mattermost-mobile/app/actions/local/session/index.test.ts
Elias Nahum 44eb76bed7
feat(iOS): Add Microsoft Intune MAM integration with multi-server support (#9312)
* refactor: implement custom ExpoImage wrapper for cache control

Add ExpoImage component with automatic cacheKey/cachePath management and replace all expo-image imports across the app

* refactor(ios): convert Gekidou to CocoaPods

Migrate from Swift Package Manager to CocoaPods, add Keychain write operations, refactor notification handler to remove react-native-notifications headers, and upgrade Swift to 5.0

* npm audit

* update fastlane

* feat(ci): integrate Intune MAM for enterprise builds with strict OSS protection

Add Intune submodule, CI actions, Fastlane configuration, developer scripts, pre-commit hooks, and validation workflows to enable internal MAM builds while protecting OSS repository

* fix tests by mocking @mattermost/intune

* feat: implement Intune MAM integration with comprehensive security enforcement

Add IntuneManager, refactor SecurityManager/SessionManager for MAM policies, implement native OIDC auth flow, add biometric enforcement, conditional launch blocking, and file protection controls

* fix alerts when no server database is present

* Unify cache strategy

* fix emit config changed after it was stored in the db

* Handle Mid-Session Enrollment Detection

* fix ADALLogOverrideDisabled missing in Fastfile

* fix flow for initial enrollment

* fix and add unit tests

* enable Intune configuration for PR and beta builds, CLIENT_ID should be changed before actual release

* Update intune submodule with addressed feedback

* fix validate-intune-clean workflow

* feat(intune): add comprehensive error handling and SAML+Entra support

Add production-ready error handling for native Entra authentication with
user-friendly i18n messages, comprehensive test coverage, and support for
Entra login when server requires SAML.

* update i18n

* update intune submodule

* update build-pr token

* fix race condition between server auth and intune enrollment

* fix CI workflow to build with intune

* use deploy key for intune submodule

* set the config directly in the submodule .git

* debug injection

* try setting GIT_SSH_COMMAND

* remove action debug

* fix server url input

* match pod cache with intune hash

* Fastfile and envs

* have workflows check for intune/.git

* have ci cache intune frameworks as well

* update Fastlane to set no-cache to artifacts uploaded

* fix s3 upload

* fix pblist template

* Attempt to remove the cache control for PR uploads to s3

* use hash from commit for S3 path

* Implement crash-resilient selective wipe with automatic retry and add removeInternetPassword to Gekidou Keychain

* Fix surface errors from intune login

* fix postinstall scripts

* use cacheKey for draft md images

* remove unnecessary double await during test

* Have isMinimumLicenseTier accept valid license sku tier as target

* Add missing Auth error messages

* remove the last period for intune errors in i18n

* do not call unenroll with wipe on manual logout

* Fix tests and Intune error messages

* do not filter any SSO type regardless of which is used for Intune

* fix 412 to not retry

* fix tests, app logs sharing and share_extension avatar cache

* apply setScreenCapturePolicy on license change

Co-authored-by: Eva Sarafianou <eva.sarafianou@mattermost.com>

* re-apply screen capture on enrollment

Co-authored-by: Eva Sarafianou <eva.sarafianou@mattermost.com>

* use userData from intunr login and prevent getMe

Co-authored-by: Eva Sarafianou <eva.sarafianou@mattermost.com>

* Check for Biometrics and Jailbreak as we used to

---------

Co-authored-by: Eva Sarafianou <eva.sarafianou@mattermost.com>
2025-12-10 13:07:28 +02:00

346 lines
15 KiB
TypeScript

// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
// See LICENSE.txt for license information.
import NetInfo, {type NetInfoState} from '@react-native-community/netinfo';
import {Platform} from 'react-native';
import {removePushDisabledInServerAcknowledged} from '@actions/app/global';
import DatabaseManager from '@database/manager';
import {resetMomentLocale} from '@i18n';
import {getAllServerCredentials, removeServerCredentials} from '@init/credentials';
import PushNotifications from '@init/push_notifications';
import NetworkManager from '@managers/network_manager';
import WebsocketManager from '@managers/websocket_manager';
import {getDeviceToken} from '@queries/app/global';
import {getExpiredSession} from '@queries/servers/system';
import {getCurrentUser} from '@queries/servers/user';
import {deleteFileCache, deleteFileCacheByDir} from '@utils/file';
import {clearCookiesForServer, getCSRFFromCookie, urlSafeBase64Encode} from '@utils/security';
import {cancelAllSessionNotifications, cancelSessionNotification, findSession, terminateSession} from './index';
import type ServerDataOperator from '@database/operator/server_data_operator';
import type {Database} from '@nozbe/watermelondb';
import type {ServerDatabase, ServerDatabases} from '@typings/database/database';
import type UserModel from '@typings/database/models/servers/user';
// Mock all dependencies
jest.mock('@react-native-community/netinfo');
jest.mock('expo-image', () => ({
Image: {
clearDiskCache: jest.fn(),
},
}));
jest.mock('@actions/app/global');
jest.mock('@database/manager', () => ({
getServerDatabaseAndOperator: jest.fn(),
getActiveServerDatabase: jest.fn(),
destroyServerDatabase: jest.fn(),
deleteServerDatabase: jest.fn(),
serverDatabases: {},
}));
jest.mock('@i18n', () => ({
resetMomentLocale: jest.fn(),
}));
jest.mock('@init/credentials');
jest.mock('@init/push_notifications', () => ({
removeServerNotifications: jest.fn(),
cancelScheduleNotification: jest.fn(),
}));
jest.mock('@managers/network_manager', () => ({
invalidateClient: jest.fn(),
}));
jest.mock('@managers/websocket_manager', () => ({
invalidateClient: jest.fn(),
}));
jest.mock('@queries/app/global');
jest.mock('@queries/servers/system');
jest.mock('@queries/servers/user');
jest.mock('@utils/file');
jest.mock('@utils/security');
describe('session actions', () => {
const mockServerUrl = 'https://example.com';
const mockDatabase = {database: 'mockDb'};
const mockOperator = {
handleSystem: jest.fn(),
};
beforeEach(() => {
jest.clearAllMocks();
});
describe('findSession', () => {
const mockSessions: Session[] = [
{id: 'session1', device_id: 'device123', props: {csrf: 'csrf123', os: 'ios'}} as Session,
{id: 'session2', device_id: 'device456', props: {csrf: 'csrf456', os: 'android'}} as Session,
{id: 'session3', device_id: 'device789', props: {csrf: 'csrf789', os: 'ios'}} as Session,
];
beforeEach(() => {
jest.mocked(DatabaseManager.getServerDatabaseAndOperator).mockReturnValue({
database: mockDatabase as unknown as Database,
operator: mockOperator as unknown as ServerDataOperator,
});
});
it('should find session by expired session ID', async () => {
const expiredSession = {id: 'session2', notificationId: '123'};
jest.mocked(getExpiredSession).mockResolvedValue(expiredSession as SessionExpiration);
jest.mocked(getDeviceToken).mockResolvedValue('device999');
jest.mocked(getCSRFFromCookie).mockResolvedValue('csrf999');
const result = await findSession(mockServerUrl, mockSessions);
expect(result).toEqual(mockSessions[1]);
expect(getExpiredSession).toHaveBeenCalledWith(mockDatabase);
});
it('should find session by device token', async () => {
jest.mocked(getExpiredSession).mockResolvedValue(undefined);
jest.mocked(getDeviceToken).mockResolvedValue('device456');
jest.mocked(getCSRFFromCookie).mockResolvedValue('csrf999');
const result = await findSession(mockServerUrl, mockSessions);
expect(result).toEqual(mockSessions[1]);
expect(getDeviceToken).toHaveBeenCalled();
});
it('should find session by CSRF token', async () => {
jest.mocked(getExpiredSession).mockResolvedValue(undefined);
jest.mocked(getDeviceToken).mockResolvedValue('device999');
jest.mocked(getCSRFFromCookie).mockResolvedValue('csrf789');
const result = await findSession(mockServerUrl, mockSessions);
expect(result).toEqual(mockSessions[2]);
expect(getCSRFFromCookie).toHaveBeenCalledWith(mockServerUrl);
});
it('should find session by platform OS', async () => {
Platform.OS = 'android';
jest.mocked(getExpiredSession).mockResolvedValue(undefined);
jest.mocked(getDeviceToken).mockResolvedValue('device999');
jest.mocked(getCSRFFromCookie).mockResolvedValue('csrf999');
const result = await findSession(mockServerUrl, mockSessions);
expect(result).toEqual(mockSessions[1]);
});
it('should return undefined when no session matches', async () => {
jest.mocked(getExpiredSession).mockResolvedValue(undefined);
jest.mocked(getDeviceToken).mockResolvedValue('device999');
jest.mocked(getCSRFFromCookie).mockResolvedValue('csrf999');
Platform.OS = 'web';
const result = await findSession(mockServerUrl, mockSessions);
expect(result).toBeUndefined();
});
it('should handle errors gracefully and return undefined', async () => {
jest.mocked(DatabaseManager.getServerDatabaseAndOperator).mockImplementation(() => {
throw new Error('Database error');
});
const result = await findSession(mockServerUrl, mockSessions);
expect(result).toBeUndefined();
});
});
describe('cancelAllSessionNotifications', () => {
it('should cancel notifications for all servers with credentials', async () => {
const mockCredentials = [
{serverUrl: 'https://server1.com', userId: 'user1', token: 'token1'},
{serverUrl: 'https://server2.com', userId: 'user2', token: 'token2'},
];
jest.mocked(getAllServerCredentials).mockResolvedValue(mockCredentials);
jest.mocked(DatabaseManager.getServerDatabaseAndOperator).mockReturnValue({
database: mockDatabase as unknown as Database,
operator: mockOperator as unknown as ServerDataOperator,
});
jest.mocked(getExpiredSession).mockResolvedValue({
id: 'session1',
notificationId: '123',
} as SessionExpiration);
jest.mocked(NetInfo.fetch).mockResolvedValue({
isInternetReachable: true,
} as NetInfoState);
await cancelAllSessionNotifications();
expect(getAllServerCredentials).toHaveBeenCalled();
expect(DatabaseManager.getServerDatabaseAndOperator).toHaveBeenCalledTimes(2);
});
it('should handle empty credentials list', async () => {
jest.mocked(getAllServerCredentials).mockResolvedValue([]);
await cancelAllSessionNotifications();
expect(getAllServerCredentials).toHaveBeenCalled();
expect(DatabaseManager.getServerDatabaseAndOperator).not.toHaveBeenCalled();
});
});
describe('cancelSessionNotification', () => {
beforeEach(() => {
jest.mocked(DatabaseManager.getServerDatabaseAndOperator).mockReturnValue({
database: mockDatabase as unknown as Database,
operator: mockOperator as unknown as ServerDataOperator,
});
});
it('should cancel notification when expired session has notification ID and internet is reachable', async () => {
const expiredSession = {id: 'session1', notificationId: '123'};
jest.mocked(getExpiredSession).mockResolvedValue(expiredSession as SessionExpiration);
jest.mocked(NetInfo.fetch).mockResolvedValue({
isInternetReachable: true,
} as NetInfoState);
const result = await cancelSessionNotification(mockServerUrl);
expect(PushNotifications.cancelScheduleNotification).toHaveBeenCalledWith(123);
expect(mockOperator.handleSystem).toHaveBeenCalledWith({
systems: [{
id: 'sessionExpiration',
value: '',
}],
prepareRecordsOnly: false,
});
expect(result).toEqual({});
});
it('should not cancel notification when no notification ID', async () => {
const expiredSession = {id: 'session1', notificationId: ''};
jest.mocked(getExpiredSession).mockResolvedValue(expiredSession as SessionExpiration);
jest.mocked(NetInfo.fetch).mockResolvedValue({
isInternetReachable: true,
} as NetInfoState);
const result = await cancelSessionNotification(mockServerUrl);
expect(PushNotifications.cancelScheduleNotification).not.toHaveBeenCalled();
expect(mockOperator.handleSystem).not.toHaveBeenCalled();
expect(result).toEqual({});
});
it('should not cancel notification when internet not reachable', async () => {
const expiredSession = {id: 'session1', notificationId: '123'};
jest.mocked(getExpiredSession).mockResolvedValue(expiredSession as SessionExpiration);
jest.mocked(NetInfo.fetch).mockResolvedValue({
isInternetReachable: false,
} as NetInfoState);
const result = await cancelSessionNotification(mockServerUrl);
expect(PushNotifications.cancelScheduleNotification).not.toHaveBeenCalled();
expect(mockOperator.handleSystem).not.toHaveBeenCalled();
expect(result).toEqual({});
});
it('should handle errors gracefully and return error object', async () => {
const error = new Error('Database error');
jest.mocked(DatabaseManager.getServerDatabaseAndOperator).mockImplementation(() => {
throw error;
});
const result = await cancelSessionNotification(mockServerUrl);
expect(result).toEqual({error});
});
});
describe('terminateSession', () => {
const encodedServerUrl = 'aHR0cHM6Ly9leGFtcGxlLmNvbQ==';
beforeEach(() => {
jest.mocked(DatabaseManager.getServerDatabaseAndOperator).mockReturnValue({
database: mockDatabase as unknown as Database,
operator: mockOperator as unknown as ServerDataOperator,
});
jest.mocked(getExpiredSession).mockResolvedValue(undefined);
jest.mocked(NetInfo.fetch).mockResolvedValue({
isInternetReachable: false,
} as NetInfoState);
jest.mocked(urlSafeBase64Encode).mockReturnValue(encodedServerUrl);
jest.mocked(getCurrentUser).mockResolvedValue(undefined);
(DatabaseManager.serverDatabases as ServerDatabases) = {};
});
it('should call all cleanup functions in correct order for removeServer=true', async () => {
await terminateSession(mockServerUrl, true);
// Verify all cleanup functions called
expect(removeServerCredentials).toHaveBeenCalledWith(mockServerUrl);
expect(PushNotifications.removeServerNotifications).toHaveBeenCalledWith(mockServerUrl);
expect(NetworkManager.invalidateClient).toHaveBeenCalledWith(mockServerUrl);
expect(WebsocketManager.invalidateClient).toHaveBeenCalledWith(mockServerUrl);
expect(removePushDisabledInServerAcknowledged).toHaveBeenCalledWith(encodedServerUrl);
expect(DatabaseManager.destroyServerDatabase).toHaveBeenCalledWith(mockServerUrl);
expect(resetMomentLocale).toHaveBeenCalled();
expect(clearCookiesForServer).toHaveBeenCalledWith(mockServerUrl);
expect(deleteFileCache).toHaveBeenCalledWith(mockServerUrl);
expect(deleteFileCacheByDir).toHaveBeenCalledWith('mmPasteInput');
expect(deleteFileCacheByDir).toHaveBeenCalledWith('thumbnails');
});
it('should call deleteServerDatabase when removeServer=false', async () => {
await terminateSession(mockServerUrl, false);
expect(DatabaseManager.deleteServerDatabase).toHaveBeenCalledWith(mockServerUrl);
expect(DatabaseManager.destroyServerDatabase).not.toHaveBeenCalled();
expect(removePushDisabledInServerAcknowledged).not.toHaveBeenCalled();
});
it('should clear cookies for server', async () => {
await terminateSession(mockServerUrl, true);
expect(clearCookiesForServer).toHaveBeenCalledWith(mockServerUrl);
});
it('should clear image cache with URL-safe encoded server URL', async () => {
await terminateSession(mockServerUrl, true);
expect(urlSafeBase64Encode).toHaveBeenCalledWith(mockServerUrl);
});
it('should delete file caches for server and common directories', async () => {
await terminateSession(mockServerUrl, true);
expect(deleteFileCache).toHaveBeenCalledWith(mockServerUrl);
expect(deleteFileCacheByDir).toHaveBeenCalledWith('mmPasteInput');
expect(deleteFileCacheByDir).toHaveBeenCalledWith('thumbnails');
});
it('should reset locale with user locale when active server database exists', async () => {
const mockUser = {locale: 'es'};
const mockServerDatabase = {database: 'serverDb'} as unknown as ServerDatabase;
(DatabaseManager.serverDatabases as ServerDatabases) = {[mockServerUrl]: mockServerDatabase};
jest.mocked(DatabaseManager.getActiveServerDatabase).mockResolvedValue(mockServerDatabase as unknown as Database);
jest.mocked(getCurrentUser).mockResolvedValue(mockUser as unknown as UserModel);
await terminateSession(mockServerUrl, true);
// Wait for the async resetLocale to complete (not awaited in implementation)
await new Promise((resolve) => setImmediate(resolve));
expect(resetMomentLocale).toHaveBeenCalledWith('es');
});
it('should reset locale to default when no active server database', async () => {
(DatabaseManager.serverDatabases as ServerDatabases) = {};
await terminateSession(mockServerUrl, true);
// Wait for the async resetLocale to complete (not awaited in implementation)
await new Promise((resolve) => setImmediate(resolve));
expect(resetMomentLocale).toHaveBeenCalledWith();
});
});
});