mirror of
https://github.com/mattermost/mattermost.git
synced 2026-08-30 17:06:34 +08:00
cursor[bot]
0ef9b7bf52
* [MM-64634] Improve license error for wrong service environment When a cryptographically valid license is uploaded to a server running a different service environment (e.g. a production license on a test/dev server, or vice versa), ValidateLicense now retries verification against the alternate environment's public key. On success it returns a distinct error that callers surface as the new WrongEnvironmentLicenseError, giving admins an actionable message instead of the generic "Invalid license file." Genuinely corrupt licenses still return the existing InvalidLicenseError. Co-authored-by: mattermost-code <matty-code@mattermost.com> * [MM-64634] Add tests for wrong-environment license error mapping Cover SaveLicense (the System Console upload entry point) returning WrongEnvironmentLicenseError for a license signed for another service environment, and add a direct unit test for NewLicenseValidationAppError. Co-authored-by: mattermost-code <matty-code@mattermost.com> * Add audit logging for wrong-environment license upload failures Handle WrongEnvironmentLicenseError in addLicense and localAddLicense so environment mismatches are logged distinctly instead of falling through to the generic unable-to-save message. Co-authored-by: mattermost-code <matty-code@mattermost.com> * Log wrong-environment audit in LicenseFromBytes error path addLicense validates the license before SaveLicense, so WrongEnvironmentLicenseError is returned from LicenseFromBytes and never reaches the SaveLicense audit handler. Co-authored-by: mattermost-code <matty-code@mattermost.com> * Address PR feedback: remove license validation audit logging from addLicense Per review feedback, the per-error-id audit logging added to the LicenseFromBytes failure path in addLicense doesn't belong in the audit logs. Remove it to clean up the diff; the AppError is still returned to the caller unchanged. Resolves: 1 change request * Remove wrong-environment license audit logging Per review feedback, the wrong-environment license classification does not belong in the audit logs. Revert the audit logging additions in both the cloud and local license upload handlers. * Split wrong-environment license error by direction Per review feedback, distinguish between a production license uploaded to a test/dev server and a test/dev license uploaded to a production server. Each case now maps to its own AppError ID and user-facing message instead of a single generic wrong-environment error. * Restrict wrong-environment license fallback to signature failures Only treat alternate-key verification success as a wrong-environment mismatch when the primary key failed with rsa.ErrVerification. Other primary-key failures (e.g. malformed key material) are now surfaced unchanged instead of being masked as a wrong-environment license, and non-verification errors from the alternate-key check are no longer discarded. * Regenerate store layers and mocks for SessionStore --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: mattermost-code <matty-code@mattermost.com> Co-authored-by: Mattermost Build <build@mattermost.com>