Commit Graph
77 Commits
Author SHA1 Message Date
Mattermost Build 68e99a44e6 MM-68151: Update server dependencies (#36571) (#36664) 2026-05-20 22:40:54 -03:00
Alejandro García Montoro f604ec7a5c MM-68662: Add Azure Blob Storage filestore backend (#36498)
* Generalize file backend error types

Replace S3FileBackendAuthError and S3FileBackendNoBucketError with
backend-agnostic FileBackendAuthError and FileBackendNoBucketError so
non-S3 drivers can return them and the admin "Test Connection" flow
keeps surfacing useful messages.

The old S3-prefixed names are kept as type aliases of the generic
types so external code (plugins, historical consumers) continues to
compile, and so existing S3 construction sites stay untouched.

The type switch in connectionTestErrorToAppError now matches the
generic types, with new i18n keys (test_connection_auth.app_error
and test_connection_no_bucket.app_error) whose wording does not name
S3. The old S3-specific i18n keys are dropped via `make i18n-extract`
since they are no longer referenced from code; the api4 test that
asserted on those keys is updated, and the Cypress
`MM-T996 Amazon S3 connection error messaging` spec that asserted
on the old user-facing string is updated to the new wording.

------
AI assisted commit

* Pull in Azure SDK and uuid dependencies

Bring in github.com/Azure/azure-sdk-for-go/sdk/azcore and
.../sdk/storage/azblob (with .../sdk/internal as their indirect
dependency). The two are needed by the upcoming Azure Blob Storage
filestore backend and its lazy-Range-backed reader. The bump of
golang.org/x/{crypto,net,sys,term,text} comes transitively from
azblob's minimum versions.

Also promotes github.com/google/uuid from indirect to direct,
since the Azure backend uses it to generate block IDs that share
the same wire format the SDK itself produces in UploadStream.

------
AI assisted commit

* Add azureRangeReader, a seekable Range-backed blob reader

A small standalone type that satisfies the FileBackend interface's
ReadCloseSeeker + the broader io.ReaderAt contract on top of Azure
Blob Storage HTTP Range requests. Lands as its own commit because
the upcoming Azure FileBackend driver builds on it, and the reader
itself is independently useful — and independently testable against
a fake downloader without standing up an Azure client.

Design notes:

* Read opens an HTTP Range stream lazily at the current offset and
  reuses it for sequential reads. Seek to a different offset closes
  the open stream; the next Read re-opens it.
* Seek to the same offset is a no-op and does not close the open
  stream, so callers like zip.NewReader that probe with redundant
  seeks don't kick off a fresh download.
* ReadAt issues a dedicated ranged DownloadStream per call and does
  not touch the streaming cursor — matches the io.ReaderAt contract
  the bulk-import worker's zip.NewReader path relies on.
* Close cancels the context (which any in-flight Azure call will
  observe and abort), stops the deadline timer, and closes the
  current body if any. It is safe to call when no body was ever
  opened.
* CancelTimeout lets long-running consumers like the import worker
  opt out of the per-operation deadline that would otherwise kill
  multi-minute downloads partway through.

The implementation talks to a small blobDownloader interface rather
than *blob.Client directly so the unit tests can substitute a fake
downloader that records every requested Range and tracks Close
calls on the bodies it hands out.

------
AI assisted commit

* Add Azure Blob Storage filestore driver

Implements the FileBackend interface against Azure Blob Storage in
a new azurestore.go (~520 LOC). The driver is not yet selectable
via NewFileBackend's switch — that wiring lands in the next commit
together with the admin config surface — but the driver itself is
complete and self-contained behind the FileBackendSettings struct.

Filesstore.go grows three pieces of supporting infrastructure that
the driver consumes:

* a `driverAzure = "azureblob"` constant alongside the existing
  driverS3 and driverLocal,
* an Azure-specific block on FileBackendSettings (storage account,
  access key, container, path prefix, endpoint, SSL flag, request
  timeout),
* a CheckMandatoryAzureFields validator that mirrors
  CheckMandatoryS3Fields.

Behavioural notes that warrant calling out:

* Reader returns the previously-added azureRangeReader, so reads
  stream lazily over HTTP Range and ReadAt is available for the
  bulk-import worker's zip.NewReader path. The deadline timer is
  armed before the initial GetProperties call so the HEAD itself
  is bounded.
* WriteFile and AppendFile both go through StageBlock +
  CommitBlockList via a shared stageBlocks helper, never the SDK's
  UploadStream. UploadStream's small-payload fast path falls back
  to single-shot PutBlob, which leaves the resulting blob with no
  committed block list; a subsequent AppendFile that calls
  CommitBlockList on that blob would then clobber its content.
  Routing every write through the block-list mechanism keeps
  AppendFile correct regardless of payload size.
* AppendFile stages the new chunk as one or more blocks and commits
  the existing committed block list plus the newly staged IDs.
  The new bytes go up exactly once — no re-download, no
  re-concatenate, no re-upload of the prior contents.
* WriteFileContext does not wrap the caller-supplied context with
  its own timeout — that timeout is applied in WriteFile only,
  matching the S3 driver, so long-running TryWriteFileContext
  callers (like message-export bulk writes) opt out of the
  per-operation timeout the way the abstraction documents.

Authentication is shared-key only for this drop; Microsoft Entra
ID / managed identity is deferred to a follow-up. The endpoint is
configurable so the same code targets the production Azure host
(vhost style — {account}.blob.core.windows.net) or Azurite /
Azure Government / sovereign clouds (path style —
host[:port]/{account}).

------
AI assisted commit

* Wire Azure backend into config, validation, and driver selection

This commit registers the previously-added AzureFileBackend driver
with the rest of the system. Until now the driver was usable only
via direct construction; after this commit, `DriverName: "azureblob"`
in config.json is a fully-supported deployment configuration.

Five integration sites are touched:

* `newFileBackend` in filesstore.go now dispatches `driverAzure` to
  NewAzureFileBackend, alongside the existing s3 and local cases.
  NewFileBackendSettingsFromConfig (and its export counterpart) gain
  an Azure branch that maps the model.FileSettings fields onto the
  Azure-specific FileBackendSettings fields.
* `model.FileSettings` grows the user-facing Azure config schema:
  storage account, access key, container, path prefix, endpoint,
  SSL flag, request timeout, plus matching Export* fields for the
  dedicated export store. SetDefaults populates them so deployments
  that never opted into Azure don't carry nil pointers. `isValid`
  accepts the new ImageDriverAzure constant.
* `Config.Sanitize()` masks AzureAccessKey and ExportAzureAccessKey
  the same way it masks AmazonS3SecretAccessKey, so the shared key
  never reaches an API consumer in plain text.
* `desanitize()` restores the masked keys on a config write so a
  PATCH that doesn't touch the key doesn't clobber it with the
  FakeSetting placeholder.
* `configSensitivePaths` covers both Azure key paths so audit
  diffs don't include them either.
* `ConfigToFileBackendSettings` in the `mattermost db` CLI helper
  gets the Azure branch its production counterpart already has —
  without it, `mattermost db migrate` / `db downgrade` would fail
  on Azure-configured deployments with "missing azure storage
  account setting".

Finally, the shared FileBackendTestSuite is now wired against
Azurite via TestAzureFileBackendTestSuite, which skips when
CI_AZURITE_HOST is unreachable. The test-infra wiring (the docker
service, the env vars, the start_dependencies entry) landed in a
previous PR; this commit is what makes the suite actually exercise
the Azure driver end to end.

------
AI assisted commit

* Validate Azure timeout and path prefix in Config.IsValid

Parity with the S3-side checks that already cover
AmazonS3RequestTimeoutMilliseconds and AmazonS3PathPrefix. Without
these, a zero/negative AzureRequestTimeoutMilliseconds passes
validation and later creates immediately-expired request contexts,
and leading/trailing whitespace in AzurePathPrefix produces blob
keys that don't match what the admin configured.

Same checks added for the Export* counterparts. The
file_driver.app_error translation is updated to mention the new
'azureblob' option alongside 'local' and 'amazons3'.

------
AI assisted commit

* Stream zip entries from the Azure backend

writeZipEntry was calling ReadFile, which loads the entire blob
into memory before writing it to the archive. For large blobs or
deep directories this spikes RSS or OOMs the goroutine. Switch to
Reader (the streaming azureRangeReader) and io.Copy into the zip
entry so memory stays bounded regardless of blob size.

------
AI assisted commit

* Use a backend-agnostic fallback for FileBackendNoBucketError

The fallback Error() message was "no such bucket", which leaks S3
terminology when an Azure caller returns the type with no wrapped
Err. Use "no such bucket or container" so logs and external error
handling stay neutral across backends.

------
AI assisted commit

* Defend Azure path prefix against directory traversal

Reject ".." in AzurePathPrefix and ExportAzurePathPrefix at config
validation time, since path.Join collapses traversal segments and a
prefix like "../other-tenant" would otherwise escape the configured
isolation boundary.

Harden the prefix helper as a second line of defense: if the joined
path no longer sits inside pathPrefix, fall back to joining the prefix
with the base name of the caller-supplied path. That preserves the
prefix invariant for plugin and import paths that the upload code does
not sanitize uniformly.

------
AI assisted commit

* Honor SkipVerify when constructing the Azure client

FileBackendSettings.SkipVerify is plumbed through from the System Console
the same way it is for S3, so admins toggling the flag for self-signed
endpoints (Azurite, sovereign clouds) get the behavior they expect
without having to drop SSL entirely and send the shared key in clear
text.

------
AI assisted commit

* Warn when the Azure request timeout falls back to its default

Config.IsValid already rejects non-positive AzureRequestTimeoutMilliseconds
for any path that goes through config validation, so this warn only fires
for direct callers that bypass validation (tests, helpers). Logging the
substitution turns a silent coercion into something an operator can
correlate against unexpected request behavior.

------
AI assisted commit

* Cap Azure request timeout at 10 minutes

Reject AzureRequestTimeoutMilliseconds values above the ceiling so an
operator (or someone who has admin access) cannot effectively disable
timeouts by setting the value to math.MaxInt64. A hung Azure call then
holds a goroutine open until the OS gives up.

Applies the same bound to ExportAzureRequestTimeoutMilliseconds. S3 has
the same gap; treating it is out of scope here but worth a follow-up.

------
AI assisted commit

* Refuse AppendFile on blobs without a committed block list

A blob written by another tool (Azure portal, azcopy, a migration script,
a plugin using Put Blob) has its content in the blob but an empty
committed-block list. Committing a new block list against such a blob
silently replaces the existing content with only the appended bytes.

Check the blob's properties before staging when the committed-block list
is empty, and refuse with a clear error if the blob has content. Same
hazard for an admin pointing the backend at an existing container with
pre-existing files.

Adds an integration test against Azurite to lock the behavior in.

------
AI assisted commit

* Surface truncated reads from azureRangeReader

Read closed the body cleanly and returned io.EOF even when the remote
stream terminated before the blob's content length. Callers (and any
retry layer above) then accepted a partial blob as complete.

ReadAt unconditionally rewrote io.ErrUnexpectedEOF to io.EOF, which made
truncated downloads indistinguishable from clean reads. That is exactly
what zip.NewReader consumes for archive readers, so the bulk-import
worker would silently import partial archives.

Read now closes the body, nils it, and returns io.ErrUnexpectedEOF when
EOF arrives before offset reaches size. ReadAt only collapses
ErrUnexpectedEOF to EOF when the full count was delivered and the stream
was consumed to the end of the blob. Otherwise the truncation
propagates with context.

Both code paths are exercised by new fakeDownloader-backed tests.

------
AI assisted commit

* Move container provisioning out of Azure TestConnection

Auto-creating the container inside TestConnection meant a typo in the
System Console (mattermosst instead of mattermost) silently provisioned
an unwanted container in the admin's Azure subscription, with no audit
log and no warning. They'd discover it later when uploads landed
somewhere unexpected.

TestConnection now returns FileBackendNoBucketError when the container
is missing, mirroring the S3 contract. A new MakeContainer method
mirrors S3FileBackend.MakeBucket, and Server.Start dispatches via two
capability interfaces (bucketMaker / containerMaker) instead of a hard
S3 type assertion — so the NoBucket error is no longer silently
swallowed for backends Server.Start has not been taught about.

------
AI assisted commit

* Carry file backend auth detail through to AppError

The Test Connection button collapsed every typed backend failure into
the same generic i18n message. Operators trying to debug bad credentials
or a missing bucket only saw "Unable to authenticate against the file
storage backend" with no SDK code to grep for in their logs.

Use errors.As so the typed checks survive future wrapping, and pass the
underlying error string through the NewAppError details argument. The
AppError serializer surfaces that detail to the admin console alongside
the translated message, so a bad S3 InvalidAccessKeyId or an Azure
AuthenticationFailed shows up in the toast without an i18n schema
change.

------
AI assisted commit

* Remove non-ascii characters from comments

------
AI assisted commit

* Make linter happy

------
AI assisted commit

* Harden Azure prefix boundary check

strings.HasPrefix on the joined path is a string-level check, not a
path-level one, so a configured prefix of "mattermost" accepts a joined
result of "mattermost-evil/...". A crafted caller path like
"../mattermost-evil/secrets" would collapse via path.Join to that exact
sibling and slip through the boundary check, escaping the configured
prefix scope.

Require the joined path to be the cleaned prefix itself or to start with
the prefix followed by a path separator. The fallback path.Join uses the
same cleaned prefix for consistency.

------
AI assisted commit

* Provision Azurite container in standalone test setup

The shared FileBackendTestSuite's SetupTest already handles a missing
container by detecting FileBackendNoBucketError from TestConnection and
calling MakeContainer, but TestAzureFileBackendAppendRefusesNonBlockBlob
bypasses SetupTest and calls TestConnection directly. On a fresh Azurite
instance the test would fail before exercising the append-refusal logic.

Extract a newAzuriteBackend(t) helper alongside azuriteSettings(t) that
builds the backend and ensures the container exists, mirroring the
suite's setup. Use errors.As for forward compatibility with future
wrapping.

------
AI assisted commit

* Fix grammar in email-settings i18n string

"Email settings has unset values." -> "Email settings have unset values."

------
AI assisted commit

* Make Azure MakeContainer idempotent

Treat a ContainerAlreadyExists response as success so that two nodes
racing through TestConnection plus MakeContainer at boot both converge
instead of having the loser fail. Mirrors how the S3 backend handles
the equivalent BucketAlreadyOwnedByYou case.

------
AI assisted commit

* Narrow AzureEndpoint comment to path-style only

The setting only builds path-style URLs, so it cannot reach sovereign
clouds like Azure Government or Azure China, which require vhost-style
endpoints. Update the comment to reflect what the code actually does
and document that sovereign-cloud support is out of scope.

------
AI assisted commit
2026-05-14 16:59:18 +00:00
bbbfc019a9 Replace bild imaging library with boxes-ltd/imaging (#36261)
* Add benchmarks for image transformation functions

Covers GeneratePreview, GenerateThumbnail, GenerateMiniPreviewImage,
FillCenter, and MakeImageUpright — all functions that delegate to the
external imaging library. Baseline before/after the library swap.

* Replace anthonynsimon/bild with boxes-ltd/imaging

Reverts the imaging library swap from PR #29657 (disintegration/imaging →
anthonynsimon/bild) and replaces it with github.com/boxes-ltd/imaging, the
maintained fork of disintegration/imaging with the same API.

- emoji.go: restore direct use of imaging.Fit with Lanczos filter
- orientation.go: restore FlipH/FlipV/Rotate90/180/270/Transpose/Transverse
- preview.go: restore imaging.Resize calls with Lanczos filter
- utils.go: remove bild-based Resize/Fit/CropCenter helpers; restore the
  original FillCenter using imaging.Fill
- Remove tests and test images added for the bild-specific helpers
- Regenerate orientation test expected images (2,3,6,7,8) and GIF thumbnail
  to match boxes-ltd/imaging output

https://claude.ai/code/session_012f5wLSCRQrQeRraPj282sT

* gofmt imaging package files

* Add tests and fixtures for the boxes-ltd/imaging-backed functions

Cover MakeImageUpright across all 8 EXIF orientations, GeneratePreview,
GenerateMiniPreviewImage, and FillCenter against fixtures regenerated
under the new library.

* Contain boxes-ltd/imaging behind the local imaging wrapper

Add a Fit wrapper alongside FillCenter and route emoji.go through the
local package so boxes-ltd/imaging is only imported from
channels/app/imaging.

* Add TestFit to cover the local Fit wrapper

Dimensional checks for the Fit wrapper used by emoji.go, mirroring
TestGenerateThumbnail. Pixel correctness is covered by the upstream
boxes-ltd/imaging tests; this guards against wrapper-level mistakes
(transposed args, wrong filter).

* Address CodeRabbit nits in TestFillCenter and TestFit

Decode a fresh source image per TestFillCenter subtest so cases stay
isolated even if the wrapper ever mutates input. Rename the TestFit
"smaller than bounds (clone)" case to "no resize when smaller than
bounds" since the assertion only checks dimensions, not clone semantics.

* Revert per-subtest decode in TestFillCenter

imaging.Fill never mutates its input — it always returns a fresh
*image.NRGBA — so re-decoding the source for every subtest was
unnecessary work. Decode once, share across subtests.

* Compare decoded pixels instead of raw PNG/JPEG bytes in tests

image/png isn't byte-stable across Go versions, so comparing
re-encoded byte streams against checked-in fixtures is brittle to
toolchain bumps and re-encoding. Decode both sides and compare RGBA
pixels via a shared requireSameImage helper. Fixtures stay on disk
unchanged.

Covers TestFillCenter, TestGeneratePreview, TestGenerateMiniPreviewImage,
and TestMakeImageUpright. TestFillImageTransparency is left alone since
its byte-comparison pattern predates this branch.

* Report total diff rate when requireSameImage fails

Walk every pixel before failing instead of stopping at the first
mismatch. The failure message now includes how many pixels differ, the
percentage of the image that's off, and the first divergence.

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
2026-05-11 12:56:51 +00:00
Christopher PoileandClaude Opus 4.7 0502d6b3c5 [MM-68655] Surface RPC errors from plugin hooks (#36414)
* add WithRPCErr hooks (server-facing/internal only)

* zero _returns on RPC failure in WithRPCErr companions

Aligns the WithRPCErr template with the HooksRPCErr godoc contract: when
g.client.Call returns a transport error, gob may have partially decoded the
reply. Reassign _returns to a zero value before destructuring so callers always
receive zeroed outputs alongside a non-nil transport error.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* rename HooksRPCErr to HooksWithRPCErr for naming consistency

Every related symbol uses the WithRPCErr suffix (MessageHasBeenPostedWithRPCErr,
RunMultiPluginHookWithRPCErr, RunMultiHookWithRPCErr, etc.). Aligning the
interface name removes the only outlier and makes the convention uniform.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* rename rpcErrImpl to hooksWithRPCErrImpl

Mirrors the existing hooksImpl/Hooks naming pattern on hooksTimerLayer.

* add supervisor.HooksWithRPCErr() and drop runtime type assertion

The old path did rp.supervisor.Hooks().(HooksWithRPCErr) and handled the
"doesn't implement" branch — but that branch was structurally unreachable
(the compile-time `_ HooksWithRPCErr = (*hooksTimerLayer)(nil)` assertion
guards it).

Change supervisor.hooks from `Hooks` to the concrete `*hooksTimerLayer`
(which implements both interfaces, enforced at field assignment), add a
parallel HooksWithRPCErr() accessor, and call it directly. Hooks() keeps
its public Hooks-interface signature via implicit conversion at return.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* drop "implemented by" clause from HooksWithRPCErr godoc

Both hooksRPCClient and hooksTimerLayer satisfy the interface, and naming
implementations in interface godocs adds rot — the contract is what readers
need, not the list of wrappers.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-05 10:41:11 -04:00
JG Heithcock 88954db3de [MM-63434] Use forked PDF library with parsing depth limit (#35947)
* [MM-63434] Use forked PDF library with parsing depth limit

Replace github.com/ledongthuc/pdf with a fork that limits object
nesting depth during parsing. Add test coverage.

* Reverting incorrect merge that lost the change to msgpack

The error was in merge https://github.com/mattermost/mattermost/commit/64bdff88d853e030d6e0f243cf21370a78dde6ae
2026-04-14 10:28:59 -07:00
Caleb Roseland 17939826ef Update msgpack fork dependency (#35988) 2026-04-10 15:26:36 -05:00
Bill Gardner 24e38f2bd7 Update server/public to v0.3.0 to avoid import cycle in v0.2.1 (#35946) 2026-04-03 17:20:45 -04:00
Carlos GarciaandJesse Hallam 50f31ae87c Mm 66662 bump dependencies (#35849)
* replace for tablewriter not longer needed

jaytaylof/html2text project has been updated and now it supports
tablewriter 1.0.0

* Replace fwSeeker with bufReadSeeker to support backward seeks for imagemeta v0.17

* Bump server dependencies (includes imagemeta v0.12→v0.17)

* revert the imagemeta upgrade to reduce risk this time

* modules-tidy

---------

Co-authored-by: Jesse Hallam <jesse@mattermost.com>
2026-04-01 10:46:46 -03:00
Alejandro García Montoro 4f16a29cb5 MM-67793: Remove dependency on blang/semver/v4 (#35742)
* Remove dependency on blang/semver/v4

Instead, consolidate on the usage of Masterminds/semver/v3

* Remove empty line

* make modules-tidy
2026-03-25 13:41:33 +00:00
76b8e3f5f7 [MM-66838] Update throttled library to v2.15.0 with Go modules support (#34657)
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
2026-03-19 11:36:19 +01:00
e5f4b982e5 Add operation tracking fields to bridge client calls (#35514)
* Add operation tracking fields to bridge client CompletionRequest calls

Populate UserID, Operation, and OperationSubType on CompletionRequest
for recaps (SummarizePosts) and message rewrite (RewriteMessage) so
token usage logs show correct values instead of defaults.

Also bumps mattermost-plugin-ai v1.8.1 → v1.12.0 which adds the
Operation/OperationSubType fields to the bridgeclient struct.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Address PR feedback: normalize rewrite action and use session-derived userID

- post.go: Add normalizeRewriteAction() that validates action against a
  whitelist of known RewriteAction values, mapping unknown values to
  "unknown" before assigning to OperationSubType.
- summarization.go: Use sessionUserID (derived from rctx.Session().UserId)
  instead of the userID parameter for tracking, ensuring operation
  tracking always uses the authenticated session user.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
2026-03-10 06:49:18 -07:00
Eva Sarafianou 24d3fed777 Update filippo.io/edwards25519 (#35422) 2026-02-25 11:27:48 -05:00
4269ebf913 Add Default Agent Support and promote Agents to be part of suite (#35091)
* Add default agent support and App Bar integration

- Add Agents section to App Bar, separating it from Core Products.
- Implement Default Agent logic in AtMentionProvider:
  - Promote default agent to top of suggestions for empty '@' prefix.
  - Filter duplicate agent entry from main list when default is shown.
- Add `AgentTag` component for UI distinction.
- Update `mattermost-plugin-ai` and `server/public` dependencies.
- Add unit tests for default agent suggestion logic.

* Add missing files (server deps, types)

* Fix pre-commit check failures

- Fix TypeScript errors in test files:
  - Add missing displayName property to defaultAgent in at_mention_provider test
  - Add missing fetchAgents mock in textbox test
- Fix Go assignment mismatch in integration_action_test.go (CreatePostAsUser returns 3 values)
- Fix license copyright year in plugins/mattermost-ai/assets/embed.go
- Update i18n translations (add tag.default.agent)
- Regenerate Go serialized files, mmctl docs, and update go.mod/go.sum

* Update snapshot tests for textbox and at_mention_suggestion

* Undo mmctl docs changes

* Undo more changes

* revert package-lock.json

* Update dep for ai plugin

* Update again

* Update at_mention_provider to filter out agent duplicates and add .cursor/ to gitignore

- Filter agent usernames from priorityProfiles and localAndRemoteMembers to prevent duplicate entries in autocomplete suggestions
- Add .cursor/ directory to .gitignore

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-12 02:59:20 +00:00
Carlos Garcia 3388093c00 updates opensearch library dependency and adds tests for caused_by error reason returned (#34826) 2026-01-27 16:01:22 +01:00
Carlos Garcia 89a29ce3c2 MM-66167 fix (#35061)
* use BUILD_ENTERPRISE_READY instead of hardcoded value in Makefile

* fixes MM-66167
2026-01-27 15:29:22 +01:00
Christopher Poile 86797c508c update mscfb and msoleps indirect dependencies to fix oom vuln. (#34910) 2026-01-23 23:56:01 +02:00
Christopher Poile 38b413a276 MM-67077: Remove PSD file previews (#34898)
* remove image preview support for PSD files

* remove psd as a supported image type in webapp

* remove unneeded comments
2026-01-15 13:39:46 -05:00
Eva Sarafianou 08087a1420 Update golang.org/x/crypto (#34838) 2026-01-05 16:09:22 +02:00
Carlos Garcia a0326c91ac [MM-66203] removes direct jaytaylor/html2text dependency (#34539)
* removes direct jaytaylor/html2text dependency

there is still some indirect dependency on the library preventing
to use latest tablewriter with a PR made to the outdated library
that should be monitored as stated in go.mod comments.

* makes variable not shadow outer one

* fixes typo and makes test fail on error

* uses current docconv dependency to generate plain text email content
2025-12-04 17:15:01 +01:00
Carlos GarciaandMattermost Build 4ba7f7e16e MM-66202: Migrate to aws-sdk-go-v2 (#34496)
* updated aws-sdk dependency to aws-sdk-go-v2

* simplify error handling in case of timeout errors

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2025-11-20 11:26:09 +01:00
Ben SchumacherandClaude 97dedb9de5 Migrate from gopkg.in/yaml.v3 to github.com/goccy/go-yaml (#34510)
Co-authored-by: Claude <noreply@anthropic.com>
2025-11-18 08:52:05 +01:00
0dc1830948 [Build 2025] AI Plugin Bridge (#34216)
* initial commit for POC of Plugin Bridge

* Updates

* POC for plugin bridge

* Updates from collaboration

* Fixes

* Refactor Plugin Bridge to use HTTP/REST instead of RPC

- Remove ExecuteBridgeCall hook and Context.SourcePluginId
- Implement HTTP-based bridge using existing PluginHTTP infrastructure
- Add CallPlugin API method with endpoint parameter instead of method name
- Update CallPluginBridge to construct HTTP POST requests
- Add proper headers: Mattermost-User-Id, Mattermost-Plugin-ID
- Use 'com.mattermost.server' as plugin ID for core server calls
- Update ai.go to use REST endpoint /inter-plugin/v1/completion
- Add comprehensive spec documentation in server/spec.md
- Add MIGRATION_GUIDE.md for plugin developers
- Fix 401/404 issues by setting correct headers and URL paths

* Improve Plugin Bridge security and architecture

- Create ServeInternalPluginRequest for internal plugin calls (core + plugin-to-plugin)
- Move header-setting logic from CallPluginBridge to ServeInternalPluginRequest
- Improve separation of concerns: business logic vs HTTP transport
- Add security documentation explaining header protection

Security Improvements:
- ServeInternalPluginRequest is NOT exposed as HTTP route (internal only)
- Headers (Mattermost-User-Id, Mattermost-Plugin-ID) are set by trusted server code
- External requests cannot spoof these headers (stripped by servePluginRequest)
- Core calls use 'com.mattermost.server' as plugin ID for authorization
- Plugin-to-plugin calls use real plugin ID (enforced by server)

Backward Compatibility:
- Keep ServeInterPluginRequest for existing API.PluginHTTP callers (deprecated)
- All tests pass

Docs:
- Update spec.md with security model explanation
- Update MIGRATION_GUIDE.md with correct header usage examples

* Space

* cursor please stop creating markdown files

* Fix style

* Fix i18n, linter

* REMOVE MARKDOWN

* Remove CallPlugin method from plugin API interface

Per review feedback, this method is no longer needed.

Co-authored-by: Nick Misasi <nickmisasi@users.noreply.github.com>

* Remove CallPlugin method implementation from PluginAPI

Co-authored-by: Nick Misasi <nickmisasi@users.noreply.github.com>

* fixes

* Add AI OpenAPI spec

* fix openapi spec

* Use agents client (#34225)

* Use agents client

* Remove default agent

* Fixes

* fix: modify system prompts to ensure JSON is being returned

* remove webapp changes

* Add feature flags for rewrites and ai bridge, clean up

* Remove comments that aren't helpful

* Fix i18n

* Remove rewrites

* Fix tests

* Fix i18n

* adjust i18n again

* Add back translations

* Remove leftover mock code

* remove model file

* Make the real substitutions

* Include a basic invokation of the client with noop to ensure build works

* Remove unneeded change

* Updates from review

* Fixes

* Use v1.5.0 of agents plugin

---------

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Nick Misasi <nickmisasi@users.noreply.github.com>
Co-authored-by: Christopher Speller <crspeller@gmail.com>
Co-authored-by: Felipe Martin <me@fmartingr.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
2025-10-30 19:09:27 +00:00
Alejandro García Montoro 0b7b968087 Update dependencies (#34071)
* Update dependencies

* Undo hack needed by go-elasticsearch v8.18.0

See https://github.com/mattermost/mattermost/pull/31021 for more
information.

* Another breaking change in a minor version :)

* Remove old exclude rules

* Unify ES/OS tests when getting no documents

* Clarify weird assert on ES/OS common tests

* Bump dependencies now that archives v0.1.5 is out
2025-10-14 13:00:39 +02:00
Eva SarafianouandJesse Hallam 3ac4a73c63 [MM-65837], [MM-65824] - Update Dependencies (#33972)
* Update github.com/mholt/archives

* Update github.com/spf13/viper

* make batch migration worker tests less flaky

---------

Co-authored-by: Jesse Hallam <jesse@mattermost.com>
2025-10-01 20:19:22 +00:00
8cace74692 MM-64486: Remove telemetry (#33606)
* MM-64486: Remove telemetry

Remove telemetry from Mattermost. We're no longer relying on Rudder upstream, and no longer making use of this information.

* recover mock for SystemStore.Get

* Fix TestClearPushNotificationSync by adding missing SystemStore mock

The test was failing because the SystemStore mock was missing the Get()
method that's required by the ServerId() function. Added the missing mock
to return a StringMap with SystemServerId.

* fix mocking issue

* Remove now-unused telemetry and constants

* Remove "Disable telemetry events" debug setting

* Remove empty functions

* Remove most "Telemetry tracking removed" comments

* Remove remains of DataPrefetch telemetry

* Remove now-unused prop from InviteMembersButton

* Remove trackDotMenuEvent

* Remove some more leftover comments

* Remove lingering logic related to trackingLocation

* Remove now-unused argument from useCopyText

* Remove lingering telemetry references from PreparingWorkspace

* fixup Remove trackDotMenuEvent

* Remove lingering telemetry references from signup page and password check

* Update snapshots and fix test broken by my changes

* Fix unintended behavior change in thread list filtering

Remove handleSetFilter wrapper that was accidentally modified during
telemetry removal. The function was calling clear() when switching to
unread filter, which was not the original behavior. Use setFilter
directly instead, restoring the original functionality.

* Remove unused useOpenDowngradeModal hook

The useOpenDowngradeModal hook was not being used anywhere in the codebase.

* Remove unused expandableLink from useExpandOverageUsersCheck

The expandableLink return value was not being used by any components.

* Re-add missing TeamLinkClicked performance telemetry

The mark(Mark.TeamLinkClicked) call was accidentally removed from the
handleSwitch function. This telemetry is needed for Looker-based
performance tracking.

* drop LogSettings.VerboseDiagnostics

---------

Co-authored-by: Harrison Healey <harrisonmhealey@gmail.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
2025-09-04 18:46:18 +00:00
Agniva De Sarker 41e88b74ac MM-61407: Remove Bleve (#33430)
https://mattermost.atlassian.net/browse/MM-61407

```release-note
NONE
```

* webapp i18n

```release-note
NONE
```

* Fix e2e tests

```release-note
NONE
```

* fix roles in e2e tests

```release-note
NONE
```

* some review comments

```release-note
NONE
```

* add back permissions to deprecated list

```release-note
NONE
```
2025-07-31 09:35:29 +05:30
Julien TantandClaude c90ee268df Remove PDF library version constraint and update to latest (#31400)
Co-authored-by: Claude <noreply@anthropic.com>
2025-07-14 21:37:17 -07:00
Claudio Costa 05585e5388 Update gosaml2 to latest v0.10.0 (#31263) 2025-06-03 11:57:26 +02:00
Eva SarafianouandJesse Hallam c90dfa4895 Move to library archives (#31100)
* Move to library archives

* wrap the error with %w

Co-authored-by: Jesse Hallam <jesse.hallam@gmail.com>

* remove redundant format

---------

Co-authored-by: Jesse Hallam <jesse.hallam@gmail.com>
2025-06-02 09:21:37 +03:00
Jesse Hallam b7012952c4 MM-62158: Final migration for GetMemberUsersNotInChannel and GetMemberUsersInTeam (#31237)
* upgrade mattermost/squirrel

* migrate GetMemberUsersInTeam

* migrate GetMemberUsersNotInChannel
2025-05-30 16:20:05 +00:00
Agniva De Sarker 79bf1c34db MM-63217: Bump dependencies (#31021)
* MM-63217: Bump dependencies

Skip-Enterprise-PR: true

https://mattermost.atlassian.net/browse/MM-63217

```release-note
NONE
```

* fix go.mod

```release-note
NONE
```

* fix test

```release-note
NONE
```
2025-05-29 13:08:00 +05:30
a344b3225b [MM-61756] Attribute Based Access Control - Phase 1 (#30785)
Attribute Based Access Control - Base
* MM-63662

* MM-63919

* MM-63954

* MM-63955 

* MM-63425

* MM-63426

* MM-63458

* MM-63459

* MM-63603

* MM-63845

* MM-64146

* MM-64199

* MM-64201

* MM-64233

* MM-64247

* MM-64268

---------

Co-authored-by: Harshil Sharma <harshilsharma63@gmail.com>
Co-authored-by: Pablo Andrés Vélez Vidal <pablovv2012@gmail.com>
Co-authored-by: abhijit-singh <abhijitsingh0702@gmail.com>
Co-authored-by: Harrison Healey <harrisonmhealey@gmail.com>
2025-05-15 11:33:08 +02:00
Ben Cooke 4af8acb702 update gosaml to match enterprise version (#31031) 2025-05-13 14:34:08 -04:00
Guillermo VayáandMattermost Build 5b68afe452 [MM-63837] Bump x/net version to 0.39 (#30843)
* bump x/net version to 0.39

* modules-tidy

* upgrade dependencies for public

* tidy

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2025-05-07 11:41:31 +02:00
David Krauser 94dcd9f311 Upgrade logr to v2.0.22 (#30827) 2025-04-28 10:20:42 -04:00
Claudio Costa 5b793ad11d Update bep/imagemeta to latest v0.11.0 (#30670) 2025-04-15 07:26:24 -06:00
Claudio Costa a219fbcfa1 Update golang-jwt/jwt dependency to latest (#30625) 2025-04-03 15:30:21 -06:00
Ibrahim Serdar Acikgoz 10b1f4c5ac [MM-63428] add access control policy store (#30597) 2025-04-02 13:39:28 +02:00
Claudio CostaandMattermost Build f8e16780ef [MM-63436] Replace Exif parser dependency (#30479)
* Replace Exif parser dependency

* Improve forward seeking logic

* Fix linting

* Stop decoding upon finding tag

* Use latest version of imagemeta dependency

* Don't skip TIFF reader tests

* Log improvements

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2025-04-01 13:57:43 -06:00
Agniva De SarkerandMattermost Build c4718e4542 MM-60211: Bump dependencies (#30005)
https://mattermost.atlassian.net/browse/MM-60211
```release-note
NONE
```

Co-authored-by: Mattermost Build <build@mattermost.com>
2025-02-06 21:48:08 +05:30
Claudio CostaandMattermost Build 316cde2569 [MM-62191] Remove disintegration/imaging dependency (#29657)
* Remove disintegration/imaging dependency

* Simplify FillCenter logic

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2025-02-03 11:04:00 +05:30
Jesús Espino f1acdce42c Removing opentracing (#29965)
* Removing opentracing

* Fixing CI
2025-01-29 07:45:13 +01:00
Agniva De Sarker 833578741d Improve Redis failure modes (#29405)
While investigating code paths during
Redis downtime, I found out that the library
by default retries indefinitely for read commmands.

This leads to it being stuck in a loop
while trying to read anything from Redis.
We fix that by disabling retry.

Secondly, we adjust the ConnWriteTimeout
value slightly from its default of 10s
which is a bit too high for normal working
conditions.

Ref: https://github.com/redis/rueidis/issues/680
```release-note
NONE
```
2024-12-03 09:34:47 +05:30
Agniva De Sarker 65ed87bda0 Move Elasticsearch to source available 🎉 🎉 (#29015)
* Move Elasticsearch to source available
2024-11-06 09:26:54 +05:30
Alejandro García MontoroandMattermost Build 9b368b9214 MM58746: Bump yuin/goldmark dependency (#28250)
* Bump yuin/goldmark dependency to latest version

* Add docs to modules-tidy make rule

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
2024-09-20 12:08:35 +02:00
Agniva De Sarker 75ed2860ac MM-59934: Add Redis to CI and other improvements (#28164)
- Update library version.
- Added MaxFlush delay to help reduce CPU usage.
- Fall back to LRU cache for the caches which use SCAN.
- Added mattermost-redis and running for all api layer
tests in Postgres.

https://mattermost.atlassian.net/browse/MM-59934
```release-note
NONE
```
2024-09-18 19:13:44 +05:30
540febd866 MM-56876: Redis: first introduction (#27752)
```release-note
NONE
```

---------

Co-authored-by: Jesús Espino <jespinog@gmail.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
2024-08-06 09:28:41 +05:30
Agniva De Sarker a7210dff01 MM-57289: Bump dependencies (#27734)
https://mattermost.atlassian.net/browse/MM-57289
```release-note
NONE
```
2024-07-25 19:26:40 +05:30
Agniva De SarkerandMattermost Build 177389d224 MM-53962: Adding ES8 dependency (#24399)
* Adding ES8 dependency

```release-note
NONE
```


Co-authored-by: Mattermost Build <build@mattermost.com>
2024-07-11 13:13:31 +05:30
Christopher Poile 9b2f20210b [MM-56339] Audit logs: on login add UserId and SessionId to audit's Actor field (#27446)
* on login add UserId and SessionId to audit's Actor field to match logout

* lint

* simplify to add only userId and sessionId

* AddToEventActor -> AddUser/SessionToEventActor

* fill in missing session data when logging the audit record

* why did it bump that? reverting.

* make modules-tidy

* trigger build

* add more context to the comment
2024-07-08 18:56:54 -04:00