* Add Action Search render-decision API for ABAC file actions
* Add render-permission store, client method, and useRenderPermission hook
* Wire upload/download render decisions into UI with invalidation and e2e coverage
* Work around false-literal bug in ABAC file-access e2e specs
* add related schemas and fix format
* remove redundant comment in upload file enforcement test
* Fix stale post-list ETags and missing live updates after ABAC policy or attribute changes
* Enhance channel access control event handling by marking non-current channels stale for lazy reconciliation
* Refactor ETag handling and improve permission policy checks in channel and post APIs
* Remove unnecessary blank line in access control policy update function
* Align action search API with AuthZEN spec: add results list, discovery mode, reserve subject/page fields
* Nest ActionSearchResult to AuthZEN canonical shape and apply code review fixes
* Refactor action search request type formatting and update test loop for clarity
* Implement ABAC permission checks for channel access in searchAccessControlDecisionActions
* Scope ABAC render ETag to target channel, cache policy and CPA epochs in localcachelayer, and fail-closed on unknown resource types
* add stub for ETag cache invalidation in access control policy tests
* Jitter render reconcile on system-scoped permission policy updates to avoid a thundering herd
* Make the ABAC ETag epochs deletion-sensitive by folding a row count into each
* Address web app review: reuse RESET_POSTS_IN_CHANNEL, batch decision fetches, and simplify the upload affordance
* Split the render-decision reducer per key and scope invalidation stamps per resource
* MM-68283 - Use aria-disabled on the policy-restricted upload button so its tooltip still opens
* MM-68283 - Cover live post redaction without reload and use native Playwright assertions
* MM-68283 - Trim comments to the load-bearing reasons and drop dead test fixture fields
* MM-68283 - Refetch the channel in view after a policy change instead of relying on a remount
* MM-68283 - Apply a refetched post whose file metadata was redacted or restored
* MM-68283 - Require metadata on both sides before treating a post's redaction state as changed
* Keep the ABAC render caches and materialized attribute view in step with every attribute write
* Restructure the ABAC file-permission e2e specs and cover upload enforcement server-side
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
Co-authored-by: Harshil Sharma <harshilsharma63@gmail.com>
* MM-69063 - Add team ABAC model and constants foundation
* Add team ABAC store EXISTS, channel Type retrofit, policy count split, and index migration
* Add team ABAC app layer: access gate, hydrators, assign/unassign, cleanup, and GetTeamMembersToRemove store
* Enforce team membership ABAC on join and hide policy governed teams from non-qualifying users in the directory
* Add team_ids to access policy assign/unassign, expose per-team policy GET, and support abac_match_only for not_in_team user listing
* Add team ABAC client methods, websocket handler, per-team System Console policy UI, and hide policy-governed teams from non-qualifying users
* Make team ABAC mode-aware: advisory on public teams, strict on private, and surface governed private teams to qualifying users in directory listings
* Flag-gate team ABAC mutation/read APIs and fix policy-save error handling, member-removal limit, team-id validation, export, and audit cleanup
* coderabbit feedback; Broadcast team policy enforcement updates on policy create/update and activation, not only on delete
* Update team access control policy schema to allow nullable policies and enhance test cases with channel counts
* Enhance access control policy tests to include team policy search alongside channel policy search
* Add team membership access control feature flag to docker-compose generation
* Implement team access control policy checks and refactor related components
* Audit-log team ABAC policy removal on team archive and delete
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* MM-65618 - filter based on admin values
* add open api documentation
* adjust api description and adjust UX to match design
* reorganize function and add unit tests
* more UX adjustments; always show the self-exclusion warning modal
* use SubjectID parameter for more performant user lookup instead of fetching all matching users
* fix unit tests and remove wrong condition for job run
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
Pablo Vélez