Commit graph

16 commits

Author SHA1 Message Date
David Krauser
1cfe3d92b6
[MM-66836] Integrate PropertyAccessService into API and app layers (#34818)
Updates all Custom Profile Attribute endpoints and app layer methods to pass caller user IDs through to the PropertyAccessService. This connects the access control service introduced in #34812 to the REST API, Plugin API, and internal app operations.

Also updates the OpenAPI spec to document the new field attributes (protected, source_plugin_id, access_mode) and adds notes about protected field restrictions.
2026-02-06 18:06:51 -05:00
Ibrahim Serdar Acikgoz
197fa160b4
[MM-67126] harden checks (#35171) 2026-02-05 21:48:36 +01:00
Ibrahim Serdar Acikgoz
ced9a56e39
[MM-67126] Deprecate UpdateAccessControlPolicyActiveStatus API in favor of new one (#34940) 2026-01-27 15:49:08 +01:00
Daniel Espino García
b5a816a657
Add audits for accessing posts without membership (#31266)
Some checks are pending
API / build (push) Waiting to run
Server CI / Compute Go Version (push) Waiting to run
Server CI / Check mocks (push) Blocked by required conditions
Server CI / Check go mod tidy (push) Blocked by required conditions
Server CI / check-style (push) Blocked by required conditions
Server CI / Check serialization methods for hot structs (push) Blocked by required conditions
Server CI / Vet API (push) Blocked by required conditions
Server CI / Check migration files (push) Blocked by required conditions
Server CI / Generate email templates (push) Blocked by required conditions
Server CI / Check store layers (push) Blocked by required conditions
Server CI / Check mmctl docs (push) Blocked by required conditions
Server CI / Postgres with binary parameters (push) Blocked by required conditions
Server CI / Postgres (push) Blocked by required conditions
Server CI / Postgres (FIPS) (push) Blocked by required conditions
Server CI / Generate Test Coverage (push) Blocked by required conditions
Server CI / Run mmctl tests (push) Blocked by required conditions
Server CI / Run mmctl tests (FIPS) (push) Blocked by required conditions
Server CI / Build mattermost server app (push) Blocked by required conditions
Web App CI / check-lint (push) Waiting to run
Web App CI / check-i18n (push) Blocked by required conditions
Web App CI / check-types (push) Blocked by required conditions
Web App CI / test (platform) (push) Blocked by required conditions
Web App CI / test (mattermost-redux) (push) Blocked by required conditions
Web App CI / test (channels shard 1/4) (push) Blocked by required conditions
Web App CI / test (channels shard 2/4) (push) Blocked by required conditions
Web App CI / test (channels shard 3/4) (push) Blocked by required conditions
Web App CI / test (channels shard 4/4) (push) Blocked by required conditions
Web App CI / upload-coverage (push) Blocked by required conditions
Web App CI / build (push) Blocked by required conditions
* Add audits for accessing posts without membership

* Fix tests

* Use correct audit level

* Address feedback

* Add missing checks all over the app

* Fix lint

* Fix test

* Fix tests

* Fix enterprise test

* Add missing test and docs

* Fix merge

* Fix lint

* Add audit logs on the web socket hook for permalink posts

* Fix lint

* Fix merge conflicts

* Handle all events with "non_channel_member_access" parameter

* Fix lint and tests

* Fix merge

* Fix tests
2026-01-20 10:38:27 +01:00
Ibrahim Serdar Acikgoz
fc93ede640
[MM-65956] Tweak auto add to make it consistent with child policies (#33990)
Some checks are pending
API / build (push) Waiting to run
Server CI / Compute Go Version (push) Waiting to run
Server CI / Check mocks (push) Blocked by required conditions
Server CI / Check go mod tidy (push) Blocked by required conditions
Server CI / check-style (push) Blocked by required conditions
Server CI / Check serialization methods for hot structs (push) Blocked by required conditions
Server CI / Vet API (push) Blocked by required conditions
Server CI / Check migration files (push) Blocked by required conditions
Server CI / Generate email templates (push) Blocked by required conditions
Server CI / Check store layers (push) Blocked by required conditions
Server CI / Check mmctl docs (push) Blocked by required conditions
Server CI / Postgres with binary parameters (push) Blocked by required conditions
Server CI / Postgres (push) Blocked by required conditions
Server CI / Postgres (FIPS) (push) Blocked by required conditions
Server CI / Generate Test Coverage (push) Blocked by required conditions
Server CI / Run mmctl tests (push) Blocked by required conditions
Server CI / Run mmctl tests (FIPS) (push) Blocked by required conditions
Server CI / Build mattermost server app (push) Blocked by required conditions
Web App CI / check-lint (push) Waiting to run
Web App CI / check-i18n (push) Waiting to run
Web App CI / check-types (push) Waiting to run
Web App CI / test (push) Waiting to run
Web App CI / build (push) Waiting to run
2025-11-19 20:18:45 +00:00
Pablo Vélez
b311da87a4
Mm 65123 remove channel abac ff (#33953)
* MM-65123 - remove channel abac feature flag

* enable the channel scope access control to true

* fix linters

* adjust expected error in tests

* remove no longer needed comment

* Remove write_restrictable from core ABAC settings and fix channel access control logic

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2025-10-01 16:12:36 +02:00
Pablo Vélez
f2f83187b8
MM-65618 - filter based on admin values (#33857)
* MM-65618 - filter based on admin values

* add open api documentation

* adjust api description and adjust UX to match design

* reorganize function and add unit tests

* more UX adjustments; always show the self-exclusion warning modal

* use SubjectID parameter for more performant user lookup instead of fetching all matching users

* fix unit tests and remove wrong condition for job run

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2025-09-12 20:09:47 +02:00
Pablo Vélez
a062239402
MM-65182 - auto disable toggle on rules deleted and permissions update (#33810)
* MM-65182 - auto disable toggle on rules deleted and channel admin permissions update

* fix types and fix unit test

* adjust the useEffect hook and fix auto-save issue

* MM-65183 - rename access rules tab to access control (#33812)

* fix infinite loop issue and fix channel admin permissions issue

* fix linter and fix snapshots

* allow non-sysadmin users to see the system policy information banner

* stack modals backdrops

* address pr feedback; reorganize function and add unit tests

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2025-09-11 18:27:30 +02:00
Pablo Vélez
86c5c8a568
MM-64848 - extract actions to hook and implement table editor and test result modal (#33437)
* MM-6449 - manage channel access rules permissions backend part

* add the system console changes to show the new permission

* MM-64496 - update abac api permissions check

* fix unit tests

* enhance test coverage and fix broken unit tests

* fix linter issues

* add proper translations

* MM-64498 - create base code for channel settings modal

* Add feature flag to the channel admin abac rules

* fix unit tests

* remove unused translations

* add missing translation

* readd missing translations

* fix unit test after master merge

* fix linter issues

* migrate test to RTL

* MM-64848 - extract actions to hook and implement table editor and test result modal

* remove unnecessary comments and adjust catch logic

* adjust tests from enzyme to RTL

* expose abac config values to non system admin users

* add proper error on FF error

* fix unit tests

* add missing translation

* fix missing translation

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2025-08-26 11:30:41 +02:00
Pablo Vélez
bfa136e20e
Mm 64498 - create base code for channel settings modal (#32170)
* MM-6449 - manage channel access rules permissions backend part

* add the system console changes to show the new permission

* MM-64496 - update abac api permissions check

* fix unit tests

* enhance test coverage and fix broken unit tests

* fix linter issues

* add proper translations

* MM-64498 - create base code for channel settings modal

* Add feature flag to the channel admin abac rules

* fix unit tests

* remove unused translations

* add missing translation

* readd missing translations

* fix unit test after master merge

* fix linter issues

* migrate test to RTL

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2025-08-21 19:37:43 +02:00
Pablo Vélez
6946aac2b3
MM-64496 - update abac api permissions check (#32134)
* MM-6449 - manage channel access rules permissions backend part

* add the system console changes to show the new permission

* MM-64496 - update abac api permissions check

* fix unit tests

* enhance test coverage and fix broken unit tests

* fix linter issues

* add proper translations

* fix unit tests

* remove unused translations

* add missing translation

* readd missing translations

* fix unit test after master merge

* Implement PR feedback

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2025-08-21 00:10:10 +02:00
Ibrahim Serdar Acikgoz
8418572745
[MM-64795] Add multiple policy inheritance (#33583) 2025-08-12 13:15:00 +03:00
Vishal
dbc04cfebe
use consts for audit events (#33433) 2025-07-16 10:17:03 +05:30
David Krauser
aaa62a40ae
[MM-64686] Expose audit logging functionality via plugin API (#31204)
This commit exposes audit logging functionality to plugins via the plugin API, allowing plugins to create and log audit records. Additionally, it addresses a gob encoding issue that could cause plugin crashes when audit data contains nil pointers or unregistered types.
2025-06-25 20:37:32 -04:00
Ibrahim Serdar Acikgoz
6f26ad5cec
[ABAC - Table Editor] Improvements on table editor and review feedback (#31125)
* reflect review comments

* update table editor

* adjust test limits

* reflect review comments

* MM-64376

* resolve conflicts

* address review comments

* fix merge conflict error
2025-06-01 12:05:57 +02:00
Ibrahim Serdar Acikgoz
a344b3225b
[MM-61756] Attribute Based Access Control - Phase 1 (#30785)
Attribute Based Access Control - Base
* MM-63662

* MM-63919

* MM-63954

* MM-63955 

* MM-63425

* MM-63426

* MM-63458

* MM-63459

* MM-63603

* MM-63845

* MM-64146

* MM-64199

* MM-64201

* MM-64233

* MM-64247

* MM-64268

---------

Co-authored-by: Harshil Sharma <harshilsharma63@gmail.com>
Co-authored-by: Pablo Andrés Vélez Vidal <pablovv2012@gmail.com>
Co-authored-by: abhijit-singh <abhijitsingh0702@gmail.com>
Co-authored-by: Harrison Healey <harrisonmhealey@gmail.com>
2025-05-15 11:33:08 +02:00