snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

server/channels/web/context_test.go

@@ -0,0 +1,181 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package web
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/mattermost/mattermost/server/public/plugin/plugintest/mock"
+	"github.com/mattermost/mattermost/server/v8/channels/store/storetest/mocks"
+)
+
+func TestMakeAuditRecord(t *testing.T) {
+	t.Run("PAT session includes token ID in meta", func(t *testing.T) {
+		th := SetupWithStoreMock(t)
+
+		tokenID := model.NewId()
+		th.Context = th.Context.WithSession(&model.Session{
+			Id:     model.NewId(),
+			UserId: model.NewId(),
+			Props: model.StringMap{
+				model.SessionPropType:              model.SessionTypeUserAccessToken,
+				model.SessionPropUserAccessTokenId: tokenID,
+			},
+		})
+
+		c := &Context{App: th.App, AppContext: th.Context}
+		rec := c.MakeAuditRecord("test_event", model.AuditStatusAttempt)
+
+		require.NotNil(t, rec)
+		assert.Equal(t, tokenID, rec.Meta[model.SessionPropUserAccessTokenId])
+	})
+
+	t.Run("non-PAT session omits token ID from meta", func(t *testing.T) {
+		th := SetupWithStoreMock(t)
+
+		th.Context = th.Context.WithSession(&model.Session{
+			Id:     model.NewId(),
+			UserId: model.NewId(),
+		})
+
+		c := &Context{App: th.App, AppContext: th.Context}
+		rec := c.MakeAuditRecord("test_event", model.AuditStatusAttempt)
+
+		require.NotNil(t, rec)
+		_, exists := rec.Meta[model.SessionPropUserAccessTokenId]
+		assert.False(t, exists, "token ID key should be absent from Meta for non-PAT sessions")
+	})
+}
+
+func TestLogAuditRec(t *testing.T) {
+	t.Run("late-fills token ID for PAT session", func(t *testing.T) {
+		th := SetupWithStoreMock(t)
+
+		tokenID := model.NewId()
+		th.Context = th.Context.WithSession(&model.Session{
+			Id:     model.NewId(),
+			UserId: model.NewId(),
+			Props: model.StringMap{
+				model.SessionPropType:              model.SessionTypeUserAccessToken,
+				model.SessionPropUserAccessTokenId: tokenID,
+			},
+		})
+
+		c := &Context{App: th.App, AppContext: th.Context}
+
+		// Simulate a record created before the session was established (e.g., login flow)
+		rec := &model.AuditRecord{
+			EventName: "test_event",
+			Status:    model.AuditStatusAttempt,
+			Actor:     model.AuditEventActor{},
+			Meta:      map[string]any{},
+			EventData: model.AuditEventData{},
+		}
+
+		c.LogAuditRec(rec)
+
+		assert.Equal(t, tokenID, rec.Meta[model.SessionPropUserAccessTokenId])
+	})
+
+	t.Run("does not add token ID for non-PAT session", func(t *testing.T) {
+		th := SetupWithStoreMock(t)
+
+		th.Context = th.Context.WithSession(&model.Session{
+			Id:     model.NewId(),
+			UserId: model.NewId(),
+		})
+
+		c := &Context{App: th.App, AppContext: th.Context}
+
+		rec := &model.AuditRecord{
+			EventName: "test_event",
+			Status:    model.AuditStatusAttempt,
+			Actor:     model.AuditEventActor{},
+			Meta:      map[string]any{},
+			EventData: model.AuditEventData{},
+		}
+
+		c.LogAuditRec(rec)
+
+		_, exists := rec.Meta[model.SessionPropUserAccessTokenId]
+		assert.False(t, exists, "token ID key should be absent from Meta for non-PAT sessions")
+	})
+}
+
+func TestRequireHookId(t *testing.T) {
+	c := &Context{}
+	t.Run("WhenHookIdIsValid", func(t *testing.T) {
+		c.Params = &Params{HookId: "abcdefghijklmnopqrstuvwxyz"}
+		c.RequireHookId()
+
+		require.Nil(t, c.Err, "Hook Id is Valid. Should not have set error in context")
+	})
+
+	t.Run("WhenHookIdIsInvalid", func(t *testing.T) {
+		c.Params = &Params{HookId: "abc"}
+		c.RequireHookId()
+
+		require.NotNil(t, c.Err, "Should have set Error in context")
+		require.Equal(t, http.StatusBadRequest, c.Err.StatusCode, "Should have set status as 400")
+	})
+}
+
+func TestCloudKeyRequired(t *testing.T) {
+	th := SetupWithStoreMock(t)
+
+	th.App.Srv().SetLicense(model.NewTestLicense("cloud"))
+
+	c := &Context{
+		App:        th.App,
+		AppContext: th.Context,
+	}
+
+	c.CloudKeyRequired()
+
+	assert.Equal(t, c.Err.Id, "api.context.session_expired.app_error")
+}
+
+func TestMfaRequired(t *testing.T) {
+	th := SetupWithStoreMock(t)
+
+	mockStore := th.App.Srv().Store().(*mocks.Store)
+	mockUserStore := mocks.UserStore{}
+	mockUserStore.On("Count", mock.Anything).Return(int64(10), nil)
+	mockUserStore.On("Get", mock.Anything, "userid").Return(nil, model.NewAppError("Userstore.Get", "storeerror", nil, "store error", http.StatusInternalServerError))
+	mockPostStore := mocks.PostStore{}
+	mockPostStore.On("GetMaxPostSize").Return(model.PostMessageMaxBytesV2, nil)
+	mockSystemStore := mocks.SystemStore{}
+	mockSystemStore.On("GetByName", "UpgradedFromTE").Return(&model.System{Name: "UpgradedFromTE", Value: "false"}, nil)
+	mockSystemStore.On("GetByName", "InstallationDate").Return(&model.System{Name: "InstallationDate", Value: "10"}, nil)
+
+	mockStore.On("User").Return(&mockUserStore)
+	mockStore.On("Post").Return(&mockPostStore)
+	mockStore.On("System").Return(&mockSystemStore)
+	mockStore.On("GetDBSchemaVersion").Return(1, nil)
+
+	th.App.Srv().SetLicense(model.NewTestLicense("mfa"))
+
+	th.Context = th.Context.WithSession(&model.Session{Id: "abc", UserId: "userid"})
+
+	th.App.UpdateConfig(func(cfg *model.Config) {
+		*cfg.AnnouncementSettings.UserNoticesEnabled = false
+		*cfg.AnnouncementSettings.AdminNoticesEnabled = false
+		*cfg.ServiceSettings.EnableMultifactorAuthentication = true
+		*cfg.ServiceSettings.EnforceMultifactorAuthentication = true
+	})
+
+	c := &Context{
+		App:        th.App,
+		AppContext: th.Context,
+	}
+
+	c.MfaRequired(http.MethodGet)
+
+	assert.Equal(t, c.Err.Id, "api.context.get_user.app_error")
+}