MM-69269 - Spaces permissions and RBAC: read gates, capabilities, auto-join

.github/workflows/ci.yml

@@ -91,6 +91,112 @@ jobs:
       - name: ci/build
         uses: mattermost/actions/plugin-ci/build@0256d363493a1e6b9e361ea788c62a0a73bc00be
 
+  # End-to-end suite: boots a real Mattermost via Testcontainers, installs this plugin, and drives
+  # the space-permission scenarios through the real API with nothing mocked.
+  #
+  # It needs a server image carrying the paired core branch's space-permission changes. Core CI
+  # publishes one per commit as mattermostdevelopment/mattermost-team-edition:<7-char-sha>, so set
+  # the CORE_IMAGE repository variable to that tag (or to a release tag once those changes ship).
+  # While CORE_IMAGE is unset this job does not run: no available image could satisfy it, and a
+  # silent pass would be worse than an absent one.
+  #
+  # DO NOT add this job to the repository's required status checks until CORE_IMAGE is set and the
+  # suite is observed passing. A job skipped by a top-level `if:` reports as "skipped", and branch
+  # protection counts a skipped required check as satisfied — so listing it early would admit every
+  # PR as though the suite had run, which is the outcome the condition above exists to avoid.
+  # For the same reason it is not in delivery/release `needs:` yet: a skipped dependency skips the
+  # dependent job. Add it to both once CORE_IMAGE is populated, so a permission regression blocks
+  # publishing.
+  e2e:
+    if: ${{ vars.CORE_IMAGE != '' && (github.repository_owner == 'mattermost' || github.event_name != 'schedule') }}
+    runs-on: ubuntu-latest
+    needs: build
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    env:
+      CORE_IMAGE: ${{ vars.CORE_IMAGE }}
+      # Lifted to env because the secrets context is not available in a step-level `if`, and the
+      # login below has to be skippable: the repository defines no Docker Hub credentials today.
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      # The pin is checked, not just documented: a floating tag (:master, :latest) would silently
+      # re-point this suite at whatever core published most recently, so an unrelated upstream
+      # change would surface here as a test failure with no corresponding commit in this repo.
+      - name: ci/verify-core-image-pin
+        run: |
+          if [[ ! "$CORE_IMAGE" =~ :([0-9a-f]{7,40}|v[0-9]+\.[0-9]+\.[0-9]+)$ ]]; then
+            echo "CORE_IMAGE must be pinned to a commit sha or a release tag; got '$CORE_IMAGE'." >&2
+            echo "Core CI publishes one image per commit as <repo>:<7-char-sha>." >&2
+            exit 1
+          fi
+          image_tag="${CORE_IMAGE##*:}"
+
+          # The shape check above cannot catch the drift that matters. go.mod pins server/public to a
+          # core commit; CORE_IMAGE is a separate repository variable a human sets. Nothing ties them
+          # together, so bumping the pin without updating the variable leaves this suite green against
+          # a core image that predates the very changes under test.
+          gomod_commit="$(grep -oE 'server/public v[0-9]+\.[0-9]+\.[0-9]+-[0-9]+\.[0-9]+-[0-9a-f]+' go.mod | grep -oE '[0-9a-f]{12}$' || true)"
+          if [[ -z "$gomod_commit" ]]; then
+            echo "server/public is pinned to a released version, not a core commit; skipping the sha cross-check."
+            exit 0
+          fi
+          if [[ ! "$image_tag" =~ ^[0-9a-f]{7,40}$ ]]; then
+            echo "go.mod pins server/public to unreleased core commit ${gomod_commit}, but CORE_IMAGE is release tag '${image_tag}'." >&2
+            echo "A released image cannot carry that commit's changes. Point CORE_IMAGE at the core build for ${gomod_commit}." >&2
+            exit 1
+          fi
+          # Core CI tags images with a 7-char sha while go.mod carries 12, so compare on the shorter.
+          prefix_len=${#image_tag}
+          if (( ${#gomod_commit} < prefix_len )); then
+            prefix_len=${#gomod_commit}
+          fi
+          if [[ "${image_tag:0:$prefix_len}" != "${gomod_commit:0:$prefix_len}" ]]; then
+            echo "CORE_IMAGE sha '${image_tag}' does not match the core commit go.mod pins (${gomod_commit})." >&2
+            echo "Set CORE_IMAGE to the image core CI published for ${gomod_commit}, or repin go.mod." >&2
+            exit 1
+          fi
+          echo "CORE_IMAGE ${image_tag} matches the go.mod core pin ${gomod_commit}."
+
+      - name: ci/setup
+        uses: mattermost/actions/plugin-ci/setup@0256d363493a1e6b9e361ea788c62a0a73bc00be
+        with:
+          go-version-file: go.mod
+
+      # Reuses the bundle the build job already produced rather than rebuilding it here; the
+      # suite globs dist/ for it.
+      - name: ci/download-artifact
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: dist
+          path: dist
+
+      # Authenticated so the core image pull is billed to the org's Docker Hub quota rather than the
+      # shared anonymous per-IP limit, which GitHub-hosted runners exhaust as a pull failure that
+      # reads like a test failure. Skipped when no credentials are configured: the pull still works
+      # anonymously, just against the lower limit, so a missing secret must not fail the suite.
+      - name: ci/docker-login
+        if: env.DOCKERHUB_USERNAME != ''
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: ci/e2e
+        run: go test -tags e2e -count=1 -v ./server/e2e/...
+
+      # The suite boots the server in a container, so a boot or migration failure leaves its
+      # diagnosis in the container's log rather than in the test output.
+      - name: ci/e2e-logs
+        if: failure()
+        run: docker ps -aq | xargs -r -I{} sh -c 'echo "===== {} ====="; docker logs {} 2>&1 | tail -400'
+
   delivery:
     if: ${{ github.repository_owner == 'mattermost' && github.event_name != 'schedule' && github.ref_name == 'master' }}
     runs-on: ubuntu-latest

Makefile

@@ -362,6 +362,38 @@ ifneq ($(HAS_WEBAPP),)
 	cd webapp && $(NPM) run test;
 endif
 
+## Runs the official RBAC end-to-end suite (Go + Testcontainers): boots a real Mattermost server
+## built from the paired core branch (build/build-core-image.sh), installs the plugin bundle
+## into it, and drives the seven Confluence permission scenarios plus their named parity gaps
+## through the real HTTP API. Requires Docker. See server/e2e/README.md.
+##
+## A namespaced CORE_IMAGE (one containing a `/`) names a pullable image, so the local build is
+## skipped and Testcontainers fetches it — the path the CI e2e job takes.
+##
+## The bundle must contain a linux-$(arch) plugin binary for the Docker container to load it —
+## `make server` alone only builds for the host OS/arch when MM_SERVICESETTINGS_ENABLEDEVELOPER is
+## set (a common local dev convenience), which produces a bundle unusable inside the container. So
+## this checks the newest bundle for the linux binary matching the Docker daemon's architecture,
+## not just that a bundle file exists, and forces a full cross-compiled `make dist` otherwise.
+.PHONY: test-e2e
+test-e2e:
+	@docker_arch=$$(docker info --format '{{.Architecture}}' 2>/dev/null); \
+	case "$$docker_arch" in \
+		aarch64) goarch=arm64 ;; \
+		x86_64) goarch=amd64 ;; \
+		*) echo "ERROR: could not determine Docker daemon architecture (got '$$docker_arch'). Is Docker running?" >&2; exit 1 ;; \
+	esac; \
+	bundle=$$(ls -t dist/$(PLUGIN_ID)-*.tar.gz 2>/dev/null | head -1); \
+	if [ -z "$$bundle" ] || ! tar tzf "$$bundle" | grep -q "plugin-linux-$$goarch$$"; then \
+		echo "No plugin bundle with a linux-$$goarch binary found — running 'make dist' (forcing an all-architecture build)..."; \
+		MM_SERVICESETTINGS_ENABLEDEVELOPER= $(MAKE) dist; \
+	fi
+	@case "$${CORE_IMAGE:-}" in \
+		*/*) echo "CORE_IMAGE=$$CORE_IMAGE is namespaced — leaving it to Testcontainers to pull; skipping the local core-image build." ;; \
+		*) ./build/build-core-image.sh ;; \
+	esac
+	$(GO) test -tags e2e -count=1 -v ./server/e2e/...
+
 ## Creates a coverage report for the server code.
 .PHONY: coverage
 coverage: apply webapp/node_modules

assets/i18n/en.json

@@ -23,6 +23,10 @@
     "id": "api.request_too_large.app_error",
     "translation": "The request body exceeds the maximum allowed size of {{.MaxBytes}} bytes."
   },
+  {
+    "id": "api.space.add_member.capabilities_not_allowed.app_error",
+    "translation": "Capabilities cannot be set when adding a member. Add the member first, then set their capabilities."
+  },
   {
     "id": "app.optimistic_lock.baseline_required.app_error",
     "translation": "The {{.Field}} field is required unless force is set."
@@ -147,6 +151,10 @@
     "id": "app.page.move_to_space.invalid_user_id.app_error",
     "translation": "Invalid user ID."
   },
+  {
+    "id": "app.page.move_to_space.subtree_not_owned.app_error",
+    "translation": "You can only move pages you created. This page, or one of its sub-pages, was created by someone else."
+  },
   {
     "id": "app.page.not_found.app_error",
     "translation": "The page could not be found."
@@ -395,6 +403,10 @@
     "id": "app.space.add_member.failed.app_error",
     "translation": "Unable to add the member to the space."
   },
+  {
+    "id": "app.space.auto_join.get_space_failed.app_error",
+    "translation": "Failed to look up the space."
+  },
   {
     "id": "app.space.client_not_wired.app_error",
     "translation": "Unable to complete the request due to a server configuration error."
@@ -403,6 +415,10 @@
     "id": "app.space.create.add_member_failed.app_error",
     "translation": "Unable to add the creator to the backing channel for the space."
   },
+  {
+    "id": "app.space.create.admin_role_failed.app_error",
+    "translation": "Failed to assign the space admin role to the creator."
+  },
   {
     "id": "app.space.create.backing_channel_failed.app_error",
     "translation": "Unable to create the backing channel for the space."
@@ -411,6 +427,10 @@
     "id": "app.space.create.channel_id_not_allowed.app_error",
     "translation": "A channel ID must not be supplied when creating a space."
   },
+  {
+    "id": "app.space.create.forbidden.app_error",
+    "translation": "You do not have permission to create a space in this team."
+  },
   {
     "id": "app.space.create.invalid_team_id.app_error",
     "translation": "Invalid team ID."
@@ -419,6 +439,10 @@
     "id": "app.space.create.invalid_user_id.app_error",
     "translation": "Invalid user ID."
   },
+  {
+    "id": "app.space.create.invalid_view_access.app_error",
+    "translation": "Invalid view access. Must be either \"open\" or \"private\"."
+  },
   {
     "id": "app.space.create.nil_input.app_error",
     "translation": "A space must be supplied."
@@ -427,10 +451,34 @@
     "id": "app.space.create.not_team_member.app_error",
     "translation": "You must be a member of the team to create a space in it."
   },
+  {
+    "id": "app.space.create.scheme_configure_failed.app_error",
+    "translation": "Failed to configure the space's permission scheme."
+  },
+  {
+    "id": "app.space.create.scheme_lookup_failed.app_error",
+    "translation": "Failed to look up the space's permission scheme."
+  },
   {
     "id": "app.space.create.team_lookup_failed.app_error",
     "translation": "Unable to verify team membership."
   },
+  {
+    "id": "app.space.default_capabilities.channel_scheme_missing.app_error",
+    "translation": "The space has no permission scheme."
+  },
+  {
+    "id": "app.space.default_capabilities.repoint_failed.app_error",
+    "translation": "Failed to apply the new default capabilities."
+  },
+  {
+    "id": "app.space.default_capabilities.scheme_configure_failed.app_error",
+    "translation": "Failed to configure the space's new permission scheme."
+  },
+  {
+    "id": "app.space.default_capabilities.scheme_configure_rollback_failed.app_error",
+    "translation": "Failed to configure the space's new permission scheme, and the space could not be returned to its previous one. Contact your system administrator."
+  },
   {
     "id": "app.space.delete.invalid_id.app_error",
     "translation": "Invalid space ID."
@@ -439,6 +487,10 @@
     "id": "app.space.get.invalid_id.app_error",
     "translation": "Invalid space ID."
   },
+  {
+    "id": "app.space.get_for_team.forbidden.app_error",
+    "translation": "You do not have permission to view spaces in this team."
+  },
   {
     "id": "app.space.get_for_team.invalid_team_id.app_error",
     "translation": "Invalid team ID."
@@ -455,18 +507,34 @@
     "id": "app.space.get_for_team.team_lookup_failed.app_error",
     "translation": "Unable to verify team membership."
   },
+  {
+    "id": "app.space.get_members.failed.app_error",
+    "translation": "Unable to list the members of the space."
+  },
   {
     "id": "app.space.get_pages.invalid_space_id.app_error",
     "translation": "Invalid space ID."
   },
   {
-    "id": "app.space.list_members.failed.app_error",
-    "translation": "Unable to list the members of the space."
+    "id": "app.space.lock_timeout.app_error",
+    "translation": "Another change to this space is in progress. Try again."
+  },
+  {
+    "id": "app.space.member.admin_count_failed.app_error",
+    "translation": "Failed to count the space's administrators."
+  },
+  {
+    "id": "app.space.member.guest_not_assignable.app_error",
+    "translation": "Capabilities cannot be assigned to a guest."
   },
   {
     "id": "app.space.member.invalid_user_id.app_error",
     "translation": "The supplied user ID is not valid."
   },
+  {
+    "id": "app.space.member.last_admin.app_error",
+    "translation": "The last administrator of a space cannot be removed or demoted."
+  },
   {
     "id": "app.space.member.not_team_member.app_error",
     "translation": "The specified user is not a member of the space's team."
@@ -475,10 +543,18 @@
     "id": "app.space.member.team_lookup_failed.app_error",
     "translation": "Unable to verify the user's team membership."
   },
+  {
+    "id": "app.space.member.update_capabilities_failed.app_error",
+    "translation": "Failed to update the member's capabilities."
+  },
   {
     "id": "app.space.member.user_not_found.app_error",
     "translation": "The specified user could not be found."
   },
+  {
+    "id": "app.space.preset_scheme_missing.app_error",
+    "translation": "The built-in space permission schemes are not available on this server."
+  },
   {
     "id": "app.space.remove_member.failed.app_error",
     "translation": "Unable to remove the member from the space."
@@ -507,6 +583,14 @@
     "id": "app.space.update.invalid_id.app_error",
     "translation": "Invalid space ID."
   },
+  {
+    "id": "app.space.update.invalid_view_access.app_error",
+    "translation": "Invalid view access. Must be either \"open\" or \"private\"."
+  },
+  {
+    "id": "app.space.update.view_access_force.app_error",
+    "translation": "View access cannot be changed with force set."
+  },
   {
     "id": "app.store.conflict.app_error",
     "translation": "The operation conflicts with the current state. Reload and try again."
@@ -715,8 +799,24 @@
     "id": "model.space.is_valid.update_at.app_error",
     "translation": "Invalid space update time."
   },
+  {
+    "id": "model.space.is_valid.view_access.app_error",
+    "translation": "Invalid view access. Must be either \"open\" or \"private\"."
+  },
   {
     "id": "model.space.patch.nothing_to_update.app_error",
     "translation": "The update contains no changes."
+  },
+  {
+    "id": "model.space_capabilities.admin_not_a_default.app_error",
+    "translation": "The admin_space capability cannot be a space default."
+  },
+  {
+    "id": "model.space_capabilities.read_page_not_grantable.app_error",
+    "translation": "The read_page capability cannot be granted; every space member holds it."
+  },
+  {
+    "id": "model.space_capabilities.unknown_capability.app_error",
+    "translation": "Unknown capability: {{.Capability}}."
   }
 ]