From 47250c6629416b628a19e5571ac89f7b4646418c Mon Sep 17 00:00:00 2001 From: Joram Wilander Date: Mon, 14 May 2018 10:24:58 -0400 Subject: Refactor context out of API packages (#8755) * Refactor context out of API packages * Update function names per feedback * Move webhook handlers to web and fix web tests * Move more webhook tests out of api package * Fix static handler --- api4/api.go | 16 +- api4/context.go | 663 --------------------------------------------------- api4/context_test.go | 31 --- api4/emoji.go | 3 +- api4/handlers.go | 67 ++++++ api4/params.go | 197 --------------- api4/webhook.go | 91 ------- api4/webhook_test.go | 45 ---- 8 files changed, 73 insertions(+), 1040 deletions(-) delete mode 100644 api4/context.go delete mode 100644 api4/context_test.go create mode 100644 api4/handlers.go delete mode 100644 api4/params.go (limited to 'api4') diff --git a/api4/api.go b/api4/api.go index d36c3e3ee..acce923c0 100644 --- a/api4/api.go +++ b/api4/api.go @@ -4,14 +4,12 @@ package api4 import ( - "fmt" "net/http" "github.com/gorilla/mux" "github.com/mattermost/mattermost-server/app" - "github.com/mattermost/mattermost-server/mlog" "github.com/mattermost/mattermost-server/model" - "github.com/mattermost/mattermost-server/utils" + "github.com/mattermost/mattermost-server/web" _ "github.com/nicksnyder/go-i18n/i18n" ) @@ -231,7 +229,7 @@ func Init(a *app.App, root *mux.Router, full bool) *API { api.InitRole() api.InitImage() - root.Handle("/api/v4/{anything:.*}", http.HandlerFunc(Handle404)) + root.Handle("/api/v4/{anything:.*}", http.HandlerFunc(api.Handle404)) // REMOVE CONDITION WHEN APIv3 REMOVED if full { @@ -241,14 +239,8 @@ func Init(a *app.App, root *mux.Router, full bool) *API { return api } -func Handle404(w http.ResponseWriter, r *http.Request) { - err := model.NewAppError("Handle404", "api.context.404.app_error", nil, "", http.StatusNotFound) - - mlog.Debug(fmt.Sprintf("%v: code=404 ip=%v", r.URL.Path, utils.GetIpAddress(r))) - - w.WriteHeader(err.StatusCode) - err.DetailedError = "There doesn't appear to be an api call for the url='" + r.URL.Path + "'." - w.Write([]byte(err.ToJson())) +func (api *API) Handle404(w http.ResponseWriter, r *http.Request) { + web.Handle404(api.App, w, r) } func ReturnStatusOK(w http.ResponseWriter) { diff --git a/api4/context.go b/api4/context.go deleted file mode 100644 index c965e1d80..000000000 --- a/api4/context.go +++ /dev/null @@ -1,663 +0,0 @@ -// Copyright (c) 2017-present Mattermost, Inc. All Rights Reserved. -// See License.txt for license information. - -package api4 - -import ( - "fmt" - "net/http" - "regexp" - "strings" - "time" - - goi18n "github.com/nicksnyder/go-i18n/i18n" - - "github.com/mattermost/mattermost-server/app" - "github.com/mattermost/mattermost-server/mlog" - "github.com/mattermost/mattermost-server/model" - "github.com/mattermost/mattermost-server/utils" -) - -type Context struct { - App *app.App - Session model.Session - Params *ApiParams - Err *model.AppError - T goi18n.TranslateFunc - RequestId string - IpAddress string - Path string - siteURLHeader string -} - -func (api *API) ApiHandler(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler { - return &handler{ - app: api.App, - handleFunc: h, - requireSession: false, - trustRequester: false, - requireMfa: false, - } -} - -func (api *API) ApiSessionRequired(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler { - return &handler{ - app: api.App, - handleFunc: h, - requireSession: true, - trustRequester: false, - requireMfa: true, - } -} - -func (api *API) ApiSessionRequiredMfa(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler { - return &handler{ - app: api.App, - handleFunc: h, - requireSession: true, - trustRequester: false, - requireMfa: false, - } -} - -func (api *API) ApiHandlerTrustRequester(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler { - return &handler{ - app: api.App, - handleFunc: h, - requireSession: false, - trustRequester: true, - requireMfa: false, - } -} - -func (api *API) ApiSessionRequiredTrustRequester(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler { - return &handler{ - app: api.App, - handleFunc: h, - requireSession: true, - trustRequester: true, - requireMfa: true, - } -} - -type handler struct { - app *app.App - handleFunc func(*Context, http.ResponseWriter, *http.Request) - requireSession bool - trustRequester bool - requireMfa bool -} - -func (h handler) ServeHTTP(w http.ResponseWriter, r *http.Request) { - now := time.Now() - mlog.Debug(fmt.Sprintf("%v - %v", r.Method, r.URL.Path)) - - c := &Context{} - c.App = h.app - c.T, _ = utils.GetTranslationsAndLocale(w, r) - c.RequestId = model.NewId() - c.IpAddress = utils.GetIpAddress(r) - c.Params = ApiParamsFromRequest(r) - - token, tokenLocation := app.ParseAuthTokenFromRequest(r) - - // CSRF Check - if tokenLocation == app.TokenLocationCookie && h.requireSession && !h.trustRequester { - if r.Header.Get(model.HEADER_REQUESTED_WITH) != model.HEADER_REQUESTED_WITH_XML { - c.Err = model.NewAppError("ServeHTTP", "api.context.session_expired.app_error", nil, "token="+token+" Appears to be a CSRF attempt", http.StatusUnauthorized) - token = "" - } - } - - c.SetSiteURLHeader(app.GetProtocol(r) + "://" + r.Host) - - w.Header().Set(model.HEADER_REQUEST_ID, c.RequestId) - w.Header().Set(model.HEADER_VERSION_ID, fmt.Sprintf("%v.%v.%v.%v", model.CurrentVersion, model.BuildNumber, c.App.ClientConfigHash(), c.App.License() != nil)) - - w.Header().Set("Content-Type", "application/json") - - if r.Method == "GET" { - w.Header().Set("Expires", "0") - } - - if len(token) != 0 { - session, err := c.App.GetSession(token) - - if err != nil { - mlog.Info(fmt.Sprintf("Invalid session err=%v", err.Error())) - if err.StatusCode == http.StatusInternalServerError { - c.Err = err - } else if h.requireSession { - c.RemoveSessionCookie(w, r) - c.Err = model.NewAppError("ServeHTTP", "api.context.session_expired.app_error", nil, "token="+token, http.StatusUnauthorized) - } - } else if !session.IsOAuth && tokenLocation == app.TokenLocationQueryString { - c.Err = model.NewAppError("ServeHTTP", "api.context.token_provided.app_error", nil, "token="+token, http.StatusUnauthorized) - } else { - c.Session = *session - } - - // Rate limit by UserID - if c.App.Srv.RateLimiter != nil && c.App.Srv.RateLimiter.UserIdRateLimit(c.Session.UserId, w) { - return - } - } - - c.Path = r.URL.Path - - if c.Err == nil && h.requireSession { - c.SessionRequired() - } - - if c.Err == nil && h.requireMfa { - c.MfaRequired() - } - - if c.Err == nil { - h.handleFunc(c, w, r) - } - - // Handle errors that have occurred - if c.Err != nil { - c.Err.Translate(c.T) - c.Err.RequestId = c.RequestId - - if c.Err.Id == "api.context.session_expired.app_error" { - c.LogInfo(c.Err) - } else { - c.LogError(c.Err) - } - - c.Err.Where = r.URL.Path - - // Block out detailed error when not in developer mode - if !*c.App.Config().ServiceSettings.EnableDeveloper { - c.Err.DetailedError = "" - } - - w.WriteHeader(c.Err.StatusCode) - w.Write([]byte(c.Err.ToJson())) - - if c.App.Metrics != nil { - c.App.Metrics.IncrementHttpError() - } - } - - if c.App.Metrics != nil { - c.App.Metrics.IncrementHttpRequest() - - if r.URL.Path != model.API_URL_SUFFIX+"/websocket" { - elapsed := float64(time.Since(now)) / float64(time.Second) - c.App.Metrics.ObserveHttpRequestDuration(elapsed) - } - } -} - -func (c *Context) LogAudit(extraInfo string) { - audit := &model.Audit{UserId: c.Session.UserId, IpAddress: c.IpAddress, Action: c.Path, ExtraInfo: extraInfo, SessionId: c.Session.Id} - if r := <-c.App.Srv.Store.Audit().Save(audit); r.Err != nil { - c.LogError(r.Err) - } -} - -func (c *Context) LogAuditWithUserId(userId, extraInfo string) { - - if len(c.Session.UserId) > 0 { - extraInfo = strings.TrimSpace(extraInfo + " session_user=" + c.Session.UserId) - } - - audit := &model.Audit{UserId: userId, IpAddress: c.IpAddress, Action: c.Path, ExtraInfo: extraInfo, SessionId: c.Session.Id} - if r := <-c.App.Srv.Store.Audit().Save(audit); r.Err != nil { - c.LogError(r.Err) - } -} - -func (c *Context) LogError(err *model.AppError) { - - // Filter out 404s, endless reconnects and browser compatibility errors - if err.StatusCode == http.StatusNotFound || - (c.Path == "/api/v3/users/websocket" && err.StatusCode == 401) || - err.Id == "web.check_browser_compatibility.app_error" { - c.LogDebug(err) - } else { - mlog.Error(fmt.Sprintf("%v:%v code=%v rid=%v uid=%v ip=%v %v [details: %v]", c.Path, err.Where, err.StatusCode, - c.RequestId, c.Session.UserId, c.IpAddress, err.SystemMessage(utils.TDefault), err.DetailedError), mlog.String("user_id", c.Session.UserId)) - } -} - -func (c *Context) LogInfo(err *model.AppError) { - mlog.Info(fmt.Sprintf("%v:%v code=%v rid=%v uid=%v ip=%v %v [details: %v]", c.Path, err.Where, err.StatusCode, - c.RequestId, c.Session.UserId, c.IpAddress, err.SystemMessage(utils.TDefault), err.DetailedError), mlog.String("user_id", c.Session.UserId)) -} - -func (c *Context) LogDebug(err *model.AppError) { - mlog.Debug(fmt.Sprintf("%v:%v code=%v rid=%v uid=%v ip=%v %v [details: %v]", c.Path, err.Where, err.StatusCode, - c.RequestId, c.Session.UserId, c.IpAddress, err.SystemMessage(utils.TDefault), err.DetailedError), mlog.String("user_id", c.Session.UserId)) -} - -func (c *Context) IsSystemAdmin() bool { - return c.App.SessionHasPermissionTo(c.Session, model.PERMISSION_MANAGE_SYSTEM) -} - -func (c *Context) SessionRequired() { - if !*c.App.Config().ServiceSettings.EnableUserAccessTokens && c.Session.Props[model.SESSION_PROP_TYPE] == model.SESSION_TYPE_USER_ACCESS_TOKEN { - c.Err = model.NewAppError("", "api.context.session_expired.app_error", nil, "UserAccessToken", http.StatusUnauthorized) - return - } - - if len(c.Session.UserId) == 0 { - c.Err = model.NewAppError("", "api.context.session_expired.app_error", nil, "UserRequired", http.StatusUnauthorized) - return - } -} - -func (c *Context) MfaRequired() { - // Must be licensed for MFA and have it configured for enforcement - if license := c.App.License(); license == nil || !*license.Features.MFA || !*c.App.Config().ServiceSettings.EnableMultifactorAuthentication || !*c.App.Config().ServiceSettings.EnforceMultifactorAuthentication { - return - } - - // OAuth integrations are excepted - if c.Session.IsOAuth { - return - } - - if user, err := c.App.GetUser(c.Session.UserId); err != nil { - c.Err = model.NewAppError("", "api.context.session_expired.app_error", nil, "MfaRequired", http.StatusUnauthorized) - return - } else { - // Only required for email and ldap accounts - if user.AuthService != "" && - user.AuthService != model.USER_AUTH_SERVICE_EMAIL && - user.AuthService != model.USER_AUTH_SERVICE_LDAP { - return - } - - // Special case to let user get themself - if c.Path == "/api/v4/users/me" { - return - } - - if !user.MfaActive { - c.Err = model.NewAppError("", "api.context.mfa_required.app_error", nil, "MfaRequired", http.StatusForbidden) - return - } - } -} - -func (c *Context) RemoveSessionCookie(w http.ResponseWriter, r *http.Request) { - cookie := &http.Cookie{ - Name: model.SESSION_COOKIE_TOKEN, - Value: "", - Path: "/", - MaxAge: -1, - HttpOnly: true, - } - - http.SetCookie(w, cookie) -} - -func (c *Context) SetInvalidParam(parameter string) { - c.Err = NewInvalidParamError(parameter) -} - -func (c *Context) SetInvalidUrlParam(parameter string) { - c.Err = NewInvalidUrlParamError(parameter) -} - -func (c *Context) HandleEtag(etag string, routeName string, w http.ResponseWriter, r *http.Request) bool { - metrics := c.App.Metrics - if et := r.Header.Get(model.HEADER_ETAG_CLIENT); len(etag) > 0 { - if et == etag { - w.Header().Set(model.HEADER_ETAG_SERVER, etag) - w.WriteHeader(http.StatusNotModified) - if metrics != nil { - metrics.IncrementEtagHitCounter(routeName) - } - return true - } - } - - if metrics != nil { - metrics.IncrementEtagMissCounter(routeName) - } - - return false -} - -func NewInvalidParamError(parameter string) *model.AppError { - err := model.NewAppError("Context", "api.context.invalid_body_param.app_error", map[string]interface{}{"Name": parameter}, "", http.StatusBadRequest) - return err -} -func NewInvalidUrlParamError(parameter string) *model.AppError { - err := model.NewAppError("Context", "api.context.invalid_url_param.app_error", map[string]interface{}{"Name": parameter}, "", http.StatusBadRequest) - return err -} - -func (c *Context) SetPermissionError(permission *model.Permission) { - c.Err = model.NewAppError("Permissions", "api.context.permissions.app_error", nil, "userId="+c.Session.UserId+", "+"permission="+permission.Id, http.StatusForbidden) -} - -func (c *Context) SetSiteURLHeader(url string) { - c.siteURLHeader = strings.TrimRight(url, "/") -} - -func (c *Context) GetSiteURLHeader() string { - return c.siteURLHeader -} - -func (c *Context) RequireUserId() *Context { - if c.Err != nil { - return c - } - - if c.Params.UserId == model.ME { - c.Params.UserId = c.Session.UserId - } - - if len(c.Params.UserId) != 26 { - c.SetInvalidUrlParam("user_id") - } - return c -} - -func (c *Context) RequireTeamId() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.TeamId) != 26 { - c.SetInvalidUrlParam("team_id") - } - return c -} - -func (c *Context) RequireInviteId() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.InviteId) == 0 { - c.SetInvalidUrlParam("invite_id") - } - return c -} - -func (c *Context) RequireTokenId() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.TokenId) != 26 { - c.SetInvalidUrlParam("token_id") - } - return c -} - -func (c *Context) RequireChannelId() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.ChannelId) != 26 { - c.SetInvalidUrlParam("channel_id") - } - return c -} - -func (c *Context) RequireUsername() *Context { - if c.Err != nil { - return c - } - - if !model.IsValidUsername(c.Params.Username) { - c.SetInvalidParam("username") - } - - return c -} - -func (c *Context) RequirePostId() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.PostId) != 26 { - c.SetInvalidUrlParam("post_id") - } - return c -} - -func (c *Context) RequireAppId() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.AppId) != 26 { - c.SetInvalidUrlParam("app_id") - } - return c -} - -func (c *Context) RequireFileId() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.FileId) != 26 { - c.SetInvalidUrlParam("file_id") - } - - return c -} - -func (c *Context) RequireFilename() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.Filename) == 0 { - c.SetInvalidUrlParam("filename") - } - - return c -} - -func (c *Context) RequirePluginId() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.PluginId) == 0 { - c.SetInvalidUrlParam("plugin_id") - } - - return c -} - -func (c *Context) RequireReportId() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.ReportId) != 26 { - c.SetInvalidUrlParam("report_id") - } - return c -} - -func (c *Context) RequireEmojiId() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.EmojiId) != 26 { - c.SetInvalidUrlParam("emoji_id") - } - return c -} - -func (c *Context) RequireTeamName() *Context { - if c.Err != nil { - return c - } - - if !model.IsValidTeamName(c.Params.TeamName) { - c.SetInvalidUrlParam("team_name") - } - - return c -} - -func (c *Context) RequireChannelName() *Context { - if c.Err != nil { - return c - } - - if !model.IsValidChannelIdentifier(c.Params.ChannelName) { - c.SetInvalidUrlParam("channel_name") - } - - return c -} - -func (c *Context) RequireEmail() *Context { - if c.Err != nil { - return c - } - - if !model.IsValidEmail(c.Params.Email) { - c.SetInvalidUrlParam("email") - } - - return c -} - -func (c *Context) RequireCategory() *Context { - if c.Err != nil { - return c - } - - if !model.IsValidAlphaNumHyphenUnderscore(c.Params.Category, true) { - c.SetInvalidUrlParam("category") - } - - return c -} - -func (c *Context) RequireService() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.Service) == 0 { - c.SetInvalidUrlParam("service") - } - - return c -} - -func (c *Context) RequirePreferenceName() *Context { - if c.Err != nil { - return c - } - - if !model.IsValidAlphaNumHyphenUnderscore(c.Params.PreferenceName, true) { - c.SetInvalidUrlParam("preference_name") - } - - return c -} - -func (c *Context) RequireEmojiName() *Context { - if c.Err != nil { - return c - } - - validName := regexp.MustCompile(`^[a-zA-Z0-9\-\+_]+$`) - - if len(c.Params.EmojiName) == 0 || len(c.Params.EmojiName) > model.EMOJI_NAME_MAX_LENGTH || !validName.MatchString(c.Params.EmojiName) { - c.SetInvalidUrlParam("emoji_name") - } - - return c -} - -func (c *Context) RequireHookId() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.HookId) != 26 { - c.SetInvalidUrlParam("hook_id") - } - - return c -} - -func (c *Context) RequireCommandId() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.CommandId) != 26 { - c.SetInvalidUrlParam("command_id") - } - return c -} - -func (c *Context) RequireJobId() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.JobId) != 26 { - c.SetInvalidUrlParam("job_id") - } - return c -} - -func (c *Context) RequireJobType() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.JobType) == 0 || len(c.Params.JobType) > 32 { - c.SetInvalidUrlParam("job_type") - } - return c -} - -func (c *Context) RequireActionId() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.ActionId) != 26 { - c.SetInvalidUrlParam("action_id") - } - return c -} - -func (c *Context) RequireRoleId() *Context { - if c.Err != nil { - return c - } - - if len(c.Params.RoleId) != 26 { - c.SetInvalidUrlParam("role_id") - } - return c -} - -func (c *Context) RequireRoleName() *Context { - if c.Err != nil { - return c - } - - if !model.IsValidRoleName(c.Params.RoleName) { - c.SetInvalidUrlParam("role_name") - } - - return c -} diff --git a/api4/context_test.go b/api4/context_test.go deleted file mode 100644 index 302b7b24b..000000000 --- a/api4/context_test.go +++ /dev/null @@ -1,31 +0,0 @@ -package api4 - -import ( - "net/http" - "testing" -) - -func TestRequireHookId(t *testing.T) { - c := &Context{} - t.Run("WhenHookIdIsValid", func(t *testing.T) { - c.Params = &ApiParams{HookId: "abcdefghijklmnopqrstuvwxyz"} - c.RequireHookId() - - if c.Err != nil { - t.Fatal("Hook Id is Valid. Should not have set error in context") - } - }) - - t.Run("WhenHookIdIsInvalid", func(t *testing.T) { - c.Params = &ApiParams{HookId: "abc"} - c.RequireHookId() - - if c.Err == nil { - t.Fatal("Should have set Error in context") - } - - if c.Err.StatusCode != http.StatusBadRequest { - t.Fatal("Should have set status as 400") - } - }) -} diff --git a/api4/emoji.go b/api4/emoji.go index ae4a35dd5..cfb5dd6ab 100644 --- a/api4/emoji.go +++ b/api4/emoji.go @@ -9,6 +9,7 @@ import ( "github.com/mattermost/mattermost-server/app" "github.com/mattermost/mattermost-server/model" + "github.com/mattermost/mattermost-server/web" ) const ( @@ -197,7 +198,7 @@ func searchEmojis(c *Context, w http.ResponseWriter, r *http.Request) { return } - emojis, err := c.App.SearchEmoji(emojiSearch.Term, emojiSearch.PrefixOnly, PER_PAGE_MAXIMUM) + emojis, err := c.App.SearchEmoji(emojiSearch.Term, emojiSearch.PrefixOnly, web.PER_PAGE_MAXIMUM) if err != nil { c.Err = err return diff --git a/api4/handlers.go b/api4/handlers.go new file mode 100644 index 000000000..74e2fc88d --- /dev/null +++ b/api4/handlers.go @@ -0,0 +1,67 @@ +// Copyright (c) 2017-present Mattermost, Inc. All Rights Reserved. +// See License.txt for license information. + +package api4 + +import ( + "net/http" + + "github.com/mattermost/mattermost-server/web" +) + +type Context = web.Context + +func (api *API) ApiHandler(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler { + return &web.Handler{ + App: api.App, + HandleFunc: h, + RequireSession: false, + TrustRequester: false, + RequireMfa: false, + IsStatic: false, + } +} + +func (api *API) ApiSessionRequired(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler { + return &web.Handler{ + App: api.App, + HandleFunc: h, + RequireSession: true, + TrustRequester: false, + RequireMfa: true, + IsStatic: false, + } +} + +func (api *API) ApiSessionRequiredMfa(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler { + return &web.Handler{ + App: api.App, + HandleFunc: h, + RequireSession: true, + TrustRequester: false, + RequireMfa: false, + IsStatic: false, + } +} + +func (api *API) ApiHandlerTrustRequester(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler { + return &web.Handler{ + App: api.App, + HandleFunc: h, + RequireSession: false, + TrustRequester: true, + RequireMfa: false, + IsStatic: false, + } +} + +func (api *API) ApiSessionRequiredTrustRequester(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler { + return &web.Handler{ + App: api.App, + HandleFunc: h, + RequireSession: true, + TrustRequester: true, + RequireMfa: true, + IsStatic: false, + } +} diff --git a/api4/params.go b/api4/params.go deleted file mode 100644 index e8e3f25e7..000000000 --- a/api4/params.go +++ /dev/null @@ -1,197 +0,0 @@ -// Copyright (c) 2017-present Mattermost, Inc. All Rights Reserved. -// See License.txt for license information. - -package api4 - -import ( - "net/http" - "strconv" - "strings" - - "github.com/gorilla/mux" -) - -const ( - PAGE_DEFAULT = 0 - PER_PAGE_DEFAULT = 60 - PER_PAGE_MAXIMUM = 200 - LOGS_PER_PAGE_DEFAULT = 10000 - LOGS_PER_PAGE_MAXIMUM = 10000 -) - -type ApiParams struct { - UserId string - TeamId string - InviteId string - TokenId string - ChannelId string - PostId string - FileId string - Filename string - PluginId string - CommandId string - HookId string - ReportId string - EmojiId string - AppId string - Email string - Username string - TeamName string - ChannelName string - PreferenceName string - EmojiName string - Category string - Service string - JobId string - JobType string - ActionId string - RoleId string - RoleName string - Page int - PerPage int - LogsPerPage int - Permanent bool -} - -func ApiParamsFromRequest(r *http.Request) *ApiParams { - params := &ApiParams{} - - props := mux.Vars(r) - query := r.URL.Query() - - if val, ok := props["user_id"]; ok { - params.UserId = val - } - - if val, ok := props["team_id"]; ok { - params.TeamId = val - } - - if val, ok := props["invite_id"]; ok { - params.InviteId = val - } - - if val, ok := props["token_id"]; ok { - params.TokenId = val - } - - if val, ok := props["channel_id"]; ok { - params.ChannelId = val - } else { - params.ChannelId = query.Get("channel_id") - } - - if val, ok := props["post_id"]; ok { - params.PostId = val - } - - if val, ok := props["file_id"]; ok { - params.FileId = val - } - - params.Filename = query.Get("filename") - - if val, ok := props["plugin_id"]; ok { - params.PluginId = val - } - - if val, ok := props["command_id"]; ok { - params.CommandId = val - } - - if val, ok := props["hook_id"]; ok { - params.HookId = val - } - - if val, ok := props["report_id"]; ok { - params.ReportId = val - } - - if val, ok := props["emoji_id"]; ok { - params.EmojiId = val - } - - if val, ok := props["app_id"]; ok { - params.AppId = val - } - - if val, ok := props["email"]; ok { - params.Email = val - } - - if val, ok := props["username"]; ok { - params.Username = val - } - - if val, ok := props["team_name"]; ok { - params.TeamName = strings.ToLower(val) - } - - if val, ok := props["channel_name"]; ok { - params.ChannelName = strings.ToLower(val) - } - - if val, ok := props["category"]; ok { - params.Category = val - } - - if val, ok := props["service"]; ok { - params.Service = val - } - - if val, ok := props["preference_name"]; ok { - params.PreferenceName = val - } - - if val, ok := props["emoji_name"]; ok { - params.EmojiName = val - } - - if val, ok := props["job_id"]; ok { - params.JobId = val - } - - if val, ok := props["job_type"]; ok { - params.JobType = val - } - - if val, ok := props["action_id"]; ok { - params.ActionId = val - } - - if val, ok := props["role_id"]; ok { - params.RoleId = val - } - - if val, ok := props["role_name"]; ok { - params.RoleName = val - } - - if val, err := strconv.Atoi(query.Get("page")); err != nil || val < 0 { - params.Page = PAGE_DEFAULT - } else { - params.Page = val - } - - if val, err := strconv.ParseBool(query.Get("permanent")); err != nil { - params.Permanent = val - } - - if val, err := strconv.Atoi(query.Get("per_page")); err != nil || val < 0 { - params.PerPage = PER_PAGE_DEFAULT - } else if val > PER_PAGE_MAXIMUM { - params.PerPage = PER_PAGE_MAXIMUM - } else { - params.PerPage = val - } - - if val, err := strconv.Atoi(query.Get("logs_per_page")); err != nil || val < 0 { - params.LogsPerPage = LOGS_PER_PAGE_DEFAULT - } else if val > LOGS_PER_PAGE_MAXIMUM { - params.LogsPerPage = LOGS_PER_PAGE_MAXIMUM - } else { - params.LogsPerPage = val - } - - return params -} diff --git a/api4/webhook.go b/api4/webhook.go index fadc3fbf3..ec90c6f3a 100644 --- a/api4/webhook.go +++ b/api4/webhook.go @@ -4,14 +4,8 @@ package api4 import ( - "fmt" - "io" "net/http" - "strings" - "github.com/gorilla/mux" - "github.com/gorilla/schema" - "github.com/mattermost/mattermost-server/mlog" "github.com/mattermost/mattermost-server/model" ) @@ -28,12 +22,6 @@ func (api *API) InitWebhook() { api.BaseRoutes.OutgoingHook.Handle("", api.ApiSessionRequired(updateOutgoingHook)).Methods("PUT") api.BaseRoutes.OutgoingHook.Handle("", api.ApiSessionRequired(deleteOutgoingHook)).Methods("DELETE") api.BaseRoutes.OutgoingHook.Handle("/regen_token", api.ApiSessionRequired(regenOutgoingHookToken)).Methods("POST") - - api.BaseRoutes.Root.Handle("/hooks/commands/{id:[A-Za-z0-9]+}", api.ApiHandler(commandWebhook)).Methods("POST") - api.BaseRoutes.Root.Handle("/hooks/{id:[A-Za-z0-9]+}", api.ApiHandler(incomingWebhook)).Methods("POST") - - // Old endpoint for backwards compatibility - api.BaseRoutes.Root.Handle("/api/v3/teams/{team_id:[A-Za-z0-9]+}/hooks/{id:[A-Za-z0-9]+}", api.ApiHandler(incomingWebhook)).Methods("POST") } func createIncomingHook(c *Context, w http.ResponseWriter, r *http.Request) { @@ -454,82 +442,3 @@ func deleteOutgoingHook(c *Context, w http.ResponseWriter, r *http.Request) { c.LogAudit("success") ReturnStatusOK(w) } - -func incomingWebhook(c *Context, w http.ResponseWriter, r *http.Request) { - params := mux.Vars(r) - id := params["id"] - - r.ParseForm() - - var err *model.AppError - incomingWebhookPayload := &model.IncomingWebhookRequest{} - contentType := r.Header.Get("Content-Type") - if strings.Split(contentType, "; ")[0] == "application/x-www-form-urlencoded" { - payload := strings.NewReader(r.FormValue("payload")) - - incomingWebhookPayload, err = decodePayload(payload) - if err != nil { - c.Err = err - return - } - } else if strings.HasPrefix(contentType, "multipart/form-data") { - r.ParseMultipartForm(0) - - decoder := schema.NewDecoder() - err := decoder.Decode(incomingWebhookPayload, r.PostForm) - - if err != nil { - c.Err = model.NewAppError("incomingWebhook", "api.webhook.incoming.error", nil, err.Error(), http.StatusBadRequest) - return - } - } else { - incomingWebhookPayload, err = decodePayload(r.Body) - if err != nil { - c.Err = err - return - } - } - - if c.App.Config().LogSettings.EnableWebhookDebugging { - mlog.Debug(fmt.Sprint("Incoming webhook received. Content=", incomingWebhookPayload.ToJson())) - } - - err = c.App.HandleIncomingWebhook(id, incomingWebhookPayload) - if err != nil { - c.Err = err - return - } - - w.Header().Set("Content-Type", "text/plain") - w.Write([]byte("ok")) -} - -func commandWebhook(c *Context, w http.ResponseWriter, r *http.Request) { - params := mux.Vars(r) - id := params["id"] - - response, err := model.CommandResponseFromHTTPBody(r.Header.Get("Content-Type"), r.Body) - if err != nil { - c.Err = model.NewAppError("commandWebhook", "web.command_webhook.parse.app_error", nil, err.Error(), http.StatusBadRequest) - return - } - - appErr := c.App.HandleCommandWebhook(id, response) - if appErr != nil { - c.Err = appErr - return - } - - w.Header().Set("Content-Type", "text/plain") - w.Write([]byte("ok")) -} - -func decodePayload(payload io.Reader) (*model.IncomingWebhookRequest, *model.AppError) { - incomingWebhookPayload, decodeError := model.IncomingWebhookRequestFromJson(payload) - - if decodeError != nil { - return nil, decodeError - } - - return incomingWebhookPayload, nil -} diff --git a/api4/webhook_test.go b/api4/webhook_test.go index e983b6461..441fb8bb7 100644 --- a/api4/webhook_test.go +++ b/api4/webhook_test.go @@ -4,8 +4,6 @@ package api4 import ( - "bytes" - "net/http" "testing" "github.com/stretchr/testify/assert" @@ -892,46 +890,3 @@ func TestDeleteOutgoingHook(t *testing.T) { CheckForbiddenStatus(t, resp) }) } - -func TestCommandWebhooks(t *testing.T) { - th := Setup().InitBasic().InitSystemAdmin() - defer th.TearDown() - - Client := th.SystemAdminClient - - cmd := &model.Command{ - CreatorId: th.BasicUser.Id, - TeamId: th.BasicTeam.Id, - URL: "http://nowhere.com", - Method: model.COMMAND_METHOD_POST, - Trigger: "delayed"} - - cmd, _ = Client.CreateCommand(cmd) - args := &model.CommandArgs{ - TeamId: th.BasicTeam.Id, - UserId: th.BasicUser.Id, - ChannelId: th.BasicChannel.Id, - } - hook, err := th.App.CreateCommandWebhook(cmd.Id, args) - if err != nil { - t.Fatal(err) - } - - if resp, _ := http.Post(Client.Url+"/hooks/commands/123123123123", "application/json", bytes.NewBufferString(`{"text":"this is a test"}`)); resp.StatusCode != http.StatusNotFound { - t.Fatal("expected not-found for non-existent hook") - } - - if resp, err := http.Post(Client.Url+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"invalid`)); err != nil || resp.StatusCode != http.StatusBadRequest { - t.Fatal(err) - } - - for i := 0; i < 5; i++ { - if resp, err := http.Post(Client.Url+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"this is a test"}`)); err != nil || resp.StatusCode != http.StatusOK { - t.Fatal(err) - } - } - - if resp, _ := http.Post(Client.Url+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"this is a test"}`)); resp.StatusCode != http.StatusBadRequest { - t.Fatal("expected error for sixth usage") - } -} -- cgit v1.2.3-1-g7c22