snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

server/channels/api4/access_control_decision_test.go

@@ -0,0 +1,175 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package api4
+
+import (
+	"context"
+	"testing"
+
+	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/mattermost/mattermost/server/public/plugin/plugintest/mock"
+	"github.com/mattermost/mattermost/server/v8/einterfaces/mocks"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSearchAccessControlDecisionActions(t *testing.T) {
+	th := SetupConfig(t, func(cfg *model.Config) {
+		cfg.FeatureFlags.PermissionPolicies = true
+	}).InitBasic(t)
+
+	channelResource := model.Resource{Type: model.AccessControlPolicyTypeChannel, ID: th.BasicChannel.Id}
+
+	t.Run("requires a session", func(t *testing.T) {
+		client := th.CreateClient() // unauthenticated
+		_, resp, err := client.SearchAccessControlDecisionActions(context.Background(), model.ActionSearchRequest{
+			Resource: channelResource,
+			Actions:  []string{model.AccessControlPolicyActionUploadFileAttachment},
+		})
+		require.Error(t, err)
+		CheckUnauthorizedStatus(t, resp)
+	})
+
+	t.Run("unsupported action returns bad request", func(t *testing.T) {
+		_, resp, err := th.Client.SearchAccessControlDecisionActions(context.Background(), model.ActionSearchRequest{
+			Resource: channelResource,
+			Actions:  []string{"definitely_not_a_real_action"},
+		})
+		require.Error(t, err)
+		CheckBadRequestStatus(t, resp)
+	})
+
+	t.Run("invalid request returns bad request", func(t *testing.T) {
+		_, resp, err := th.Client.SearchAccessControlDecisionActions(context.Background(), model.ActionSearchRequest{
+			Resource: model.Resource{Type: "", ID: th.BasicChannel.Id},
+			Actions:  []string{model.AccessControlPolicyActionUploadFileAttachment},
+		})
+		require.Error(t, err)
+		CheckBadRequestStatus(t, resp)
+	})
+
+	t.Run("unsupported resource type returns bad request", func(t *testing.T) {
+		// A non-channel resource type must be rejected outright rather than silently skipping
+		// the resource-access check. Discovery mode (no actions) previously returned an empty 200.
+		_, resp, err := th.Client.SearchAccessControlDecisionActions(context.Background(), model.ActionSearchRequest{
+			Resource: model.Resource{Type: model.AccessControlPolicyTypeTeam, ID: th.BasicTeam.Id},
+		})
+		require.Error(t, err)
+		CheckBadRequestStatus(t, resp)
+	})
+
+	t.Run("returns allowed when ABAC is inactive", func(t *testing.T) {
+		th.App.UpdateConfig(func(cfg *model.Config) {
+			*cfg.AccessControlSettings.EnableAttributeBasedAccessControl = false
+		})
+
+		out, resp, err := th.Client.SearchAccessControlDecisionActions(context.Background(), model.ActionSearchRequest{
+			Resource: channelResource,
+			Actions:  []string{model.AccessControlPolicyActionUploadFileAttachment, model.AccessControlPolicyActionDownloadFileAttachment},
+		})
+		require.NoError(t, err)
+		CheckOKStatus(t, resp)
+		require.Len(t, out.Decisions, 2)
+		require.True(t, out.Decisions[model.AccessControlPolicyActionUploadFileAttachment].Allowed)
+		require.True(t, out.Decisions[model.AccessControlPolicyActionUploadFileAttachment].Evaluated)
+	})
+
+	t.Run("returns PDP deny for the session user", func(t *testing.T) {
+		th.App.UpdateConfig(func(cfg *model.Config) {
+			*cfg.AccessControlSettings.EnableAttributeBasedAccessControl = true
+		})
+		mockACS := &mocks.AccessControlServiceInterface{}
+		original := th.App.Srv().Channels().AccessControl
+		th.App.Srv().Channels().AccessControl = mockACS
+		defer func() { th.App.Srv().Channels().AccessControl = original }()
+
+		mockACS.On("AccessEvaluation", mock.Anything, mock.MatchedBy(func(req model.AccessRequest) bool {
+			return req.Resource.ID == th.BasicChannel.Id && req.Action == model.AccessControlPolicyActionUploadFileAttachment
+		})).Return(model.AccessDecision{Decision: false}, (*model.AppError)(nil))
+
+		out, resp, err := th.Client.SearchAccessControlDecisionActions(context.Background(), model.ActionSearchRequest{
+			Resource: channelResource,
+			Actions:  []string{model.AccessControlPolicyActionUploadFileAttachment},
+		})
+		require.NoError(t, err)
+		CheckOKStatus(t, resp)
+		require.False(t, out.Decisions[model.AccessControlPolicyActionUploadFileAttachment].Allowed)
+		require.True(t, out.Decisions[model.AccessControlPolicyActionUploadFileAttachment].Evaluated)
+		require.Empty(t, out.Results) // denied actions must not appear in the AuthZEN results list
+	})
+
+	t.Run("discovery mode returns all actions when ABAC inactive", func(t *testing.T) {
+		th.App.UpdateConfig(func(cfg *model.Config) {
+			*cfg.AccessControlSettings.EnableAttributeBasedAccessControl = false
+		})
+
+		out, resp, err := th.Client.SearchAccessControlDecisionActions(context.Background(), model.ActionSearchRequest{
+			Resource: channelResource,
+		})
+		require.NoError(t, err)
+		CheckOKStatus(t, resp)
+		require.Len(t, out.Decisions, 2)
+		require.Len(t, out.Results, 2)
+	})
+
+	t.Run("subject not matching session user returns 403", func(t *testing.T) {
+		_, resp, err := th.Client.SearchAccessControlDecisionActions(context.Background(), model.ActionSearchRequest{
+			Resource: channelResource,
+			Actions:  []string{model.AccessControlPolicyActionUploadFileAttachment},
+			Subject:  &model.ActionSearchSubject{ID: model.NewId()},
+		})
+		require.Error(t, err)
+		CheckForbiddenStatus(t, resp)
+	})
+
+	t.Run("subject matching session user is accepted", func(t *testing.T) {
+		th.App.UpdateConfig(func(cfg *model.Config) {
+			*cfg.AccessControlSettings.EnableAttributeBasedAccessControl = false
+		})
+
+		out, resp, err := th.Client.SearchAccessControlDecisionActions(context.Background(), model.ActionSearchRequest{
+			Resource: channelResource,
+			Actions:  []string{model.AccessControlPolicyActionUploadFileAttachment},
+			Subject:  &model.ActionSearchSubject{ID: th.BasicUser.Id},
+		})
+		require.NoError(t, err)
+		CheckOKStatus(t, resp)
+		require.True(t, out.Decisions[model.AccessControlPolicyActionUploadFileAttachment].Allowed)
+	})
+
+	t.Run("non-member of private channel returns 403", func(t *testing.T) {
+		th.App.UpdateConfig(func(cfg *model.Config) {
+			*cfg.AccessControlSettings.EnableAttributeBasedAccessControl = false
+		})
+		// Create a private channel as system admin; BasicUser is not a member.
+		privateCh, _, err := th.SystemAdminClient.CreateChannel(context.Background(), &model.Channel{
+			TeamId:      th.BasicTeam.Id,
+			Name:        model.NewId(),
+			DisplayName: "Private Not Member",
+			Type:        model.ChannelTypePrivate,
+		})
+		require.NoError(t, err)
+
+		_, resp, err := th.Client.SearchAccessControlDecisionActions(context.Background(), model.ActionSearchRequest{
+			Resource: model.Resource{Type: model.AccessControlPolicyTypeChannel, ID: privateCh.Id},
+			Actions:  []string{model.AccessControlPolicyActionUploadFileAttachment},
+		})
+		require.Error(t, err)
+		CheckForbiddenStatus(t, resp)
+	})
+
+	t.Run("page field accepted and ignored", func(t *testing.T) {
+		th.App.UpdateConfig(func(cfg *model.Config) {
+			*cfg.AccessControlSettings.EnableAttributeBasedAccessControl = false
+		})
+
+		out, resp, err := th.Client.SearchAccessControlDecisionActions(context.Background(), model.ActionSearchRequest{
+			Resource: channelResource,
+			Actions:  []string{model.AccessControlPolicyActionUploadFileAttachment},
+			Page:     &model.ActionSearchPage{NextToken: "tok"},
+		})
+		require.NoError(t, err)
+		CheckOKStatus(t, resp)
+		require.Nil(t, out.Page)
+	})
+}