snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

server/public/model/remote_cluster.go

@@ -0,0 +1,546 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package model
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/pbkdf2"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strings"
+
+	"golang.org/x/crypto/scrypt"
+)
+
+const (
+	RemoteOfflineAfterMillis = 1000 * 60 * 5 // 5 minutes
+	RemoteNameMinLength      = 1
+	RemoteNameMaxLength      = 64
+
+	SiteURLPending = "pending_"
+
+	// Deprecated: SiteURLPlugin was used as a prefix for plugin-based remote SiteURLs.
+	// New registrations store the plugin-provided SiteURL directly. Use PluginID field
+	// to identify plugin-based remotes.
+	SiteURLPlugin = "plugin_"
+
+	BitflagOptionAutoShareDMs Bitmask = 1 << iota // Any new DM/GM is automatically shared
+	BitflagOptionAutoInvited                      // Remote is automatically invited to all shared channels
+)
+
+var (
+	validRemoteNameChars = regexp.MustCompile(`^[a-zA-Z0-9\.\-\_]+$`)
+
+	ErrOfflineRemote = errors.New("remote is offline")
+)
+
+type Bitmask uint32
+
+func (bm *Bitmask) IsBitSet(flag Bitmask) bool {
+	return *bm != 0
+}
+
+func (bm *Bitmask) SetBit(flag Bitmask) {
+	*bm |= flag
+}
+
+func (bm *Bitmask) UnsetBit(flag Bitmask) {
+	*bm &= ^flag
+}
+
+type RemoteCluster struct {
+	RemoteId             string  `json:"remote_id"`
+	RemoteTeamId         string  `json:"remote_team_id"` // Deprecated: this field is no longer used. It's only kept for backwards compatibility.
+	Name                 string  `json:"name"`
+	DisplayName          string  `json:"display_name"`
+	SiteURL              string  `json:"site_url"`
+	DefaultTeamId        string  `json:"default_team_id"`
+	CreateAt             int64   `json:"create_at"`
+	DeleteAt             int64   `json:"delete_at"`
+	LastPingAt           int64   `json:"last_ping_at"`
+	LastGlobalUserSyncAt int64   `json:"last_global_user_sync_at"` // Timestamp of last global user sync
+	Token                string  `json:"token"`
+	RemoteToken          string  `json:"remote_token"`
+	Topics               string  `json:"topics"`
+	CreatorId            string  `json:"creator_id"`
+	PluginID             string  `json:"plugin_id"` // non-empty when sync message are to be delivered via plugin API
+	Options              Bitmask `json:"options"`   // bit-flag set of options
+}
+
+func (rc *RemoteCluster) Auditable() map[string]any {
+	return map[string]any{
+		"remote_id":                rc.RemoteId,
+		"remote_team_id":           rc.RemoteTeamId,
+		"name":                     rc.Name,
+		"display_name":             rc.DisplayName,
+		"site_url":                 rc.SiteURL,
+		"default_team_id":          rc.DefaultTeamId,
+		"create_at":                rc.CreateAt,
+		"delete_at":                rc.DeleteAt,
+		"last_ping_at":             rc.LastPingAt,
+		"last_global_user_sync_at": rc.LastGlobalUserSyncAt,
+		"creator_id":               rc.CreatorId,
+		"plugin_id":                rc.PluginID,
+		"options":                  rc.Options,
+	}
+}
+
+func (rc *RemoteCluster) PreSave() {
+	if rc.RemoteId == "" {
+		rc.RemoteId = NewId()
+	}
+
+	if rc.DisplayName == "" {
+		rc.DisplayName = rc.Name
+	}
+
+	rc.Name = SanitizeUnicode(rc.Name)
+	rc.DisplayName = SanitizeUnicode(rc.DisplayName)
+	rc.Name = NormalizeRemoteName(rc.Name)
+
+	if rc.Token == "" {
+		rc.Token = NewId()
+	}
+
+	if rc.CreateAt == 0 {
+		rc.CreateAt = GetMillis()
+	}
+	rc.fixTopics()
+}
+
+func (rc *RemoteCluster) IsValid() *AppError {
+	if !IsValidId(rc.RemoteId) {
+		return NewAppError("RemoteCluster.IsValid", "model.cluster.is_valid.id.app_error", nil, "id="+rc.RemoteId, http.StatusBadRequest)
+	}
+
+	if !IsValidRemoteName(rc.Name) {
+		return NewAppError("RemoteCluster.IsValid", "model.cluster.is_valid.name.app_error", nil, "name="+rc.Name, http.StatusBadRequest)
+	}
+
+	if rc.CreateAt == 0 {
+		return NewAppError("RemoteCluster.IsValid", "model.cluster.is_valid.create_at.app_error", nil, "create_at=0", http.StatusBadRequest)
+	}
+
+	if !IsValidId(rc.CreatorId) {
+		return NewAppError("RemoteCluster.IsValid", "model.cluster.is_valid.id.app_error", nil, "creator_id="+rc.CreatorId, http.StatusBadRequest)
+	}
+
+	if rc.SiteURL == "" {
+		return NewAppError("RemoteCluster.IsValid", "model.cluster.is_valid.site_url.app_error", nil, "site_url is empty", http.StatusBadRequest)
+	}
+
+	if rc.DefaultTeamId != "" && !IsValidId(rc.DefaultTeamId) {
+		return NewAppError("RemoteCluster.IsValid", "model.cluster.is_valid.id.app_error", nil, "default_team_id="+rc.DefaultTeamId, http.StatusBadRequest)
+	}
+
+	return nil
+}
+
+func (rc *RemoteCluster) Sanitize() {
+	rc.Token = ""
+	rc.RemoteToken = ""
+}
+
+type RemoteClusterPatch struct {
+	DisplayName   *string `json:"display_name"`
+	DefaultTeamId *string `json:"default_team_id"`
+}
+
+func (rcp *RemoteClusterPatch) Auditable() map[string]any {
+	return map[string]any{
+		"display_name":    rcp.DisplayName,
+		"default_team_id": rcp.DefaultTeamId,
+	}
+}
+
+func (rc *RemoteCluster) Patch(patch *RemoteClusterPatch) {
+	if patch.DisplayName != nil {
+		rc.DisplayName = *patch.DisplayName
+	}
+
+	if patch.DefaultTeamId != nil {
+		rc.DefaultTeamId = *patch.DefaultTeamId
+	}
+}
+
+type RemoteClusterWithPassword struct {
+	*RemoteCluster
+	Password string `json:"password"`
+}
+
+type RemoteClusterWithInvite struct {
+	RemoteCluster *RemoteCluster `json:"remote_cluster"`
+	Invite        string         `json:"invite"`
+	Password      string         `json:"password,omitempty"`
+}
+
+func (rc *RemoteCluster) IsOptionFlagSet(flag Bitmask) bool {
+	return rc.Options.IsBitSet(flag)
+}
+
+func (rc *RemoteCluster) SetOptionFlag(flag Bitmask) {
+	rc.Options.SetBit(flag)
+}
+
+func (rc *RemoteCluster) UnsetOptionFlag(flag Bitmask) {
+	rc.Options.UnsetBit(flag)
+}
+
+func IsValidRemoteName(s string) bool {
+	if len(s) < RemoteNameMinLength || len(s) > RemoteNameMaxLength {
+		return false
+	}
+	return validRemoteNameChars.MatchString(s)
+}
+
+// CleanRemoteName converts an arbitrary string into a slug compatible with
+// IsValidRemoteName: lowercased, with spaces and other disallowed characters
+// replaced by hyphens. The result is truncated to RemoteNameMaxLength. If
+// the cleaned value is still invalid (e.g. empty input), a new ID is
+// substituted so the caller always receives a valid name.
+func CleanRemoteName(s string) string {
+	s = strings.ToLower(strings.ReplaceAll(s, " ", "-"))
+	s = strings.TrimSpace(s)
+
+	for _, c := range s {
+		char := fmt.Sprintf("%c", c)
+		if !validRemoteNameChars.MatchString(char) {
+			s = strings.ReplaceAll(s, char, "-")
+		}
+	}
+
+	s = strings.Trim(s, "-")
+
+	if len(s) > RemoteNameMaxLength {
+		s = strings.Trim(s[:RemoteNameMaxLength], "-")
+	}
+
+	if !IsValidRemoteName(s) {
+		s = NewId()
+	}
+
+	return s
+}
+
+func (rc *RemoteCluster) PreUpdate() {
+	if rc.DisplayName == "" {
+		rc.DisplayName = rc.Name
+	}
+
+	rc.Name = SanitizeUnicode(rc.Name)
+	rc.DisplayName = SanitizeUnicode(rc.DisplayName)
+	rc.Name = NormalizeRemoteName(rc.Name)
+	rc.fixTopics()
+}
+
+func (rc *RemoteCluster) IsOnline() bool {
+	return rc.LastPingAt > GetMillis()-RemoteOfflineAfterMillis
+}
+
+func (rc *RemoteCluster) IsConfirmed() bool {
+	if rc.IsPlugin() {
+		return true // local plugins are automatically confirmed
+	}
+
+	if rc.SiteURL != "" && !strings.HasPrefix(rc.SiteURL, SiteURLPending) {
+		return true // empty or pending siteurl are not confirmed
+	}
+	return false
+}
+
+func (rc *RemoteCluster) IsPlugin() bool {
+	return rc.PluginID != ""
+}
+
+func (rc *RemoteCluster) GetSiteURL() string {
+	siteURL := rc.SiteURL
+	if strings.HasPrefix(siteURL, SiteURLPending) {
+		siteURL = "..."
+	}
+	if strings.HasPrefix(siteURL, SiteURLPending) || strings.HasPrefix(siteURL, SiteURLPlugin) {
+		siteURL = "plugin"
+	}
+	return siteURL
+}
+
+// fixTopics ensures all topics are separated by one, and only one, space.
+func (rc *RemoteCluster) fixTopics() {
+	trimmed := strings.TrimSpace(rc.Topics)
+	if trimmed == "" || trimmed == "*" {
+		rc.Topics = trimmed
+		return
+	}
+
+	var sb strings.Builder
+	sb.WriteString(" ")
+
+	ss := strings.SplitSeq(rc.Topics, " ")
+	for c := range ss {
+		cc := strings.TrimSpace(c)
+		if cc != "" {
+			sb.WriteString(cc)
+			sb.WriteString(" ")
+		}
+	}
+	rc.Topics = sb.String()
+}
+
+func (rc *RemoteCluster) ToRemoteClusterInfo() RemoteClusterInfo {
+	return RemoteClusterInfo{
+		RemoteId:    rc.RemoteId,
+		Name:        rc.Name,
+		DisplayName: rc.DisplayName,
+		CreateAt:    rc.CreateAt,
+		DeleteAt:    rc.DeleteAt,
+		LastPingAt:  rc.LastPingAt,
+		SiteURL:     rc.SiteURL,
+	}
+}
+
+func NormalizeRemoteName(name string) string {
+	return strings.ToLower(name)
+}
+
+// RemoteClusterInfo provides a subset of RemoteCluster fields suitable for sending to clients.
+type RemoteClusterInfo struct {
+	RemoteId    string `json:"remote_id"`
+	Name        string `json:"name"`
+	DisplayName string `json:"display_name"`
+	CreateAt    int64  `json:"create_at"`
+	DeleteAt    int64  `json:"delete_at"`
+	LastPingAt  int64  `json:"last_ping_at"`
+	SiteURL     string `json:"site_url,omitempty"`
+}
+
+// RemoteClusterFrame wraps a `RemoteClusterMsg` with credentials specific to a remote cluster.
+type RemoteClusterFrame struct {
+	RemoteId string           `json:"remote_id"`
+	Msg      RemoteClusterMsg `json:"msg"`
+}
+
+func (f *RemoteClusterFrame) Auditable() map[string]any {
+	return map[string]any{
+		"remote_id": f.RemoteId,
+		"msg_id":    f.Msg.Id,
+		"topic":     f.Msg.Topic,
+	}
+}
+
+func (f *RemoteClusterFrame) IsValid() *AppError {
+	if !IsValidId(f.RemoteId) {
+		return NewAppError("RemoteClusterFrame.IsValid", "api.remote_cluster.invalid_id.app_error", nil, "RemoteId="+f.RemoteId, http.StatusBadRequest)
+	}
+
+	if appErr := f.Msg.IsValid(); appErr != nil {
+		return appErr
+	}
+
+	return nil
+}
+
+// RemoteClusterMsg represents a message that is sent and received between clusters.
+// These are processed and routed via the RemoteClusters service.
+type RemoteClusterMsg struct {
+	Id       string          `json:"id"`
+	Topic    string          `json:"topic"`
+	CreateAt int64           `json:"create_at"`
+	Payload  json.RawMessage `json:"payload"`
+}
+
+func NewRemoteClusterMsg(topic string, payload json.RawMessage) RemoteClusterMsg {
+	return RemoteClusterMsg{
+		Id:       NewId(),
+		Topic:    topic,
+		CreateAt: GetMillis(),
+		Payload:  payload,
+	}
+}
+
+func (m RemoteClusterMsg) IsValid() *AppError {
+	if !IsValidId(m.Id) {
+		return NewAppError("RemoteClusterMsg.IsValid", "api.remote_cluster.invalid_id.app_error", nil, "Id="+m.Id, http.StatusBadRequest)
+	}
+
+	if m.Topic == "" {
+		return NewAppError("RemoteClusterMsg.IsValid", "api.remote_cluster.invalid_topic.app_error", nil, "Topic empty", http.StatusBadRequest)
+	}
+
+	if len(m.Payload) == 0 {
+		return NewAppError("RemoteClusterMsg.IsValid", "api.context.invalid_body_param.app_error", map[string]any{"Name": "PayLoad"}, "", http.StatusBadRequest)
+	}
+
+	return nil
+}
+
+// RemoteClusterPing represents a ping that is sent and received between clusters
+// to indicate a connection is alive. This is the payload for a `RemoteClusterMsg`.
+type RemoteClusterPing struct {
+	SentAt int64 `json:"sent_at"`
+	RecvAt int64 `json:"recv_at"`
+}
+
+// RemoteClusterInvite represents an invitation to establish a simple trust with a remote cluster.
+type RemoteClusterInvite struct {
+	RemoteId       string `json:"remote_id"`
+	RemoteTeamId   string `json:"remote_team_id"` // Deprecated: this field is no longer used. It's only kept for backwards compatibility.
+	SiteURL        string `json:"site_url"`
+	Token          string `json:"token"`
+	RefreshedToken string `json:"refreshed_token,omitempty"` // New token generated by the remote cluster when accepting an invitation
+	Version        int    `json:"version,omitempty"`
+}
+
+func (rci *RemoteClusterInvite) IsValid() *AppError {
+	if !IsValidId(rci.RemoteId) {
+		return NewAppError("RemoteClusterInvite.IsValid", "model.remote_cluster_invite.is_valid.remote_id.app_error", nil, "id="+rci.RemoteId, http.StatusBadRequest)
+	}
+
+	if rci.Token == "" {
+		return NewAppError("RemoteClusterInvite.IsValid", "model.remote_cluster_invite.is_valid.token.app_error", nil, "Token empty", http.StatusBadRequest)
+	}
+
+	if _, err := url.ParseRequestURI(rci.SiteURL); err != nil {
+		return NewAppError("RemoteClusterInvite.IsValid", "model.remote_cluster_invite.is_valid.site_url.app_error", nil, "", http.StatusBadRequest).Wrap(err)
+	}
+
+	return nil
+}
+
+func (rci *RemoteClusterInvite) Encrypt(password string) ([]byte, error) {
+	raw, err := json.Marshal(&rci)
+	if err != nil {
+		return nil, err
+	}
+
+	// create random salt to be prepended to the blob.
+	salt := make([]byte, 16)
+	if _, err = io.ReadFull(rand.Reader, salt); err != nil {
+		return nil, err
+	}
+
+	var key []byte
+	if rci.Version >= 3 {
+		// Use PBKDF2 for version 3 and above
+		key, err = pbkdf2.Key(sha256.New, password, salt, 600000, 32)
+		if err != nil {
+			return nil, err
+		}
+	} else {
+		// Use scrypt for older versions
+		key, err = scrypt.Key([]byte(password), salt, 32768, 8, 1, 32)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	block, err := aes.NewCipher(key[:])
+	if err != nil {
+		return nil, err
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+
+	// create random nonce
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
+		return nil, err
+	}
+
+	// prefix the nonce to the cyphertext so we don't need to keep track of it.
+	sealed := gcm.Seal(nonce, nonce, raw, nil)
+
+	return append(salt, sealed...), nil //nolint:makezero
+}
+
+func (rci *RemoteClusterInvite) Decrypt(encrypted []byte, password string) error {
+	if len(encrypted) <= 16 {
+		return errors.New("invalid length")
+	}
+
+	// first 16 bytes is the salt that was used to derive a key
+	salt := encrypted[:16]
+	encrypted = encrypted[16:]
+
+	// Try PBKDF2 first (for version 3+)
+	if err := rci.tryDecrypt(encrypted, password, salt, true); err == nil {
+		return nil
+	}
+
+	// Fall back to scrypt (for older versions)
+	return rci.tryDecrypt(encrypted, password, salt, false)
+}
+
+func (rci *RemoteClusterInvite) tryDecrypt(encrypted []byte, password string, salt []byte, usePBKDF2 bool) error {
+	var key []byte
+	var err error
+
+	if usePBKDF2 {
+		// Use PBKDF2 for version 3 and above
+		key, err = pbkdf2.Key(sha256.New, password, salt, 600000, 32)
+		if err != nil {
+			return err
+		}
+	} else {
+		// Use scrypt for older versions
+		key, err = scrypt.Key([]byte(password), salt, 32768, 8, 1, 32)
+		if err != nil {
+			return err
+		}
+	}
+
+	block, err := aes.NewCipher(key[:])
+	if err != nil {
+		return err
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return err
+	}
+
+	// nonce was prefixed to the cyphertext when encrypting so we need to extract it.
+	nonceSize := gcm.NonceSize()
+	nonce, cyphertext := encrypted[:nonceSize], encrypted[nonceSize:]
+
+	plain, err := gcm.Open(nil, nonce, cyphertext, nil)
+	if err != nil {
+		return err
+	}
+
+	// try to unmarshall the decrypted JSON to this invite struct.
+	return json.Unmarshal(plain, &rci)
+}
+
+type RemoteClusterAcceptInvite struct {
+	Name          string `json:"name"`
+	DisplayName   string `json:"display_name"`
+	DefaultTeamId string `json:"default_team_id"`
+	Invite        string `json:"invite"`
+	Password      string `json:"password"`
+}
+
+// RemoteClusterQueryFilter provides filter criteria for RemoteClusterStore.GetAll
+type RemoteClusterQueryFilter struct {
+	ExcludeOffline bool
+	InChannel      string
+	NotInChannel   string
+	Topic          string
+	CreatorId      string
+	OnlyConfirmed  bool
+	PluginID       string
+	OnlyPlugins    bool
+	ExcludePlugins bool
+	RequireOptions Bitmask
+	IncludeDeleted bool
+}