mattermost/server/channels
Nick Misasi 5d3a04760b
[MM-67605] Add DCR redirect URI allowlist for OAuth DCR (#35291)
* [MM-67605] Add DCR redirect URI allowlist enforcement

Introduce ServiceSettings.DCRRedirectURIAllowlist with glob-based validation and enforce it during OAuth dynamic client registration to block unapproved redirect URIs. Add System Console wiring and tests for config validation, wildcard matching semantics, API error behavior, and localhost wildcard support.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix pre-commit checks: TypeScript type assertion, gofmt, and regenerate CI artifacts

- admin_definition_dcr_allowlist.test.tsx: Add AdminDefinitionSettingInput type assertion for 'multiple' property
- oauth_dcr_test.go: Fix comment spacing (gofmt)
- Regenerate mocks, go.sum, gen-serialized, mmctl-docs per CI requirements

Co-authored-by: Cursor <cursoragent@cursor.com>

* Revert unnecessary pre-commit regenerations

Revert mmctl docs, mocks, go.sum, and gen-serialized to master. Keep only
the TypeScript and gofmt fixes from the previous commit.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix import order in admin_definition_dcr_allowlist.test.tsx

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix i18n

* Update server/public/model/oauth_dcr.go

Co-authored-by: Eva Sarafianou <eva.sarafianou@gmail.com>

* Fix

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Eva Sarafianou <eva.sarafianou@gmail.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
2026-02-19 01:06:08 +00:00
..
api4 [MM-67605] Add DCR redirect URI allowlist for OAuth DCR (#35291) 2026-02-19 01:06:08 +00:00
app MM-66909 - Fix BoR sender not seeing priority label on new post (#34964) 2026-02-17 20:10:30 -05:00
audit [MM-64686] Expose audit logging functionality via plugin API (#31204) 2025-06-25 20:37:32 -04:00
db [MM-67231] Etag fixes for autotranslations (#35196) 2026-02-09 18:32:26 -05:00
doc/help Mono repo -> Master (#22553) 2023-03-22 17:22:27 -04:00
jobs Changes for BoR post soft-deletion (#35100) 2026-02-12 05:25:49 -05:00
manualtesting MM-28765: Fix errcheck issues in server/channels/manualtesting/manual_testing.go (#30613) 2025-04-09 11:41:56 +02:00
store MM-66909 - Fix BoR sender not seeing priority label on new post (#34964) 2026-02-17 20:10:30 -05:00
testlib [MM-66836] Integrate PropertyAccessService into API and app layers (#34818) 2026-02-06 18:06:51 -05:00
utils [MM-65588] Fix OAuth login with redirect_to URL (#34944) 2026-02-10 15:06:28 -05:00
web Mm 66813 sso callback metadata (#34955) 2026-02-16 11:07:02 -05:00
wsapi Add audits for accessing posts without membership (#31266) 2026-01-20 10:38:27 +01:00