From 47250c6629416b628a19e5571ac89f7b4646418c Mon Sep 17 00:00:00 2001 From: Joram Wilander Date: Mon, 14 May 2018 10:24:58 -0400 Subject: Refactor context out of API packages (#8755) * Refactor context out of API packages * Update function names per feedback * Move webhook handlers to web and fix web tests * Move more webhook tests out of api package * Fix static handler --- web/context.go | 499 ++++++++++++++++++++++++++++++++++++++++++++++++++++ web/context_test.go | 31 ++++ web/handlers.go | 158 +++++++++++++++++ web/params.go | 197 +++++++++++++++++++++ web/static.go | 84 +++++++++ web/web.go | 91 +++------- web/web_test.go | 99 ++++------- web/webhook.go | 101 +++++++++++ web/webhook_test.go | 216 +++++++++++++++++++++++ 9 files changed, 1347 insertions(+), 129 deletions(-) create mode 100644 web/context.go create mode 100644 web/context_test.go create mode 100644 web/handlers.go create mode 100644 web/params.go create mode 100644 web/static.go create mode 100644 web/webhook.go create mode 100644 web/webhook_test.go (limited to 'web') diff --git a/web/context.go b/web/context.go new file mode 100644 index 000000000..bf7cfcb8d --- /dev/null +++ b/web/context.go @@ -0,0 +1,499 @@ +// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved. +// See License.txt for license information. + +package web + +import ( + "fmt" + "net/http" + "regexp" + "strings" + + goi18n "github.com/nicksnyder/go-i18n/i18n" + + "github.com/mattermost/mattermost-server/app" + "github.com/mattermost/mattermost-server/mlog" + "github.com/mattermost/mattermost-server/model" + "github.com/mattermost/mattermost-server/utils" +) + +type Context struct { + App *app.App + Session model.Session + Params *Params + Err *model.AppError + T goi18n.TranslateFunc + RequestId string + IpAddress string + Path string + siteURLHeader string +} + +func (c *Context) LogAudit(extraInfo string) { + audit := &model.Audit{UserId: c.Session.UserId, IpAddress: c.IpAddress, Action: c.Path, ExtraInfo: extraInfo, SessionId: c.Session.Id} + if r := <-c.App.Srv.Store.Audit().Save(audit); r.Err != nil { + c.LogError(r.Err) + } +} + +func (c *Context) LogAuditWithUserId(userId, extraInfo string) { + + if len(c.Session.UserId) > 0 { + extraInfo = strings.TrimSpace(extraInfo + " session_user=" + c.Session.UserId) + } + + audit := &model.Audit{UserId: userId, IpAddress: c.IpAddress, Action: c.Path, ExtraInfo: extraInfo, SessionId: c.Session.Id} + if r := <-c.App.Srv.Store.Audit().Save(audit); r.Err != nil { + c.LogError(r.Err) + } +} + +func (c *Context) LogError(err *model.AppError) { + + // Filter out 404s, endless reconnects and browser compatibility errors + if err.StatusCode == http.StatusNotFound || + (c.Path == "/api/v3/users/websocket" && err.StatusCode == 401) || + err.Id == "web.check_browser_compatibility.app_error" { + c.LogDebug(err) + } else { + mlog.Error(fmt.Sprintf("%v:%v code=%v rid=%v uid=%v ip=%v %v [details: %v]", c.Path, err.Where, err.StatusCode, + c.RequestId, c.Session.UserId, c.IpAddress, err.SystemMessage(utils.TDefault), err.DetailedError), mlog.String("user_id", c.Session.UserId)) + } +} + +func (c *Context) LogInfo(err *model.AppError) { + mlog.Info(fmt.Sprintf("%v:%v code=%v rid=%v uid=%v ip=%v %v [details: %v]", c.Path, err.Where, err.StatusCode, + c.RequestId, c.Session.UserId, c.IpAddress, err.SystemMessage(utils.TDefault), err.DetailedError), mlog.String("user_id", c.Session.UserId)) +} + +func (c *Context) LogDebug(err *model.AppError) { + mlog.Debug(fmt.Sprintf("%v:%v code=%v rid=%v uid=%v ip=%v %v [details: %v]", c.Path, err.Where, err.StatusCode, + c.RequestId, c.Session.UserId, c.IpAddress, err.SystemMessage(utils.TDefault), err.DetailedError), mlog.String("user_id", c.Session.UserId)) +} + +func (c *Context) IsSystemAdmin() bool { + return c.App.SessionHasPermissionTo(c.Session, model.PERMISSION_MANAGE_SYSTEM) +} + +func (c *Context) SessionRequired() { + if !*c.App.Config().ServiceSettings.EnableUserAccessTokens && c.Session.Props[model.SESSION_PROP_TYPE] == model.SESSION_TYPE_USER_ACCESS_TOKEN { + c.Err = model.NewAppError("", "api.context.session_expired.app_error", nil, "UserAccessToken", http.StatusUnauthorized) + return + } + + if len(c.Session.UserId) == 0 { + c.Err = model.NewAppError("", "api.context.session_expired.app_error", nil, "UserRequired", http.StatusUnauthorized) + return + } +} + +func (c *Context) MfaRequired() { + // Must be licensed for MFA and have it configured for enforcement + if license := c.App.License(); license == nil || !*license.Features.MFA || !*c.App.Config().ServiceSettings.EnableMultifactorAuthentication || !*c.App.Config().ServiceSettings.EnforceMultifactorAuthentication { + return + } + + // OAuth integrations are excepted + if c.Session.IsOAuth { + return + } + + if user, err := c.App.GetUser(c.Session.UserId); err != nil { + c.Err = model.NewAppError("", "api.context.session_expired.app_error", nil, "MfaRequired", http.StatusUnauthorized) + return + } else { + // Only required for email and ldap accounts + if user.AuthService != "" && + user.AuthService != model.USER_AUTH_SERVICE_EMAIL && + user.AuthService != model.USER_AUTH_SERVICE_LDAP { + return + } + + // Special case to let user get themself + if c.Path == "/api/v4/users/me" { + return + } + + if !user.MfaActive { + c.Err = model.NewAppError("", "api.context.mfa_required.app_error", nil, "MfaRequired", http.StatusForbidden) + return + } + } +} + +func (c *Context) RemoveSessionCookie(w http.ResponseWriter, r *http.Request) { + cookie := &http.Cookie{ + Name: model.SESSION_COOKIE_TOKEN, + Value: "", + Path: "/", + MaxAge: -1, + HttpOnly: true, + } + + http.SetCookie(w, cookie) +} + +func (c *Context) SetInvalidParam(parameter string) { + c.Err = NewInvalidParamError(parameter) +} + +func (c *Context) SetInvalidUrlParam(parameter string) { + c.Err = NewInvalidUrlParamError(parameter) +} + +func (c *Context) HandleEtag(etag string, routeName string, w http.ResponseWriter, r *http.Request) bool { + metrics := c.App.Metrics + if et := r.Header.Get(model.HEADER_ETAG_CLIENT); len(etag) > 0 { + if et == etag { + w.Header().Set(model.HEADER_ETAG_SERVER, etag) + w.WriteHeader(http.StatusNotModified) + if metrics != nil { + metrics.IncrementEtagHitCounter(routeName) + } + return true + } + } + + if metrics != nil { + metrics.IncrementEtagMissCounter(routeName) + } + + return false +} + +func NewInvalidParamError(parameter string) *model.AppError { + err := model.NewAppError("Context", "api.context.invalid_body_param.app_error", map[string]interface{}{"Name": parameter}, "", http.StatusBadRequest) + return err +} +func NewInvalidUrlParamError(parameter string) *model.AppError { + err := model.NewAppError("Context", "api.context.invalid_url_param.app_error", map[string]interface{}{"Name": parameter}, "", http.StatusBadRequest) + return err +} + +func (c *Context) SetPermissionError(permission *model.Permission) { + c.Err = model.NewAppError("Permissions", "api.context.permissions.app_error", nil, "userId="+c.Session.UserId+", "+"permission="+permission.Id, http.StatusForbidden) +} + +func (c *Context) SetSiteURLHeader(url string) { + c.siteURLHeader = strings.TrimRight(url, "/") +} + +func (c *Context) GetSiteURLHeader() string { + return c.siteURLHeader +} + +func (c *Context) RequireUserId() *Context { + if c.Err != nil { + return c + } + + if c.Params.UserId == model.ME { + c.Params.UserId = c.Session.UserId + } + + if len(c.Params.UserId) != 26 { + c.SetInvalidUrlParam("user_id") + } + return c +} + +func (c *Context) RequireTeamId() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.TeamId) != 26 { + c.SetInvalidUrlParam("team_id") + } + return c +} + +func (c *Context) RequireInviteId() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.InviteId) == 0 { + c.SetInvalidUrlParam("invite_id") + } + return c +} + +func (c *Context) RequireTokenId() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.TokenId) != 26 { + c.SetInvalidUrlParam("token_id") + } + return c +} + +func (c *Context) RequireChannelId() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.ChannelId) != 26 { + c.SetInvalidUrlParam("channel_id") + } + return c +} + +func (c *Context) RequireUsername() *Context { + if c.Err != nil { + return c + } + + if !model.IsValidUsername(c.Params.Username) { + c.SetInvalidParam("username") + } + + return c +} + +func (c *Context) RequirePostId() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.PostId) != 26 { + c.SetInvalidUrlParam("post_id") + } + return c +} + +func (c *Context) RequireAppId() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.AppId) != 26 { + c.SetInvalidUrlParam("app_id") + } + return c +} + +func (c *Context) RequireFileId() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.FileId) != 26 { + c.SetInvalidUrlParam("file_id") + } + + return c +} + +func (c *Context) RequireFilename() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.Filename) == 0 { + c.SetInvalidUrlParam("filename") + } + + return c +} + +func (c *Context) RequirePluginId() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.PluginId) == 0 { + c.SetInvalidUrlParam("plugin_id") + } + + return c +} + +func (c *Context) RequireReportId() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.ReportId) != 26 { + c.SetInvalidUrlParam("report_id") + } + return c +} + +func (c *Context) RequireEmojiId() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.EmojiId) != 26 { + c.SetInvalidUrlParam("emoji_id") + } + return c +} + +func (c *Context) RequireTeamName() *Context { + if c.Err != nil { + return c + } + + if !model.IsValidTeamName(c.Params.TeamName) { + c.SetInvalidUrlParam("team_name") + } + + return c +} + +func (c *Context) RequireChannelName() *Context { + if c.Err != nil { + return c + } + + if !model.IsValidChannelIdentifier(c.Params.ChannelName) { + c.SetInvalidUrlParam("channel_name") + } + + return c +} + +func (c *Context) RequireEmail() *Context { + if c.Err != nil { + return c + } + + if !model.IsValidEmail(c.Params.Email) { + c.SetInvalidUrlParam("email") + } + + return c +} + +func (c *Context) RequireCategory() *Context { + if c.Err != nil { + return c + } + + if !model.IsValidAlphaNumHyphenUnderscore(c.Params.Category, true) { + c.SetInvalidUrlParam("category") + } + + return c +} + +func (c *Context) RequireService() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.Service) == 0 { + c.SetInvalidUrlParam("service") + } + + return c +} + +func (c *Context) RequirePreferenceName() *Context { + if c.Err != nil { + return c + } + + if !model.IsValidAlphaNumHyphenUnderscore(c.Params.PreferenceName, true) { + c.SetInvalidUrlParam("preference_name") + } + + return c +} + +func (c *Context) RequireEmojiName() *Context { + if c.Err != nil { + return c + } + + validName := regexp.MustCompile(`^[a-zA-Z0-9\-\+_]+$`) + + if len(c.Params.EmojiName) == 0 || len(c.Params.EmojiName) > model.EMOJI_NAME_MAX_LENGTH || !validName.MatchString(c.Params.EmojiName) { + c.SetInvalidUrlParam("emoji_name") + } + + return c +} + +func (c *Context) RequireHookId() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.HookId) != 26 { + c.SetInvalidUrlParam("hook_id") + } + + return c +} + +func (c *Context) RequireCommandId() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.CommandId) != 26 { + c.SetInvalidUrlParam("command_id") + } + return c +} + +func (c *Context) RequireJobId() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.JobId) != 26 { + c.SetInvalidUrlParam("job_id") + } + return c +} + +func (c *Context) RequireJobType() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.JobType) == 0 || len(c.Params.JobType) > 32 { + c.SetInvalidUrlParam("job_type") + } + return c +} + +func (c *Context) RequireActionId() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.ActionId) != 26 { + c.SetInvalidUrlParam("action_id") + } + return c +} + +func (c *Context) RequireRoleId() *Context { + if c.Err != nil { + return c + } + + if len(c.Params.RoleId) != 26 { + c.SetInvalidUrlParam("role_id") + } + return c +} + +func (c *Context) RequireRoleName() *Context { + if c.Err != nil { + return c + } + + if !model.IsValidRoleName(c.Params.RoleName) { + c.SetInvalidUrlParam("role_name") + } + + return c +} diff --git a/web/context_test.go b/web/context_test.go new file mode 100644 index 000000000..3fa6ebf22 --- /dev/null +++ b/web/context_test.go @@ -0,0 +1,31 @@ +package web + +import ( + "net/http" + "testing" +) + +func TestRequireHookId(t *testing.T) { + c := &Context{} + t.Run("WhenHookIdIsValid", func(t *testing.T) { + c.Params = &Params{HookId: "abcdefghijklmnopqrstuvwxyz"} + c.RequireHookId() + + if c.Err != nil { + t.Fatal("Hook Id is Valid. Should not have set error in context") + } + }) + + t.Run("WhenHookIdIsInvalid", func(t *testing.T) { + c.Params = &Params{HookId: "abc"} + c.RequireHookId() + + if c.Err == nil { + t.Fatal("Should have set Error in context") + } + + if c.Err.StatusCode != http.StatusBadRequest { + t.Fatal("Should have set status as 400") + } + }) +} diff --git a/web/handlers.go b/web/handlers.go new file mode 100644 index 000000000..e2521674a --- /dev/null +++ b/web/handlers.go @@ -0,0 +1,158 @@ +// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved. +// See License.txt for license information. + +package web + +import ( + "fmt" + "net/http" + "time" + + "github.com/mattermost/mattermost-server/app" + "github.com/mattermost/mattermost-server/mlog" + "github.com/mattermost/mattermost-server/model" + "github.com/mattermost/mattermost-server/utils" +) + +func (w *Web) NewHandler(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler { + return &Handler{ + App: w.App, + HandleFunc: h, + RequireSession: false, + TrustRequester: false, + RequireMfa: false, + IsStatic: false, + } +} + +func (w *Web) NewStaticHandler(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler { + return &Handler{ + App: w.App, + HandleFunc: h, + RequireSession: false, + TrustRequester: false, + RequireMfa: false, + IsStatic: true, + } +} + +type Handler struct { + App *app.App + HandleFunc func(*Context, http.ResponseWriter, *http.Request) + RequireSession bool + TrustRequester bool + RequireMfa bool + IsStatic bool +} + +func (h Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) { + now := time.Now() + mlog.Debug(fmt.Sprintf("%v - %v", r.Method, r.URL.Path)) + + c := &Context{} + c.App = h.App + c.T, _ = utils.GetTranslationsAndLocale(w, r) + c.RequestId = model.NewId() + c.IpAddress = utils.GetIpAddress(r) + c.Params = ParamsFromRequest(r) + + token, tokenLocation := app.ParseAuthTokenFromRequest(r) + + // CSRF Check + if tokenLocation == app.TokenLocationCookie && h.RequireSession && !h.TrustRequester { + if r.Header.Get(model.HEADER_REQUESTED_WITH) != model.HEADER_REQUESTED_WITH_XML { + c.Err = model.NewAppError("ServeHTTP", "api.context.session_expired.app_error", nil, "token="+token+" Appears to be a CSRF attempt", http.StatusUnauthorized) + token = "" + } + } + + c.SetSiteURLHeader(app.GetProtocol(r) + "://" + r.Host) + + w.Header().Set(model.HEADER_REQUEST_ID, c.RequestId) + w.Header().Set(model.HEADER_VERSION_ID, fmt.Sprintf("%v.%v.%v.%v", model.CurrentVersion, model.BuildNumber, c.App.ClientConfigHash(), c.App.License() != nil)) + + if h.IsStatic { + // Instruct the browser not to display us in an iframe unless is the same origin for anti-clickjacking + w.Header().Set("X-Frame-Options", "SAMEORIGIN") + w.Header().Set("Content-Security-Policy", "frame-ancestors 'self'") + } else { + // All api response bodies will be JSON formatted by default + w.Header().Set("Content-Type", "application/json") + + if r.Method == "GET" { + w.Header().Set("Expires", "0") + } + } + + if len(token) != 0 { + session, err := c.App.GetSession(token) + + if err != nil { + mlog.Info(fmt.Sprintf("Invalid session err=%v", err.Error())) + if err.StatusCode == http.StatusInternalServerError { + c.Err = err + } else if h.RequireSession { + c.RemoveSessionCookie(w, r) + c.Err = model.NewAppError("ServeHTTP", "api.context.session_expired.app_error", nil, "token="+token, http.StatusUnauthorized) + } + } else if !session.IsOAuth && tokenLocation == app.TokenLocationQueryString { + c.Err = model.NewAppError("ServeHTTP", "api.context.token_provided.app_error", nil, "token="+token, http.StatusUnauthorized) + } else { + c.Session = *session + } + + // Rate limit by UserID + if c.App.Srv.RateLimiter != nil && c.App.Srv.RateLimiter.UserIdRateLimit(c.Session.UserId, w) { + return + } + } + + c.Path = r.URL.Path + + if c.Err == nil && h.RequireSession { + c.SessionRequired() + } + + if c.Err == nil && h.RequireMfa { + c.MfaRequired() + } + + if c.Err == nil { + h.HandleFunc(c, w, r) + } + + // Handle errors that have occurred + if c.Err != nil { + c.Err.Translate(c.T) + c.Err.RequestId = c.RequestId + + if c.Err.Id == "api.context.session_expired.app_error" { + c.LogInfo(c.Err) + } else { + c.LogError(c.Err) + } + + c.Err.Where = r.URL.Path + + // Block out detailed error when not in developer mode + if !*c.App.Config().ServiceSettings.EnableDeveloper { + c.Err.DetailedError = "" + } + + w.WriteHeader(c.Err.StatusCode) + w.Write([]byte(c.Err.ToJson())) + + if c.App.Metrics != nil { + c.App.Metrics.IncrementHttpError() + } + } + + if c.App.Metrics != nil { + c.App.Metrics.IncrementHttpRequest() + + if r.URL.Path != model.API_URL_SUFFIX+"/websocket" { + elapsed := float64(time.Since(now)) / float64(time.Second) + c.App.Metrics.ObserveHttpRequestDuration(elapsed) + } + } +} diff --git a/web/params.go b/web/params.go new file mode 100644 index 000000000..286c3f44f --- /dev/null +++ b/web/params.go @@ -0,0 +1,197 @@ +// Copyright (c) 2017-present Mattermost, Inc. All Rights Reserved. +// See License.txt for license information. + +package web + +import ( + "net/http" + "strconv" + "strings" + + "github.com/gorilla/mux" +) + +const ( + PAGE_DEFAULT = 0 + PER_PAGE_DEFAULT = 60 + PER_PAGE_MAXIMUM = 200 + LOGS_PER_PAGE_DEFAULT = 10000 + LOGS_PER_PAGE_MAXIMUM = 10000 +) + +type Params struct { + UserId string + TeamId string + InviteId string + TokenId string + ChannelId string + PostId string + FileId string + Filename string + PluginId string + CommandId string + HookId string + ReportId string + EmojiId string + AppId string + Email string + Username string + TeamName string + ChannelName string + PreferenceName string + EmojiName string + Category string + Service string + JobId string + JobType string + ActionId string + RoleId string + RoleName string + Page int + PerPage int + LogsPerPage int + Permanent bool +} + +func ParamsFromRequest(r *http.Request) *Params { + params := &Params{} + + props := mux.Vars(r) + query := r.URL.Query() + + if val, ok := props["user_id"]; ok { + params.UserId = val + } + + if val, ok := props["team_id"]; ok { + params.TeamId = val + } + + if val, ok := props["invite_id"]; ok { + params.InviteId = val + } + + if val, ok := props["token_id"]; ok { + params.TokenId = val + } + + if val, ok := props["channel_id"]; ok { + params.ChannelId = val + } else { + params.ChannelId = query.Get("channel_id") + } + + if val, ok := props["post_id"]; ok { + params.PostId = val + } + + if val, ok := props["file_id"]; ok { + params.FileId = val + } + + params.Filename = query.Get("filename") + + if val, ok := props["plugin_id"]; ok { + params.PluginId = val + } + + if val, ok := props["command_id"]; ok { + params.CommandId = val + } + + if val, ok := props["hook_id"]; ok { + params.HookId = val + } + + if val, ok := props["report_id"]; ok { + params.ReportId = val + } + + if val, ok := props["emoji_id"]; ok { + params.EmojiId = val + } + + if val, ok := props["app_id"]; ok { + params.AppId = val + } + + if val, ok := props["email"]; ok { + params.Email = val + } + + if val, ok := props["username"]; ok { + params.Username = val + } + + if val, ok := props["team_name"]; ok { + params.TeamName = strings.ToLower(val) + } + + if val, ok := props["channel_name"]; ok { + params.ChannelName = strings.ToLower(val) + } + + if val, ok := props["category"]; ok { + params.Category = val + } + + if val, ok := props["service"]; ok { + params.Service = val + } + + if val, ok := props["preference_name"]; ok { + params.PreferenceName = val + } + + if val, ok := props["emoji_name"]; ok { + params.EmojiName = val + } + + if val, ok := props["job_id"]; ok { + params.JobId = val + } + + if val, ok := props["job_type"]; ok { + params.JobType = val + } + + if val, ok := props["action_id"]; ok { + params.ActionId = val + } + + if val, ok := props["role_id"]; ok { + params.RoleId = val + } + + if val, ok := props["role_name"]; ok { + params.RoleName = val + } + + if val, err := strconv.Atoi(query.Get("page")); err != nil || val < 0 { + params.Page = PAGE_DEFAULT + } else { + params.Page = val + } + + if val, err := strconv.ParseBool(query.Get("permanent")); err != nil { + params.Permanent = val + } + + if val, err := strconv.Atoi(query.Get("per_page")); err != nil || val < 0 { + params.PerPage = PER_PAGE_DEFAULT + } else if val > PER_PAGE_MAXIMUM { + params.PerPage = PER_PAGE_MAXIMUM + } else { + params.PerPage = val + } + + if val, err := strconv.Atoi(query.Get("logs_per_page")); err != nil || val < 0 { + params.LogsPerPage = LOGS_PER_PAGE_DEFAULT + } else if val > LOGS_PER_PAGE_MAXIMUM { + params.LogsPerPage = LOGS_PER_PAGE_MAXIMUM + } else { + params.LogsPerPage = val + } + + return params +} diff --git a/web/static.go b/web/static.go new file mode 100644 index 000000000..487526fdf --- /dev/null +++ b/web/static.go @@ -0,0 +1,84 @@ +// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved. +// See License.txt for license information. + +package web + +import ( + "fmt" + "net/http" + "path/filepath" + "strings" + + "github.com/NYTimes/gziphandler" + + "github.com/mattermost/mattermost-server/mlog" + "github.com/mattermost/mattermost-server/model" + "github.com/mattermost/mattermost-server/utils" +) + +func (w *Web) InitStatic() { + if *w.App.Config().ServiceSettings.WebserverMode != "disabled" { + staticDir, _ := utils.FindDir(model.CLIENT_DIR) + mlog.Debug(fmt.Sprintf("Using client directory at %v", staticDir)) + + staticHandler := staticHandler(http.StripPrefix("/static/", http.FileServer(http.Dir(staticDir)))) + pluginHandler := pluginHandler(w.App.Config, http.StripPrefix("/static/plugins/", http.FileServer(http.Dir(*w.App.Config().PluginSettings.ClientDirectory)))) + + if *w.App.Config().ServiceSettings.WebserverMode == "gzip" { + staticHandler = gziphandler.GzipHandler(staticHandler) + pluginHandler = gziphandler.GzipHandler(pluginHandler) + } + + w.MainRouter.PathPrefix("/static/plugins/").Handler(pluginHandler) + w.MainRouter.PathPrefix("/static/").Handler(staticHandler) + w.MainRouter.Handle("/{anything:.*}", w.NewStaticHandler(root)).Methods("GET") + } +} + +func root(c *Context, w http.ResponseWriter, r *http.Request) { + + if !CheckClientCompatability(r.UserAgent()) { + w.Header().Set("Cache-Control", "no-store") + page := utils.NewHTMLTemplate(c.App.HTMLTemplates(), "unsupported_browser") + page.Props["Title"] = c.T("web.error.unsupported_browser.title") + page.Props["Message"] = c.T("web.error.unsupported_browser.message") + page.RenderToWriter(w) + return + } + + if IsApiCall(r) { + Handle404(c.App, w, r) + return + } + + w.Header().Set("Cache-Control", "no-cache, max-age=31556926, public") + + staticDir, _ := utils.FindDir(model.CLIENT_DIR) + http.ServeFile(w, r, filepath.Join(staticDir, "root.html")) +} + +func staticHandler(handler http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Cache-Control", "max-age=31556926, public") + if strings.HasSuffix(r.URL.Path, "/") { + http.NotFound(w, r) + return + } + handler.ServeHTTP(w, r) + }) +} + +func pluginHandler(config model.ConfigFunc, handler http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if *config().ServiceSettings.EnableDeveloper { + w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate") + } else { + w.Header().Set("Cache-Control", "max-age=31556926, public") + } + if strings.HasSuffix(r.URL.Path, "/") { + http.NotFound(w, r) + return + } + handler.ServeHTTP(w, r) + }) +} diff --git a/web/web.go b/web/web.go index 56a5ab6ac..94363cfde 100644 --- a/web/web.go +++ b/web/web.go @@ -6,69 +6,38 @@ package web import ( "fmt" "net/http" - "path/filepath" "strings" - "github.com/NYTimes/gziphandler" "github.com/avct/uasurfer" + "github.com/gorilla/mux" - "github.com/mattermost/mattermost-server/api" + "github.com/mattermost/mattermost-server/app" "github.com/mattermost/mattermost-server/mlog" "github.com/mattermost/mattermost-server/model" "github.com/mattermost/mattermost-server/utils" ) -func Init(api3 *api.API) { - mlog.Debug("Initializing web routes") - - mainrouter := api3.BaseRoutes.Root - - if *api3.App.Config().ServiceSettings.WebserverMode != "disabled" { - staticDir, _ := utils.FindDir(model.CLIENT_DIR) - mlog.Debug(fmt.Sprintf("Using client directory at %v", staticDir)) - - staticHandler := staticHandler(http.StripPrefix("/static/", http.FileServer(http.Dir(staticDir)))) - pluginHandler := pluginHandler(api3.App.Config, http.StripPrefix("/static/plugins/", http.FileServer(http.Dir(*api3.App.Config().PluginSettings.ClientDirectory)))) +type Web struct { + App *app.App + MainRouter *mux.Router +} - if *api3.App.Config().ServiceSettings.WebserverMode == "gzip" { - staticHandler = gziphandler.GzipHandler(staticHandler) - pluginHandler = gziphandler.GzipHandler(pluginHandler) - } +func NewWeb(a *app.App, root *mux.Router) *Web { + mlog.Debug("Initializing web routes") - mainrouter.PathPrefix("/static/plugins/").Handler(pluginHandler) - mainrouter.PathPrefix("/static/").Handler(staticHandler) - mainrouter.Handle("/{anything:.*}", api3.AppHandlerIndependent(root)).Methods("GET") + web := &Web{ + App: a, + MainRouter: root, } -} -func staticHandler(handler http.Handler) http.Handler { - return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - w.Header().Set("Cache-Control", "max-age=31556926, public") - if strings.HasSuffix(r.URL.Path, "/") { - http.NotFound(w, r) - return - } - handler.ServeHTTP(w, r) - }) -} + web.InitStatic() + web.InitWebhooks() -func pluginHandler(config model.ConfigFunc, handler http.Handler) http.Handler { - return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - if *config().ServiceSettings.EnableDeveloper { - w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate") - } else { - w.Header().Set("Cache-Control", "max-age=31556926, public") - } - if strings.HasSuffix(r.URL.Path, "/") { - http.NotFound(w, r) - return - } - handler.ServeHTTP(w, r) - }) + return web } -// Due to the complexities of UA detection and the ramifications of a misdetection only older Safari and IE browsers throw incompatibility errors. - +// Due to the complexities of UA detection and the ramifications of a misdetection +// only older Safari and IE browsers throw incompatibility errors. // Map should be of minimum required browser version. var browserMinimumSupported = map[string]int{ "BrowserIE": 11, @@ -85,24 +54,20 @@ func CheckClientCompatability(agentString string) bool { return true } -func root(c *api.Context, w http.ResponseWriter, r *http.Request) { +func Handle404(a *app.App, w http.ResponseWriter, r *http.Request) { + err := model.NewAppError("Handle404", "api.context.404.app_error", nil, "", http.StatusNotFound) - if !CheckClientCompatability(r.UserAgent()) { - w.Header().Set("Cache-Control", "no-store") - page := utils.NewHTMLTemplate(c.App.HTMLTemplates(), "unsupported_browser") - page.Props["Title"] = c.T("web.error.unsupported_browser.title") - page.Props["Message"] = c.T("web.error.unsupported_browser.message") - page.RenderToWriter(w) - return - } + mlog.Debug(fmt.Sprintf("%v: code=404 ip=%v", r.URL.Path, utils.GetIpAddress(r))) - if api.IsApiCall(r) { - api.Handle404(c.App, w, r) - return + if IsApiCall(r) { + w.WriteHeader(err.StatusCode) + err.DetailedError = "There doesn't appear to be an api call for the url='" + r.URL.Path + "'. Typo? are you missing a team_id or user_id as part of the url?" + w.Write([]byte(err.ToJson())) + } else { + utils.RenderWebAppError(w, r, err, a.AsymmetricSigningKey()) } +} - w.Header().Set("Cache-Control", "no-cache, max-age=31556926, public") - - staticDir, _ := utils.FindDir(model.CLIENT_DIR) - http.ServeFile(w, r, filepath.Join(staticDir, "root.html")) +func IsApiCall(r *http.Request) bool { + return strings.Index(r.URL.Path, "/api/") == 0 } diff --git a/web/web_test.go b/web/web_test.go index 12099709e..4497f00cc 100644 --- a/web/web_test.go +++ b/web/web_test.go @@ -8,8 +8,6 @@ import ( "os" "testing" - "github.com/mattermost/mattermost-server/api" - "github.com/mattermost/mattermost-server/api4" "github.com/mattermost/mattermost-server/app" "github.com/mattermost/mattermost-server/mlog" "github.com/mattermost/mattermost-server/model" @@ -38,7 +36,14 @@ func StopTestStore() { } } -func Setup() *app.App { +type TestHelper struct { + App *app.App + BasicUser *model.User + BasicChannel *model.Channel + BasicTeam *model.Team +} + +func Setup() *TestHelper { a, err := app.New(app.StoreOverride(testStore), app.DisableConfigWatch) if err != nil { panic(err) @@ -50,9 +55,8 @@ func Setup() *app.App { panic(serverErr) } a.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.ListenAddress = prevListenAddress }) - api4.Init(a, a.Srv.Router, false) - api3 := api.Init(a, a.Srv.Router) - Init(api3) + + NewWeb(a, a.Srv.Router) URL = fmt.Sprintf("http://localhost:%v", a.Srv.ListenAddr.Port) ApiClient = model.NewClient(URL) @@ -65,11 +69,31 @@ func Setup() *app.App { *cfg.ServiceSettings.EnableAPIv3 = true }) - return a + th := &TestHelper{ + App: a, + } + + return th +} + +func (th *TestHelper) InitBasic() *TestHelper { + user, _ := th.App.CreateUser(&model.User{Email: model.NewId() + "success+test@simulator.amazonses.com", Nickname: "Corey Hulen", Password: "passwd1", EmailVerified: true, Roles: model.SYSTEM_ADMIN_ROLE_ID}) + + team, _ := th.App.CreateTeam(&model.Team{DisplayName: "Name", Name: "z-z-" + model.NewId() + "a", Email: user.Email, Type: model.TEAM_OPEN}) + + th.App.JoinUserToTeam(team, user, "") + + channel, _ := th.App.CreateChannel(&model.Channel{DisplayName: "Test API Name", Name: "zz" + model.NewId() + "a", Type: model.CHANNEL_OPEN, TeamId: team.Id, CreatorId: user.Id}, true) + + th.BasicUser = user + th.BasicChannel = channel + th.BasicTeam = team + + return th } -func TearDown(a *app.App) { - a.Shutdown() +func (th *TestHelper) TearDown() { + th.App.Shutdown() if err := recover(); err != nil { StopTestStore() panic(err) @@ -93,63 +117,6 @@ func TestStatic(t *testing.T) { } */ -func TestIncomingWebhook(t *testing.T) { - a := Setup() - defer TearDown(a) - - user := &model.User{Email: model.NewId() + "success+test@simulator.amazonses.com", Nickname: "Corey Hulen", Password: "passwd1"} - user = ApiClient.Must(ApiClient.CreateUser(user, "")).Data.(*model.User) - store.Must(a.Srv.Store.User().VerifyEmail(user.Id)) - - ApiClient.Login(user.Email, "passwd1") - - team := &model.Team{DisplayName: "Name", Name: "z-z-" + model.NewId() + "a", Email: "test@nowhere.com", Type: model.TEAM_OPEN} - team = ApiClient.Must(ApiClient.CreateTeam(team)).Data.(*model.Team) - - a.JoinUserToTeam(team, user, "") - - a.UpdateUserRoles(user.Id, model.SYSTEM_ADMIN_ROLE_ID, false) - ApiClient.SetTeamId(team.Id) - - channel1 := &model.Channel{DisplayName: "Test API Name", Name: "zz" + model.NewId() + "a", Type: model.CHANNEL_OPEN, TeamId: team.Id} - channel1 = ApiClient.Must(ApiClient.CreateChannel(channel1)).Data.(*model.Channel) - - if a.Config().ServiceSettings.EnableIncomingWebhooks { - hook1 := &model.IncomingWebhook{ChannelId: channel1.Id} - hook1 = ApiClient.Must(ApiClient.CreateIncomingWebhook(hook1)).Data.(*model.IncomingWebhook) - - payload := "payload={\"text\": \"test text\"}" - if _, err := ApiClient.PostToWebhook(hook1.Id, payload); err != nil { - t.Fatal(err) - } - - payload = "payload={\"text\": \"\"}" - if _, err := ApiClient.PostToWebhook(hook1.Id, payload); err == nil { - t.Fatal("should have errored - no text to post") - } - - payload = "payload={\"text\": \"test text\", \"channel\": \"junk\"}" - if _, err := ApiClient.PostToWebhook(hook1.Id, payload); err == nil { - t.Fatal("should have errored - bad channel") - } - - payload = "payload={\"text\": \"test text\"}" - if _, err := ApiClient.PostToWebhook("abc123", payload); err == nil { - t.Fatal("should have errored - bad hook") - } - - payloadMultiPart := "------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\nwebhook-bot\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"text\"\r\n\r\nthis is a test :tada:\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW--" - if _, err := ApiClient.DoPost("/hooks/"+hook1.Id, payloadMultiPart, "multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW"); err != nil { - t.Fatal("should have errored - bad hook") - } - - } else { - if _, err := ApiClient.PostToWebhook("123", "123"); err == nil { - t.Fatal("should have failed - webhooks turned off") - } - } -} - func TestMain(m *testing.M) { // Setup a global logger to catch tests logging outside of app context // The global logger will be stomped by apps initalizing but that's fine for testing. Ideally this won't happen. diff --git a/web/webhook.go b/web/webhook.go new file mode 100644 index 000000000..55cdeb9b5 --- /dev/null +++ b/web/webhook.go @@ -0,0 +1,101 @@ +// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved. +// See License.txt for license information. + +package web + +import ( + "fmt" + "io" + "net/http" + "strings" + + "github.com/gorilla/mux" + "github.com/gorilla/schema" + + "github.com/mattermost/mattermost-server/mlog" + "github.com/mattermost/mattermost-server/model" +) + +func (w *Web) InitWebhooks() { + w.MainRouter.Handle("/hooks/commands/{id:[A-Za-z0-9]+}", w.NewHandler(commandWebhook)).Methods("POST") + w.MainRouter.Handle("/hooks/{id:[A-Za-z0-9]+}", w.NewHandler(incomingWebhook)).Methods("POST") +} + +func incomingWebhook(c *Context, w http.ResponseWriter, r *http.Request) { + params := mux.Vars(r) + id := params["id"] + + r.ParseForm() + + var err *model.AppError + incomingWebhookPayload := &model.IncomingWebhookRequest{} + contentType := r.Header.Get("Content-Type") + if strings.Split(contentType, "; ")[0] == "application/x-www-form-urlencoded" { + payload := strings.NewReader(r.FormValue("payload")) + + incomingWebhookPayload, err = decodePayload(payload) + if err != nil { + c.Err = err + return + } + } else if strings.HasPrefix(contentType, "multipart/form-data") { + r.ParseMultipartForm(0) + + decoder := schema.NewDecoder() + err := decoder.Decode(incomingWebhookPayload, r.PostForm) + + if err != nil { + c.Err = model.NewAppError("incomingWebhook", "api.webhook.incoming.error", nil, err.Error(), http.StatusBadRequest) + return + } + } else { + incomingWebhookPayload, err = decodePayload(r.Body) + if err != nil { + c.Err = err + return + } + } + + if c.App.Config().LogSettings.EnableWebhookDebugging { + mlog.Debug(fmt.Sprint("Incoming webhook received. Content=", incomingWebhookPayload.ToJson())) + } + + err = c.App.HandleIncomingWebhook(id, incomingWebhookPayload) + if err != nil { + c.Err = err + return + } + + w.Header().Set("Content-Type", "text/plain") + w.Write([]byte("ok")) +} + +func commandWebhook(c *Context, w http.ResponseWriter, r *http.Request) { + params := mux.Vars(r) + id := params["id"] + + response, err := model.CommandResponseFromHTTPBody(r.Header.Get("Content-Type"), r.Body) + if err != nil { + c.Err = model.NewAppError("commandWebhook", "web.command_webhook.parse.app_error", nil, err.Error(), http.StatusBadRequest) + return + } + + appErr := c.App.HandleCommandWebhook(id, response) + if appErr != nil { + c.Err = appErr + return + } + + w.Header().Set("Content-Type", "text/plain") + w.Write([]byte("ok")) +} + +func decodePayload(payload io.Reader) (*model.IncomingWebhookRequest, *model.AppError) { + incomingWebhookPayload, decodeError := model.IncomingWebhookRequestFromJson(payload) + + if decodeError != nil { + return nil, decodeError + } + + return incomingWebhookPayload, nil +} diff --git a/web/webhook_test.go b/web/webhook_test.go new file mode 100644 index 000000000..e625e55bb --- /dev/null +++ b/web/webhook_test.go @@ -0,0 +1,216 @@ +// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved. +// See License.txt for license information. + +package web + +import ( + "bytes" + "fmt" + "net/http" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/mattermost/mattermost-server/model" +) + +func TestIncomingWebhook(t *testing.T) { + th := Setup().InitBasic() + defer th.TearDown() + + if !th.App.Config().ServiceSettings.EnableIncomingWebhooks { + _, err := ApiClient.PostToWebhook("123", "123") + assert.NotNil(t, err, "should have errored - webhooks turned off") + return + } + + hook, err := th.App.CreateIncomingWebhookForChannel(th.BasicUser.Id, th.BasicChannel, &model.IncomingWebhook{ChannelId: th.BasicChannel.Id}) + require.Nil(t, err) + + url := "/hooks/" + hook.Id + + tooLongText := "" + for i := 0; i < 8200; i++ { + tooLongText += "a" + } + + t.Run("WebhookBasics", func(t *testing.T) { + payload := "payload={\"text\": \"test text\"}" + _, err := ApiClient.DoPost(url, payload, "application/x-www-form-urlencoded") + assert.Nil(t, err) + + payload = "payload={\"text\": \"\"}" + _, err = ApiClient.DoPost(url, payload, "application/x-www-form-urlencoded") + assert.NotNil(t, err, "should have errored - no text to post") + + payload = "payload={\"text\": \"test text\", \"channel\": \"junk\"}" + _, err = ApiClient.DoPost(url, payload, "application/x-www-form-urlencoded") + assert.NotNil(t, err, "should have errored - bad channel") + + payload = "payload={\"text\": \"test text\"}" + _, err = ApiClient.DoPost("/hooks/abc123", payload, "application/x-www-form-urlencoded") + assert.NotNil(t, err, "should have errored - bad hook") + + _, err = ApiClient.DoPost(url, "{\"text\":\"this is a test\"}", "application/json") + assert.Nil(t, err) + + text := `this is a \"test\" + that contains a newline and a tab` + _, err = ApiClient.DoPost(url, "{\"text\":\""+text+"\"}", "application/json") + assert.Nil(t, err) + + _, err = ApiClient.DoPost(url, fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", th.BasicChannel.Name), "application/json") + assert.Nil(t, err) + + _, err = ApiClient.DoPost(url, fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"#%s\"}", th.BasicChannel.Name), "application/json") + assert.Nil(t, err) + + _, err = ApiClient.DoPost(url, fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"@%s\"}", th.BasicUser.Username), "application/json") + assert.Nil(t, err) + + _, err = ApiClient.DoPost(url, "payload={\"text\":\"this is a test\"}", "application/x-www-form-urlencoded") + assert.Nil(t, err) + + _, err = ApiClient.DoPost(url, "payload={\"text\":\""+text+"\"}", "application/x-www-form-urlencoded") + assert.Nil(t, err) + + _, err = ApiClient.DoPost(url, "{\"text\":\""+tooLongText+"\"}", "application/json") + assert.Nil(t, err) + + payloadMultiPart := "------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\nwebhook-bot\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"text\"\r\n\r\nthis is a test :tada:\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW--" + _, err = ApiClient.DoPost("/hooks/"+hook.Id, payloadMultiPart, "multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW") + assert.Nil(t, err) + }) + + t.Run("WebhookExperimentReadOnly", func(t *testing.T) { + th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = false }) + _, err := ApiClient.DoPost(url, fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", model.DEFAULT_CHANNEL), "application/json") + assert.Nil(t, err, "Not read only") + + th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = true }) + th.App.SetLicense(model.NewTestLicense()) + }) + + t.Run("WebhookAttachments", func(t *testing.T) { + attachmentPayload := `{ + "text": "this is a test", + "attachments": [ + { + "fallback": "Required plain-text summary of the attachment.", + + "color": "#36a64f", + + "pretext": "Optional text that appears above the attachment block", + + "author_name": "Bobby Tables", + "author_link": "http://flickr.com/bobby/", + "author_icon": "http://flickr.com/icons/bobby.jpg", + + "title": "Slack API Documentation", + "title_link": "https://api.slack.com/", + + "text": "Optional text that appears within the attachment", + + "fields": [ + { + "title": "Priority", + "value": "High", + "short": false + } + ], + + "image_url": "http://my-website.com/path/to/image.jpg", + "thumb_url": "http://example.com/path/to/thumb.png" + } + ] + }` + + _, err := ApiClient.DoPost(url, attachmentPayload, "application/json") + assert.Nil(t, err) + + attachmentPayload = `{ + "text": "this is a test", + "attachments": [ + { + "fallback": "Required plain-text summary of the attachment.", + + "color": "#36a64f", + + "pretext": "Optional text that appears above the attachment block", + + "author_name": "Bobby Tables", + "author_link": "http://flickr.com/bobby/", + "author_icon": "http://flickr.com/icons/bobby.jpg", + + "title": "Slack API Documentation", + "title_link": "https://api.slack.com/", + + "text": "` + tooLongText + `", + + "fields": [ + { + "title": "Priority", + "value": "High", + "short": false + } + ], + + "image_url": "http://my-website.com/path/to/image.jpg", + "thumb_url": "http://example.com/path/to/thumb.png" + } + ] + }` + + _, err = ApiClient.DoPost(url, attachmentPayload, "application/json") + assert.Nil(t, err) + }) + + t.Run("DisableWebhooks", func(t *testing.T) { + th.App.UpdateConfig(func(cfg *model.Config) { cfg.ServiceSettings.EnableIncomingWebhooks = false }) + _, err := ApiClient.DoPost(url, "{\"text\":\"this is a test\"}", "application/json") + assert.NotNil(t, err) + }) +} + +func TestCommandWebhooks(t *testing.T) { + th := Setup().InitBasic() + defer th.TearDown() + + cmd, err := th.App.CreateCommand(&model.Command{ + CreatorId: th.BasicUser.Id, + TeamId: th.BasicTeam.Id, + URL: "http://nowhere.com", + Method: model.COMMAND_METHOD_POST, + Trigger: "delayed"}) + require.Nil(t, err) + + args := &model.CommandArgs{ + TeamId: th.BasicTeam.Id, + UserId: th.BasicUser.Id, + ChannelId: th.BasicChannel.Id, + } + + hook, err := th.App.CreateCommandWebhook(cmd.Id, args) + if err != nil { + t.Fatal(err) + } + + if resp, _ := http.Post(ApiClient.Url+"/hooks/commands/123123123123", "application/json", bytes.NewBufferString(`{"text":"this is a test"}`)); resp.StatusCode != http.StatusNotFound { + t.Fatal("expected not-found for non-existent hook") + } + + if resp, err := http.Post(ApiClient.Url+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"invalid`)); err != nil || resp.StatusCode != http.StatusBadRequest { + t.Fatal(err) + } + + for i := 0; i < 5; i++ { + if resp, err := http.Post(ApiClient.Url+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"this is a test"}`)); err != nil || resp.StatusCode != http.StatusOK { + t.Fatal(err) + } + } + + if resp, _ := http.Post(ApiClient.Url+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"this is a test"}`)); resp.StatusCode != http.StatusBadRequest { + t.Fatal("expected error for sixth usage") + } +} -- cgit v1.2.3-1-g7c22