mirror of
https://github.com/mattermost/mattermost.git
synced 2026-08-27 05:37:15 -05:00
* MM-69561: Add ability to rotate (regenerate) Personal Access Tokens - Add UpdateTokenRotate to UserAccessTokenStore interface and implement in sqlstore: deletes sessions on the old secret, then updates the token row with the new secret and expiry in one transaction - Regenerate store retrylayer, timerlayer, and mocks - Add RotateUserAccessToken app method: validates expiry (bot-exempt), captures old session for cache eviction, generates new secret, and sends a notification email - Register POST /api/v4/users/tokens/rotate handler with full permission checks (create_user_access_token + edit_other_users + manage_system for sysadmin targets); rejects OAuth sessions and disabled tokens - Add RotateUserAccessToken to the Go client (client4.go) - Add storetest covering secret rotation and old-session cleanup - Add API4 tests: happy path, permission denials, OAuth rejection, and max-lifetime enforcement Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * MM-69561: Add dedicated rotate email and i18n strings - Add SendUserAccessTokenRotatedEmail (subject/body distinct from the 'added' email so users aren't confused by a rotation event) - Add SendUserAccessTokenRotatedEmail to ServiceInterface + mock - Add en.json strings for the rotate email and the two new error ids (rotate.app_error, disabled_token.app_error) - Switch RotateUserAccessToken to call SendUserAccessTokenRotatedEmail Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * MM-69561: Add mmctl token rotate subcommand - Add RotateUserAccessToken to the mmctl Client interface and mock - Add 'mmctl token rotate <token-id> [--expires-in <duration>]' command reusing the existing resolveTokenExpiry/parseExpiresIn helpers from 'generate'; prints the new secret once on success - Add unit tests: happy path, --expires-in passed through, server error, invalid --expires-in Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * MM-69561: Regenerate mmctl docs for token rotate Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * MM-69561: Add API docs for POST /users/tokens/rotate Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * MM-69561: Fix i18n string ordering after extract Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * MM-69561: Add missing API4 test cases for token rotate Cover the three untested access-control branches flagged by the test analysis bot: - Rotating a disabled token returns 400 - Non-system-admin rotating a sysadmin's token returns 403 - Rotating a remote user's token returns 403 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * MM-69561: Address review comments - Fix handler authorization order: check SessionHasPermissionToUserOrBot and manage_system before IsRemote/IsActive to avoid leaking token state to unauthorized callers; matches revokeUserAccessToken/disableUserAccessToken - Fix API docs minimum server version: 10.8 -> 10.10 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * MM-69561: Restore i18n strings accidentally deleted by extract The earlier i18n-extract run stripped ~164 unrelated translation keys (mostly enterprise-only strings like app.pap.* and api.ldap.*) because the enterprise codebase isn't present in this checkout, so the extractor treated them as unused. Restore them while keeping the 5 new keys added for token rotation. * comment * [MM-69561] Add webapp Regenerate option for Personal Access Tokens Adds a "Regenerate" link to Account Settings > Security > Personal Access Tokens that calls the POST /users/tokens/rotate endpoint added in the server-side rotate PAT work. Regenerating shows a confirmation modal naming the token, then reveals the new secret via the existing one-time-copy flow used for token creation. - webapp Client4.rotateUserAccessToken - mattermost-redux rotateUserAccessToken action - Regenerate link/confirm modal/reveal flow in user_access_token_section - i18n strings - Playwright e2e coverage * Fix regenerate PAT e2e test: confirm modal is not nested in the Profile dialog ConfirmModal renders via react-bootstrap's Modal, which portals to document.body as a sibling of the Profile dialog rather than a descendant, so it must be located via #confirmModal on the page instead of scoped to the Profile dialog locator. * Let users pick a new expiry when regenerating a Personal Access Token Previously, regenerating a token always called rotateUserAccessToken with no expiresAt, so the rotated secret never expired even if the original token did. The Regenerate confirmation modal now includes the same expiry picker used by token creation (extracted into a shared renderExpiryPicker helper), enforces MaximumPersonalAccessTokenLifetimeDays the same way, and disables the confirm button until a valid expiry is selected. * Scope the red background in the Regenerate modal to the warning text only The confirmation question, expiry picker, and its hints were sitting inside the same alert-danger box as the warning, making the whole modal read as an error. Only the warning paragraph keeps the red background now. * Move the regenerate confirmation question below the expiry picker * Align rotate-token wording with UI: use 'regenerate/regenerated' Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * [MM-69561] rename pat_expiry_notify job to notify_expiring_access_tokens Unifies naming with the sibling cleanup_expired_access_tokens job and fixes the "expiry" vs "expiring" ambiguity: this job warns about tokens approaching expiry, not ones that have already expired. Safe to rename outright since the job hasn't shipped yet. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * [MM-69561] remove dead session lookup from EnableUserAccessToken The GetSessionContext call and its result were never used: both branches returned nil regardless. Leftover from mirroring DisableUserAccessToken's shape, which does use its session (to revoke it) unlike Enable. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * [MM-69561] rename remaining PAT identifiers to match AccessToken convention The job-level rename (pat_expiry_notify -> notify_expiring_access_tokens) left the app-layer function and its helpers using the old PAT/ PersonalAccessToken naming. Rename them to match: - NotifyPersonalAccessTokensExpiring -> NotifyExpiringAccessTokens - patExpiryBucket -> accessTokenExpiryBucket - sendPATExpiryNotification -> sendAccessTokenExpiryNotification - patExpiryNotifyBatchLimit -> expiringAccessTokenBatchLimit - patExpiryThresholds -> expiringAccessTokenThresholds - maxPersonalAccessTokenExpiry -> maxUserAccessTokenExpiry Also reword the package doc on notify_expiring_access_tokens, which no longer needs to explain a PAT/UserAccessToken naming split now that the app-layer method matches the job name. Pure rename, no behavior change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
E2E testing for the Mattermost web client
This directory contains the E2E testing code for the Mattermost web client.
How to run locally
For test case development
Please refer to the dedicated developer documentation for instructions.
For pipeline debugging
The E2E testing pipeline's scripts depend on the following tools being installed on your system: docker, docker-compose, make, git, jq, node, and some common utilities (coreutils, findutils, bash, awk, sed, grep)
Instructions, tl;dr: create a local branch with your E2E test changes, then open a PR to the mattermost-server repo targeting the master branch (so that CI will produce the image that docker-compose needs), then run make in this directory.
Instructions, detailed:
- (optional, undefined variables are set to sane defaults) Create the
.ci/envfile, and populate it with the variables you need out of the following list:
SERVER: eitheronprem(default) orcloud.CWS_URL(mandatory whenSERVER=cloud, only used in such case): when spinning up a cloud-like test server that communicates with a test instance of a customer web server.TEST: eithercypress(default),playwright, ornone(to avoid creating the cypress/playwright sidecar containers, e.g. if you only want to launch a server instance)ENABLED_DOCKER_SERVICES: a space-separated list of services to start alongside the server. Default topostgres inbucket, for smoke test purposes and for lightweight and faster start-up time. Depending on the test requirement being worked on, you may want to override as needed, as such:- Cypress full tests require all services to be running:
postgres inbucket minio openldap elasticsearch keycloak. - Cypress smoke tests require only the following:
postgres inbucket. - Playwright full tests require only the following:
postgres inbucket.
- Cypress full tests require all services to be running:
- The following variables, will be passed over to the server container:
MM_LICENSE(no enterprise features will be available if this is unset; required whenSERVER=cloud), and the explodedMM_ENV(a comma-separated list of env var specifications) - The following variables, which will be passed over to the cypress container:
BRANCH,BUILD_ID,CI_BASE_URL,BROWSER,AUTOMATION_DASHBOARD_URLandAUTOMATION_DASHBOARD_TOKEN - The
SERVER_IMAGEvariable can also be set if you want to select a custom mattermost-server image. If not specified, the value of theSERVER_IMAGE_DEFAULTvariable defined in file.ci/.e2ercis used. - The
TEST_FILTERvariable can also be set, to customize which tests you want Cypress/Playwright to run. If not specified, only the smoke tests will run- Its format depends on which tool is used: for Cypress, please check the
e2e-tests/cypress/run_tests.jsfile for details. For Playwright, it can simply be populated with arguments you want to give to theplaywright testcommand.
- Its format depends on which tool is used: for Cypress, please check the
- More variables may be required to configure reporting and cloud interactions. Check the content of the
.ci/report.*.shand.ci/server.cloud_*.shscripts for reference.
- (optional)
make start-dashboard && make generate-test-cycle: start the automation dashboard in the background, and initiate a test cycle on it, for the givenBUILD_ID
- NB: the
BUILD_IDvalue should stay the same across themake generate-test-cyclecommand, and the subsequentmake(see next step). If you need to initiate a new test cycle on the same dashboard, you'll need to change theBUILD_IDvalue and rerun bothmake generate-test-cycleandmake. - Note that part of the dashboard functionality assumes the
BUILD_IDto have a certain format (see here for details). This is not relevant for local running, but it's important to note in the testing pipelines. - This also automatically sets the
AUTOMATION_DASHBOARD_URLandAUTOMATION_DASHBOARD_TOKENvariables for the cypress container - Note that if you run the dashboard locally, but also specify other
AUTOMATION_DASHBOARD_*variables in your.ci/envfile, the latter variables will take precedence. - The dashboard is used for orchestrating specs with parallel test runs and is typically used in CI.
- Only Cypress is currently using the dashboard; Playwright is not.
make: start and prepare the server, then run the Cypress smoke tests
- You can track the progress of the run in the
http://localhost:4000/cyclesdashboard if you launched it locally - For
SERVER=cloudruns, you'll need to first create a cloud customer against the specifiedCWS_URLservice by runningmake cloud-init. The user isn't automatically removed, and may be reused across multiple runs until you runmake cloud-teardownto delete it. - If you want to run the Playwright tests instead of the Cypress ones, you can run
TEST=playwright make - If you just want to run a local server instance, without any further testing, you can run
TEST=none make - If you're using the automation dashboard, you have the option of sharding the E2E test run: you can launch the
makecommand in parallel on different machines (NB: you must use the sameBUILD_IDandBRANCHvalues that you used formake generate-test-cycle) to distribute running the test cases across them. When doing this, you should also set on each machine theCI_BASE_URLvariable to a value that uniquely identifies the instance wheremakeis running. - This script will also parse the local test results, and write a
e2e-tests/${TEST}/results/summary.jsonfile containing the following keys:passed,failedandfailed_expected(the total number of testcases that were run is the sum of these three numbers)
make stop: tears down the server (and the dashboard, if running)
- This will stop and cleanup all of the E2E testing containers, including the database and its persistent volume.
- This also implicitly runs
make clean, which also removes any generated environment or docker-compose files.
Notes:
- Setting a variable in
.ci/envis functionally equivalent to exporting variables in your current shell's environment, before invoking the makefile. - The
.ci/.env.*files are auto-generated by the pipeline scripts and aren't meant to be modified manually. The only file you should edit to control the containers' environment is.ci/env, as specified in the instructions above. - All of the variables in
.ci/envmust be set before themake generate-servercommand is run (or, if using the dashboard, before themake generate-test-cyclecommand). Modifying that file afterward has no effect because the containers' env files are generated in that step. - If you restart the dashboard at any point, you must also restart the server containers, so that it picks up the new IP of the dashboard from the newly generated
.env.dashboardfile - If new variables need to be passed to any of the containers, here are the general principles to follow when deciding where to populate it:
- If their value is fixed (e.g. a static server configuration), these may be simply added to the
docker_compose_generator.shfile, to the appropriate container. - If you need to introduce variables that you want to control from
.ci/env: you need to update the scripts under the.ci/dir and configure them to write the new variables' values over to the appropriate.env.*file. In particular, avoid defining variables that depend on other variables within the docker-compose override files: this is to ensure uniformity in their availability and simplifies the question of what container has access to which variable considerably. - Exceptions are of course accepted wherever it makes sense (e.g. if you need to group variables based on some common functionality)
- If their value is fixed (e.g. a static server configuration), these may be simply added to the
- The
reportMake target is meant for internal usage. Usage and variables are documented in the respective scripts. make start-serverwon't cleanup containers that don't change across runs. This means that you can use it to emulate a Mattermost server upgrade while retaining your database data by simply changing theSERVER_IMAGEvariable on your machine, and then re-runningmake start-server. But this also means that if you want to run a clean local environment, you may have to manually runmake stopto cleanup any running containers and their volumes, which include e.g. the database.
For code changes:
make fmt-cito format and check yaml files and shell scripts.
For test stressing an E2E testcase
For Cypress:
- Enter the
cypress/subdirectory - Identify which test files you want to run, and how many times each. For instance: suppose you want to run
create_a_team_spec.jsanddemoted_user_spec.js(which you can locate with thefindcommand, undercypress/tests/), each run 3 times - Run the chosen testcases the desired amount of times:
node run_tests.js --include-file=create_a_team_spec.js,demoted_user_spec.js --invert --stress-test-count=3
- Your system needs to be setup for Cypress usage, to be able to run this command. Refer to the E2E testing developer documentation for this.
- The
cypress/results/testPasses.jsonfile will count, for each of the testfiles, how many times it was run, and how many times each of the testcases contained in it passed. If the attempts and passes numbers do not match, that specific testcase may be flaky.
For Playwright: WIP