* Add inline action buttons for bot-posted markdown
Bots, webhooks, and plugins can now embed clickable action buttons
inside markdown (including table cells) using mmaction://actionId
links, with row-specific parameters forwarded to the integration on
click. This enables use cases like a per-row "Mx Plan" button in a
fleet-status table that opens a dialog scoped to the clicked row.
Design
- New post prop inline_actions maps actionId (alphanumeric) to a
PostActionIntegration {URL, Context}, capped at 50 entries.
- Markdown link with scheme mmaction:// emits a placeholder span that
messageHtmlToComponent converts to the InlineActionButton component.
- Click POSTs inline_context (parsed from the URL query string) to the
existing /posts/{id}/actions/{action_id} endpoint; the server merges
it into the integration request as context.inline_params while
preserving the post-level context.
- Only bot, webhook, and plugin posts render the button; non-integration
posts have inline_actions stripped on create, update, and ephemeral
broadcast. Hardened-mode also covers the new prop.
- Reuses the existing PostAction dialog pipeline: plugin handlers reply
with a trigger_id and call /actions/dialogs/open as before.
Security
- InlineContext capped at 50 entries / 128-char keys / 2 KB values.
- Integration Context cloned per click so per-click inline_params and
selected_option cannot leak into the cached post for other clickers.
- Plugin response updates cannot add inline_actions to a post that did
not already have them; invalid entries are dropped with a warn log.
- Label content and data attributes are escaped; labels are flattened
to plain text (tags stripped, entities decoded, then escaped).
- Malformed JSON request bodies now return 400 instead of falling
through with an empty inline_context.
Tests
- Model: validators, normalization, GetInlineAction, strip, fallback.
- App: create strip, update guard (4 subtests including
AllowInlineActionsUpdate bypass), ephemeral strip, inline_params
merge, context-map isolation, plugin-response guards, from_bot and
from_plugin retention across plugin updates.
- API: inline_context validation (size bounds + error id),
omitempty backward compat, malformed JSON 400.
- Webapp: renderer scheme handling, allow/deny flags, size caps,
HTML escape, tag strip, entity decode, attribute-injection defense;
component click dispatch, double-click race guard, unmount safety,
error-result recovery, aria state.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* lint fix
* i18n-extract
* Review fixes for inline action buttons
- renderer: preserve actionId case; reject opaque mmaction: URI
- app: require bot AND integration session to preserve inline_actions
- app: restore original inline_actions when plugin response is invalid
- i18n: rename key to ...app_error to match convention
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Tighten UpdatePost inline_actions guard; fix test seeds
- app: UpdatePost now requires AllowInlineActionsUpdate to modify
inline_actions. Integration session alone is insufficient — a
PAT-wielding user could otherwise inject inline_actions on any
post they could edit.
- tests: seed bot posts with inline_actions via an integration
session (intSeedCtx) so they survive the create-time strip.
- renderer: lint fix (blank line before comment block).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Reject malformed inline-action authorities at render time
- renderer: enforce ^[A-Za-z0-9]+$ on actionId, mirroring the server
regex. Authorities like mmaction://plan:443 or mmaction://user@plan
now fall through to plain text instead of rendering a dead button.
- post: clarify in the strip comment that webhooks and plugins bypass
CreatePostAsUser entirely (they call CreatePost / CreatePostMissingChannel
directly), so the strip block does not apply to them.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Tighten inline-action renderer tests
- Replace oversized-params test with boundary pair (at-cap and over-cap)
to lock in the > vs >= behavior of the size-limit check.
- Add a "surrounding text survives" assertion for the tag-strip path so
a future swap from regex strip to a DOM sanitizer won't silently
drop legitimate content along with tags.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Inline action buttons via mmaction:// markdown links
Adds inline action buttons rendered from mmaction:// links in markdown,
with the click pipeline reusing the existing post-action infrastructure.
Aligned with the broader mm_blocks_actions framework (Daniel's PR).
* fix lint, DoS hardening, fix and rename test
* Address review feedback
* lint fix
* Reject percent-encoded path traversal in validateIntegrationURL (e.g. %2e%2e%2f) by parsing the URL and checking the decoded path.
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
|
||
|---|---|---|
| .. | ||
| client | ||
| components | ||
| eslint-plugin | ||
| mattermost-redux | ||
| shared | ||
| types | ||
| CLAUDE.OPTIONAL.md | ||
| README.md | ||
This folder contains a number of packages intended to be built and shipped separately on NPM as well as a few legacy packages for internal use only (reselect and mattermost-redux). The following documentation only applies to the newer packages and not to the legacy ones.
Importing a subpackage
Subpackages should be imported using their full name, both inside the web app and when installing them using npm. They should not be imported using a relative path, and the src folder shouldn't be necessary to include.
// Correct
import {Client4} from '@mattermost/client';
import {UserProfile} from '@mattermost/types/users';
// Incorrect
import Client4 from 'packages/client/src/client4.ts';
import {UserProfile} from '../../types/src/users';
Some tools have difficulty doing this on their own, but they often support import path aliases so that we can keep them consistent acrosss the code base. More details on how to do this will be provided in packages where this is necessary such as types.
Importing one subpackage into another
When building packages that depend on each other, be careful to:
- Avoid import loops. While JavaScript lets us get away with these in most cases within a project, we cannot have two packages that depend directly with each other.
- Not compile one subpackage into another. We don't want the published libraries to include code from one subpackage into another. They should be set up so that they're peer dependencies in the
package.json, and if a project wants to use multiple packages, they can install them each separately.
As above, some tooling may need additional configuration to have one subpackage use code from another. For example, in packages compiled with the TypeScript compiler (tsc), you'll need to have the tsconfig.json from the dependent pacakge reference its dependency using the references field.
Versioning subpackages
At this time, we'll have the version of each package match the version of the web app. Versions can be incremented for each affected package by using npm version, and then npm install should be run to propagate those changes into the shared package-lock.json.
# Set a version of a single package
npm version 6.7.8 --workspace=packages/apple
# Increment the version of each package to the next minor version
npm version minor --workspaces
## Increment the version of a package to a pre-release version of the next minor version
npm version preminor --workspace=packages/apple
When a subpackage imports another, it should be set to depend on the * version of the other subpackage.
Adding a new subpackage
To set up a new package:
- Add a
package.jsonandREADME.mdfor that package. - Ensure all source files are located in
srcand all compiled files are built tolib. - Add an entry to the
workspacessection of the rootpackage.jsonso that NPM is aware of your package. - Set up import aliases so that the package is visible from the web app to the following tools:
-
TypeScript - In the root
tsconfig.json, add an entry to thecompilerOptions.pathssection pointing to thesrcfolder and an entry to thereferencessection pointing to the root of your package which should contain its owntsconfig.json.Note that the
compilerOptions.pathsentry will differ based on if your package exports just a single module (ie a singleindex.jsfile) or if it exports multiple submodules.{ "compilerOptions": { "paths": { "@mattermost/apple": ["packages/apple/lib"], // import * as Apple from '@mattermost/apple'; "@mattermost/banana/*": ["packages/banana/lib/*"], // import Yellow from '@mattermost/banana/yellow'; } }, "references": [ {"path": "./packages/apple"}, {"path": "./packages/banana"}, ] } -
Jest - Add an entry to the
jest.moduleNameMappersection of the rootjest.config.jsfor your package. Since that setting supports regexes, you can add these to the existing patterns used by theclientandtypespackages.Similar to TypeScript, this will differ based on if the package exports a single module or multiple modules.
{ "jest": { "moduleNameMapper": { "^@mattermost/(apple|client)$": "<rootDir>/packages/$1/src", "^@mattermost/(banana|types)/(.*)$": "<rootDir>/packages/$1/src/$2", } } }
-
- Add the compiled code to the CircleCI dependency cache. This is done by modifying the
pathsused by thesave_cachestep in.circleci/config.ymlaliases: - &save_cache save_cache: paths: - ~/mattermost/mattermost-webapp/packages/apple/lib - ~/mattermost/mattermost-webapp/packages/banana/lib
Publishing a subpackage
The following is the rough process for releasing these packages. They'll require someone with write access on our NPM organization to run them, and they'll likely change over time as we improve this process.
For full releases accompanying new versions of Mattermost:
-
Clean the repo.
make clean -
Update the version of the desired packages to match the server/web app as described above.
-
Download an up to date copy of the dependencies and update package-lock.json.
make node_modules -
Check in the changes to the package-lock.json.
-
Build the desired packages.
npm run build --workspace=packages/apple --workspace=packages/banana -
Test everything in the web app. This will be needed until the packages get their own standalone tests.
make check-style check-types test -
Assuming those pass, you can now publish those packages to npm. You can also do a dry run first or use
npm packto see exactly which files will be pushed.# Run a dry run which will list all the files to be included in the published package. npm publish --dry-run --workspace=packages/apple # Generate the tar file that will be uploaded to NPM for inspection. npm pack --workspace=packages/apple # Actually publish these packages. You can also use --workspaces to publish everything. npm publish --access=public --workspace=packages/apple --workspace=packages/bananaThe packages have now been published! There's still a few remaining cleanup tasks to do though.
-
Tag the commit for each package that has been updated. The tag name should be of the form
@mattermost/package-name@x.y.z. -
Push that commit and the corresponding tags up to GitHub
git push release-x.y git push origin @mattermost/apple@x.y.z @mattermost/banana@x.y.z
Publishing a pre-release version
Similarly, you can publish a pre-release version of the package. This can be done either to use changes from master while developing another product/plugin or to generate a release candidate.
This process is the same as above, except the version will have a suffix like -1, -2, etc. As explained above, this can be automatically done by using npm version preminor for minor releases, npm version premajor for major releases, and npm version prerelease for patch releases. These versions won't be automatically installed when people add them using npm add without a version, but they can be installed by specifying the version number manually.
Caveats
-
Currently, all packages are treated by CI as if they're part of the web app. This means that, for example, their style checking and tests are ran as part of the web app. In turn, that means that regardless of what tooling we use to build each package, they'll be compiled into the web app using webpack directly from source, and that it's possible for them to behave slightly differently in development compared to after release.
Eventually, we hope to get these building in parallel (so instead of having webpack watch the whole repo for changes during development, we'll have multiple watchers for the web app and each package) which should solve this issue, but that requires much larger changes that we're not ready to do yet.
-
For packages that export multiple submodules (such as
types), we've chosen to expose these using Node's subpath exports feature. Some tools like Webpack support this natively, but others like TypeScript and Jest don't support it yet. We've provided steps on how to support this in theREADME.mdfor thetypespackage, but this may vary depending on the project's setup.