snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

e2e-tests/playwright/specs/functional/system_console/abac/ldap/ldap_sync_add.spec.ts

@@ -0,0 +1,154 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+import {
+    expect,
+    test,
+    enableABAC,
+    navigateToABACPage,
+    runSyncJob,
+    verifyUserInChannel,
+    updateUserAttributes,
+    createUserWithAttributes,
+} from '@mattermost/playwright-lib';
+
+import {
+    ensureUserAttributes,
+    createPrivateChannelForABAC,
+    createBasicPolicy,
+    createAdvancedPolicy,
+    activatePolicy,
+    waitForLatestSyncJob,
+    getPolicyIdByName,
+} from '../support';
+
+/**
+ * MM-T5797a: LDAP sync - User auto-added with `= is` operator (auto-add true)
+ *
+ * 1. Policy with Department == Engineering, auto-add=true
+ * 2. User has non-qualifying attribute (Sales) → not added on first sync
+ * 3. Attribute updated to Engineering (simulating LDAP sync)
+ * 4. Next sync auto-adds the user
+ */
+test('MM-T5797a LDAP sync - User auto-added with == operator (auto-add true)', async ({pw}) => {
+    test.setTimeout(120000);
+    await pw.skipIfNoLicense();
+
+    const {adminUser, adminClient, team} = await pw.initSetup();
+    await ensureUserAttributes(adminClient, ['Department']);
+
+    const user = await createUserWithAttributes(adminClient, {Department: 'Sales'});
+    await adminClient.addToTeam(team.id, user.id);
+
+    const channel = await createPrivateChannelForABAC(adminClient, team.id);
+
+    const {systemConsolePage} = await pw.testBrowser.login(adminUser);
+    await navigateToABACPage(systemConsolePage.page);
+    await enableABAC(systemConsolePage.page);
+
+    const policyName = `LDAP AutoAdd Equals ${await pw.random.id()}`;
+    await createBasicPolicy(systemConsolePage.page, {
+        name: policyName,
+        attribute: 'Department',
+        operator: '==',
+        value: 'Engineering',
+        autoSync: true,
+        channels: [channel.display_name],
+    });
+
+    const policyId = (await getPolicyIdByName(adminClient, policyName))!;
+    await activatePolicy(adminClient, policyId);
+
+    // Initial sync — user has non-qualifying attribute, should not be added.
+    // Capture exact job ID so we poll the right job, not the most-recent row
+    // (which may belong to a concurrent shard's sync job under PW_WORKERS >= 2).
+    const syncJob5797a1 = await runSyncJob(systemConsolePage.page);
+    await waitForLatestSyncJob(systemConsolePage.page, undefined, syncJob5797a1);
+
+    // Poll: sync job marks itself success before channel_members write is committed.
+    await expect
+        .poll(() => verifyUserInChannel(adminClient, user.id, channel.id), {
+            timeout: 15_000,
+            intervals: [500, 1000, 2000],
+            message: 'User should NOT be in channel after first sync (Department=Sales)',
+        })
+        .toBe(false);
+
+    // Simulate LDAP sync: update attribute to qualifying value.
+    await updateUserAttributes(adminClient, user.id, {Department: 'Engineering'});
+
+    // Sync again — user now qualifies and should be auto-added.
+    const syncJob5797a2 = await runSyncJob(systemConsolePage.page);
+    await waitForLatestSyncJob(systemConsolePage.page, undefined, syncJob5797a2);
+
+    await expect
+        .poll(() => verifyUserInChannel(adminClient, user.id, channel.id), {
+            timeout: 15_000,
+            intervals: [500, 1000, 2000],
+            message: 'User should be in channel after second sync (Department=Engineering)',
+        })
+        .toBe(true);
+});
+
+/**
+ * MM-T5797b: LDAP sync - User auto-added with `contains` operator (auto-add true)
+ *
+ * 1. Policy with Department.contains("Eng"), auto-add=true
+ * 2. User has non-qualifying attribute (Sales) → not added on first sync
+ * 3. Attribute updated to Engineering (simulating LDAP sync)
+ * 4. Next sync auto-adds the user
+ */
+test('MM-T5797b LDAP sync - User auto-added with contains operator (auto-add true)', async ({pw}) => {
+    test.setTimeout(120000);
+    await pw.skipIfNoLicense();
+
+    const {adminUser, adminClient, team} = await pw.initSetup();
+    await ensureUserAttributes(adminClient, ['Department']);
+
+    const user = await createUserWithAttributes(adminClient, {Department: 'Sales'});
+    await adminClient.addToTeam(team.id, user.id);
+
+    const channel = await createPrivateChannelForABAC(adminClient, team.id);
+
+    const {systemConsolePage} = await pw.testBrowser.login(adminUser);
+    await navigateToABACPage(systemConsolePage.page);
+    await enableABAC(systemConsolePage.page);
+
+    const policyName = `LDAP AutoAdd Contains ${await pw.random.id()}`;
+    await createAdvancedPolicy(systemConsolePage.page, {
+        name: policyName,
+        celExpression: 'user.attributes.Department.contains("Eng")',
+        autoSync: true,
+        channels: [channel.display_name],
+    });
+
+    const policyId = (await getPolicyIdByName(adminClient, policyName))!;
+    await activatePolicy(adminClient, policyId);
+
+    // Initial sync — user has non-qualifying attribute, should not be added.
+    const syncJob5797b1 = await runSyncJob(systemConsolePage.page);
+    await waitForLatestSyncJob(systemConsolePage.page, undefined, syncJob5797b1);
+
+    await expect
+        .poll(() => verifyUserInChannel(adminClient, user.id, channel.id), {
+            timeout: 15_000,
+            intervals: [500, 1000, 2000],
+            message: 'User should NOT be in channel after first sync (Department=Sales)',
+        })
+        .toBe(false);
+
+    // Simulate LDAP sync: update Department to value containing "Eng".
+    await updateUserAttributes(adminClient, user.id, {Department: 'Engineering'});
+
+    // Sync again — user now qualifies and should be auto-added.
+    const syncJob5797b2 = await runSyncJob(systemConsolePage.page);
+    await waitForLatestSyncJob(systemConsolePage.page, undefined, syncJob5797b2);
+
+    await expect
+        .poll(() => verifyUserInChannel(adminClient, user.id, channel.id), {
+            timeout: 15_000,
+            intervals: [500, 1000, 2000],
+            message: 'User should be in channel after second sync (Department=Engineering)',
+        })
+        .toBe(true);
+});

e2e-tests/playwright/specs/functional/system_console/abac/ldap/ldap_sync_admin.spec.ts

@@ -0,0 +1,169 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+import {
+    expect,
+    test,
+    enableABAC,
+    navigateToABACPage,
+    runSyncJob,
+    verifyUserInChannel,
+    updateUserAttributes,
+    createUserWithAttributes,
+} from '@mattermost/playwright-lib';
+
+import {
+    ensureUserAttributes,
+    createPrivateChannelForABAC,
+    createBasicPolicy,
+    createAdvancedPolicy,
+    activatePolicy,
+    waitForLatestSyncJob,
+    getPolicyIdByName,
+} from '../support';
+
+/**
+ * ABAC LDAP Integration - Sync
+ * Tests for LDAP sync behavior with ABAC policies
+ */
+test.describe('ABAC LDAP Integration - Sync', () => {
+    /**
+     * MM-T5798: LDAP sync - User can be added to channel by admin after editing qualifying attribute (auto-add false)
+     *
+     * Step 1: Using `= is` operator
+     * 1. Policy with auto-add=false exists and is applied to a channel
+     * 2. User has wrong attribute value (non-qualifying)
+     * 3. Simulate LDAP sync by updating user's attribute to qualifying value
+     * 4. Run ABAC sync job (updates qualification state but doesn't auto-add due to auto-add=false)
+     * 5. Verify user NOT auto-added
+     * 6. Admin manually adds user to channel
+     *
+     * Step 2: Using `∈ in` operator
+     * 1. Policy with `in` operator exists
+     * 2. User has attribute but not a qualifying value
+     * 3. Simulate LDAP sync by updating to qualifying value
+     * 4. Admin adds user to channel
+     *
+     * Expected:
+     * - User who satisfies policy can be added by admin
+     * - `User added` message posted in channel
+     *
+     * NOTE: This test simulates LDAP attribute sync behavior via API.
+     *       In production, attributes would be synced from LDAP server.
+     */
+    test('MM-T5798 User added by admin after LDAP attribute sync (auto-add false)', async ({pw}) => {
+        test.setTimeout(180000);
+
+        await pw.skipIfNoLicense();
+
+        // ============================================================
+        // SETUP
+        // ============================================================
+        const {adminUser, adminClient, team} = await pw.initSetup();
+
+        await ensureUserAttributes(adminClient);
+
+        // ============================================================
+        // STEP 1: Test with `= is` operator
+        // ============================================================
+
+        // Create user with NON-qualifying attribute (simulating LDAP user before sync)
+        const user1 = await createUserWithAttributes(adminClient, {Department: 'Sales'});
+        await adminClient.addToTeam(team.id, user1.id);
+
+        const channel1 = await createPrivateChannelForABAC(adminClient, team.id);
+
+        const {systemConsolePage} = await pw.testBrowser.login(adminUser);
+        await navigateToABACPage(systemConsolePage.page);
+        await enableABAC(systemConsolePage.page);
+
+        const policy1Name = `LDAP Sync Equals ${pw.random.id()}`;
+        await createBasicPolicy(systemConsolePage.page, {
+            name: policy1Name,
+            attribute: 'Department',
+            operator: '==',
+            value: 'Engineering',
+            autoSync: false,
+            channels: [channel1.display_name],
+        });
+
+        // Get policy ID via API (no DOM scraping, no page reload needed)
+        const policyId1 = (await getPolicyIdByName(adminClient, policy1Name))!;
+        await activatePolicy(adminClient, policyId1);
+
+        // Initial sync — user has non-qualifying attribute, should not be added.
+        // Capture exact job ID so we poll the right job, not the most-recent row
+        // (which may belong to a concurrent shard's sync job under PW_WORKERS >= 2).
+        const syncJob5798a1 = await runSyncJob(systemConsolePage.page);
+        await waitForLatestSyncJob(systemConsolePage.page, undefined, syncJob5798a1);
+
+        const user1InitialCheck = await verifyUserInChannel(adminClient, user1.id, channel1.id);
+        expect(user1InitialCheck).toBe(false);
+
+        // Simulate LDAP sync: update attribute to qualifying value
+        await updateUserAttributes(adminClient, user1.id, {Department: 'Engineering'});
+
+        // Sync again — auto-add=false, so user is NOT auto-added even when qualifying
+        const syncJob5798a2 = await runSyncJob(systemConsolePage.page);
+        await waitForLatestSyncJob(systemConsolePage.page, undefined, syncJob5798a2);
+
+        const user1AfterSync = await verifyUserInChannel(adminClient, user1.id, channel1.id);
+
+        if (!user1AfterSync) {
+            // Expected: admin must manually add qualifying user when auto-add=false
+            await adminClient.addToChannel(user1.id, channel1.id);
+            const user1AfterAdminAdd = await verifyUserInChannel(adminClient, user1.id, channel1.id);
+            expect(user1AfterAdminAdd).toBe(true);
+        }
+
+        const user1Final = await verifyUserInChannel(adminClient, user1.id, channel1.id);
+        expect(user1Final).toBe(true);
+
+        // ============================================================
+        // STEP 2: Test with `∈ in` operator
+        // ============================================================
+
+        const user2 = await createUserWithAttributes(adminClient, {Department: 'Marketing'});
+        await adminClient.addToTeam(team.id, user2.id);
+
+        const channel2 = await createPrivateChannelForABAC(adminClient, team.id);
+
+        await navigateToABACPage(systemConsolePage.page);
+
+        const policy2Name = `LDAP Sync In ${pw.random.id()}`;
+        await createAdvancedPolicy(systemConsolePage.page, {
+            name: policy2Name,
+            celExpression: 'user.attributes.Department in ["Engineering", "Product"]',
+            autoSync: false,
+            channels: [channel2.display_name],
+        });
+
+        const policyId2 = (await getPolicyIdByName(adminClient, policy2Name))!;
+        await activatePolicy(adminClient, policyId2);
+
+        // Initial sync — non-qualifying, should not be added
+        const syncJob5798b1 = await runSyncJob(systemConsolePage.page);
+        await waitForLatestSyncJob(systemConsolePage.page, undefined, syncJob5798b1);
+
+        const user2InitialCheck = await verifyUserInChannel(adminClient, user2.id, channel2.id);
+        expect(user2InitialCheck).toBe(false);
+
+        // Simulate LDAP sync: update to qualifying value
+        await updateUserAttributes(adminClient, user2.id, {Department: 'Product'});
+
+        // Sync again — auto-add=false, admin must manually add
+        const syncJob5798b2 = await runSyncJob(systemConsolePage.page);
+        await waitForLatestSyncJob(systemConsolePage.page, undefined, syncJob5798b2);
+
+        const user2AfterSync = await verifyUserInChannel(adminClient, user2.id, channel2.id);
+
+        if (!user2AfterSync) {
+            await adminClient.addToChannel(user2.id, channel2.id);
+            const user2AfterAdminAdd = await verifyUserInChannel(adminClient, user2.id, channel2.id);
+            expect(user2AfterAdminAdd).toBe(true);
+        }
+
+        const user2Final = await verifyUserInChannel(adminClient, user2.id, channel2.id);
+        expect(user2Final).toBe(true);
+    });
+});

e2e-tests/playwright/specs/functional/system_console/abac/ldap/ldap_sync_bidirectional.spec.ts

@@ -0,0 +1,121 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+import {
+    expect,
+    test,
+    enableABAC,
+    navigateToABACPage,
+    runSyncJob,
+    verifyUserInChannel,
+    updateUserAttributes,
+    createUserWithAttributes,
+} from '@mattermost/playwright-lib';
+
+import {
+    ensureUserAttributes,
+    createPrivateChannelForABAC,
+    createBasicPolicy,
+    activatePolicy,
+    waitForLatestSyncJob,
+} from '../support';
+
+/**
+ * ABAC LDAP Integration - Sync
+ * Tests for LDAP sync behavior with ABAC policies
+ */
+test.describe('ABAC LDAP Integration - Sync', () => {
+    /**
+     * MM-T5800: Policy enforcement after attribute change
+     * @objective Verify that policy enforcement updates when user attributes change
+     *
+     * This test is similar to MM-T5794 but focuses on the bidirectional nature:
+     * - User starts with non-qualifying attribute → NOT in channel
+     * - Attribute changed to qualifying value → User auto-added
+     * - Attribute changed back to non-qualifying → User auto-removed
+     */
+    test('MM-T5800 Policy enforcement after attribute change (bidirectional)', async ({pw}) => {
+        // 4 x waitForLatestSyncJob at up to 180 s each, plus policy creation and browser
+        // navigation — CI LDAP sync jobs can take significantly longer than the default 90 s.
+        test.setTimeout(300000);
+
+        await pw.skipIfNoLicense();
+
+        // ============================================================
+        // SETUP
+        // ============================================================
+        const {adminUser, adminClient, team} = await pw.initSetup();
+        await ensureUserAttributes(adminClient);
+
+        // Create user with Sales department (non-qualifying)
+        const user = await createUserWithAttributes(adminClient, {Department: 'Sales'});
+        await adminClient.addToTeam(team.id, user.id);
+
+        const privateChannel = await createPrivateChannelForABAC(adminClient, team.id);
+
+        // ============================================================
+        // Create policy for Engineering with auto-add
+        // ============================================================
+        const {systemConsolePage} = await pw.testBrowser.login(adminUser);
+        await navigateToABACPage(systemConsolePage.page);
+        await enableABAC(systemConsolePage.page);
+
+        const policyName = `Dynamic Policy ${pw.random.id()}`;
+        const createJobId = await createBasicPolicy(systemConsolePage.page, {
+            name: policyName,
+            attribute: 'Department',
+            operator: '==',
+            value: 'Engineering',
+            autoSync: true,
+            channels: [privateChannel.display_name],
+        });
+
+        // Activate policy
+        await waitForLatestSyncJob(systemConsolePage.page, undefined, createJobId, 180_000);
+        const searchInput = systemConsolePage.page.locator('input[placeholder*="Search" i]').first();
+        await searchInput.waitFor({state: 'visible', timeout: 5000});
+        const idMatch = policyName.match(/([a-z0-9]+)$/i);
+        const uniqueId = idMatch ? idMatch[1] : policyName;
+        await searchInput.fill(uniqueId);
+        await systemConsolePage.page.waitForTimeout(1000);
+
+        const policyRow = systemConsolePage.page.locator('.policy-name').first();
+        const policyId = (await policyRow.getAttribute('id'))?.replace('customDescription-', '');
+
+        if (policyId) {
+            await activatePolicy(adminClient, policyId);
+        }
+        await searchInput.clear();
+
+        // ============================================================
+        // PHASE 1: User should NOT be added (Department=Sales)
+        // ============================================================
+        const syncJob1 = await runSyncJob(systemConsolePage.page);
+        await waitForLatestSyncJob(systemConsolePage.page, undefined, syncJob1, 180_000);
+
+        const phase1InChannel = await verifyUserInChannel(adminClient, user.id, privateChannel.id);
+        expect(phase1InChannel).toBe(false);
+
+        // ============================================================
+        // PHASE 2: Change attribute to qualifying value → User auto-added
+        // ============================================================
+        await updateUserAttributes(adminClient, user.id, {Department: 'Engineering'});
+
+        const syncJob2 = await runSyncJob(systemConsolePage.page);
+        await waitForLatestSyncJob(systemConsolePage.page, undefined, syncJob2, 180_000);
+
+        const phase2InChannel = await verifyUserInChannel(adminClient, user.id, privateChannel.id);
+        expect(phase2InChannel).toBe(true);
+
+        // ============================================================
+        // PHASE 3: Change attribute back → User auto-removed
+        // ============================================================
+        await updateUserAttributes(adminClient, user.id, {Department: 'Marketing'});
+
+        const syncJob3 = await runSyncJob(systemConsolePage.page);
+        await waitForLatestSyncJob(systemConsolePage.page, undefined, syncJob3, 180_000);
+
+        const phase3InChannel = await verifyUserInChannel(adminClient, user.id, privateChannel.id);
+        expect(phase3InChannel).toBe(false);
+    });
+});

e2e-tests/playwright/specs/functional/system_console/abac/ldap/ldap_sync_removal_bidirectional.spec.ts

@@ -0,0 +1,93 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+import {
+    expect,
+    test,
+    navigateToABACPage,
+    runSyncJob,
+    verifyUserInChannel,
+    updateUserAttributes,
+    createUserWithAttributes,
+} from '@mattermost/playwright-lib';
+
+import {
+    ensureUserAttributes,
+    createPrivateChannelForABAC,
+    createBasicPolicy,
+    activatePolicy,
+    waitForLatestSyncJob,
+    getPolicyIdByName,
+} from '../support';
+
+/**
+ * MM-T5800: Policy enforcement after attribute change (bidirectional)
+ */
+test('MM-T5800 Policy enforcement after attribute change (bidirectional)', async ({pw}) => {
+    test.setTimeout(180000);
+
+    await pw.skipIfNoLicense();
+
+    const {adminUser, adminClient, team} = await pw.initSetup();
+
+    // Ensure the "Department" custom profile attribute exists before creating users.
+    // A concurrent test shard may not yet have run the global setup, or the attribute
+    // may have been recreated under a different ID — ensureUserAttributes is idempotent.
+    await ensureUserAttributes(adminClient);
+
+    // User starts with non-qualifying attribute.
+    const user = await createUserWithAttributes(adminClient, {Department: 'Sales'});
+    await adminClient.addToTeam(team.id, user.id);
+
+    const privateChannel = await createPrivateChannelForABAC(adminClient, team.id);
+
+    const {systemConsolePage} = await pw.testBrowser.login(adminUser);
+    await navigateToABACPage(systemConsolePage.page);
+
+    const policyName = `Dynamic Policy ${await pw.random.id()}`;
+    await createBasicPolicy(systemConsolePage.page, {
+        name: policyName,
+        attribute: 'Department',
+        operator: '==',
+        value: 'Engineering',
+        autoSync: true,
+        channels: [privateChannel.display_name],
+    });
+    const t5800PolicyId = (await getPolicyIdByName(adminClient, policyName))!;
+
+    await activatePolicy(adminClient, t5800PolicyId);
+
+    // PHASE 1: User has non-qualifying attribute — not in channel without a sync.
+    const phase1InChannel = await verifyUserInChannel(adminClient, user.id, privateChannel.id);
+    expect(phase1InChannel).toBe(false);
+
+    // PHASE 2: Change to qualifying → User auto-added.
+    await updateUserAttributes(adminClient, user.id, {Department: 'Engineering'});
+
+    // Capture exact job ID so waitForLatestSyncJob polls the right job, not
+    // the most-recent row (which may belong to a concurrent shard's sync job).
+    const syncJob2 = await runSyncJob(systemConsolePage.page);
+    await waitForLatestSyncJob(systemConsolePage.page, undefined, syncJob2);
+
+    await expect
+        .poll(() => verifyUserInChannel(adminClient, user.id, privateChannel.id), {
+            timeout: 15_000,
+            intervals: [500, 1000, 2000],
+            message: 'User should have been added to channel after qualifying sync',
+        })
+        .toBe(true);
+
+    // PHASE 3: Change back to non-qualifying → User auto-removed.
+    await updateUserAttributes(adminClient, user.id, {Department: 'Marketing'});
+
+    const syncJob3 = await runSyncJob(systemConsolePage.page);
+    await waitForLatestSyncJob(systemConsolePage.page, undefined, syncJob3);
+
+    await expect
+        .poll(() => verifyUserInChannel(adminClient, user.id, privateChannel.id), {
+            timeout: 15_000,
+            intervals: [500, 1000, 2000],
+            message: 'User should have been removed from channel after non-qualifying sync',
+        })
+        .toBe(false);
+});

e2e-tests/playwright/specs/functional/system_console/abac/ldap/ldap_sync_removal_equals.spec.ts

@@ -0,0 +1,86 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+import {
+    expect,
+    test,
+    enableABAC,
+    navigateToABACPage,
+    runSyncJob,
+    verifyUserInChannel,
+    updateUserAttributes,
+    createUserWithAttributes,
+} from '@mattermost/playwright-lib';
+
+import {
+    ensureUserAttributes,
+    createPrivateChannelForABAC,
+    createBasicPolicy,
+    activatePolicy,
+    waitForLatestSyncJob,
+    getPolicyIdByName,
+} from '../support';
+
+/**
+ * MM-T5799b: LDAP sync - User removed after attribute removed (== operator, auto-add true)
+ */
+test('MM-T5799b LDAP sync - User removed with == operator (auto-add true)', async ({pw}) => {
+    test.setTimeout(120000);
+
+    await pw.skipIfNoLicense();
+
+    const {adminUser, adminClient, team} = await pw.initSetup();
+    await ensureUserAttributes(adminClient, ['Department']);
+
+    // User starts WITH qualifying attribute.
+    const user2 = await createUserWithAttributes(adminClient, {Department: 'Engineering'});
+    await adminClient.addToTeam(team.id, user2.id);
+
+    const channel2 = await createPrivateChannelForABAC(adminClient, team.id);
+
+    const {systemConsolePage} = await pw.testBrowser.login(adminUser);
+    await navigateToABACPage(systemConsolePage.page);
+    await enableABAC(systemConsolePage.page);
+
+    const policy2Name = `LDAP Remove TwoAttr ${await pw.random.id()}`;
+    await createBasicPolicy(systemConsolePage.page, {
+        name: policy2Name,
+        attribute: 'Department',
+        operator: '==',
+        value: 'Engineering',
+        autoSync: true,
+        channels: [channel2.display_name],
+    });
+    const t5799Policy2Id = (await getPolicyIdByName(adminClient, policy2Name))!;
+
+    await activatePolicy(adminClient, t5799Policy2Id);
+
+    // Sync: user has qualifying attribute → gets auto-added.
+    // Capture exact job ID so we poll the right job, not the most-recent row
+    // (which may belong to a concurrent shard's sync job under PW_WORKERS >= 2).
+    const syncJob5799b1 = await runSyncJob(systemConsolePage.page);
+    await waitForLatestSyncJob(systemConsolePage.page, undefined, syncJob5799b1);
+
+    await expect
+        .poll(() => verifyUserInChannel(adminClient, user2.id, channel2.id), {
+            timeout: 15_000,
+            intervals: [500, 1000, 2000],
+            message: 'User should have been added to channel after first sync',
+        })
+        .toBe(true);
+
+    // Change Department to non-qualifying value.
+    await updateUserAttributes(adminClient, user2.id, {Department: 'Sales'});
+
+    // Sync: user no longer qualifies → gets removed.
+    const syncJob5799b2 = await runSyncJob(systemConsolePage.page);
+    await waitForLatestSyncJob(systemConsolePage.page, undefined, syncJob5799b2);
+
+    await expect
+        .poll(() => verifyUserInChannel(adminClient, user2.id, channel2.id), {
+            timeout: 15_000,
+            intervals: [500, 1000, 2000],
+            message: 'User should have been removed from channel after second sync',
+        })
+        .toBe(false);
+});

e2e-tests/playwright/specs/functional/system_console/abac/ldap/ldap_sync_removal_startsWith.spec.ts

@@ -0,0 +1,90 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+import {
+    expect,
+    test,
+    enableABAC,
+    navigateToABACPage,
+    runSyncJob,
+    verifyUserInChannel,
+    updateUserAttributes,
+    createUserWithAttributes,
+} from '@mattermost/playwright-lib';
+
+import {
+    ensureUserAttributes,
+    createPrivateChannelForABAC,
+    createAdvancedPolicy,
+    activatePolicy,
+    waitForLatestSyncJob,
+    getPolicyIdByName,
+} from '../support';
+
+/**
+ * MM-T5799a: LDAP sync - User removed after attribute removed (startsWith operator, auto-add true)
+ */
+test('MM-T5799a LDAP sync - User removed with startsWith operator (auto-add true)', async ({pw}) => {
+    test.setTimeout(120000);
+
+    await pw.skipIfNoLicense();
+
+    const {adminUser, adminClient, team} = await pw.initSetup();
+
+    // Ensure the "Department" attribute exists — may not be present if global
+    // setup hasn't run yet or ran on a different shard.
+    await ensureUserAttributes(adminClient, ['Department']);
+
+    // User starts WITH qualifying attribute (Department starts with "Eng").
+    const user1 = await createUserWithAttributes(adminClient, {Department: 'Engineering'});
+    await adminClient.addToTeam(team.id, user1.id);
+
+    const channel1 = await createPrivateChannelForABAC(adminClient, team.id);
+
+    const {systemConsolePage} = await pw.testBrowser.login(adminUser);
+    await navigateToABACPage(systemConsolePage.page);
+    await enableABAC(systemConsolePage.page);
+
+    const policy1Name = `LDAP Remove StartsWith ${await pw.random.id()}`;
+    await createAdvancedPolicy(systemConsolePage.page, {
+        name: policy1Name,
+        celExpression: 'user.attributes.Department.startsWith("Eng")',
+        autoSync: true,
+        channels: [channel1.display_name],
+    });
+    const t5799Policy1Id = (await getPolicyIdByName(adminClient, policy1Name))!;
+
+    // Activate immediately using the UUID — no creation-sync wait needed.
+    await activatePolicy(adminClient, t5799Policy1Id);
+
+    // Sync: user has qualifying attribute → gets auto-added.
+    // Capture exact job ID so we poll the right job, not the most-recent row
+    // (which may belong to a concurrent shard's sync job under PW_WORKERS >= 2).
+    const syncJob5799a1 = await runSyncJob(systemConsolePage.page);
+    await waitForLatestSyncJob(systemConsolePage.page, undefined, syncJob5799a1);
+
+    // Poll: the sync job marks itself success before the channel_members write
+    // is fully committed.  Give the server up to 15 s to catch up.
+    await expect
+        .poll(() => verifyUserInChannel(adminClient, user1.id, channel1.id), {
+            timeout: 15_000,
+            intervals: [500, 1000, 2000],
+            message: 'User should have been added to channel after first sync',
+        })
+        .toBe(true);
+
+    // Simulate LDAP sync: change Department to non-qualifying value.
+    await updateUserAttributes(adminClient, user1.id, {Department: 'Sales'});
+
+    // Sync: user no longer qualifies → gets removed.
+    const syncJob5799a2 = await runSyncJob(systemConsolePage.page);
+    await waitForLatestSyncJob(systemConsolePage.page, undefined, syncJob5799a2);
+
+    await expect
+        .poll(() => verifyUserInChannel(adminClient, user1.id, channel1.id), {
+            timeout: 15_000,
+            intervals: [500, 1000, 2000],
+            message: 'User should have been removed from channel after second sync',
+        })
+        .toBe(false);
+});