* MM-68547: Tighten authorization on group syncable link and patch endpoints
Adds an additional permission check on the group syncable link and patch
endpoints. Callers must hold the role-management permission for the
target team or channel (or the sysconsole groups-management permission).
Made-with: Cursor
* Linting
* MM-68547: Extend group syncable scheme_admin authorization checks
Gate any explicit scheme_admin value (in either direction) on link and
patch. Populate SchemeAdmin in the singular getGroupSyncable so that
patches that do not touch scheme_admin no longer overwrite the persisted
value. Restrict PermittedSyncableAdmins to active syncables. Start the
link upsert from the existing active row to preserve fields the caller
did not, or could not, set.
Made-with: Cursor
* MM-68547: Add store-layer regression coverage for SchemeAdmin handling
Extend testGetGroupSyncable to round-trip SchemeAdmin: true through
UpdateGroupSyncable and re-fetch, locking in that getGroupSyncable
populates the field from the persisted row.
Strengthen groupTestPermittedSyncableAdmins{Team,Channel} to assert
that DeleteGroupSyncable preserves SchemeAdmin in the persisted row
and that PermittedSyncableAdmins still excludes the row, making the
coupling between the two store changes explicit.
Made-with: Cursor
* MM-68547: Fix group details role-change dedup on remove
The roleChangeKey helper was reading team_id/channel_id from the items
in itemsToRemove, but onRemoveTeamOrChannel pushes those items with a
generic id field. The deletion of the staged role change in
handleRemovedTeamsAndChannels therefore never matched the key produced
by onChangeRoles, and a stale patchGroupSyncable was dispatched after
the unlink.
Accept either id or team_id/channel_id when computing the key. Also
extend the e2e assertion to verify the channel removal took effect
(delete_at != 0) alongside the existing scheme_admin check.
Made-with: Cursor
* MM-68547: Mirror delete_at assertion on the removed-team e2e test
The team variant of "does not update the role of a removed X" was left
asserting only on scheme_admin. Add the matching delete_at != 0 check
already present in the channel variant so both tests verify the same
user-visible contract.
Made-with: Cursor
* Skip SyncSyncableRoles if no scheme_admin
* Implemented edit file permission
* lint fixes
* Updated snapshot
* Updated tests
* Updated test
* CI
* Permission reordering and tooltip text update
* Made a geneeric function
* MM-68536: Show actual remote names in system console channel list
The system console "Channels" list rendered SharedChannelIndicator
without a remoteNames prop, so every shared channel showed the generic
"Shared with trusted organizations" fallback even after PR 35908.
Add a small connected wrapper that selects remote names via
getRemoteNamesForChannel and dispatches fetchChannelRemotes on mount,
mirroring the pattern used by the LHS sidebar. The shared_channel_remote_updated
websocket event added in PR 35908 already refreshes the same Redux slice,
so the system console list now stays in sync automatically.
Bump the default prepackaged Agents plugin from 2.0.2 to 2.0.3 (non-FIPS).
FIPS prepackaged plugin package list is unchanged.
Co-authored-by: Cursor <cursoragent@cursor.com>
* MM-68622: start inter-cluster services before plugin activation
Move startInterClusterServices from the end of Server.Start() to the
beginning, before Channels().Start() initializes plugins. This lets
plugins call shared channels APIs (ShareChannel, InviteRemoteToChannel,
UninviteRemoteFromChannel, UnshareChannel, UpdateSharedChannel,
CheckCanInviteToSharedChannel) during OnActivate instead of failing with
"Shared Channels Service is disabled".
Side-effect analysis:
* Plugin API gating: getSharedChannelsService in
channels/app/shared_channel.go:32 only requires the service to be
non-nil. The plugin-facing wrappers all pass ensureIsActive=false, so
Active() is bypassed. Once SetSharedChannelService runs, calls succeed
on both leader and follower nodes. This is the fix path.
* Multi-node leader timing: the enterprise cluster impl in
enterprise/cluster/cluster.go:70 initializes currentLeader="", so
IsLeader() returns false before StartInterNodeCommunication runs. The
immediate onClusterLeaderChange in scs.Start at
platform/services/sharedchannel/service.go:151 therefore takes the
pause path, which is a no-op since the service was never active. When
memberlist.Create fires NotifyJoin for the local node,
addPotentialLeader runs and InvokeClusterLeaderChangedListeners drives
the registered listener to resume() the sync loop on the elected
leader. End state matches the prior ordering.
* Single-node: IsLeader() returns true unconditionally per
channels/app/platform/cluster.go:33, so SharedChannelSyncHandler is
active during plugin OnActivate. Events emitted by plugins during
activation (posts to shared channels, DM creation) now flow through
sync where they were previously dropped. This is intended correctness,
not a regression.
* Transport and handlers: api4 remote-cluster routes are registered
before Server.Start, so HTTP handlers exist when rcs.Start runs early.
rcs and scs do not send cluster-broadcast messages during Start; they
only register topic listeners on the rcs transport, which is
independent of cluster gossip. registerClusterHandlers ordering is
unaffected.
* Config: scs reads only ConnectedWorkspacesSettings and the License at
construction, both stable from the initial config load. ReloadConfig
at server.go:912 has no bearing on inter-cluster service init.
Errors from startInterClusterServices remain logged and non-fatal,
matching prior behavior.
Restore the `fullyparallel: false` override for the unsharded
`Postgres with binary parameters` and `Postgres FIPS` jobs in the
weekly workflow. The override was originally added to the binary
parameters job in #35995 to prevent resource exhaustion on a single
runner, but was dropped when both jobs moved into
server-ci-weekly.yml in #36036, leaving them on the template default
of `true`.
Without it, the hosted runner is overwhelmed (too many server
instances, WebSocket hubs, and DB connections) and the runner agent
itself loses communication with GitHub mid-run, surfacing as
"hosted runner lost communication with the server" at ~55-60 min
into the Run Tests step. Both runs on April 27 and May 4 failed
this way; the sharded FIPS variant retained for FIPS-touching PRs
in server-ci.yml is unaffected because each shard handles only a
fraction of the packages.
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
#### Summary
Moving Hungarian language from Beta to Alpha as Hungarian has fallen below the 79% quality threshold for over three months.
#### Release Note
```release-note
Downgrading Hungarian translations from Beta to Alpha.
```
* Report POC
* Including more error logs
* Added localisationj for each reviewer
* Optimisations
* Minor tweaks
* restored go module files
* lint fixes
* Added back transslations
* Added translations
* linter and test fixes
* restored go module files
* e2e lint fix
* lint fixes
* AI fixes
* fixed typo
* fixed nil pointer error
* Added more tests
* Publish report even if deletion fails
* Fixed the e2e test
* Distinguished between no data and deleted data
* lint fixes
* fixed tests
* e2e test fix
* Updated test to also upload actual file
* Removed file name tracking
* Text updates
* fixed e2e test
* lint fix
* [MM-67867] Update Playbooks plugin to v2.8.1
Updates the prepackaged Playbooks plugin to v2.8.1 (regular and FIPS builds).
Prepackage FIPS version for Playbooks.
* Removing FIPS version
* Move min_date, max_date, time_interval into DialogElement.datetime_config
Consolidate date/datetime configuration into the datetime_config sub-object
on both DialogElement (Go/TS) and AppField (TS), deprecating the top-level
fields while keeping them for backward compatibility. DateTimeConfig values
take precedence over legacy fields via EffectiveDateTimeConfig() (Go) and
nullish coalescing fallback chains (TS).
Also fixes: timezone indicator now uses FormattedMessage for i18n, CSS class
with theme variable instead of inline styles, and proper DateTimeConfig type
instead of Record<string, unknown> cast.
* MM-68382 - align team creation invite permissions
Keep invite-related team settings consistent during team creation so authorization matches existing update and patch behavior.
Made-with: Cursor
* MM-68382 - move team create helper closer to usage
Keep the create-team authorization helper next to createTeam so the file reads in usage order.
Made-with: Cursor
* commit before ff
* MM-68382 - reject invite fields on create without permission
Reject createTeam with 403 (matching updateTeam/patchTeam) when the creator
tries to set AllowOpenInvite or AllowedDomains without PermissionInviteUser,
instead of silently stripping those fields. Add scheme-branch coverage and
log scheme-fetch failures from the permission check.
Made-with: Cursor
* api4: add symmetric happy path test for scheme InviteUser without invite fields
Cover team creation when the scheme grants InviteUser but AllowOpenInvite and
AllowedDomains are unset, asserting InviteId is returned in the response.
Made-with: Cursor
* [MM-68393] Tighten protected role patch authorization
Harden role patch authorization for protected system roles and cover the restricted paths with focused API tests.
Made-with: Cursor
* [MM-68393] Fix role patch test shadowing
Rename shadowing response variables in the protected role patch tests so govet passes in core and enterprise check-style jobs.
Made-with: Cursor
* [MM-68393] Block privileged role permissions
Made-with: Cursor
* MM-64977: Fix channel switcher row overlap with long names
In the Find Channels modal, very long channel names overflowed
their row and visually overlapped the team name shown on the right
because the team label was absolutely positioned and the channel
column did not reserve horizontal space.
Restructure the SwitchChannelSuggestion row to use a real flex
layout: a primary column wrapper holds the channel name and inline
metadata with `flex: 1 1 auto; min-width: 0;` so the name truncates
with an ellipsis, and the team-name span becomes a flex sibling
with `flex: 0 0 auto; max-width: 40%;` so it remains visible. The
channel name is wrapped in WithTooltip whose disabled prop is
driven by a useLayoutEffect-based scrollWidth > clientWidth check,
so the full name is shown on hover only when truncation occurs.
Made-with: Cursor
* MM-64977: Show tooltip on truncated team name as well
Mirror the channel-name tooltip behavior on the team-name span in
the channel switcher row: track its truncation state via the same
useLayoutEffect + ref pattern, and wrap the team name in WithTooltip
whose disabled prop is driven by scrollWidth > clientWidth. Hovering
the team label now reveals the full team display name when (and only
when) it is actually truncated.
Extend existing tooltip tests to assert the team-name tooltip
disabled flag mirrors the truncation state in both branches; loosen
the layout test to permit the WithTooltip wrapper around the team
span while still asserting the team name does not live inside the
primary column.
Made-with: Cursor
Every test binary that uses TestPool builds 16 stores in parallel, each
running the full migration set. Without DisableMorphLogging() the morph
debug stream from each store flows through to the test logger (which is
configured at LvlTrace), producing tens of thousands of "migrating (up)"
lines per shard — amplified further on shards that re-run flaky tests,
since every re-run spawns a fresh TestMain and a fresh pool.
Migration failures are still surfaced: engine.ApplyAll returns the
error, sqlstore.New wraps it as "failed to apply database migrations",
and both NewTestPool callers panic on a non-nil result.
Co-authored-by: Mattermost Build <build@mattermost.com>
The Invite Guest modal's 'Add to channels' section was rendering with
hard-coded or dimmed text colors that did not respect the active theme.
This was hardest to read on dark themes where the typed-input text and
the parenthetical channel name in the suggestion dropdown nearly blended
into the background.
Changes:
- Set the shared invite section title to var(--center-channel-color) so
it follows the active theme.
- Override the react-select default emotion color on
.channels-input__input-container so typed text in the channel picker
uses the themed color (the previous attempt only fixed the outer
control and the inner input, missing the input container that
react-select uses to set the inherited color).
- Use the themed color (with 0.75 alpha) for the .channel-name option
text and remove the 0.5 opacity layers so dark themes stay readable.
Fixes: https://mattermost.atlassian.net/browse/MM-68238
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Nick Misasi <nick13misasi@gmail.com>
* Avoid setting an empty value on slash command IconURL
When `PostEnablePostIconOverride` is enabled and no icon URL is
provided, the override icon URL was being set to empty and triggering
a warning. This change updates the behavior not to set the icon at
all, avoiding the triggering of the warn message while keeping the
behavior.
* Adds an additional check to the test
---------
Co-authored-by: Miguel de la Cruz <miguel@ctrlz.es>
* MM-68499 - auto run sync jobs on team admin abac policy creation
* Use child-policy flow for access-control sync ownership test
---------
Co-authored-by: Mattermost Build <build@mattermost.com>
* fix: detect ADFS when IdpDescriptorURL has no trailing slash
The ADFS detection in detectSAMLProviderType was checking for "/adfs/"
(with trailing slash) but standard ADFS IdpDescriptorURL values often
end with just "/adfs" (e.g. https://adfs.company.com/adfs), causing the
provider type to show as "unknown" in support packets.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: lowercase FederationMetadata pattern for case-insensitive matching
The normalizedURL is already lowercased, so comparing against the mixed-case
literal "/FederationMetadata/" made that branch unreachable.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* MM-67913: fix white flash on product navigation by centralizing app__body ownership
Previously, `document.body.classList.add/remove('app__body')` was managed
independently by `ChannelController` and each product plugin (Playbooks,
Boards). When switching products, the plugin's cleanup removed `app__body`
before the incoming tree's effect re-applied it. Because `ChannelController`
is deeply nested and sometimes async, a ~170ms gap could elapse during which
the body fell back to `background: $bg--gray`, producing a visible white
flash behind the transparent `GlobalHeader` and LHS.
Centralize `app__body` ownership in `WithUserTheme` via a new
`useAppBodyClass` hook. Since `WithUserTheme` wraps both the products
Switch and the `/:team` route in `root.tsx`, it stays mounted across
product navigation, so the class is never removed mid-transition.
`ChannelController` no longer toggles `app__body`; tests updated.
Product plugins (Playbooks, Boards) should stop touching `app__body` as
well; companion fixes land in their respective repos.
Made-with: Cursor
* MM-67913: add coverage for app body class ownership
Made-with: Cursor
* Update webapp/channels/src/components/theme_provider/theme_context.ts
Co-authored-by: Harrison Healey <harrisonmhealey@gmail.com>
* MM-67913: fix theme context hook closure
Made-with: Cursor
---------
Co-authored-by: Harrison Healey <harrisonmhealey@gmail.com>
The new TestRegisterPluginForSharedChannels tests added in #36126 broke
master CI because RegisterPluginForSharedChannels assigned opts.Displayname
directly to RemoteCluster.Name, which IsValid validates against the slug
regex ^[a-zA-Z0-9.\-_]+$. Display names with spaces (e.g. "legacy plugin")
fail validation. The tests didn't run in the PR's final CI shard and the
issue surfaced post-merge.
Add CleanRemoteName to the public model, mirroring CleanTeamName and
CleanUsername: lowercase, replace spaces and other disallowed characters
with hyphens, trim, truncate to RemoteNameMaxLength, fall back to NewId
when the result is empty. Use it in RegisterPluginForSharedChannels so
Name is always slug-valid while DisplayName keeps the human-readable label.
This also lets real plugins register with display names containing spaces.
* MM-67979 MM-67980: Add SMTP and push proxy connectivity to support packet
Adds a `notifications` section to `diagnostics.yaml` in the support
packet with SMTP email and push proxy connectivity probe results.
- `notifications.email.status`: ok/fail/disabled based on whether
SendEmailNotifications is enabled and an SMTP connection can be
established using mail.TestConnection()
- `notifications.push.status`: ok/fail/disabled based on whether
SendPushNotifications is enabled and an HTTP GET to the configured
PushNotificationServer URL succeeds
- Error messages are included in the `error` field on failure
- No email or push notification is sent during the probe
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* fix: handle errcheck lint violations in support_packet_test.go
Suppress unhandled error return values from rw.WriteString calls in
the mock SMTP server used in tests.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: use 127.0.0.1 directly in SMTP reachability test
Replace localhost:0 with 127.0.0.1:0 for the mock SMTP listener so
that it always binds to the loopback interface. In CI Docker containers
localhost may resolve to the container IP rather than 127.0.0.1, causing
the SMTP dial to fail with connection refused. Also switch from string
manipulation to net.TCPAddr type assertion for reliable host/port
extraction.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: override MM_EMAILSETTINGS_SMTPSERVER env var in SMTP reachability test
The CI environment sets MM_EMAILSETTINGS_SMTPSERVER=inbucket via
test.env. Mattermost's config Store.Set() calls GetEnvironment()
(os.Environ()) on every UpdateConfig, so env vars silently override
any programmatic config change. Use t.Setenv before UpdateConfig so
the env var points to 127.0.0.1 for the duration of the subtest.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Add model.StatusDisabled constant and use it in support_packet.go
Replace "disabled" string literals with model.StatusDisabled for
consistency with model.StatusOk and model.StatusFail.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* refactor: use utils.GetHostnameFromSiteURL, extract testPushProxyConnection helper, set LDAP StatusDisabled
- Replace manual url.Parse with utils.GetHostnameFromSiteURL (consistent with app/config.go)
- Extract push proxy HTTP check into testPushProxyConnection with TODO to move to its own package
- Set d.LDAP.Status = model.StatusDisabled when LDAP is not configured
- Replace "disabled" string literals in tests with model.StatusDisabled
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: add status field to ElasticSearch diagnostics with ok/fail/disabled
When indexing is enabled, reports ok or fail based on TestConfig result.
When indexing is disabled or the engine is unavailable, reports disabled.
Backend/ServerVersion/ServerPlugins are still collected when the engine
exists regardless of indexing status.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: update Happy path test for LDAP and ES StatusDisabled assertions
Both are disabled in the test environment so they now report StatusDisabled.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: use GET /version endpoint for push proxy connectivity check
Use url.JoinPath to construct the /version path safely, replacing
raw root URL access. Also validate the HTTP status code so non-2xx/3xx
responses are treated as failures.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
* Add XML struct tags and multi-remote registration for shared channels plugin API
Phase 1: Add xml struct tags to model types used in SyncMsg (Post, User,
Reaction, Status, PostAcknowledgement, FileInfo, SyncResponse,
MembershipChangeMsg). Add custom MarshalXML/UnmarshalXML for SyncMsg
(Users map, MentionTransforms map), StringMap, and StringInterface.
Exclude Post.Metadata, PrevStatus, and server-internal FileInfo fields
from XML. JSON serialization is unaffected.
Phase 2: Lift the one-remote-per-plugin constraint so plugins can
register multiple remotes with different SiteURLs. Add SiteURL field to
RegisterPluginOpts (defaults to "plugin_<PluginID>" for backward
compatibility). Add GetAllByPluginID and GetBySiteURL store methods.
Rewrite registration to dedup by SiteURL instead of PluginID. Add
UnregisterPluginRemoteForSharedChannels for single-remote removal with
plugin ownership validation. Validate SiteURL is non-empty in
RemoteCluster.IsValid. Simplify IsPlugin() to check PluginID only.
* ci: compile mmctl e2e tests with requirefips when FIPS_ENABLED=true
Without this, the mmctl test binary was compiled without the requirefips
tag even in the FIPS container, leaving model.FIPSEnabled=false and
PasswordSettings.MinimumLength=8. Short passwords like "somepass" passed
validation and hashing silently succeeded, giving false confidence that
the tests were FIPS-clean.
* tests: fix short password in TestUserConvertCmdF for FIPS
"Valid bot to user convert" reached ConvertBotToUser with "password"
(8 chars), which fails MinimumLength=14 on FIPS builds.
* MM-67319 Move ShortcutKey component into Shared Package
* MM-67322 Add i18n-extract support for shared package and move key constants
* MM-67320 Move WithTooltip into shared package without modification
* Add CSS variables for standard z-indices
* Update TooltipShortcut to point to shared ShortcutKey
* Update TooltipContent to use shared Emoji
* Move isMessageDescriptor into shared package
* Add Floating UI as explicit dependency of shared package
* Fix WithTooltip imports
* Fix imports for ShortcutX types
* Move/copy tooltip constants into shared package
* Fix WithTooltip tests
* Remove unneeded TODO comments
* Actually share new modules with plugins
* Stop publishing src folder for shared package
Maria A Nunez