snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

server/platform/shared/filestore/azurestore_test.go

@@ -0,0 +1,466 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package filestore
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+)
+
+func TestBuildAzureServiceURL(t *testing.T) {
+	const account = "acmemattermost"
+
+	tests := []struct {
+		name     string
+		cloud    string
+		scheme   string
+		account  string // defaults to the package-level account const when empty
+		endpoint string
+		expected string
+		wantErr  bool
+	}{
+		{
+			name:     "commercial cloud, default scheme",
+			cloud:    model.AzureCloudCommercial,
+			scheme:   "https",
+			expected: "https://acmemattermost.blob.core.windows.net/",
+		},
+		{
+			name:    "commercial cloud rejects an account name with a hash character",
+			cloud:   model.AzureCloudCommercial,
+			scheme:  "https",
+			account: "account#",
+			wantErr: true,
+		},
+		{
+			name:    "commercial cloud rejects an account name with a slash character",
+			cloud:   model.AzureCloudCommercial,
+			scheme:  "https",
+			account: "account/",
+			wantErr: true,
+		},
+		{
+			name:    "government cloud rejects a malformed account name",
+			cloud:   model.AzureCloudGovernment,
+			scheme:  "https",
+			account: "account#",
+			wantErr: true,
+		},
+		{
+			name:     "empty cloud falls back to commercial for legacy configs",
+			cloud:    "",
+			scheme:   "https",
+			expected: "https://acmemattermost.blob.core.windows.net/",
+		},
+		{
+			name:     "government cloud uses the usgovcloudapi suffix",
+			cloud:    model.AzureCloudGovernment,
+			scheme:   "https",
+			expected: "https://acmemattermost.blob.core.usgovcloudapi.net/",
+		},
+		{
+			name:     "custom cloud returns the endpoint verbatim (vhost-style)",
+			cloud:    model.AzureCloudCustom,
+			scheme:   "https",
+			endpoint: "https://acmemattermost.blob.core.windows.net/",
+			expected: "https://acmemattermost.blob.core.windows.net/",
+		},
+		{
+			name:     "custom cloud returns the endpoint verbatim (Azurite path-style)",
+			cloud:    model.AzureCloudCustom,
+			scheme:   "http",
+			endpoint: "http://localhost:10000/devstoreaccount1/",
+			expected: "http://localhost:10000/devstoreaccount1/",
+		},
+		{
+			name:     "custom cloud preserves arbitrary paths the admin provides",
+			cloud:    model.AzureCloudCustom,
+			scheme:   "https",
+			endpoint: "https://blob-proxy.internal.example.com/some/prefix/account/",
+			expected: "https://blob-proxy.internal.example.com/some/prefix/account/",
+		},
+		{
+			name:    "custom cloud rejects an empty endpoint",
+			cloud:   model.AzureCloudCustom,
+			scheme:  "https",
+			wantErr: true,
+		},
+		{
+			name:     "custom cloud rejects an endpoint missing the scheme",
+			cloud:    model.AzureCloudCustom,
+			scheme:   "https",
+			endpoint: "acmemattermost.blob.core.windows.net/",
+			wantErr:  true,
+		},
+		{
+			name:     "custom cloud rejects an endpoint with no host",
+			cloud:    model.AzureCloudCustom,
+			scheme:   "https",
+			endpoint: "https:///acmemattermost/",
+			wantErr:  true,
+		},
+		{
+			name:     "custom cloud rejects a non-HTTP scheme",
+			cloud:    model.AzureCloudCustom,
+			scheme:   "https",
+			endpoint: "ftp://blob.example.com/",
+			wantErr:  true,
+		},
+		{
+			name:    "unknown cloud value is rejected",
+			cloud:   "azuregermany",
+			scheme:  "https",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			acct := account
+			if tt.account != "" {
+				acct = tt.account
+			}
+			got, err := buildAzureServiceURL(tt.cloud, tt.scheme, acct, tt.endpoint)
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, tt.expected, got)
+		})
+	}
+}
+
+func TestAzureFileBackendPrefix(t *testing.T) {
+	tests := []struct {
+		name     string
+		prefix   string
+		input    string
+		expected string
+	}{
+		{name: "no prefix, plain path", prefix: "", input: "team/channel/file", expected: "team/channel/file"},
+		{name: "no prefix, with dot-dot", prefix: "", input: "../escape", expected: "../escape"},
+		{name: "prefix, plain path", prefix: "mattermost", input: "team/channel/file", expected: "mattermost/team/channel/file"},
+		{name: "prefix, exact root", prefix: "mattermost", input: "", expected: "mattermost"},
+		{name: "prefix, dot-dot escapes", prefix: "mattermost", input: "../escape", expected: "mattermost/escape"},
+		{name: "prefix, nested dot-dot escapes", prefix: "mattermost", input: "sub/../../escape", expected: "mattermost/escape"},
+		{name: "prefix, dot-dot in middle stays inside", prefix: "mattermost", input: "a/../b", expected: "mattermost/b"},
+		{name: "prefix with trailing slash, dot-dot escapes", prefix: "mattermost/", input: "../escape", expected: "mattermost/escape"},
+		{name: "prefix boundary collision must not escape", prefix: "mattermost", input: "../mattermost-evil/file", expected: "mattermost/file"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b := &AzureFileBackend{pathPrefix: tt.prefix}
+			require.Equal(t, tt.expected, b.prefix(tt.input))
+		})
+	}
+}
+
+// azuriteWellKnownAccount and azuriteWellKnownKey are Azurite's published
+// development credentials. They are not secrets - they are documented in the
+// Azurite README and ship hardcoded in every Azurite distribution.
+const (
+	azuriteWellKnownAccount = "devstoreaccount1"
+	azuriteWellKnownKey     = "Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw=="
+)
+
+// TestAzureFileBackendAppendRefusesNonBlockBlob exercises the safety
+// check in AppendFile: when a blob exists with content but no committed
+// block list (i.e. it was uploaded via Put Blob by another tool), the
+// backend must refuse the append rather than silently destroy the
+// existing content.
+func TestAzureFileBackendAppendRefusesNonBlockBlob(t *testing.T) {
+	be := newAzuriteBackend(t)
+
+	path := "append-refusal-test.bin"
+	t.Cleanup(func() { _ = be.RemoveFile(path) })
+
+	// Write the blob via the high-level Upload helper, which calls the
+	// Put Blob REST endpoint and leaves the committed-block list empty.
+	original := []byte("planted-by-another-tool")
+	bb := be.newBlockBlobClient(path)
+	_, err := bb.Upload(context.Background(), nopReadSeekCloser{bytes.NewReader(original)}, nil)
+	require.NoError(t, err)
+
+	_, err = be.AppendFile(bytes.NewReader([]byte("would-overwrite")), path)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "no committed block list")
+
+	// The original content must still be intact.
+	got, err := be.ReadFile(path)
+	require.NoError(t, err)
+	require.Equal(t, original, got)
+}
+
+// TestAzureFileBackendMakeContainerIdempotent ensures that calling
+// MakeContainer twice on the same backend is a no-op the second time.
+// Two nodes can race through TestConnection plus MakeContainer at boot;
+// the loser must converge instead of returning an error.
+func TestAzureFileBackendMakeContainerIdempotent(t *testing.T) {
+	be := newAzuriteBackend(t)
+
+	require.NoError(t, be.MakeContainer())
+	require.NoError(t, be.MakeContainer())
+}
+
+type nopReadSeekCloser struct {
+	*bytes.Reader
+}
+
+func (nopReadSeekCloser) Close() error { return nil }
+
+// newAzuriteBackend builds an Azure backend pointed at the Azurite emulator
+// and ensures the container exists. Standalone Azure tests should use this
+// instead of calling NewAzureFileBackend + TestConnection directly; the
+// shared FileBackendTestSuite handles provisioning itself in SetupTest.
+func newAzuriteBackend(t *testing.T) *AzureFileBackend {
+	t.Helper()
+	be, err := NewAzureFileBackend(azuriteSettings(t))
+	require.NoError(t, err)
+
+	var noBucket *FileBackendNoBucketError
+	if err := be.TestConnection(); errors.As(err, &noBucket) {
+		require.NoError(t, be.MakeContainer())
+	} else {
+		require.NoError(t, err)
+	}
+	return be
+}
+
+func azuriteSettings(t *testing.T) FileBackendSettings {
+	t.Helper()
+	host := os.Getenv("CI_AZURITE_HOST")
+	if host == "" {
+		host = "localhost"
+	}
+	port := os.Getenv("CI_AZURITE_PORT")
+	if port == "" {
+		port = "10000"
+	}
+	return FileBackendSettings{
+		DriverName:          driverAzure,
+		AzureStorageAccount: azuriteWellKnownAccount,
+		AzureAuthMode:       model.AzureAuthModeSharedKey,
+		AzureAccessKey:      azuriteWellKnownKey,
+		AzureContainer:      "mattermost-test",
+		AzureCloud:          model.AzureCloudCustom,
+		AzureEndpoint:       "http://" + net.JoinHostPort(host, port) + "/" + azuriteWellKnownAccount + "/",
+		// The emulator runs on an internal address, so its host must be allowed.
+		AllowedUntrustedInternalConnections: host,
+		AzureRequestTimeoutMilliseconds:     30000,
+	}
+}
+
+func TestNewAzureFileBackendAuthMode(t *testing.T) {
+	base := FileBackendSettings{
+		DriverName:                      driverAzure,
+		AzureStorageAccount:             "anaccount",
+		AzureContainer:                  "acontainer",
+		AzureEndpoint:                   "localhost:10000",
+		AzureSSL:                        false,
+		AzureRequestTimeoutMilliseconds: 30000,
+	}
+
+	t.Run("shared_key constructs a client", func(t *testing.T) {
+		s := base
+		s.AzureAuthMode = model.AzureAuthModeSharedKey
+		s.AzureAccessKey = azuriteWellKnownKey
+
+		be, err := NewAzureFileBackend(s)
+		require.NoError(t, err)
+		require.NotNil(t, be.client)
+	})
+
+	t.Run("default_credential constructs a client without an access key", func(t *testing.T) {
+		s := base
+		s.AzureAuthMode = model.AzureAuthModeDefaultCredential
+		// Intentionally no AzureAccessKey - default credential reads
+		// identity from the host environment, not config.
+
+		be, err := NewAzureFileBackend(s)
+		require.NoError(t, err)
+		require.NotNil(t, be.client)
+	})
+
+	t.Run("empty AuthMode is rejected", func(t *testing.T) {
+		s := base
+		s.AzureAuthMode = ""
+		s.AzureAccessKey = azuriteWellKnownKey
+
+		_, err := NewAzureFileBackend(s)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "unknown azure auth mode")
+	})
+
+	t.Run("unknown AuthMode is rejected", func(t *testing.T) {
+		s := base
+		s.AzureAuthMode = "oauth2"
+		s.AzureAccessKey = azuriteWellKnownKey
+
+		_, err := NewAzureFileBackend(s)
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "unknown azure auth mode")
+	})
+}
+
+func TestCheckMandatoryAzureFieldsAuthMode(t *testing.T) {
+	base := FileBackendSettings{
+		AzureStorageAccount: "anaccount",
+		AzureContainer:      "acontainer",
+	}
+
+	t.Run("shared_key requires access key", func(t *testing.T) {
+		s := base
+		s.AzureAuthMode = model.AzureAuthModeSharedKey
+		s.AzureAccessKey = ""
+		require.Error(t, s.CheckMandatoryAzureFields())
+
+		s.AzureAccessKey = "somekey"
+		require.NoError(t, s.CheckMandatoryAzureFields())
+	})
+
+	t.Run("default_credential does not require access key", func(t *testing.T) {
+		s := base
+		s.AzureAuthMode = model.AzureAuthModeDefaultCredential
+		s.AzureAccessKey = ""
+		require.NoError(t, s.CheckMandatoryAzureFields())
+	})
+}
+
+func TestAzureFileBackendTestSuite(t *testing.T) {
+	suite.Run(t, &FileBackendTestSuite{settings: azuriteSettings(t)})
+}
+
+// TestAzureGeneratePublicLink exercises the Service SAS path against Azurite.
+// The user-delegation SAS path requires Entra ID and cannot run in CI; it is
+// covered by the manual verification recipe in the PR description.
+func TestAzureGeneratePublicLink(t *testing.T) {
+	t.Run("refuses to issue a link when presign expiration is unset", func(t *testing.T) {
+		settings := azuriteSettings(t)
+		// Deliberately leave AzurePresignExpiresSeconds at zero - the
+		// shape an admin would hit if they enabled the export-direct-
+		// download feature without ever configuring the field.
+		be, err := NewAzureFileBackend(settings)
+		require.NoError(t, err)
+
+		_, _, err = be.GeneratePublicLink("any/path")
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "presign expiration is not configured")
+	})
+
+	t.Run("shared-key SAS round-trips through Azurite", func(t *testing.T) {
+		settings := azuriteSettings(t)
+		settings.AzurePresignExpiresSeconds = 300
+		be, err := NewAzureFileBackend(settings)
+		require.NoError(t, err)
+
+		var noBucket *FileBackendNoBucketError
+		if connErr := be.TestConnection(); errors.As(connErr, &noBucket) {
+			require.NoError(t, be.MakeContainer())
+		} else {
+			require.NoError(t, connErr)
+		}
+
+		path := "tests/presign-" + model.NewId() + ".bin"
+		payload := bytes.Repeat([]byte("mattermost"), 4096) // 40 KiB
+		_, writeErr := be.WriteFile(bytes.NewReader(payload), path)
+		require.NoError(t, writeErr)
+		t.Cleanup(func() { _ = be.RemoveFile(path) })
+
+		link, expiry, err := be.GeneratePublicLink(path)
+		require.NoError(t, err)
+		require.NotEmpty(t, link)
+		require.Equal(t, 300*time.Second, expiry)
+
+		// SAS query parameters Azurite expects to see.
+		u, err := url.Parse(link)
+		require.NoError(t, err)
+		require.NotEmpty(t, u.Query().Get("sig"))
+		require.Equal(t, "r", u.Query().Get("sp"))
+		require.Equal(t, "attachment", u.Query().Get("rscd"))
+
+		resp, err := http.Get(link)
+		require.NoError(t, err)
+		t.Cleanup(func() { _ = resp.Body.Close() })
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		require.Equal(t, "attachment", resp.Header.Get("Content-Disposition"))
+
+		got, err := io.ReadAll(resp.Body)
+		require.NoError(t, err)
+		require.Equal(t, payload, got)
+	})
+
+	t.Run("tampered SAS is rejected by the storage service", func(t *testing.T) {
+		settings := azuriteSettings(t)
+		settings.AzurePresignExpiresSeconds = 300
+		be, err := NewAzureFileBackend(settings)
+		require.NoError(t, err)
+
+		var noBucket *FileBackendNoBucketError
+		if connErr := be.TestConnection(); errors.As(connErr, &noBucket) {
+			require.NoError(t, be.MakeContainer())
+		} else {
+			require.NoError(t, connErr)
+		}
+
+		path := "tests/tamper-" + model.NewId() + ".bin"
+		_, writeErr := be.WriteFile(bytes.NewReader([]byte("contents")), path)
+		require.NoError(t, writeErr)
+		t.Cleanup(func() { _ = be.RemoveFile(path) })
+
+		link, _, err := be.GeneratePublicLink(path)
+		require.NoError(t, err)
+
+		// Flip the last character of the signature so the link no longer
+		// matches what Azurite signed.
+		u, err := url.Parse(link)
+		require.NoError(t, err)
+		q := u.Query()
+		sig := q.Get("sig")
+		require.NotEmpty(t, sig)
+		swapped := sig[:len(sig)-1] + flipBase64Char(sig[len(sig)-1])
+		q.Set("sig", swapped)
+		u.RawQuery = q.Encode()
+
+		resp, err := http.Get(u.String())
+		require.NoError(t, err)
+		t.Cleanup(func() { _ = resp.Body.Close() })
+		require.Equal(t, http.StatusForbidden, resp.StatusCode)
+	})
+
+	t.Run("unknown auth mode is rejected", func(t *testing.T) {
+		// Build a backend by hand so we can exercise the default-branch
+		// guard. Going through NewAzureFileBackend would be rejected by
+		// CheckMandatoryAzureFields first.
+		be := &AzureFileBackend{
+			authMode:       "totally-not-real",
+			presignExpires: time.Minute,
+		}
+		_, _, err := be.GeneratePublicLink("any/path")
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "unknown azure auth mode")
+	})
+}
+
+// flipBase64Char swaps a base64 character for another in the same alphabet
+// to produce a still-valid-but-wrong signature character. Used only by the
+// tamper test above.
+func flipBase64Char(c byte) string {
+	if c == 'A' {
+		return "B"
+	}
+	return "A"
+}