Federation: Provide a New Endpoint for Obtaining Classified Domains

[mdimjasevic]

The PR implements a new endpoint GET /teams/:teamId/features/classifiedDomains that fetches a list of classified domains. There is an internal endpoint equivalent.

Checklist

• Title of this PR explains the impact of the change.
• The description provides context as to why the change should occur and what the code contributes to that effect. This could also be a link to a JIRA ticket or a Github issue, if there is one.
• The CHANGELOG.md file in the Unreleased section has been updated to explain the change which will be included in the release notes.
• If a component uses a new or changed internal endpoint of another component, this is mentioned in the CHANGELOG.md.
• If this PR creates a new endpoint, or adds a new configuration flag, the endpoint / config-flag checklist (see Wire-employee only backend wiki page) has been followed.
• Add a test that checks if a user is authenticated when getting classified domains

[mdimjasevic]

@smatting , should I also add an endpoint in Stern for classified domains, just like the app lock feature has one at

wire-server/tools/stern/src/Stern/API.hs

Line 352 in b757784

mkFeaturePutGetRoute @'Public.TeamFeatureAppLock

?

[jschaul]

I ran helm install --debug --dry-run wire-server .local/charts/wire-server -f hack/helm_vars/wire-server/values.yaml > output.yaml using a valid kubernetes server config, which results in a final galley config of

#snippet from configmap of galley
galley:
  config:
    cassandra:
      host: cassandra-ephemeral
      replicaCount: 1
    enableFederator: true
    journal:
      endpoint: http://fake-aws-sqs:4568
      queue: integration-team-events.fifo
    settings:
      conversationCodeURI: https://kube-staging-nginz-https.zinfra.io/conversation-join/
      enableIndexedBillingTeamMembers: true
      featureFlags:
        classifiedDomains:
          config:
            domains:
            - example.com
          status: enabled
        legalhold: whitelist-teams-and-implicit-consent
        sso: disabled-by-default
        teamSearchVisibility: disabled-by-default
      federationDomain: integration.example.com

which appears to be in line with what's in galley.integration.yaml.

Do integration tests pass locally?

[jschaul]

Can you test that when querying the GET /teams/{tid}/features endpoint, the classified domains stuff is included as well?

[jschaul]

I performed a manual test:

curl -s http://localhost:8085/teams/b8509dc2-4b4e-4d2f-afd6-410666bbb464/features -H Z-User:c8b2bb6b-4980-4950-af5d-211d6cb951e9 | json_pp
{
   "appLock" : {
      "config" : {
         "enforceAppLock" : false,
         "inactivityTimeoutSecs" : 60
      },
      "status" : "enabled"
   },
   "classifiedDomains" : {
      "config" : {
         "domains" : [
            "example.com"
         ]
      },
      "status" : "enabled"
   },
   "digitalSignatures" : {
      "status" : "disabled"
   },
   "legalhold" : {
      "status" : "disabled"
   },
   "searchVisibility" : {
      "status" : "disabled"
   },
   "sso" : {
      "status" : "disabled"
   },
   "validateSAMLemails" : {
      "status" : "disabled"
   }
}

(and got some user/team ids using select team, binding, creator from galley_test.team limit 10; after make cqlsh and picked IDs from a binding team)

Still, an integration test here would be nice.

[jschaul]

I performed a manual test:

curl -s http://localhost:8085/teams/b8509dc2-4b4e-4d2f-afd6-410666bbb464/features -H Z-User:c8b2bb6b-4980-4950-af5d-211d6cb951e9 | json_pp
{
   "appLock" : {
      "config" : {
         "enforceAppLock" : false,
         "inactivityTimeoutSecs" : 60
      },
      "status" : "enabled"
   },
   "classifiedDomains" : {
      "config" : {
         "domains" : [
            "example.com"
         ]
      },
      "status" : "enabled"
   },
   "digitalSignatures" : {
      "status" : "disabled"
   },
   "legalhold" : {
      "status" : "disabled"
   },
   "searchVisibility" : {
      "status" : "disabled"
   },
   "sso" : {
      "status" : "disabled"
   },
   "validateSAMLemails" : {
      "status" : "disabled"
   }
}

(and got some user/team ids using select team, binding, creator from galley_test.team limit 10; after make cqlsh and picked IDs from a binding team)

Still, an integration test here would be nice.

[mdimjasevic]

@jschaul , I just added an integration test for the all features endpoint.

[smatting]

I think this good to merge since the 1 failing test is known to be unrelated.

[smatting]

@smatting , should I also add an endpoint in Stern for classified domains, just like the app lock feature has one at

no, applock is supposed to be configured only by team admins with the public endpoint