mirror of
https://github.com/hanzoai/team.git
synced 2026-10-30 14:49:35 +00:00
de4bcf9c66
* MM-69063 - Add team ABAC model and constants foundation * Add team ABAC store EXISTS, channel Type retrofit, policy count split, and index migration * Add team ABAC app layer: access gate, hydrators, assign/unassign, cleanup, and GetTeamMembersToRemove store * Enforce team membership ABAC on join and hide policy governed teams from non-qualifying users in the directory * Add team_ids to access policy assign/unassign, expose per-team policy GET, and support abac_match_only for not_in_team user listing * Add team ABAC client methods, websocket handler, per-team System Console policy UI, and hide policy-governed teams from non-qualifying users * Make team ABAC mode-aware: advisory on public teams, strict on private, and surface governed private teams to qualifying users in directory listings * Flag-gate team ABAC mutation/read APIs and fix policy-save error handling, member-removal limit, team-id validation, export, and audit cleanup * coderabbit feedback; Broadcast team policy enforcement updates on policy create/update and activation, not only on delete * Update team access control policy schema to allow nullable policies and enhance test cases with channel counts * Enhance access control policy tests to include team policy search alongside channel policy search * Add team membership access control feature flag to docker-compose generation * Implement team access control policy checks and refactor related components * Audit-log team ABAC policy removal on team archive and delete --------- Co-authored-by: Mattermost Build <[email protected]>
66 lines
2.4 KiB
TypeScript
66 lines
2.4 KiB
TypeScript
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
import type {Client4} from '@mattermost/client';
|
|
|
|
/**
|
|
* Enable team-membership ABAC end to end: the umbrella attribute-based access
|
|
* control setting plus the `TeamMembershipAccessControl` feature flag that gates
|
|
* the per-team System Console section. Both must be on for the team page to
|
|
* render the membership-policy toggle — mirroring the server enforcement gate.
|
|
*/
|
|
export async function enableTeamMembershipPolicies(client: Client4): Promise<void> {
|
|
await client.patchConfig({
|
|
AccessControlSettings: {
|
|
EnableAttributeBasedAccessControl: true,
|
|
EnableUserManagedAttributes: true,
|
|
},
|
|
FeatureFlags: {
|
|
TeamMembershipAccessControl: true,
|
|
},
|
|
} as any);
|
|
}
|
|
|
|
/**
|
|
* Create a parent membership policy that can be assigned to a TEAM.
|
|
*
|
|
* Team assignment runs `child.Inherit(parent)` with the child at v0.3, which
|
|
* requires the parent to also be v0.3 — so (unlike the channel-side
|
|
* createParentPolicy, which is v0.2) this helper stamps v0.3 and a membership
|
|
* action. Returns the created policy (carries `id` and `name`).
|
|
*/
|
|
export async function createTeamMembershipParentPolicy(
|
|
client: Client4,
|
|
name: string,
|
|
expression: string,
|
|
): Promise<{id: string; name: string}> {
|
|
return (client as any).doFetch(`${client.getBaseRoute()}/access_control_policies`, {
|
|
method: 'put',
|
|
body: JSON.stringify({
|
|
id: '',
|
|
name,
|
|
type: 'parent',
|
|
version: 'v0.3',
|
|
revision: 0,
|
|
rules: [{expression, actions: ['membership']}],
|
|
}),
|
|
});
|
|
}
|
|
|
|
/**
|
|
* Assign a parent policy to teams via the REST API (the `team_ids` field).
|
|
* Mirrors `assignChannelsToPolicy` from team_settings/helpers — same endpoint,
|
|
* different resource list.
|
|
*/
|
|
export async function assignTeamsToPolicy(client: Client4, policyId: string, teamIds: string[]): Promise<void> {
|
|
const url = `${client.getBaseRoute()}/access_control_policies/${policyId}/assign`;
|
|
const response = await fetch(url, {
|
|
method: 'POST',
|
|
headers: {'Content-Type': 'application/json', Authorization: `Bearer ${client.getToken()}`},
|
|
body: JSON.stringify({team_ids: teamIds}),
|
|
});
|
|
if (!response.ok) {
|
|
throw new Error(`assignTeamsToPolicy failed: ${response.status}`);
|
|
}
|
|
}
|