* Change test password to mostest_password
This makes the password compliant with the 112 bits minimum length
requirement. Otherwise, FIPS-compliant OpenSSL implementations will
panic when trying to connect from `lib/pq` with a shorter password.
* Simplify test templates' POSTGRES_PASSWORD values
* make generated
* Modify missing "mostest" strings
* introduce mlogFieldNaming
* apply vet-fix changes
* Cover every keyed mlog constructor in the analyzer fixture
* clarify end result in comment
* Check mlog field keys on explicitly instantiated constructors
* MM-69792: Recover shared channel sync after a brief remote outage
When a remote went offline for less than the 5-minute IsOnline()
threshold, sync recovery never ran. IsOnline() never flipped, so no
connection-state-change event fired and ForceSyncForRemote was never
triggered. Posts created during the outage stayed unsynced until the
next organic change in the channel.
The root cause was that send failures are reported asynchronously
through a callback that sendSyncMsgToRemote discarded. On a failed
send syncForRemote still returned nil, so processTask saw success:
the retry loop and the failure-notification hook were effectively
dead code for delivery failures.
Changes:
- sendSyncMsgToRemote now propagates the delivery error reported via
the callback instead of swallowing it. A failed send is retried
rather than silently dropped. This applies to every sync type
(posts, users, memberships, reactions, statuses); the success path
is unchanged.
- remotecluster tracks a per-remote "sync failed since last ping"
flag (NotifySyncFailed). On the next successful ping, PingNow fires
a connection-state-change event even when IsOnline() never flipped,
driving a single ForceSyncForRemote on recovery.
- Sync retries are now spaced by SyncRetryDelay (15s) instead of
retrying immediately, giving a short outage time to recover and
guaranteeing a failed ping before retries exhaust.
Also adds a post/offline-recovery case to the sharedchannel-test
integration tool (stop and restart Server B mid-run) and disables
metrics on the two test servers so they do not collide on the
metrics port when the loaded config has metrics enabled.
* fix linter error
* Fix Rabbit nit
* fix CI
* Delete pr37499-fix-findings-1-and-4.md
* address review comments
* MM-69792: Keep a per-remote retry task when a shared channel sync fans out
A sync task with no specific remote (remoteID == "") fans out to every
remote sharing the channel. On failure each remote's retry was a copy of
the original task that still carried the original, remote-less task id.
Because addTask merges on task id, all of those per-remote retries
collapsed into a single entry, so only one failed remote was ever
retried and the rest were silently dropped. Delivery failures were
partly masked by the ping-driven ForceSyncForRemote recovery, but
non-delivery errors for the other remotes had no path back.
Give each per-remote retry a remote-specific id (task.id + remoteId) when
the originating task had no remote, so every failed remote keeps its own
retry task. Single-remote tasks already have a remote-specific id and are
left untouched, since recomputing would grow the id on each retry.
Also harden the tests: assert the retry is scheduled the full
SyncRetryDelay out (no tolerance), assert the result callback is not
invoked on delivery failures or unconfirmed responses (so the cursor
stays un-advanced), and add a regression test covering fan-out to
multiple failing remotes.
* fix one more pre-existing edge case.
* fix linter
* [MM-64634] Improve license error for wrong service environment
When a cryptographically valid license is uploaded to a server running a
different service environment (e.g. a production license on a test/dev
server, or vice versa), ValidateLicense now retries verification against
the alternate environment's public key. On success it returns a distinct
error that callers surface as the new WrongEnvironmentLicenseError, giving
admins an actionable message instead of the generic "Invalid license file."
Genuinely corrupt licenses still return the existing InvalidLicenseError.
Co-authored-by: mattermost-code <matty-code@mattermost.com>
* [MM-64634] Add tests for wrong-environment license error mapping
Cover SaveLicense (the System Console upload entry point) returning
WrongEnvironmentLicenseError for a license signed for another service
environment, and add a direct unit test for NewLicenseValidationAppError.
Co-authored-by: mattermost-code <matty-code@mattermost.com>
* Add audit logging for wrong-environment license upload failures
Handle WrongEnvironmentLicenseError in addLicense and localAddLicense
so environment mismatches are logged distinctly instead of falling
through to the generic unable-to-save message.
Co-authored-by: mattermost-code <matty-code@mattermost.com>
* Log wrong-environment audit in LicenseFromBytes error path
addLicense validates the license before SaveLicense, so
WrongEnvironmentLicenseError is returned from LicenseFromBytes and
never reaches the SaveLicense audit handler.
Co-authored-by: mattermost-code <matty-code@mattermost.com>
* Address PR feedback: remove license validation audit logging from addLicense
Per review feedback, the per-error-id audit logging added to the
LicenseFromBytes failure path in addLicense doesn't belong in the audit
logs. Remove it to clean up the diff; the AppError is still returned to
the caller unchanged.
Resolves: 1 change request
* Remove wrong-environment license audit logging
Per review feedback, the wrong-environment license classification does not
belong in the audit logs. Revert the audit logging additions in both the
cloud and local license upload handlers.
* Split wrong-environment license error by direction
Per review feedback, distinguish between a production license uploaded to a
test/dev server and a test/dev license uploaded to a production server. Each
case now maps to its own AppError ID and user-facing message instead of a
single generic wrong-environment error.
* Restrict wrong-environment license fallback to signature failures
Only treat alternate-key verification success as a wrong-environment
mismatch when the primary key failed with rsa.ErrVerification. Other
primary-key failures (e.g. malformed key material) are now surfaced
unchanged instead of being masked as a wrong-environment license, and
non-verification errors from the alternate-key check are no longer
discarded.
* Regenerate store layers and mocks for SessionStore
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: mattermost-code <matty-code@mattermost.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
* Simplify invite_people email parsing
Replace backwards in-place mutation loop with a straightforward forward
filter into a new slice. Extract into parseEmailList so the logic can be
unit tested directly.
* MM-68150: Upgrade golangci-lint to v2.12.2
Remove //go:fix inline from NewPointer, which is a generic function not
yet supported by the inline analyzer, and fix 11 slicesbackward
modernize issues flagged by the new version.
* MM-68150: Enable all linters by default; disable those with >20 existing issues
Switch from opt-in (default: none) to opt-out (default: all) so new
linters added to golangci-lint are evaluated automatically. Explicitly
disable every linter that has more than 20 pre-existing violations,
deferring those for later cleanup. Also disable a handful of linters
whose violations are intentional patterns in this codebase (nilerr,
dogsled, sqlclosecheck, iotamixing, predeclared, containedctx, iface,
gocheckcompilerdirectives, promlinter, goprintffuncname, gomoddirectives).
* MM-68150: Fix mirror linter issues
Replace Write([]byte(s)) with WriteString(s), and FindIndex([]byte(s))
with FindStringIndex(s), to avoid unnecessary allocations.
* MM-68150: Fix nosprintfhostport linter issue
Use net.JoinHostPort to construct host:port strings instead of
fmt.Sprintf with a manually formatted pattern.
* MM-68150: Fix rowserrcheck and sqlclosecheck linter issues
Check rows.Err() after iteration loops in schema_dump.go. In the
sqlx_wrapper test, defer rows.Close() rather than closing inline.
* MM-68150: Fix nilnesserr linter issues — wrong variable in error handlers
In 11 places, a stale variable (often the outer err from a prior
assignment) was used instead of the freshly-checked error variable
(appErr, rowErr, jsonErr, writeErr, esErr). Each produces a typed-nil
wrapped in a non-nil interface, silently discarding the real error.
* MM-68150: Add i18n string for app.compile_csv_chunks.write_error
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* MM-68149: upgrade to Go 1.26.2
Update go directive in go.mod and .go-version.
* MM-68149: replace pointer helpers with Go 1.26 new()
Go 1.26 extends the built-in new() to accept an initial value expression,
making typed-pointer helpers like model.NewPointer(x), bToP(x), and boolPtr(x)
redundant. Replace every call site with new(x) and remove the now-unused
helper functions and their //go:fix inline directives.
* MM-68149: apply go fix for reflect API and format-string changes
- reflect.Ptr → reflect.Pointer (renamed in Go 1.18, deprecated alias removed in 1.26)
- reflect range-over-struct: for i := 0; i < t.NumField(); i++ → for field := range t.Fields()
and the equivalent for Methods() and interface types
- Fix format-string concatenation and variadic-arg mismatches flagged by go vet
* MM-68149: update JPEG fixtures and test infrastructure for Go 1.26 encoder
Go 1.26 ships a new image/jpeg encoder that produces slightly different output.
Regenerate all JPEG fixture files and switch the comparison helpers from
byte-equality to pixel-level comparison with a small per-channel tolerance,
so minor encoder drift across patch versions is handled automatically.
Add -update-fixtures flag to make it easy to regenerate fixtures after future
major Go upgrades. Document the update procedure in tests/README.md.
* MM-68149: CI check that go fix ./... produces no changes
* Fix real bugs flagged by CodeRabbit review
- group.go: set newGroup.MemberCount not group.MemberCount (member count
was populated on the wrong variable and lost before publish/return)
- file_test.go: guard compareImage(GetFilePreview) on the preview slice
length, not the thumbnail slice length (copy-paste error)
- config_test.go: remove duplicate MinimumLength assignment
* fixup! Fix real bugs flagged by CodeRabbit review
* Report POC
* Including more error logs
* Added localisationj for each reviewer
* Optimisations
* Minor tweaks
* restored go module files
* lint fixes
* Added back transslations
* Added translations
* linter and test fixes
* restored go module files
* e2e lint fix
* lint fixes
* AI fixes
* fixed typo
* fixed nil pointer error
* Added more tests
* Publish report even if deletion fails
* Fixed the e2e test
* Distinguished between no data and deleted data
* lint fixes
* fixed tests
* e2e test fix
* Updated test to also upload actual file
* Removed file name tracking
* Text updates
* fixed e2e test
* lint fix
* Replace hardcoded test passwords with model.NewTestPassword()
Add model.NewTestPassword() utility that generates 14+ character
passwords meeting complexity requirements for FIPS compliance. Replace
all short hardcoded test passwords across the test suite with calls to
this function.
* Enforce FIPS compliance for passwords and HMAC keys
FIPS OpenSSL requires HMAC keys to be at least 14 bytes. PBKDF2 uses
the password as the HMAC key internally, so short passwords cause
PKCS5_PBKDF2_HMAC to fail.
- Add FIPSEnabled and PasswordFIPSMinimumLength build-tag constants
- Raise the password minimum length floor to 14 when compiled with
requirefips, applied in SetDefaults only when unset and validated
independently in IsValid
- Return ErrMismatchedHashAndPassword for too-short passwords in
PBKDF2 CompareHashAndPassword rather than a cryptic OpenSSL error
- Validate atmos/camo HMAC key length under FIPS and lengthen test
keys accordingly
- Adjust password validation tests to use PasswordFIPSMinimumLength
so they work under both FIPS and non-FIPS builds
* CI: shard FIPS test suite and extract merge template
Run FIPS tests on PRs that touch go.mod or have 'fips' in the branch
name. Shard FIPS tests across 4 runners matching the normal Postgres
suite. Extract the test result merge logic into a reusable workflow
template to deduplicate the normal and FIPS merge jobs.
* more
* Fix email test helper to respect FIPS minimum password length
* Fix test helpers to respect FIPS minimum password length
* Remove unnecessary "disable strict password requirements" blocks from test helpers
* Fix CodeRabbit review comments on PR #35905
- Add server-test-merge-template.yml to server-ci.yml pull_request.paths
so changes to the reusable merge workflow trigger Server CI validation
- Skip merge-postgres-fips-test-results job when test-postgres-normal-fips
was skipped, preventing failures due to missing artifacts
- Set guest.Password on returned guest in CreateGuestAndClient helper
to keep contract consistent with CreateUserWithClient
- Use shared LowercaseLetters/UppercaseLetters/NUMBERS/PasswordFIPSMinimumLength
constants in NewTestPassword() to avoid drift if FIPS floor changes
https://claude.ai/code/session_01HmE9QkZM3cAoXn2J7XrK2f
* Rename FIPS test artifact to match server-ci-report pattern
The server-ci-report job searches for artifacts matching "*-test-logs",
so rename from postgres-server-test-logs-fips to
postgres-server-fips-test-logs to be included in the report.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* updated go to version 1.25.8
* updated gotestsum version to work with go 1.25.8
go 1.25 does not work with indirect tools 0.11 dependency pulled by
gotestsum.
* Use sync.WaitGroup.Go to simplify goroutine creation
Replace the wg.Add(1) + go func() { defer wg.Done() }() pattern with
wg.Go(), which was introduced in Go 1.25.
* pushes fips image on workflow dispatch to allow fips test to run on go version update
* fix new requirements for FIPS compliance imposed on updating to go 1.25.8
* updates openssl symbol check for library shipped with FIPS new versions
go-openssl v2 shipped with FIPS versions starting from 1.25 uses mkcgo to generate
bindings causing symbol names to be different.
* removes temp workflow-dispatch condition
* keep versions out of agents md file
* Add shared channel integration test tool (MM-67944)
Add tools/sharedchannel-test, a standalone Go tool that validates shared
channel synchronization between two real Mattermost Enterprise instances.
The tool builds and manages two server processes with separate databases,
establishes a remote cluster connection, and runs integration tests for
membership, post, and reaction sync.
Test coverage:
- Membership: add, remove, re-add, bulk remove
- Posts: create, edit, delete
- Reactions: add, remove
Uses mlog with dual console targets (stdout for info, stderr for errors)
and exits non-zero on failure for CI integration.
Running `make i18n-extract` on a en.json file
with bad JSON will just wipe off all keys instead
of throwing the error. This is very confusing
and can lead to a lot of time wasted because
there's no indication that the JSON is incorrect.
Fixing this.
```release-note
NONE
```
* update ArrayFromJSON to use LimitedReader
* update for bad merge
* fix lint errors
* update test code
* update unit tests
* update unit tests
* fix unit tests
* use consts, other cleanup
* add non sorting duplicate check
* set config to default value, then config setting if available
* fix lint errors
* fixes and debugs
* fix log test
* remove setting from Client, add unlimited Parser to client
* a couple more fixes
* another fix
* rename some variables
* remove superflous call
* check for valid MaximumPayloadSize
* update language file
* fix for e2e-tests
* update util function to return error
* lint fix
* update config property name to include unit
* fix for unit test
* add new config to telemetry
* call function to create LimitedReader
* Deprecate old function, use new function name
* return new AppError on failed parse
* return new AppError on failed parse
* return new AppError on failed parse
* add constant for i18n valid constants
* Update server/public/model/utils_test.go
Co-authored-by: Miguel de la Cruz <mgdelacroix@gmail.com>
* Apply suggestions from code review
Co-authored-by: Miguel de la Cruz <mgdelacroix@gmail.com>
* update error variable, remove unnecessary check
* Update function names
* fix errors from merge
* update unit test to create unique ids
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
Co-authored-by: Miguel de la Cruz <mgdelacroix@gmail.com>
Alejandro García Montoro