240db4e2a7
Some checks failed
Server CI / Postgres (shard 0) (push) Has been skipped
Server CI / Postgres (shard 3) (push) Has been skipped
BuildEnv Docker Image / build-image (push) Failing after 4s
BuildEnv Docker Image / build-image-fips (push) Failing after 4s
Migration Review & Release Notes / Generate migration review & release notes (push) Failing after 3s
Server CI / Build Environment (push) Failing after 3s
Server CI / Postgres (shard 1) (push) Has been skipped
Tools CI / check-style (mattermost-govet) (push) Failing after 4s
Server CI / Postgres (shard 2) (push) Has been skipped
Tools CI / check-style (mmgotool) (push) Failing after 3s
Server CI / Elasticsearch v8 Compatibility (push) Has been skipped
Server CI / OpenSearch v2 Compatibility (push) Has been skipped
Server CI / Postgres FIPS (shard 0) (push) Has been skipped
Tools CI / Test (mattermost-govet) (push) Failing after 3s
Server CI / Postgres FIPS (shard 1) (push) Has been skipped
Server CI / Postgres FIPS (shard 2) (push) Has been skipped
Tools CI / Test (mmgotool) (push) Failing after 3s
Server CI / Postgres FIPS (shard 3) (push) Has been skipped
Server CI / Run mmctl tests (push) Has been skipped
Server CI / Run mmctl tests (FIPS) (push) Has been skipped
Server CI / Merge Postgres Test Results (push) Has been skipped
Server CI / Merge Postgres FIPS Test Results (push) Has been skipped
Server CI / Check backport migrations (push) Has been skipped
Server CI / Check generated files (push) Has been skipped
Server CI / check-style (push) Has been skipped
Server CI / Vet API (push) Has been skipped
Server CI / Build mattermost server app (push) Has been skipped
Server CI / Server CI Complete (push) Failing after 2s
Server CI / Server CI Artifacts (push) Has been skipped
Server CI / Sentry Upload (push) Has been skipped
Server CI / Server CI Report (push) Failing after 5m1s
Server CI Nightly Race / Race Detector (push) Has been skipped
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (javascript) (push) Has been cancelled
Webapp CI Cache Warm / Warm Webapp node_modules Cache (push) Has been cancelled
E2E CI Cache Warm / Warm E2E npm Registry Cache (push) Has been cancelled
API / build (push) Has been cancelled
Web App CI / check-types (push) Has been cancelled
Web App CI / check-lint (push) Has been cancelled
Web App CI / check-i18n (push) Has been cancelled
Web App CI / check-external-links (push) Has been cancelled
Web App CI / test (platform) (push) Has been cancelled
Web App CI / test (mattermost-redux) (push) Has been cancelled
Web App CI / test (channels shard 1/4) (push) Has been cancelled
Web App CI / test (channels shard 2/4) (push) Has been cancelled
Web App CI / test (channels shard 3/4) (push) Has been cancelled
Web App CI / test (channels shard 4/4) (push) Has been cancelled
Web App CI / upload-coverage (push) Has been cancelled
Web App CI / build (push) Has been cancelled
YAML Lint / yamllint (push) Has been cancelled
Push mirrored docker images / cd/Push mirrored docker images (push) Has been cancelled
docs-cd / Build and deploy docs (push) Has been cancelled
Docs CI / build (push) Has been cancelled
E2E Cache Warm: Cypress deps / Warm Cypress deps cache (push) Has been cancelled
Scorecards supply-chain security / Scorecard analysis (push) Has been cancelled
Server CI Weekly / Postgres FIPS (push) Has been skipped
Server CI Weekly / Run mmctl tests (FIPS) (push) Has been skipped
Server CI Weekly / Postgres with binary parameters (push) Has been skipped
Server CI Weekly / Build Environment (push) Failing after 1s
Server CI Cache Warm / Warm Go Module and Build Cache (push) Failing after 2s
Server CI Nightly Race / Build Environment (push) Failing after 1s
57 lines
2.3 KiB
Go
57 lines
2.3 KiB
Go
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
|
// See LICENSE.txt for license information.
|
|
|
|
/*
|
|
Package api4 implements the HTTP REST API layer for Mattermost server.
|
|
|
|
This package provides the primary interface between client applications
|
|
(web, mobile, desktop) and the Mattermost server backend. It exposes
|
|
HTTP endpoints that follow REST conventions for managing users, teams,
|
|
channels, posts, and other Mattermost resources.
|
|
|
|
# Architecture
|
|
|
|
The API is structured around resource-based endpoints under the /api/v4/ path.
|
|
Each endpoint is handled by specific handler functions that provide different
|
|
levels of authentication and authorization:
|
|
|
|
- APIHandler: Public endpoints requiring no authentication
|
|
- APISessionRequired: Endpoints requiring authenticated user sessions
|
|
- APISessionRequiredTrustRequester: Authenticated endpoints for trusted requests
|
|
- CloudAPIKeyRequired: Cloud installation webhook endpoints
|
|
- RemoteClusterTokenRequired: Remote cluster communication endpoints
|
|
- APILocal: Local mode access via UNIX socket
|
|
|
|
# Key Responsibilities
|
|
|
|
- Input validation: Validate request parameters and body content
|
|
- Permission checks: Verify user has required permissions for the operation
|
|
- HTTP handling: Parse requests, format responses, set appropriate status codes
|
|
- Error formatting: Convert app layer errors to appropriate HTTP responses
|
|
- Audit logging: Log security-relevant operations
|
|
|
|
# Error Handling
|
|
|
|
The API uses consistent error responses with appropriate HTTP status codes.
|
|
All handlers use the Context object for standardized error reporting and
|
|
audit logging. Errors are returned in a structured JSON format with
|
|
error codes, messages, and additional context when available.
|
|
|
|
# Security
|
|
|
|
Security is implemented through multiple layers:
|
|
|
|
- Authentication via sessions, tokens, or API keys
|
|
- Role-based access control and permission checking
|
|
- CSRF protection through request validation
|
|
- Rate limiting to prevent abuse
|
|
- Multi-factor authentication support
|
|
- Secure session management
|
|
|
|
The api4 package serves as the HTTP interface layer in Mattermost's
|
|
layered architecture, providing a stable, versioned API for client
|
|
applications while maintaining clear separation from business logic
|
|
and data persistence concerns.
|
|
*/
|
|
package api4
|