo_plugin/helpers.ts and demo_plugin_installation.spec.ts use
installAndEnablePlugin and isPluginActive which don't exist on
release-11.4's PlaywrightExtended type. These files were re-created
by the step-11 cherry-pick of 39f1979aa5, but they don't compile on
this branch (same class of problem as actions.spec.ts in step 10).

* fixup: add missing await in PluginLinkTooltip test

The test added in 39f1979aa5 is missing an await on renderWithContext,
causing the pointer-events assertion to race. Fix from 0c7d3f27c6
(on a feature branch, not yet on master).

* fixup: drop pointer-events test incompatible with jsdom@20

The 'should not block interaction with elements outside the tooltip' test
checks getComputedStyle for pointer-events: none, which is set only in SCSS.
release-11.4 uses jest-environment-jsdom@29 (jsdom@20), which does not apply
stylesheets, so getComputedStyle always returns "". The test passes on
release-11.5+ only because they use jest-environment-jsdom@30 (jsdom@25+).

Drop the test rather than backport the jsdom upgrade.

* fixup: add missing i18n keys for elasticsearch/opensearch functions

BackfillPostsChannelType and UpdatePostsChannelTypeByChannelId exist on
release-11.4 (unlike release-11.5+). The golangci-lint cherry-pick added
new error strings to those functions referencing i18n keys that weren't
in en.json.

* fixup: run make i18n-extract to reorder keys correctly

* fixup: drop terms-and-privacy checkbox from MM-T1774 on release-11.4

The #signup-body-card-form-check-terms-and-privacy element did not exist
on release-11.4's signup page. It was added to master after this branch
was cut, so the check() call from the incoming cherry-pick causes the test
to fail with "element never found".

* fixup: remove UpdatePostsChannelTypeByChannelId/BackfillPostsChannelType

These functions were introduced by MM-67540 (allow searching public channel
messages without channel membership), which never landed on release-11.4.
The golangci-lint cherry-pick only modernizes existing code; the rerere
resolution incorrectly added the full function bodies from master.

Remove both functions and their now-unused imports (fmt, updatebyquery,
scriptlanguage) from elasticsearch.go and opensearch.go. Also remove the
two i18n keys added to support them.

Same treatment as release-11.5, where these functions were also absent.

---------

Co-authored-by: Mattermost Build <[email protected]>
2026-04-16 12:10:03 -03:00

487 lines
15 KiB
Go

// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
// See LICENSE.txt for license information.
package app
import (
"testing"
"github.com/mattermost/mattermost/server/public/model"
storemocks "github.com/mattermost/mattermost/server/v8/channels/store/storetest/mocks"
"github.com/stretchr/testify/mock"
"github.com/stretchr/testify/require"
)
func TestUpdateActiveWithUserLimits(t *testing.T) {
mainHelper.Parallel(t)
t.Run("unlicensed server", func(t *testing.T) {
t.Run("reactivation allowed below hard limit", func(t *testing.T) {
th := Setup(t).InitBasic(t)
th.App.Srv().SetLicense(nil)
// Deactivate user
deactivatedUser, appErr := th.App.UpdateActive(th.Context, th.BasicUser, false)
require.Nil(t, appErr)
require.NotEqual(t, 0, deactivatedUser.DeleteAt)
// Reactivate user (should succeed - below hard limit)
updatedUser, appErr := th.App.UpdateActive(th.Context, th.BasicUser, true)
require.Nil(t, appErr)
require.Equal(t, int64(0), updatedUser.DeleteAt)
})
t.Run("reactivation blocked at hard limit", func(t *testing.T) {
th := SetupWithStoreMock(t)
th.App.Srv().SetLicense(nil)
// Mock user count at hard limit
mockUserStore := storemocks.UserStore{}
mockUserStore.On("Count", mock.Anything).Return(int64(5000), nil) // At 5000 hard limit
mockStore := th.App.Srv().Store().(*storemocks.Store)
mockStore.On("User").Return(&mockUserStore)
user := &model.User{
Id: model.NewId(),
Email: "[email protected]",
Username: "testuser",
DeleteAt: model.GetMillis(),
}
// Try to reactivate user (should fail)
updatedUser, appErr := th.App.UpdateActive(th.Context, user, true)
require.NotNil(t, appErr)
require.Nil(t, updatedUser)
require.Equal(t, "app.user.update_active.user_limit.exceeded", appErr.Id)
})
t.Run("reactivation blocked above hard limit", func(t *testing.T) {
th := SetupWithStoreMock(t)
th.App.Srv().SetLicense(nil)
// Mock user count to exceed hard limit
mockUserStore := storemocks.UserStore{}
mockUserStore.On("Count", mock.Anything).Return(int64(6000), nil) // Over 5000 hard limit
mockStore := th.App.Srv().Store().(*storemocks.Store)
mockStore.On("User").Return(&mockUserStore)
user := &model.User{
Id: model.NewId(),
Email: "[email protected]",
Username: "testuser",
DeleteAt: model.GetMillis(),
}
// Try to reactivate user (should fail)
updatedUser, appErr := th.App.UpdateActive(th.Context, user, true)
require.NotNil(t, appErr)
require.Nil(t, updatedUser)
require.Equal(t, "app.user.update_active.user_limit.exceeded", appErr.Id)
})
})
t.Run("licensed server with seat count enforcement", func(t *testing.T) {
t.Run("reactivation allowed below limit", func(t *testing.T) {
th := Setup(t).InitBasic(t)
userLimit := 100
license := model.NewTestLicense("")
license.IsSeatCountEnforced = true
license.Features.Users = &userLimit
th.App.Srv().SetLicense(license)
// Deactivate user
_, appErr := th.App.UpdateActive(th.Context, th.BasicUser, false)
require.Nil(t, appErr)
// Reactivate user (should succeed - below limit)
updatedUser, appErr := th.App.UpdateActive(th.Context, th.BasicUser, true)
require.Nil(t, appErr)
require.Equal(t, int64(0), updatedUser.DeleteAt)
})
t.Run("reactivation blocked at grace limit", func(t *testing.T) {
th := SetupWithStoreMock(t)
userLimit := 100
license := model.NewTestLicense("")
license.IsSeatCountEnforced = true
license.Features.Users = &userLimit
th.App.Srv().SetLicense(license)
// Mock user count at grace limit (105 = 100 + 5% grace period)
mockUserStore := storemocks.UserStore{}
mockUserStore.On("Count", mock.Anything).Return(int64(105), nil) // At grace limit
mockStore := th.App.Srv().Store().(*storemocks.Store)
mockStore.On("User").Return(&mockUserStore)
user := &model.User{
Id: model.NewId(),
Email: "[email protected]",
Username: "testuser",
DeleteAt: model.GetMillis(),
}
// Try to reactivate user (should fail)
updatedUser, appErr := th.App.UpdateActive(th.Context, user, true)
require.NotNil(t, appErr)
require.Nil(t, updatedUser)
require.Equal(t, "app.user.update_active.license_user_limit.exceeded", appErr.Id)
})
t.Run("reactivation allowed at base limit but below grace limit", func(t *testing.T) {
th := Setup(t).InitBasic(t)
userLimit := 5 // Grace limit will be 6 (5 + 1 minimum)
license := model.NewTestLicense("")
license.IsSeatCountEnforced = true
license.Features.Users = &userLimit
th.App.Srv().SetLicense(license)
// InitBasic creates 3 users, create 2 more to reach base limit of 5
th.CreateUser(t)
th.CreateUser(t)
// Deactivate a user
_, appErr := th.App.UpdateActive(th.Context, th.BasicUser, false)
require.Nil(t, appErr)
// Reactivate user (should succeed - we're at base limit 5 but below grace limit 6)
updatedUser, appErr := th.App.UpdateActive(th.Context, th.BasicUser, true)
require.Nil(t, appErr)
require.Equal(t, int64(0), updatedUser.DeleteAt)
})
t.Run("reactivation blocked above grace limit", func(t *testing.T) {
th := SetupWithStoreMock(t)
userLimit := 100
license := model.NewTestLicense("")
license.IsSeatCountEnforced = true
license.Features.Users = &userLimit
th.App.Srv().SetLicense(license)
// Mock user count above grace limit (106 > 105 grace limit)
mockUserStore := storemocks.UserStore{}
mockUserStore.On("Count", mock.Anything).Return(int64(106), nil) // Above grace limit
mockStore := th.App.Srv().Store().(*storemocks.Store)
mockStore.On("User").Return(&mockUserStore)
user := &model.User{
Id: model.NewId(),
Email: "[email protected]",
Username: "testuser",
DeleteAt: model.GetMillis(),
}
// Try to reactivate user (should fail)
updatedUser, appErr := th.App.UpdateActive(th.Context, user, true)
require.NotNil(t, appErr)
require.Nil(t, updatedUser)
require.Equal(t, "app.user.update_active.license_user_limit.exceeded", appErr.Id)
})
})
t.Run("licensed server without seat count enforcement", func(t *testing.T) {
t.Run("reactivation allowed below unenforced limit", func(t *testing.T) {
th := Setup(t).InitBasic(t)
userLimit := 5
license := model.NewTestLicense("")
license.IsSeatCountEnforced = false
license.Features.Users = &userLimit
th.App.Srv().SetLicense(license)
// Create 2 additional users to have 3 total (below limit of 5)
th.CreateUser(t)
th.CreateUser(t)
// Deactivate user
_, appErr := th.App.UpdateActive(th.Context, th.BasicUser, false)
require.Nil(t, appErr)
// Reactivate user (should succeed - enforcement disabled and below limit)
updatedUser, appErr := th.App.UpdateActive(th.Context, th.BasicUser, true)
require.Nil(t, appErr)
require.Equal(t, int64(0), updatedUser.DeleteAt)
})
t.Run("reactivation allowed at unenforced limit", func(t *testing.T) {
th := Setup(t).InitBasic(t)
userLimit := 5
license := model.NewTestLicense("")
license.IsSeatCountEnforced = false
license.Features.Users = &userLimit
th.App.Srv().SetLicense(license)
// Create 4 additional users to have 5 total (at limit of 5)
th.CreateUser(t)
th.CreateUser(t)
th.CreateUser(t)
th.CreateUser(t)
// Create a user and then deactivate them
testUser := th.CreateUser(t)
_, appErr := th.App.UpdateActive(th.Context, testUser, false)
require.Nil(t, appErr)
// Reactivate user (should succeed - enforcement disabled)
updatedUser, appErr := th.App.UpdateActive(th.Context, testUser, true)
require.Nil(t, appErr)
require.Equal(t, int64(0), updatedUser.DeleteAt)
})
t.Run("reactivation allowed above unenforced limit", func(t *testing.T) {
th := Setup(t).InitBasic(t)
userLimit := 5
license := model.NewTestLicense("")
license.IsSeatCountEnforced = false
license.Features.Users = &userLimit
th.App.Srv().SetLicense(license)
// Create 5 additional users to have 6 total (above limit of 5)
th.CreateUser(t)
th.CreateUser(t)
th.CreateUser(t)
th.CreateUser(t)
th.CreateUser(t)
// Create a user and then deactivate them
testUser := th.CreateUser(t)
_, appErr := th.App.UpdateActive(th.Context, testUser, false)
require.Nil(t, appErr)
// Reactivate user (should succeed - enforcement disabled)
updatedUser, appErr := th.App.UpdateActive(th.Context, testUser, true)
require.Nil(t, appErr)
require.Equal(t, int64(0), updatedUser.DeleteAt)
})
})
}
func TestCreateUserOrGuestSeatCountEnforcement(t *testing.T) {
mainHelper.Parallel(t)
t.Run("seat count enforced - allows user creation when under limit", func(t *testing.T) {
th := Setup(t).InitBasic(t)
userLimit := 5
license := model.NewTestLicense("")
license.IsSeatCountEnforced = true
license.Features.Users = &userLimit
th.App.Srv().SetLicense(license)
// InitBasic creates 3 users, so we're under the limit of 5
user := &model.User{
Email: "[email protected]",
Username: "username_123",
Password: model.NewTestPassword(),
EmailVerified: true,
}
createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false)
require.Nil(t, appErr)
require.NotNil(t, createdUser)
require.Equal(t, "username_123", createdUser.Username)
})
t.Run("seat count enforced - blocks user creation when at limit", func(t *testing.T) {
th := Setup(t).InitBasic(t)
userLimit := 5
extraUsers := 1
license := model.NewTestLicense("")
license.IsSeatCountEnforced = true
license.Features.Users = &userLimit
license.ExtraUsers = &extraUsers
th.App.Srv().SetLicense(license)
// Create 3 additional users to reach the hard limit of 6 (3 from InitBasic + 3)
// Hard limit = 5 base users + 1 extra user = 6 total
th.CreateUser(t)
th.CreateUser(t)
th.CreateUser(t)
// Now at hard limit - attempting to create another user should fail
user := &model.User{
Email: "[email protected]",
Username: "seat_test_user",
Password: model.NewTestPassword(),
EmailVerified: true,
}
createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false)
require.NotNil(t, appErr)
require.Nil(t, createdUser)
require.Equal(t, "api.user.create_user.license_user_limits.exceeded", appErr.Id)
})
t.Run("seat count enforced - blocks user creation when over limit", func(t *testing.T) {
// Use mocks for this test since we can't actually create users beyond the safety limit
th := SetupWithStoreMock(t)
userLimit := 5
extraUsers := 0
currentUserCount := int64(6) // Over limit (limit=5, hard limit=5+0=5, current=6)
mockUserStore := storemocks.UserStore{}
mockUserStore.On("Count", mock.Anything).Return(currentUserCount, nil)
mockUserStore.On("IsEmpty", true).Return(false, nil)
mockGroupStore := storemocks.GroupStore{}
mockGroupStore.On("GetByName", "seat_test_user", mock.Anything).Return(nil, nil)
mockStore := th.App.Srv().Store().(*storemocks.Store)
mockStore.On("User").Return(&mockUserStore)
mockStore.On("Group").Return(&mockGroupStore)
license := model.NewTestLicense("")
license.IsSeatCountEnforced = true
license.Features.Users = &userLimit
license.ExtraUsers = &extraUsers
th.App.Srv().SetLicense(license)
user := &model.User{
Email: "[email protected]",
Username: "seat_test_user",
Password: model.NewTestPassword(),
EmailVerified: true,
}
createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false)
require.NotNil(t, appErr)
require.Nil(t, createdUser)
require.Equal(t, "api.user.create_user.license_user_limits.exceeded", appErr.Id)
})
t.Run("seat count not enforced - allows user creation even when over limit", func(t *testing.T) {
th := Setup(t).InitBasic(t)
userLimit := 5
license := model.NewTestLicense("")
license.IsSeatCountEnforced = false
license.Features.Users = &userLimit
th.App.Srv().SetLicense(license)
// Create additional users to exceed the limit (3 from InitBasic + 3 = 6, over limit of 5)
th.CreateUser(t)
th.CreateUser(t)
th.CreateUser(t)
// Should still allow creation since enforcement is disabled
user := &model.User{
Email: "[email protected]",
Username: "seat_test_user",
Password: model.NewTestPassword(),
EmailVerified: true,
}
createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false)
require.Nil(t, appErr)
require.NotNil(t, createdUser)
require.Equal(t, "seat_test_user", createdUser.Username)
})
t.Run("no license - uses existing hard limit logic", func(t *testing.T) {
th := Setup(t).InitBasic(t)
th.App.Srv().SetLicense(nil)
// Should allow creation under hard limit
user := &model.User{
Email: "[email protected]",
Username: "seat_test_user",
Password: model.NewTestPassword(),
EmailVerified: true,
}
createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false)
require.Nil(t, appErr)
require.NotNil(t, createdUser)
require.Equal(t, "seat_test_user", createdUser.Username)
})
t.Run("license without Users feature - no seat count enforcement", func(t *testing.T) {
th := Setup(t).InitBasic(t)
license := model.NewTestLicense("")
license.IsSeatCountEnforced = true
license.Features.Users = nil
th.App.Srv().SetLicense(license)
// Should allow creation since Users feature is nil
user := &model.User{
Email: "[email protected]",
Username: "seat_test_user",
Password: model.NewTestPassword(),
EmailVerified: true,
}
createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false)
require.Nil(t, appErr)
require.NotNil(t, createdUser)
require.Equal(t, "seat_test_user", createdUser.Username)
})
t.Run("guest creation with seat count enforcement - blocks when at limit", func(t *testing.T) {
th := Setup(t).InitBasic(t)
userLimit := 5
extraUsers := 1
license := model.NewTestLicense("")
license.IsSeatCountEnforced = true
license.Features.Users = &userLimit
license.ExtraUsers = &extraUsers
th.App.Srv().SetLicense(license)
// Create 3 additional users to reach the hard limit of 6 (3 from InitBasic + 3)
// Hard limit = 5 base users + 1 extra user = 6 total
th.CreateUser(t)
th.CreateUser(t)
th.CreateUser(t)
// Now at hard limit - attempting to create a guest should fail
user := &model.User{
Email: "[email protected]",
Username: "seat_test_guest",
Password: model.NewTestPassword(),
EmailVerified: true,
}
createdUser, appErr := th.App.createUserOrGuest(th.Context, user, true)
require.NotNil(t, appErr)
require.Nil(t, createdUser)
require.Equal(t, "api.user.create_user.license_user_limits.exceeded", appErr.Id)
})
t.Run("guest creation with seat count enforcement - allows when under limit", func(t *testing.T) {
th := Setup(t).InitBasic(t)
userLimit := 5
extraUsers := 0
license := model.NewTestLicense("")
license.IsSeatCountEnforced = true
license.Features.Users = &userLimit
license.ExtraUsers = &extraUsers
th.App.Srv().SetLicense(license)
// InitBasic creates 3 users, so we're under the limit of 5
user := &model.User{
Email: "[email protected]",
Username: "seat_test_guest",
Password: model.NewTestPassword(),
EmailVerified: true,
}
createdUser, appErr := th.App.createUserOrGuest(th.Context, user, true)
require.Nil(t, appErr)
require.NotNil(t, createdUser)
require.Equal(t, "seat_test_guest", createdUser.Username)
})
}