snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

server/channels/app/property_errors_test.go

@@ -0,0 +1,146 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package app
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/mattermost/mattermost/server/v8/channels/app/properties"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMapPropertyServiceError(t *testing.T) {
+	t.Run("nil err returns nil", func(t *testing.T) {
+		require.Nil(t, mapPropertyServiceError("Where", nil))
+	})
+
+	t.Run("unknown err returns nil so caller can 500-wrap", func(t *testing.T) {
+		require.Nil(t, mapPropertyServiceError("Where", errors.New("db connection lost")))
+	})
+
+	t.Run("unwrapped AppError is returned as-is via fallback", func(t *testing.T) {
+		orig := model.NewAppError("SomeSource", "some.id", nil, "detail", http.StatusTeapot)
+		got := mapPropertyServiceError("Where", orig)
+		require.NotNil(t, got)
+		assert.Same(t, orig, got)
+	})
+
+	sentinelCases := []struct {
+		name           string
+		sentinel       error
+		expectedID     string
+		expectedStatus int
+		expectDetail   bool
+	}{
+		{
+			name:           "access denied",
+			sentinel:       properties.ErrAccessDenied,
+			expectedID:     "app.property.access_denied.app_error",
+			expectedStatus: http.StatusForbidden,
+			expectDetail:   false,
+		},
+		{
+			name:           "sync locked",
+			sentinel:       properties.ErrSyncLocked,
+			expectedID:     "app.property.sync_lock.app_error",
+			expectedStatus: http.StatusForbidden,
+			expectDetail:   false,
+		},
+		{
+			name:           "invalid access mode",
+			sentinel:       properties.ErrInvalidAccessMode,
+			expectedID:     "app.property.invalid_access_mode.app_error",
+			expectedStatus: http.StatusBadRequest,
+			expectDetail:   true,
+		},
+		{
+			name:           "field limit reached",
+			sentinel:       properties.ErrFieldLimitReached,
+			expectedID:     "app.property_field.create.limit_reached.app_error",
+			expectedStatus: http.StatusUnprocessableEntity,
+			expectDetail:   true,
+		},
+		{
+			name:           "group field limit reached",
+			sentinel:       properties.ErrGroupFieldLimitReached,
+			expectedID:     "app.property_field.create.group_limit_reached.app_error",
+			expectedStatus: http.StatusUnprocessableEntity,
+			expectDetail:   true,
+		},
+		{
+			name:           "license required",
+			sentinel:       properties.ErrLicenseRequired,
+			expectedID:     "app.property.license_error",
+			expectedStatus: http.StatusForbidden,
+			expectDetail:   false,
+		},
+		{
+			name:           "invalid field attrs",
+			sentinel:       properties.ErrInvalidFieldAttrs,
+			expectedID:     "app.property_field.invalid_attrs.app_error",
+			expectedStatus: http.StatusBadRequest,
+			expectDetail:   true,
+		},
+		{
+			name:           "invalid value",
+			sentinel:       properties.ErrInvalidValue,
+			expectedID:     "app.property_value.validate.app_error",
+			expectedStatus: http.StatusBadRequest,
+			expectDetail:   true,
+		},
+		{
+			name:           "admin required",
+			sentinel:       properties.ErrAdminRequired,
+			expectedID:     "app.property_field.managed_admin.permission.app_error",
+			expectedStatus: http.StatusForbidden,
+			expectDetail:   false,
+		},
+		{
+			name:           "field not found",
+			sentinel:       properties.ErrFieldNotFound,
+			expectedID:     "app.property_field.not_found.app_error",
+			expectedStatus: http.StatusNotFound,
+			expectDetail:   false,
+		},
+	}
+
+	for _, tc := range sentinelCases {
+		t.Run("direct sentinel: "+tc.name, func(t *testing.T) {
+			got := mapPropertyServiceError("Where", tc.sentinel)
+			require.NotNil(t, got)
+			assert.Equal(t, tc.expectedID, got.Id)
+			assert.Equal(t, tc.expectedStatus, got.StatusCode)
+			assert.Equal(t, "Where", got.Where)
+			if tc.expectDetail {
+				assert.NotEmpty(t, got.DetailedError, "sentinel %s should carry operator-facing detail", tc.name)
+			} else {
+				assert.Empty(t, got.DetailedError, "sentinel %s should redact detail to avoid leaking internal identifiers", tc.name)
+			}
+		})
+
+		t.Run("wrapped sentinel detected through chain: "+tc.name, func(t *testing.T) {
+			wrapped := fmt.Errorf("outer context: %w", fmt.Errorf("inner context: %w", tc.sentinel))
+			got := mapPropertyServiceError("Where", wrapped)
+			require.NotNil(t, got)
+			assert.Equal(t, tc.expectedID, got.Id)
+			assert.Equal(t, tc.expectedStatus, got.StatusCode)
+		})
+	}
+
+	t.Run("sentinel priority over wrapped AppError", func(t *testing.T) {
+		// A hook that wraps an AppError with a sentinel should be mapped by
+		// the sentinel, not by the embedded AppError.
+		inner := model.NewAppError("OldPath", "old.id", nil, "old detail", http.StatusTeapot)
+		wrapped := fmt.Errorf("authz denied: %w: %w", properties.ErrAccessDenied, inner)
+		got := mapPropertyServiceError("Where", wrapped)
+		require.NotNil(t, got)
+		assert.Equal(t, "app.property.access_denied.app_error", got.Id)
+		assert.Equal(t, http.StatusForbidden, got.StatusCode)
+	})
+}