* Add Entra ID token authentication and Intune MAM config exposure
* Add Intune MAM toggle to Mobile Security admin console
* Add IntuneSettings with the AuthService to use and its own TenantID andClientID for the Entra App registration
Include Admin console changes
switch from /oauth/entra to /oauth/intune endpoint
* openAPI documentation
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
Co-authored-by: yasser khan <attitude3cena.yf@gmail.com>
* Add EasyLogin configuration (#34217)
* add easy login config
* add easy login to the invite modal
* add to the query parameters
* Add an API to get login method for the login id (#34223)
* add an api to get login method for the login id
* do not return errors if user is not found
* Add support for Easy Login invitation link sending (#34224)
This generates Easy Login token types when requested. The server
doesn't do anything with these tokens, yet - that will come in a
future change.
* Add support for logging in with easy login (#34236)
* Fix E2E tests (#34240)
* Prevent easy login accounts to reset their password (#34262)
* Add easy login support to login api and limit token to 5 min (#34259)
* webapp easy login ui mods (#34237)
* webapp easy login ui mods
* easy login i18n
* lint issues
* getUserLoginType
* using the real API
* easylogin proper redirect
* remove unneeded functions and files
* duplicated localization
* remove easylogin
* using EnableEasyLogin setting
* localization fix
* fix lint issue
* remove excessive setIsWaiting
* changed logic to make it more readable
* renaming component to make easier editable
* password will disappear when username change
* login test
* text for easy login password
* Add app links to emails
* Update templates and always land in the landing screen
* Update svg image, improve checks on server, fix linking page and show deactivated on login type
* Update naming
* Fix mocks and imports
* Remove all sessions on disable and forbid user promotion
* Fix layer and tests
* Address feedback
* Fix tests
* Fix missing string
* Fix texts
* Fix tests
* Fix constant name
* Fix tests
* Fix test
* Address feedback
* Fix lint
* Fix test
* Address feedback
* Fix test
---------
Co-authored-by: Ibrahim Serdar Acikgoz <serdaracikgoz86@gmail.com>
Co-authored-by: David Krauser <david@krauser.org>
Co-authored-by: Daniel Espino <larkox@gmail.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
Fixed PatchChannelModerationsForChannel where AppError instances were created
without setting StatusCode, causing zero-value StatusCode in error handling.
Also added defensive hardening to handleContextError to detect and correct any
future occurrences by logging diagnostic information and defaulting to 500.
* Added another property field
* WIP
* WIP
* Added validations
* Added data validations and hidden post if confifgured to
* lint fixes
* Added API spec
* Added some tests
* Added tests for getContentReviewBot
* test: add comprehensive tests for getContentReviewChannels function
* Added more app layer tests
* Added TestCanFlagPost
* test: Add comprehensive tests for FlagPost function
* Added all app layer tests
* Removed a file that was reamoved downstream
* test: add content flagging test file
* test: add comprehensive tests for FlagContentRequest.IsValid method
* Added model tests
* test: add comprehensive tests for SqlPropertyValueStore.CreateMany
* test: add comprehensive tests for flagPost() API function
* Added API tests
* linter fix
* WIP
* sent post flagging confirmation message
* fixed i18n nissues
* fixed i18n nissues
* CI
* WIP
* WIP
* Added API call
* test: add test for Client4.flagPost API call in FlagPostModal
* fix: remove userEvent.setup() from flag post modal test
* test: wrap submit button click in act for proper state updates
* Updated tests
* lint fix
* Updated test
* fix: reset contentFlaggingGroupId for test isolation in content flagging tests
* removed cached group ID
* removed debug log
* CI
* Updated to allow special characters in comments
* Handled empty comment
* Created getContentFlaggingFields API
* created getPostPropertyValues API
* Used finally
* WIP
* Created useContentFlaggingFields hook
* WIP
* WIP
* Added option to retain data for reviewers
* Displayed deleted post's preview
* DIsplayed all properties
* Adding field name i18n
* WIP - managing i18n able texts
* Finished displaying all fields
* Manual cleanup
* lint fixes
* team role filter logic fix
* Fixed tests
* created new API to fetch flagged posts
* lint fix
* Added new client methods
* test: add comprehensive tests for content flagging APIs
* Added new API tests
* fixed openapi spec
* Fixed DataSpillageReport tests
* Fixed PostMarkdown test
* Fixed PostPreviewPropertyRenderer test
* Added metadata to card renderer
* test fixes
* Added no comment placeholder
* Added view detail button
* Created RemoveFlaggedMessageConfirmationModal modal
* Added key and remove flag request modal
* IMplemented delete flagged post
* Handled edge cases of deleting flagged post
* keep message
* UI integration
* Added WS event for post report update and handled deleted files of flagged post
* Added error handling in keep/remove forms
* i18n fixes
* Fixed test
* Updated OpenAPI specs
* fixed types
* fixed types
* refactoring
* refactor: improve test mocking for data spillage report component
* test mock updates
* Fixed tests
* Updated reducer
* not resetting mocks
* Added migrations for content flagging tables
* Created new structure
* review fixes
* Used correct ot name
* WIP
* review fixes
* review fixes
* Added new property translations
* CI
* CI
* CI
* Improved test
* fixed test
* CI
* New UI component
* WIP
* Updated settings APIs
* cached DB data
* used cached reviewer data
* Updated tests
* Lint fixes
* test: add tests for saveContentFlaggingSettings and getContentFlaggingSettings APIs
* test fix
* test: add tests for SaveContentFlaggingConfig and GetContentFlaggingConfigReviewerIDs
* Updated tests
* test: add content flagging test for local cache layer
* test: add comprehensive tests for content flagging store cache
* Updated tests
* lint fix
* Updated mobile text
* Added content flagging SQL store mocks
* Added API specs for new APIs
* fixed tests
* feat: add TestContentFlaggingStore function for content flagging store testing
* feat: add comprehensive tests for content flagging store
* Added SQL store tests
* test: add content flagging test for local cache layer
* test: add tests for content flagging store caching
* Added cache layer tests
* Updated tests
* Fixed
* Handled JSON error
* fixes
* fixes
* Fixed retry layer test
* fixerdf i18n
* Fixed test
* CI
* building index concurrently
* CI
* fixed a test
* CI
* cleanup
* Implemented reviewer search API
* feat: add tests for SearchCommonContentFlaggingReviewers and SearchTeamContentFlaggingReviewers
* Added store tests
* test: add comprehensive tests for SearchReviewers function
* feat: add comprehensive tests for searchReviewers endpoint
* API tests
* Integrate flag post api (#33798)
* WIP
* WIP
* Added API call
* test: add test for Client4.flagPost API call in FlagPostModal
* fix: remove userEvent.setup() from flag post modal test
* test: wrap submit button click in act for proper state updates
* Updated tests
* lint fix
* CI
* Updated to allow special characters in comments
* Handled empty comment
* Used finally
* CI
* Fixed test
* Spillage card integration (#33832)
* Created getContentFlaggingFields API
* created getPostPropertyValues API
* WIP
* Created useContentFlaggingFields hook
* WIP
* WIP
* Added option to retain data for reviewers
* Displayed deleted post's preview
* DIsplayed all properties
* Adding field name i18n
* WIP - managing i18n able texts
* Finished displaying all fields
* Manual cleanup
* lint fixes
* team role filter logic fix
* Fixed tests
* created new API to fetch flagged posts
* lint fix
* Added new client methods
* test: add comprehensive tests for content flagging APIs
* Added new API tests
* fixed openapi spec
* Fixed DataSpillageReport tests
* Fixed PostMarkdown test
* Fixed PostPreviewPropertyRenderer test
* Added metadata to card renderer
* test fixes
* Added no comment placeholder
* Fixed test
* refactor: improve test mocking for data spillage report component
* test mock updates
* Updated reducer
* not resetting mocks
* WIP
* review fixes
* CI
* Fixed
* fixes
* Content flagging actions implementation (#33852)
* Added view detail button
* Created RemoveFlaggedMessageConfirmationModal modal
* Added key and remove flag request modal
* IMplemented delete flagged post
* Handled edge cases of deleting flagged post
* keep message
* UI integration
* Added WS event for post report update and handled deleted files of flagged post
* Added error handling in keep/remove forms
* i18n fixes
* Updated OpenAPI specs
* fixed types
* fixed types
* refactoring
* Fixed tests
* review fixes
* Added new property translations
* Improved test
* fixed test
* CI
* fixes
* CI
* fixed a test
* fixed abad commit
* CI
* WIP
* IMplemented assign reviewer API
* Display reviewers
* Review fixes
* UI integration
* lint fix
* Added API docs
* test: add comprehensive tests for assignFlaggedPostReviewer function
* test: add comprehensive tests for AssignFlaggedPostReviewer
* Added tests
* Fixed test
* Sequential tests
* minor improvemenmts
* WIP
* Added keep/delete message notifications
* refactor: update AssignFlaggedPostReviewer method signature to include context
* test: add tests for getReviewerPostsForFlaggedPost and postReviewerMessage
* lint fixes
* handled reviewer updates
* Handled preference
* review fixes
* Review fixes
* Revert "MM-13657: Set ExperimentalStrictCSRFEnforcement to true by default (#33444)"
This reverts commit 257eec43ed.
* Fix call to checkCSRFToken
* Adapt test that relied on strict CSRF enforcement
This test was added after
https://github.com/mattermost/mattermost/pull/33444, so it assumed
strict CSRF enforcement to be enabled. When reverting that PR, we need
to adapt the test to account for both cases.
* Fix newer tests to use older setting
* MM-65084: (server-side) PKCE code-exchange for SSO
Server side changes needed for MM-65084. Guarded by MobileSSOCodeExchange feature flag.
* Update users.yaml for vet-api testing
* Change error for not saving SAML token to existing generic 'can't save token' message
* Restricting to sha256 only PKCEs
* Change out PKCE terminology to SAML
This came out as Claude used "PKCE" as a shorthand for the style and I did not know better. SAML is the correct term here.
This also fixes a linter issue where we were assigning `codeVerifier` to `computed` but then overwriting it in all cases (so that was misleading and unecessary)
* Adding ConsumeTokenOnce and IsExpired as suggested by security review
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* Standardize request.CTX parameter naming to rctx
- Migrate 886 request.CTX parameters across 147 files to use consistent 'rctx' naming
- Updated function signatures from 'c', 'ctx', and 'cancelContext' to 'rctx'
- Updated function bodies to reference the new parameter names
- Preserved underscore parameters unchanged as they are unused
- Fixed method receiver context issue in store.go
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Use request.CTX interface in batch worker
* Manual fixes
* Fix parameter naming
* Add linter check
---------
Co-authored-by: Claude <noreply@anthropic.com>
* MM-64486: Remove telemetry
Remove telemetry from Mattermost. We're no longer relying on Rudder upstream, and no longer making use of this information.
* recover mock for SystemStore.Get
* Fix TestClearPushNotificationSync by adding missing SystemStore mock
The test was failing because the SystemStore mock was missing the Get()
method that's required by the ServerId() function. Added the missing mock
to return a StringMap with SystemServerId.
* fix mocking issue
* Remove now-unused telemetry and constants
* Remove "Disable telemetry events" debug setting
* Remove empty functions
* Remove most "Telemetry tracking removed" comments
* Remove remains of DataPrefetch telemetry
* Remove now-unused prop from InviteMembersButton
* Remove trackDotMenuEvent
* Remove some more leftover comments
* Remove lingering logic related to trackingLocation
* Remove now-unused argument from useCopyText
* Remove lingering telemetry references from PreparingWorkspace
* fixup Remove trackDotMenuEvent
* Remove lingering telemetry references from signup page and password check
* Update snapshots and fix test broken by my changes
* Fix unintended behavior change in thread list filtering
Remove handleSetFilter wrapper that was accidentally modified during
telemetry removal. The function was calling clear() when switching to
unread filter, which was not the original behavior. Use setFilter
directly instead, restoring the original functionality.
* Remove unused useOpenDowngradeModal hook
The useOpenDowngradeModal hook was not being used anywhere in the codebase.
* Remove unused expandableLink from useExpandOverageUsersCheck
The expandableLink return value was not being used by any components.
* Re-add missing TeamLinkClicked performance telemetry
The mark(Mark.TeamLinkClicked) call was accidentally removed from the
handleSwitch function. This telemetry is needed for Looker-based
performance tracking.
* drop LogSettings.VerboseDiagnostics
---------
Co-authored-by: Harrison Healey <harrisonmhealey@gmail.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
* [MM-64896][MM-64898] Pass inviteid/tokenid to relay state/props for external auth when auto-joining a team
* Check for group constraint when inviting by id
https://mattermost.atlassian.net/browse/MM-13657
```release-note
We change ServiceSettings.ExperimentalStrictCSRFEnforcement to be
true by default for new installations. For existing installations,
the value will remain unchanged.
```
* Remove ''Experimental'' prefix from CSRF enforcement field
Change field name from ExperimentalStrictCSRFEnforcement to StrictCSRFEnforcement across all files
Co-authored-by: Agniva De Sarker <agnivade@users.noreply.github.com>
* lint fix
```release-note
NONE
```
* fix test
```release-note
NONE
```
* set StrictCSRFEnforcement to false on starting a test server
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Agniva De Sarker <agnivade@users.noreply.github.com>
Co-authored-by: Saturnino Abril <5334504+saturninoabril@users.noreply.github.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
This commit exposes audit logging functionality to plugins via the plugin API, allowing plugins to create and log audit records. Additionally, it addresses a gob encoding issue that could cause plugin crashes when audit data contains nil pointers or unregistered types.
On page load, we load ALL channels and channel members from all teams.
But then, on team_switch, we would again load channels and channel
members from that team. This was redundant and mainly kept
because previously the websocket events were considered unreliable.
Now with reliable websockets, and client-side pings, we can detect
broken connections faster and recover without loss.
Additionally, the getAllChannelMembers call would page through
all responses on the client side. This was inefficient and incur
extra latency. To optimize for this, we introduce server-side
streaming of the full response if page is set to -1.
This optimizes the intial response as well.
https://mattermost.atlassian.net/browse/MM-56906
```release-note
Optimize team switch operation by removing calls to get channels
and channel members.
```
Co-authored-by: Mattermost Build <build@mattermost.com>
* Adds the main Property System Architecture components
This change adds the necessary migrations for the Property Groups,
Fields and Values tables to be created, the store layer and a Property
Service that can be used from the app layer.
* Adds Custom Profile Attributes endpoints and app layer
* implement get and patch cpa values
* run i18n-extract
* Update property field type to use user instead of person
* Update PropertyFields to allow for unique nondeleted fields and remove redundant indexes
* Update PropertyValues to allow for unique nondeleted fields and remove redundant indexes
* Use StringMap instead of the map[string]any on property fields
* Add i18n strings
* Revert "Use StringMap instead of the map[string]any on property fields"
This reverts commit e2735ab0f8.
* Cast JSON binary data to string and add todo note for StringMap use
* Add mocks to the retrylayer tests
* Cast JSON binary data to string in property value store
* Check for binary parameter instead of casting to string for JSON data
* Fix bad merge
* Check property field type is one of the allowed ones
* Avoid reusing err variable to be explicit about the returned value
* Merge Property System Migrations into one file
* Adds NOT NULL to timestamps at the DB level
* Update stores to use tableSelectQuery instead of a slice var
* Update PropertyField model translations to be more explicit and avoid repetition
* Update PropertyValue model translations to be more explicit and avoid repetition
* Use ExecBuilder instead of ToSql&Exec
* Update property field errors to add context
* Ensure PerPage is greater than zero
* Update store errors to give more context
* Use ExecBuilder in the property stores where possible
* Add an on conflict suffix to the group register to avoid race conditions
* Remove user profile API documentation changes
* Update patchCPAValues endpoint and docs to return the updated information
* Merge two similar error conditions
* Use a route function for ListCPAValues
* Remove badly used translation string
* Remove unused get in register group method
* Adds input sanitization and validation to the CPA API endpoints
* Takes login outside of one test case to make it clear it affects multiple t.Runs
* Fix wrap error and return code when property field has been deleted
* Fix receiver name
* Adds comment to move the CPA group ID to the db cache
* Set the PerPage of CPA fields to the fields limit
* Update server/channels/app/custom_profile_attributes_test.go
Co-authored-by: Alejandro García Montoro <alejandro.garciamontoro@gmail.com>
* Standardize group ID access
* Avoid polluting the state between tests
* Use specific errors for the retrieval of CPA group
---------
Co-authored-by: Scott Bishel <scott.bishel@mattermost.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
Co-authored-by: Alejandro García Montoro <alejandro.garciamontoro@gmail.com>
* add webhook id to logs
* Move hook_id context to api level from app level.
* pass errCtx to other references of same app-error-id
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
Essentially applying the fix for https://github.com/mattermost/mattermost/pull/29214
to the web package. It seems like the app.StoreOverrideWithCache
function was never used in this package.
Just a small highlight of how much boilerplate is repeated
in multiple packages
```release-note
NONE
```
Co-authored-by: Mattermost Build <build@mattermost.com>
