mirror of
https://github.com/hanzoai/team.git
synced 2026-09-30 01:57:35 +00:00
9ed85b6850
* ci: shard server Postgres tests into 4 parallel runners (#35739) Cherry-pick of00296f9b49from master. * updated go to version 1.25.8 (#35817) Cherry-pick of32a10bac62from master. * Move password hashers from server/v8 to server/public (#35805) Cherry-pick ofcca3f08574from master. * Generate instead of hard-coding test passwords, enforce new minimum for FIPS, shard CI, fix FIPS builds (#35905) Cherry-pick of1bdd985b41from master. * upgrade golangci-lint (#35845) Cherry-pick of157e0400b2from master. On release-11.4 (unlike 11.5), UpdatePostsChannelTypeByChannelId and BackfillPostsChannelType exist in the elasticsearch/opensearch files, so the imports they require (fmt, updatebyquery, scriptlanguage) must be added — they were not in the cherry-pick diff since they already existed on master. Also updates html2text/tablewriter/olekukonko deps to fix a workspace conflict where enterprise's Go 1.25.8 bump pulled in a newer html2text that requires tablewriter ≥ 1.1 (was pinned to 0.0.5 via a replace directive). Matches the subset of866f759e4b(Mm 66662 bump deps) relevant to this incompatibility. * Fix FIPS-incompatible passwords and config in e2e test suites (#36001) Cherry-pick ofb51b4a8937from master. release-11.4 differences vs release-11.5: - demo_plugin_installation.spec.ts also deleted (modify/delete conflict, git rm) - authentication_2_spec.ts conflict: HEAD missing check() call; took incoming (check + FIPS-length passwords) - member_invitation_ui_spec.ts: HEAD has 'Create Account' (capital A) matching release-11.4 button text; kept HEAD's button text with incoming's newTestPassword() * fix(cypress): demo plugin (#36056) Cherry-pick of39f1979aa5from master. demo_plugin_installation.spec.ts was deleted in step 10 (modify/delete); re-created here with both the FIPS-password change and the URL fix. * test: clean up channel store data after TestChannelStore (#36066) TestChannelStore sub-tests create channels, members, and team members using fake TeamIds and UserIds (model.NewId() for non-existent rows). These records are left in the database and cause integrity tests (TestCheck*) running in the same binary to fail their full-table scans. Register a t.Cleanup on TestChannelStore that purges the affected tables entirely. A blanket purge is safe: the schema enforces no FK constraints, and every test suite creates its own data independently. * Fix command injection in server-test-template workflow (#36080) Cherry-pick of9223935f16from master. * fix(ci): restore testname format in sharded gotestsum runs (#36078) run-shard-tests.sh called gotestsum directly without --format, so it fell back to gotestsum's default (pkgname) instead of the testname format set by the Makefile. Pass --format "${GOTESTSUM_FORMAT:-testname}" to match the Makefile default. Co-authored-by: Mattermost Build <[email protected]> * fixup: drop demo_plugin playwright specs — master-only APIs demo_plugin/helpers.ts and demo_plugin_installation.spec.ts use installAndEnablePlugin and isPluginActive which don't exist on release-11.4's PlaywrightExtended type. These files were re-created by the step-11 cherry-pick of39f1979aa5, but they don't compile on this branch (same class of problem as actions.spec.ts in step 10). * fixup: add missing await in PluginLinkTooltip test The test added in39f1979aa5is missing an await on renderWithContext, causing the pointer-events assertion to race. Fix from 0c7d3f27c6 (on a feature branch, not yet on master). * fixup: drop pointer-events test incompatible with jsdom@20 The 'should not block interaction with elements outside the tooltip' test checks getComputedStyle for pointer-events: none, which is set only in SCSS. release-11.4 uses jest-environment-jsdom@29 (jsdom@20), which does not apply stylesheets, so getComputedStyle always returns "". The test passes on release-11.5+ only because they use jest-environment-jsdom@30 (jsdom@25+). Drop the test rather than backport the jsdom upgrade. * fixup: add missing i18n keys for elasticsearch/opensearch functions BackfillPostsChannelType and UpdatePostsChannelTypeByChannelId exist on release-11.4 (unlike release-11.5+). The golangci-lint cherry-pick added new error strings to those functions referencing i18n keys that weren't in en.json. * fixup: run make i18n-extract to reorder keys correctly * fixup: drop terms-and-privacy checkbox from MM-T1774 on release-11.4 The #signup-body-card-form-check-terms-and-privacy element did not exist on release-11.4's signup page. It was added to master after this branch was cut, so the check() call from the incoming cherry-pick causes the test to fail with "element never found". * fixup: remove UpdatePostsChannelTypeByChannelId/BackfillPostsChannelType These functions were introduced by MM-67540 (allow searching public channel messages without channel membership), which never landed on release-11.4. The golangci-lint cherry-pick only modernizes existing code; the rerere resolution incorrectly added the full function bodies from master. Remove both functions and their now-unused imports (fmt, updatebyquery, scriptlanguage) from elasticsearch.go and opensearch.go. Also remove the two i18n keys added to support them. Same treatment as release-11.5, where these functions were also absent. --------- Co-authored-by: Mattermost Build <[email protected]>
277 lines
11 KiB
Go
277 lines
11 KiB
Go
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
package web
|
|
|
|
import (
|
|
"bytes"
|
|
"fmt"
|
|
"net/http"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/mattermost/mattermost/server/public/model"
|
|
)
|
|
|
|
func TestIncomingWebhook(t *testing.T) {
|
|
th := Setup(t).InitBasic(t)
|
|
|
|
if !*th.App.Config().ServiceSettings.EnableIncomingWebhooks {
|
|
_, err := http.Post(apiClient.URL+"/hooks/123", "", strings.NewReader("123"))
|
|
assert.Error(t, err, "should have errored - webhooks turned off")
|
|
return
|
|
}
|
|
|
|
hook, err := th.App.CreateIncomingWebhookForChannel(th.BasicUser.Id, th.BasicChannel, &model.IncomingWebhook{ChannelId: th.BasicChannel.Id})
|
|
require.Nil(t, err)
|
|
|
|
url := apiClient.URL + "/hooks/" + hook.Id
|
|
|
|
var tooLongTextBuilder strings.Builder
|
|
for range 8200 {
|
|
tooLongTextBuilder.WriteString("a")
|
|
}
|
|
tooLongText := tooLongTextBuilder.String()
|
|
|
|
t.Run("WebhookBasics", func(t *testing.T) {
|
|
payload := "payload={\"text\": \"test text\"}"
|
|
resp, err := http.Post(url, "application/x-www-form-urlencoded", strings.NewReader(payload))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
payload = "payload={\"text\": \"\"}"
|
|
resp, err = http.Post(url, "application/x-www-form-urlencoded", strings.NewReader(payload))
|
|
require.NoError(t, err)
|
|
assert.NotEqual(t, http.StatusOK, resp.StatusCode, "should have errored - no text post")
|
|
|
|
payload = "payload={\"text\": \"test text\", \"channel\": \"junk\"}"
|
|
resp, err = http.Post(url, "application/x-www-form-urlencoded", strings.NewReader(payload))
|
|
require.NoError(t, err)
|
|
assert.NotEqual(t, http.StatusOK, resp.StatusCode, "should have errored - bad channel")
|
|
|
|
payload = "payload={\"text\": \"test text\"}"
|
|
resp, err = http.Post(apiClient.URL+"/hooks/abc123", "application/x-www-form-urlencoded", strings.NewReader(payload))
|
|
require.NoError(t, err)
|
|
assert.NotEqual(t, http.StatusOK, resp.StatusCode, "should have errored - bad hook")
|
|
|
|
resp, err = http.Post(url, "application/json", strings.NewReader("{\"text\":\"this is a test\"}"))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
text := `this is a \"test\"
|
|
that contains a newline and a tab`
|
|
resp, err = http.Post(url, "application/json", strings.NewReader("{\"text\":\""+text+"\"}"))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
resp, err = http.Post(url, "application/json", strings.NewReader(fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", th.BasicChannel.Name)))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
resp, err = http.Post(url, "application/json", strings.NewReader(fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"#%s\"}", th.BasicChannel.Name)))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
resp, err = http.Post(url, "application/json", strings.NewReader(fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"@%s\"}", th.BasicUser.Username)))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
resp, err = http.Post(url, "application/x-www-form-urlencoded", strings.NewReader("payload={\"text\":\"this is a test\"}"))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
resp, err = http.Post(url, "application/x-www-form-urlencoded", strings.NewReader("payload={\"text\":\""+text+"\"}"))
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
resp, err = http.Post(url, "AppLicaTion/x-www-Form-urlencoded", strings.NewReader("payload={\"text\":\""+text+"\"}"))
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
resp, err = http.Post(url, "application/x-www-form-urlencoded;charset=utf-8", strings.NewReader("payload={\"text\":\""+text+"\"}"))
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
resp, err = http.Post(url, "application/x-www-form-urlencoded; charset=utf-8", strings.NewReader("payload={\"text\":\""+text+"\"}"))
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
resp, err = http.Post(url, "application/x-www-form-urlencoded wrongtext", strings.NewReader("payload={\"text\":\""+text+"\"}"))
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
|
|
|
|
resp, err = http.Post(url, "application/json", strings.NewReader("{\"text\":\""+tooLongText+"\"}"))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
resp, err = http.Post(url, "application/x-www-form-urlencoded", strings.NewReader("{\"text\":\""+tooLongText+"\"}"))
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
|
|
|
|
resp, err = http.Post(url, "application/json", strings.NewReader("payload={\"text\":\""+text+"\"}"))
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
|
|
|
|
payloadMultiPart := "------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\nwebhook-bot\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"text\"\r\n\r\nthis is a test :tada:\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW--"
|
|
resp, err = http.Post(apiClient.URL+"/hooks/"+hook.Id, "multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW", strings.NewReader(payloadMultiPart))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
|
|
resp, err = http.Post(url, "mimetype/wrong", strings.NewReader("payload={\"text\":\""+text+"\"}"))
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
|
|
|
|
resp, err = http.Post(url, "", strings.NewReader("{\"text\":\""+text+"\"}"))
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
})
|
|
|
|
t.Run("WebhookAttachments", func(t *testing.T) {
|
|
attachmentPayload := `{
|
|
"text": "this is a test",
|
|
"attachments": [
|
|
{
|
|
"fallback": "Required plain-text summary of the attachment.",
|
|
|
|
"color": "#36a64f",
|
|
|
|
"pretext": "Optional text that appears above the attachment block",
|
|
|
|
"author_name": "Bobby Tables",
|
|
"author_link": "http://flickr.com/bobby/",
|
|
"author_icon": "http://flickr.com/icons/bobby.jpg",
|
|
|
|
"title": "Slack API Documentation",
|
|
"title_link": "https://api.slack.com/",
|
|
|
|
"text": "Optional text that appears within the attachment",
|
|
|
|
"fields": [
|
|
{
|
|
"title": "Priority",
|
|
"value": "High",
|
|
"short": false
|
|
}
|
|
],
|
|
|
|
"image_url": "http://my-website.com/path/to/image.jpg",
|
|
"thumb_url": "http://example.com/path/to/thumb.png"
|
|
}
|
|
]
|
|
}`
|
|
|
|
resp, err := http.Post(url, "application/json", strings.NewReader(attachmentPayload))
|
|
require.NoError(t, err)
|
|
assert.True(t, resp.StatusCode == http.StatusOK)
|
|
|
|
attachmentPayload = `{
|
|
"text": "this is a test",
|
|
"attachments": [
|
|
{
|
|
"fallback": "Required plain-text summary of the attachment.",
|
|
|
|
"color": "#36a64f",
|
|
|
|
"pretext": "Optional text that appears above the attachment block",
|
|
|
|
"author_name": "Bobby Tables",
|
|
"author_link": "http://flickr.com/bobby/",
|
|
"author_icon": "http://flickr.com/icons/bobby.jpg",
|
|
|
|
"title": "Slack API Documentation",
|
|
"title_link": "https://api.slack.com/",
|
|
|
|
"text": "` + tooLongText + `",
|
|
|
|
"fields": [
|
|
{
|
|
"title": "Priority",
|
|
"value": "High",
|
|
"short": false
|
|
}
|
|
],
|
|
|
|
"image_url": "http://my-website.com/path/to/image.jpg",
|
|
"thumb_url": "http://example.com/path/to/thumb.png"
|
|
}
|
|
]
|
|
}`
|
|
|
|
resp, err = http.Post(url, "application/json", strings.NewReader(attachmentPayload))
|
|
require.NoError(t, err)
|
|
assert.True(t, resp.StatusCode == http.StatusOK)
|
|
})
|
|
|
|
t.Run("ChannelLockedWebhook", func(t *testing.T) {
|
|
channel, err := th.App.CreateChannel(th.Context, &model.Channel{TeamId: th.BasicTeam.Id, Name: model.NewId(), DisplayName: model.NewId(), Type: model.ChannelTypeOpen, CreatorId: th.BasicUser.Id}, true)
|
|
require.Nil(t, err)
|
|
|
|
hook, err := th.App.CreateIncomingWebhookForChannel(th.BasicUser.Id, th.BasicChannel, &model.IncomingWebhook{ChannelId: th.BasicChannel.Id, ChannelLocked: true})
|
|
require.Nil(t, err)
|
|
require.NotNil(t, hook)
|
|
|
|
apiHookURL := apiClient.URL + "/hooks/" + hook.Id
|
|
|
|
payload := "payload={\"text\": \"test text\"}"
|
|
resp, err2 := http.Post(apiHookURL, "application/x-www-form-urlencoded", strings.NewReader(payload))
|
|
require.NoError(t, err2)
|
|
assert.True(t, resp.StatusCode == http.StatusOK)
|
|
|
|
resp, err2 = http.Post(apiHookURL, "application/json", strings.NewReader(fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", th.BasicChannel.Name)))
|
|
require.NoError(t, err2)
|
|
assert.True(t, resp.StatusCode == http.StatusOK)
|
|
|
|
resp, err2 = http.Post(apiHookURL, "application/json", strings.NewReader(fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", channel.Name)))
|
|
require.NoError(t, err2)
|
|
assert.True(t, resp.StatusCode == http.StatusForbidden)
|
|
})
|
|
|
|
t.Run("DisableWebhooks", func(t *testing.T) {
|
|
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableIncomingWebhooks = false })
|
|
resp, err := http.Post(url, "application/json", strings.NewReader("{\"text\":\"this is a test\"}"))
|
|
require.NoError(t, err)
|
|
assert.True(t, resp.StatusCode == http.StatusNotImplemented)
|
|
})
|
|
}
|
|
|
|
func TestCommandWebhooks(t *testing.T) {
|
|
th := Setup(t).InitBasic(t)
|
|
|
|
cmd, appErr := th.App.CreateCommand(&model.Command{
|
|
CreatorId: th.BasicUser.Id,
|
|
TeamId: th.BasicTeam.Id,
|
|
URL: "http://nowhere.com",
|
|
Method: model.CommandMethodPost,
|
|
Trigger: "delayed"})
|
|
require.Nil(t, appErr)
|
|
|
|
args := &model.CommandArgs{
|
|
TeamId: th.BasicTeam.Id,
|
|
UserId: th.BasicUser.Id,
|
|
ChannelId: th.BasicChannel.Id,
|
|
}
|
|
|
|
hook, appErr := th.App.CreateCommandWebhook(cmd.Id, args)
|
|
require.Nil(t, appErr)
|
|
|
|
resp, err := http.Post(apiClient.URL+"/hooks/commands/123123123123", "application/json", bytes.NewBufferString(`{"text":"this is a test"}`))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, http.StatusNotFound, resp.StatusCode, "expected not-found for non-existent hook")
|
|
|
|
resp, err = http.Post(apiClient.URL+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"invalid`))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, http.StatusBadRequest, resp.StatusCode)
|
|
|
|
for range 5 {
|
|
response, err2 := http.Post(apiClient.URL+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"this is a test"}`))
|
|
require.NoError(t, err2)
|
|
require.Equal(t, http.StatusOK, response.StatusCode)
|
|
}
|
|
|
|
resp, _ = http.Post(apiClient.URL+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"this is a test"}`))
|
|
require.Equal(t, http.StatusBadRequest, resp.StatusCode)
|
|
}
|