Federation: Provide a New Endpoint for Obtaining Classified Domains

CHANGELOG.md

@@ -50,6 +50,9 @@ This release requires a manual change in your galley configuration: `settings.co
 
 ## API Changes
 
+* A new team feature for classified domains is available (#1626):
+  - a public endpoint is at `GET /teams/:tid/features/classifiedDomains`
+  - an internal endpoint is at `GET /i/teams/:tid/features/classifiedDomains`
 * Several public team feature endpoints are removed (their internal and
   Stern-based counterparts remain available):
   - `PUT /teams/:tid/features/sso`

charts/galley/templates/configmap.yaml

@@ -62,5 +62,7 @@ data:
         sso: {{ .settings.featureFlags.sso }}
         legalhold: {{ .settings.featureFlags.legalhold }}
         teamSearchVisibility: {{ .settings.featureFlags.teamSearchVisibility }}
+        classifiedDomains:
+          {{- toYaml .settings.featureFlags.classifiedDomains | nindent 10 }}
       {{- end }}
   {{- end }}

charts/galley/values.yaml

@@ -30,6 +30,10 @@ config:
       sso: disabled-by-default
       legalhold: disabled-by-default
       teamSearchVisibility: disabled-by-default
+      classifiedDomains:
+        status: disabled
+        config:
+          domains: []
   aws:
     region: "eu-west-1"
   proxy: {}

deploy/services-demo/conf/galley.demo.yaml

@@ -39,6 +39,10 @@ settings:
         config:
           enforceAppLock: false
           inactivityTimeoutSecs: 60
+    classifiedDomains:
+      status: enabled
+      config:
+        domains: ["example.com"]
 
   federationDomain: example.com
 

docs/reference/config-options.md

@@ -29,7 +29,7 @@ production.
 ## Feature flags
 
 Feature flags can be used to turn features on or off, or determine the
-behavior of the features.  Example:
+behavior of the features. Example:
 
 ```
 # [galley.yaml]
@@ -101,6 +101,25 @@ pull-down-menu "body":
 
 [Allowd values](https://github.com/wireapp/wire-server/blob/0126651a25aabc0c5589edc2b1988bb06550a03a/services/brig/src/Brig/Options.hs#L304-L306) and their [description](https://github.com/wireapp/wire-server/blob/0126651a25aabc0c5589edc2b1988bb06550a03a/services/brig/src/Brig/Options.hs#L290-L299).
 
+### Classified domains
+
+To enable classified domains, the following needs to be in galley.yaml or wire-server/values.yaml under `settings` / `featureFlags`:
+
+```yaml
+classifiedDomains:
+  status: enabled
+  config:
+    domains: ["example.com", "example2.com"]
+```
+
+To disable, either omit the entry entirely (it is disabled by default), or provide the following:
+
+```yaml
+classifiedDomains:
+  status: disabled
+  config:
+    domains: []
+```
 
 ### Federation Domain
 

hack/helm_vars/wire-server/values.yaml

@@ -148,6 +148,10 @@ galley:
         sso: disabled-by-default  # this needs to be the default; tests can enable it when needed.
         legalhold: whitelist-teams-and-implicit-consent
         teamSearchVisibility: disabled-by-default
+        classifiedDomains:
+          status: enabled
+          config:
+            domains: ["example.com"]
     journal:
       endpoint: http://fake-aws-sqs:4568
       queue: integration-team-events.fifo

libs/galley-types/src/Galley/Types/Teams.hs

@@ -28,6 +28,7 @@ module Galley.Types.Teams
     flagLegalHold,
     flagTeamSearchVisibility,
     flagAppLockDefaults,
+    flagClassifiedDomains,
     Defaults (..),
     FeatureSSO (..),
     FeatureLegalHold (..),
@@ -194,7 +195,8 @@ data FeatureFlags = FeatureFlags
   { _flagSSO :: !FeatureSSO,
     _flagLegalHold :: !FeatureLegalHold,
     _flagTeamSearchVisibility :: !FeatureTeamSearchVisibility,
-    _flagAppLockDefaults :: !(Defaults (TeamFeatureStatus 'TeamFeatureAppLock))
+    _flagAppLockDefaults :: !(Defaults (TeamFeatureStatus 'TeamFeatureAppLock)),
+    _flagClassifiedDomains :: !(TeamFeatureStatus 'TeamFeatureClassifiedDomains)
   }
   deriving (Eq, Show, Generic)
 
@@ -237,14 +239,16 @@ instance FromJSON FeatureFlags where
       <*> obj .: "legalhold"
       <*> obj .: "teamSearchVisibility"
       <*> (fromMaybe (Defaults defaultAppLockStatus) <$> (obj .:? "appLock"))
+      <*> (fromMaybe defaultClassifiedDomains <$> (obj .:? "classifiedDomains"))
 
 instance ToJSON FeatureFlags where
-  toJSON (FeatureFlags sso legalhold searchVisibility appLock) =
+  toJSON (FeatureFlags sso legalhold searchVisibility appLock classifiedDomains) =
     object $
       [ "sso" .= sso,
         "legalhold" .= legalhold,
         "teamSearchVisibility" .= searchVisibility,
-        "appLock" .= appLock
+        "appLock" .= appLock,
+        "classifiedDomains" .= classifiedDomains
       ]
 
 instance FromJSON FeatureSSO where
@@ -285,6 +289,9 @@ makeLenses ''FeatureFlags
 -- client apps treat permission bit matrices as opaque role identifiers, so if we add new
 -- permission flags, things will break there.
 --
+-- "Hidden" in "HiddenPerm", therefore, refers to a permission hidden from
+-- clients, thereby making it internal to the backend.
+--
 -- The solution: add new permission bits to 'HiddenPerm', 'HiddenPermissions', and make
 -- 'hasPermission', 'mayGrantPermission' polymorphic.  Now you can check both for the hidden
 -- permission bits and the old ones that we share with the client apps.
@@ -329,8 +336,9 @@ roleHiddenPermissions role = HiddenPermissions p p
           [ ChangeLegalHoldTeamSettings,
             ChangeLegalHoldUserSettings,
             ChangeTeamSearchVisibility,
-            ChangeTeamFeature TeamFeatureAppLock {- the features not listed here can only be changed in stern -},
+            ChangeTeamFeature TeamFeatureAppLock,
             ChangeTeamFeature TeamFeatureFileSharing,
+            ChangeTeamFeature TeamFeatureClassifiedDomains {- the features not listed here can only be changed in stern -},
             ReadIdp,
             CreateUpdateDeleteIdp,
             CreateReadDeleteScimToken,
@@ -348,6 +356,7 @@ roleHiddenPermissions role = HiddenPermissions p p
           ViewTeamFeature TeamFeatureDigitalSignatures,
           ViewTeamFeature TeamFeatureAppLock,
           ViewTeamFeature TeamFeatureFileSharing,
+          ViewTeamFeature TeamFeatureClassifiedDomains,
           ViewLegalHoldUserSettings,
           ViewTeamSearchVisibility
         ]

libs/galley-types/test/unit/Test/Galley/Types.hs

@@ -64,3 +64,4 @@ instance Arbitrary FeatureFlags where
       <*> QC.elements [minBound ..]
       <*> QC.elements [minBound ..]
       <*> arbitrary
+      <*> arbitrary

libs/wire-api/src/Wire/API/Routes/Public/Galley.hs

@@ -323,7 +323,10 @@ data Api routes = Api
         :- FeatureStatusGet 'TeamFeatureFileSharing,
     teamFeatureStatusFileSharingPut ::
       routes
-        :- FeatureStatusPut 'TeamFeatureFileSharing
+        :- FeatureStatusPut 'TeamFeatureFileSharing,
+    teamFeatureStatusClassifiedDomainsGet ::
+      routes
+        :- FeatureStatusGet 'TeamFeatureClassifiedDomains
   }
   deriving (Generic)
 

libs/wire-api/src/Wire/API/Swagger.hs

@@ -126,7 +126,9 @@ models =
     Team.Feature.modelForTeamFeature Team.Feature.TeamFeatureValidateSAMLEmails,
     Team.Feature.modelForTeamFeature Team.Feature.TeamFeatureDigitalSignatures,
     Team.Feature.modelForTeamFeature Team.Feature.TeamFeatureAppLock,
+    Team.Feature.modelForTeamFeature Team.Feature.TeamFeatureClassifiedDomains,
     Team.Feature.modelTeamFeatureAppLockConfig,
+    Team.Feature.modelTeamFeatureClassifiedDomainsConfig,
     Team.Invitation.modelTeamInvitation,
     Team.Invitation.modelTeamInvitationList,
     Team.Invitation.modelTeamInvitationRequest,

libs/wire-api/src/Wire/API/Team/Feature.hs

@@ -22,6 +22,7 @@ module Wire.API.Team.Feature
   ( TeamFeatureName (..),
     TeamFeatureStatus,
     TeamFeatureAppLockConfig (..),
+    TeamFeatureClassifiedDomainsConfig (..),
     TeamFeatureStatusValue (..),
     FeatureHasNoConfig,
     EnforceAppLock (..),
@@ -30,19 +31,22 @@ module Wire.API.Team.Feature
     TeamFeatureStatusWithConfig (..),
     HasDeprecatedFeatureName (..),
     defaultAppLockStatus,
+    defaultClassifiedDomains,
 
     -- * Swagger
     typeTeamFeatureName,
     typeTeamFeatureStatusValue,
     modelTeamFeatureStatusNoConfig,
     modelTeamFeatureStatusWithConfig,
     modelTeamFeatureAppLockConfig,
+    modelTeamFeatureClassifiedDomainsConfig,
     modelForTeamFeature,
   )
 where
 
 import qualified Data.Attoparsec.ByteString as Parser
 import Data.ByteString.Conversion (FromByteString (..), ToByteString (..), toByteString')
+import Data.Domain (Domain)
 import Data.Kind (Constraint)
 import Data.Schema
 import Data.String.Conversions (cs)
@@ -94,6 +98,7 @@ data TeamFeatureName
   | TeamFeatureDigitalSignatures
   | TeamFeatureAppLock
   | TeamFeatureFileSharing
+  | TeamFeatureClassifiedDomains
   deriving stock (Eq, Show, Ord, Generic, Enum, Bounded, Typeable)
   deriving (Arbitrary) via (GenericUniform TeamFeatureName)
 
@@ -129,6 +134,10 @@ instance KnownTeamFeatureName 'TeamFeatureFileSharing where
   type KnownTeamFeatureNameSymbol 'TeamFeatureFileSharing = "fileSharing"
   knownTeamFeatureName = TeamFeatureFileSharing
 
+instance KnownTeamFeatureName 'TeamFeatureClassifiedDomains where
+  type KnownTeamFeatureNameSymbol 'TeamFeatureClassifiedDomains = "classifiedDomains"
+  knownTeamFeatureName = TeamFeatureClassifiedDomains
+
 instance FromByteString TeamFeatureName where
   parser =
     Parser.takeByteString >>= \b ->
@@ -144,6 +153,7 @@ instance FromByteString TeamFeatureName where
         Right "digital-signatures" -> pure TeamFeatureDigitalSignatures
         Right "appLock" -> pure TeamFeatureAppLock
         Right "fileSharing" -> pure TeamFeatureFileSharing
+        Right "classifiedDomains" -> pure TeamFeatureClassifiedDomains
         Right t -> fail $ "Invalid TeamFeatureName: " <> T.unpack t
 
 instance ToByteString TeamFeatureName where
@@ -154,6 +164,7 @@ instance ToByteString TeamFeatureName where
   builder TeamFeatureDigitalSignatures = "digitalSignatures"
   builder TeamFeatureAppLock = "appLock"
   builder TeamFeatureFileSharing = "fileSharing"
+  builder TeamFeatureClassifiedDomains = "classifiedDomains"
 
 class HasDeprecatedFeatureName (a :: TeamFeatureName) where
   type DeprecatedFeatureName a :: Symbol
@@ -220,6 +231,7 @@ type family TeamFeatureStatus (a :: TeamFeatureName) :: * where
   TeamFeatureStatus 'TeamFeatureDigitalSignatures = TeamFeatureStatusNoConfig
   TeamFeatureStatus 'TeamFeatureAppLock = TeamFeatureStatusWithConfig TeamFeatureAppLockConfig
   TeamFeatureStatus 'TeamFeatureFileSharing = TeamFeatureStatusNoConfig
+  TeamFeatureStatus 'TeamFeatureClassifiedDomains = TeamFeatureStatusWithConfig TeamFeatureClassifiedDomainsConfig
 
 type FeatureHasNoConfig (a :: TeamFeatureName) = (TeamFeatureStatus a ~ TeamFeatureStatusNoConfig) :: Constraint
 
@@ -232,6 +244,7 @@ modelForTeamFeature TeamFeatureValidateSAMLEmails = modelTeamFeatureStatusNoConf
 modelForTeamFeature TeamFeatureDigitalSignatures = modelTeamFeatureStatusNoConfig
 modelForTeamFeature name@TeamFeatureAppLock = modelTeamFeatureStatusWithConfig name modelTeamFeatureAppLockConfig
 modelForTeamFeature TeamFeatureFileSharing = modelTeamFeatureStatusNoConfig
+modelForTeamFeature name@TeamFeatureClassifiedDomains = modelTeamFeatureStatusWithConfig name modelTeamFeatureClassifiedDomainsConfig
 
 ----------------------------------------------------------------------
 -- TeamFeatureStatusNoConfig
@@ -283,6 +296,31 @@ instance ToSchema cfg => ToSchema (TeamFeatureStatusWithConfig cfg) where
         <$> tfwcStatus .= field "status" schema
         <*> tfwcConfig .= field "config" schema
 
+----------------------------------------------------------------------
+-- TeamFeatureClassifiedDomainsConfig
+
+newtype TeamFeatureClassifiedDomainsConfig = TeamFeatureClassifiedDomainsConfig
+  { classifiedDomainsDomains :: [Domain]
+  }
+  deriving stock (Show, Eq, Generic)
+  deriving (ToJSON, FromJSON, S.ToSchema) via (Schema TeamFeatureClassifiedDomainsConfig)
+
+deriving via (GenericUniform TeamFeatureClassifiedDomainsConfig) instance Arbitrary TeamFeatureClassifiedDomainsConfig
+
+instance ToSchema TeamFeatureClassifiedDomainsConfig where
+  schema =
+    object "TeamFeatureClassifiedDomainsConfig" $
+      TeamFeatureClassifiedDomainsConfig
+        <$> classifiedDomainsDomains .= field "domains" (array schema)
+
+modelTeamFeatureClassifiedDomainsConfig :: Doc.Model
+modelTeamFeatureClassifiedDomainsConfig =
+  Doc.defineModel "TeamFeatureClassifiedDomainsConfig" $ do
+    Doc.property "domains" (Doc.array Doc.string') $ Doc.description "domains"
+
+defaultClassifiedDomains :: TeamFeatureStatusWithConfig TeamFeatureClassifiedDomainsConfig
+defaultClassifiedDomains = TeamFeatureStatusWithConfig TeamFeatureDisabled (TeamFeatureClassifiedDomainsConfig [])
+
 ----------------------------------------------------------------------
 -- TeamFeatureAppLockConfig
 

libs/wire-api/test/unit/Test/Wire/API/Roundtrip/Aeson.hs

@@ -203,6 +203,7 @@ tests =
       testRoundTrip @(Team.Feature.TeamFeatureStatus 'Team.Feature.TeamFeatureDigitalSignatures),
       testRoundTrip @(Team.Feature.TeamFeatureStatus 'Team.Feature.TeamFeatureAppLock),
       testRoundTrip @(Team.Feature.TeamFeatureStatus 'Team.Feature.TeamFeatureFileSharing),
+      testRoundTrip @(Team.Feature.TeamFeatureStatus 'Team.Feature.TeamFeatureClassifiedDomains),
       testRoundTrip @Team.Feature.TeamFeatureStatusValue,
       testRoundTrip @Team.Invitation.InvitationRequest,
       testRoundTrip @Team.Invitation.Invitation,

services/galley/galley.cabal

@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 0f109e5428272ef5ea11b8d726a52fbf24adbd53f628a7d2fe27b4996e18bb22
+-- hash: bb7dc649f5fc67c5e449f5b5984e8d7ae01caa5833ba0fa6a5db4f45cd5b1b42
 
 name:           galley
 version:        0.83.0
@@ -251,6 +251,7 @@ executable galley-integration
     , raw-strings-qq >=1.0
     , retry
     , safe >=0.3
+    , schema-profunctor
     , servant
     , servant-client
     , servant-client-core

services/galley/galley.integration.yaml

@@ -52,6 +52,10 @@ settings:
         config:
           enforceAppLock: false
           inactivityTimeoutSecs: 60
+    classifiedDomains:
+      status: enabled
+      config:
+        domains: ["example.com"]
 
 logLevel: Info
 logNetStrings: false

services/galley/package.yaml

@@ -186,6 +186,7 @@ executables:
     - quickcheck-instances
     - random
     - retry
+    - schema-profunctor
     - servant
     - servant-server
     - servant-swagger

services/galley/src/Galley/API/Internal.hs

@@ -147,7 +147,10 @@ data InternalApi routes = InternalApi
         :- IFeatureStatusGet 'Public.TeamFeatureFileSharing,
     iTeamFeatureStatusFileSharingPut ::
       routes
-        :- IFeatureStatusPut 'Public.TeamFeatureFileSharing
+        :- IFeatureStatusPut 'Public.TeamFeatureFileSharing,
+    iTeamFeatureStatusClassifiedDomainsGet ::
+      routes
+        :- IFeatureStatusGet 'Public.TeamFeatureClassifiedDomains
   }
   deriving (Generic)
 
@@ -218,7 +221,8 @@ servantSitemap =
         iTeamFeatureStatusAppLockGet = iGetTeamFeature @'Public.TeamFeatureAppLock Features.getAppLockInternal,
         iTeamFeatureStatusAppLockPut = iPutTeamFeature @'Public.TeamFeatureAppLock Features.setAppLockInternal,
         iTeamFeatureStatusFileSharingGet = iGetTeamFeature @'Public.TeamFeatureFileSharing Features.getFileSharingInternal,
-        iTeamFeatureStatusFileSharingPut = iPutTeamFeature @'Public.TeamFeatureFileSharing Features.setFileSharingInternal
+        iTeamFeatureStatusFileSharingPut = iPutTeamFeature @'Public.TeamFeatureFileSharing Features.setFileSharingInternal,
+        iTeamFeatureStatusClassifiedDomainsGet = iGetTeamFeature @'Public.TeamFeatureClassifiedDomains Features.getClassifiedDomainsInternal
       }
 
 iGetTeamFeature ::

services/galley/src/Galley/API/Public.hs

@@ -129,11 +129,15 @@ servantSitemap =
           getFeatureStatus @'Public.TeamFeatureAppLock Features.getAppLockInternal
             . DoAuth,
         GalleyAPI.teamFeatureStatusAppLockPut =
-          setFeatureStatus @'Public.TeamFeatureAppLock Features.setAppLockInternal . DoAuth,
+          setFeatureStatus @'Public.TeamFeatureAppLock Features.setAppLockInternal
+            . DoAuth,
         GalleyAPI.teamFeatureStatusFileSharingGet =
           getFeatureStatus @'Public.TeamFeatureFileSharing Features.getFileSharingInternal . DoAuth,
         GalleyAPI.teamFeatureStatusFileSharingPut =
-          setFeatureStatus @'Public.TeamFeatureFileSharing Features.setFileSharingInternal . DoAuth
+          setFeatureStatus @'Public.TeamFeatureFileSharing Features.setFileSharingInternal . DoAuth,
+        GalleyAPI.teamFeatureStatusClassifiedDomainsGet =
+          getFeatureStatus @'Public.TeamFeatureClassifiedDomains Features.getClassifiedDomainsInternal
+            . DoAuth
       }
 
 sitemap :: Routes ApiBuilder Galley ()