* Prevent system-owned bots from being disabled System-owned bots (system-bot, content-review) could be disabled either directly via the API or via the owner-deactivation path when DisableBotsWhenOwnerIsDeactivated=true. Once disabled, they never self-healed, silently breaking post reminders, reports, and channel notifications. - Add model.ProtectedBotUsernames and remove the dead BotWarnMetricBotUsername constant. - Guard UpdateBotActive so protected bots cannot be disabled (403), covering both the API and disableUserBots paths. - Auto-heal the system bot in GetOrCreateSystemOwnedBot by fetching including deleted and re-enabling if disabled. - Hide the Edit and Disable controls for protected bots in the System Console bot list. Co-authored-by: mattermost-code <matty-code@mattermost.com> * Strengthen tests for protected system bots - Parameterize the app-layer guard test over both protected usernames (system-bot and content-review). - Assert the underlying user is also reactivated by the auto-heal path. - Drive the owner-deactivation test through the real UpdateActive path and add a non-protected bot to prove the batch keeps disabling other bots. - Add an API-layer test asserting a 403 when disabling the system bot. - Make the webapp recovery test click Enable and assert the action fires. Co-authored-by: mattermost-code <matty-code@mattermost.com> * Address CodeRabbit feedback on protected bot reactivation - Add reactivateProtectedBot to bypass active-user limit checks when auto-healing or re-enabling disabled system-owned bots - Fail closed on bot store lookup errors in UpdateBotActive before mutating user state Co-authored-by: mattermost-code <matty-code@mattermost.com> * Fix govet shadow lint in reactivateProtectedBot Co-authored-by: mattermost-code <matty-code@mattermost.com> * Update unknown bot test for bot-first lookup in UpdateBotActive Co-authored-by: mattermost-code <matty-code@mattermost.com> * Address PR feedback: DRY protected bot reactivation, range over ProtectedBotUsernames, label system bots as Managed by Mattermost * Refactor UpdateActive to share inner updateActive with protected bot reactivation * Address PR feedback: remove user-limit bypass for bot activation Bot accounts are excluded from the active-user/license counts (User().Count defaults to IncludeBotAccounts=false), so the dedicated bypass path was guarding a case that cannot occur. Revert the UpdateActive/updateActive split and the protected-bot branch in UpdateBotActive; bot (re)activation goes through the normal UpdateActive path again. * Replace hardcoded webapp protected-bot list with server-driven system_owned field Addresses marianunez's review comment: the webapp kept its own copy of the protected bot usernames (system-bot, content-review), duplicating model.ProtectedBotUsernames and risking silent drift if a new system-owned bot is added server-side without updating the client list. model.Bot now computes IsSystemOwned() from ProtectedBotUsernames and serializes it as system_owned via a custom MarshalJSON, so the webapp reads it directly off the bot instead of matching usernames itself. --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: mattermost-code <matty-code@mattermost.com> Co-authored-by: Ben Schumacher <ben.schumacher@mattermost.com>
This folder contains a number of packages intended to be built and shipped separately on NPM as well as a few legacy packages for internal use only (reselect and mattermost-redux). The following documentation only applies to the newer packages and not to the legacy ones.
Importing a subpackage
Subpackages should be imported using their full name, both inside the web app and when installing them using npm. They should not be imported using a relative path, and the src folder shouldn't be necessary to include.
// Correct
import {Client4} from '@mattermost/client';
import {UserProfile} from '@mattermost/types/users';
// Incorrect
import Client4 from 'packages/client/src/client4.ts';
import {UserProfile} from '../../types/src/users';
Some tools have difficulty doing this on their own, but they often support import path aliases so that we can keep them consistent acrosss the code base. More details on how to do this will be provided in packages where this is necessary such as types.
Importing one subpackage into another
When building packages that depend on each other, be careful to:
- Avoid import loops. While JavaScript lets us get away with these in most cases within a project, we cannot have two packages that depend directly with each other.
- Not compile one subpackage into another. We don't want the published libraries to include code from one subpackage into another. They should be set up so that they're peer dependencies in the
package.json, and if a project wants to use multiple packages, they can install them each separately.
As above, some tooling may need additional configuration to have one subpackage use code from another. For example, in packages compiled with the TypeScript compiler (tsc), you'll need to have the tsconfig.json from the dependent pacakge reference its dependency using the references field.
Versioning subpackages
At this time, we'll have the version of each package match the version of the web app. Versions can be incremented for each affected package by using npm version, and then npm install should be run to propagate those changes into the shared package-lock.json.
# Set a version of a single package
npm version 6.7.8 --workspace=packages/apple
# Increment the version of each package to the next minor version
npm version minor --workspaces
## Increment the version of a package to a pre-release version of the next minor version
npm version preminor --workspace=packages/apple
When a subpackage imports another, it should be set to depend on the * version of the other subpackage.
Adding a new subpackage
To set up a new package:
- Add a
package.jsonandREADME.mdfor that package. - Ensure all source files are located in
srcand all compiled files are built tolib. - Add an entry to the
workspacessection of the rootpackage.jsonso that NPM is aware of your package. - Set up import aliases so that the package is visible from the web app to the following tools:
-
TypeScript - In the root
tsconfig.json, add an entry to thecompilerOptions.pathssection pointing to thesrcfolder and an entry to thereferencessection pointing to the root of your package which should contain its owntsconfig.json.Note that the
compilerOptions.pathsentry will differ based on if your package exports just a single module (ie a singleindex.jsfile) or if it exports multiple submodules.{ "compilerOptions": { "paths": { "@mattermost/apple": ["packages/apple/lib"], // import * as Apple from '@mattermost/apple'; "@mattermost/banana/*": ["packages/banana/lib/*"], // import Yellow from '@mattermost/banana/yellow'; } }, "references": [ {"path": "./packages/apple"}, {"path": "./packages/banana"}, ] } -
Jest - Add an entry to the
jest.moduleNameMappersection of the rootjest.config.jsfor your package. Since that setting supports regexes, you can add these to the existing patterns used by theclientandtypespackages.Similar to TypeScript, this will differ based on if the package exports a single module or multiple modules.
{ "jest": { "moduleNameMapper": { "^@mattermost/(apple|client)$": "<rootDir>/packages/$1/src", "^@mattermost/(banana|types)/(.*)$": "<rootDir>/packages/$1/src/$2", } } }
-
- Add the compiled code to the CircleCI dependency cache. This is done by modifying the
pathsused by thesave_cachestep in.circleci/config.ymlaliases: - &save_cache save_cache: paths: - ~/mattermost/mattermost-webapp/packages/apple/lib - ~/mattermost/mattermost-webapp/packages/banana/lib
Publishing a subpackage
The following is the rough process for releasing these packages. They'll require someone with write access on our NPM organization to run them, and they'll likely change over time as we improve this process.
For full releases accompanying new versions of Mattermost:
-
Clean the repo.
make clean -
Update the version of the desired packages to match the server/web app as described above.
-
Download an up to date copy of the dependencies and update package-lock.json.
make node_modules -
Check in the changes to the package-lock.json.
-
Build the desired packages.
npm run build --workspace=packages/apple --workspace=packages/banana -
Test everything in the web app. This will be needed until the packages get their own standalone tests.
make check-style check-types test -
Assuming those pass, you can now publish those packages to npm. You can also do a dry run first or use
npm packto see exactly which files will be pushed.# Run a dry run which will list all the files to be included in the published package. npm publish --dry-run --workspace=packages/apple # Generate the tar file that will be uploaded to NPM for inspection. npm pack --workspace=packages/apple # Actually publish these packages. You can also use --workspaces to publish everything. npm publish --access=public --workspace=packages/apple --workspace=packages/bananaThe packages have now been published! There's still a few remaining cleanup tasks to do though.
-
Tag the commit for each package that has been updated. The tag name should be of the form
@mattermost/package-name@x.y.z. -
Push that commit and the corresponding tags up to GitHub
git push release-x.y git push origin @mattermost/apple@x.y.z @mattermost/banana@x.y.z
Publishing a pre-release version
Similarly, you can publish a pre-release version of the package. This can be done either to use changes from master while developing another product/plugin or to generate a release candidate.
This process is the same as above, except the version will have a suffix like -1, -2, etc. As explained above, this can be automatically done by using npm version preminor for minor releases, npm version premajor for major releases, and npm version prerelease for patch releases. These versions won't be automatically installed when people add them using npm add without a version, but they can be installed by specifying the version number manually.
Caveats
-
Currently, all packages are treated by CI as if they're part of the web app. This means that, for example, their style checking and tests are ran as part of the web app. In turn, that means that regardless of what tooling we use to build each package, they'll be compiled into the web app using webpack directly from source, and that it's possible for them to behave slightly differently in development compared to after release.
Eventually, we hope to get these building in parallel (so instead of having webpack watch the whole repo for changes during development, we'll have multiple watchers for the web app and each package) which should solve this issue, but that requires much larger changes that we're not ready to do yet.
-
For packages that export multiple submodules (such as
types), we've chosen to expose these using Node's subpath exports feature. Some tools like Webpack support this natively, but others like TypeScript and Jest don't support it yet. We've provided steps on how to support this in theREADME.mdfor thetypespackage, but this may vary depending on the project's setup.