[MM-44185] Add conditions for subscription validation

Makefile

@@ -65,7 +65,7 @@ endif
 ## Ensures NPM dependencies are installed without having to run this all the time.
 webapp/.npminstall:
 ifneq ($(HAS_WEBAPP),)
-	cd webapp && $(NPM) install
+	cd webapp && $(NPM) install --verbose
 	touch $@
 endif
 

go.mod

@@ -15,6 +15,7 @@ require (
 	github.com/pkg/errors v0.9.1
 	github.com/rbriski/atlassian-jwt v0.0.0-20180307182949-7bb4ae273058
 	github.com/stretchr/testify v1.7.0
+	github.com/trivago/tgo v1.0.1
 	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8
 )
 

server/issue.go

@@ -22,12 +22,13 @@ import (
 )
 
 const (
-	labelsField      = "labels"
-	statusField      = "status"
-	reporterField    = "reporter"
-	priorityField    = "priority"
-	descriptionField = "description"
-	resolutionField  = "resolution"
+	labelsField        = "labels"
+	statusField        = "status"
+	reporterField      = "reporter"
+	priorityField      = "priority"
+	descriptionField   = "description"
+	resolutionField    = "resolution"
+	securityLevelField = "security"
 )
 
 func makePost(userID, channelID, message string) *model.Post {

server/issue_test.go

@@ -15,6 +15,7 @@ import (
 	"github.com/mattermost/mattermost-server/v6/plugin/plugintest/mock"
 	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
+	"github.com/trivago/tgo/tcontainer"
 
 	"github.com/mattermost/mattermost-plugin-jira/server/utils/kvstore"
 )
@@ -84,6 +85,28 @@ func (client testClient) AddComment(issueKey string, comment *jira.Comment) (*ji
 	return nil, nil
 }
 
+func (client testClient) GetCreateMeta(options *jira.GetQueryOptions) (*jira.CreateMetaInfo, error) {
+	return &jira.CreateMetaInfo{
+		Projects: []*jira.MetaProject{
+			{
+				IssueTypes: []*jira.MetaIssueType{
+					{
+						Fields: tcontainer.MarshalMap{
+							"security": tcontainer.MarshalMap{
+								"allowedValues": []interface{}{
+									tcontainer.MarshalMap{
+										"id": "10001",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}, nil
+}
+
 func TestTransitionJiraIssue(t *testing.T) {
 	api := &plugintest.API{}
 	api.On("SendEphemeralPost", mock.Anything, mock.Anything).Return(nil)

server/subscribe.go

@@ -15,6 +15,7 @@ import (
 
 	jira "github.com/andygrunwald/go-jira"
 	"github.com/pkg/errors"
+	"github.com/trivago/tgo/tcontainer"
 
 	"github.com/mattermost/mattermost-server/v6/model"
 
@@ -141,37 +142,47 @@ func (p *Plugin) matchesSubsciptionFilters(wh *webhook, filters SubscriptionFilt
 		return false
 	}
 
-	if filters.IssueTypes.Len() != 0 && !filters.IssueTypes.ContainsAny(wh.JiraWebhook.Issue.Fields.Type.ID) {
+	issue := &wh.JiraWebhook.Issue
+
+	if filters.IssueTypes.Len() != 0 && !filters.IssueTypes.ContainsAny(issue.Fields.Type.ID) {
 		return false
 	}
 
-	if filters.Projects.Len() != 0 && !filters.Projects.ContainsAny(wh.JiraWebhook.Issue.Fields.Project.Key) {
+	if filters.Projects.Len() != 0 && !filters.Projects.ContainsAny(issue.Fields.Project.Key) {
 		return false
 	}
 
-	validFilter := true
-
+	containsSecurityLevelFilter := false
 	for _, field := range filters.Fields {
 		// Broken filter, values must be provided
 		if field.Inclusion == "" || (field.Values.Len() == 0 && field.Inclusion != FilterEmpty) {
-			validFilter = false
-			break
+			return false
+		}
+
+		if field.Key == securityLevelField {
+			containsSecurityLevelFilter = true
 		}
 
-		value := getIssueFieldValue(&wh.JiraWebhook.Issue, field.Key)
+		value := getIssueFieldValue(issue, field.Key)
 		containsAny := value.ContainsAny(field.Values.Elems()...)
 		containsAll := value.ContainsAll(field.Values.Elems()...)
 
 		if (field.Inclusion == FilterIncludeAny && !containsAny) ||
 			(field.Inclusion == FilterIncludeAll && !containsAll) ||
 			(field.Inclusion == FilterExcludeAny && containsAny) ||
 			(field.Inclusion == FilterEmpty && value.Len() > 0) {
-			validFilter = false
-			break
+			return false
 		}
 	}
 
-	return validFilter
+	if !containsSecurityLevelFilter {
+		securityLevel := getIssueFieldValue(issue, securityLevelField)
+		if securityLevel.Len() > 0 {
+			return false
+		}
+	}
+
+	return true
 }
 
 func (p *Plugin) getChannelsSubscribed(wh *webhook, instanceID types.ID) ([]ChannelSubscription, error) {
@@ -298,6 +309,36 @@ func (p *Plugin) validateSubscription(instanceID types.ID, subscription *Channel
 		return errors.New("please provide a project identifier")
 	}
 
+	projectKey := subscription.Filters.Projects.Elems()[0]
+
+	var securityLevels StringSet
+	for _, field := range subscription.Filters.Fields {
+		if field.Key != securityLevelField {
+			continue
+		}
+
+		if field.Inclusion == FilterEmpty {
+			continue
+		}
+
+		if field.Inclusion == FilterExcludeAny {
+			return errors.New("security level does not allow for an \"Exclude\" clause")
+		}
+
+		if securityLevels == nil {
+			securityLevelsArray, err := getSecurityLevelsForProject(client, projectKey)
+			if err != nil {
+				return errors.Wrap(err, "failed to get security levels for project")
+			}
+
+			securityLevels = NewStringSet(securityLevelsArray...)
+		}
+
+		if !securityLevels.ContainsAll(field.Values.Elems()...) {
+			return errors.New("invalid access to security level")
+		}
+	}
+
 	channelID := subscription.ChannelID
 	subs, err := p.getSubscriptionsForChannel(instanceID, channelID)
 	if err != nil {
@@ -310,7 +351,6 @@ func (p *Plugin) validateSubscription(instanceID types.ID, subscription *Channel
 		}
 	}
 
-	projectKey := subscription.Filters.Projects.Elems()[0]
 	_, err = client.GetProject(projectKey)
 	if err != nil {
 		return errors.WithMessagef(err, "failed to get project %q", projectKey)
@@ -319,6 +359,43 @@ func (p *Plugin) validateSubscription(instanceID types.ID, subscription *Channel
 	return nil
 }
 
+func getSecurityLevelsForProject(client Client, projectKey string) ([]string, error) {
+	createMeta, err := client.GetCreateMeta(&jira.GetQueryOptions{
+		Expand:      "projects.issuetypes.fields",
+		ProjectKeys: projectKey,
+	})
+	if err != nil {
+		return nil, errors.Wrap(err, "error fetching user security levels")
+	}
+
+	securityLevels1, err := createMeta.Projects[0].IssueTypes[0].Fields.MarshalMap(securityLevelField)
+	if err != nil {
+		return nil, errors.Wrap(err, "error parsing user security levels")
+	}
+
+	allowed, ok := securityLevels1["allowedValues"].([]interface{})
+	if !ok {
+		return nil, errors.New("error parsing user security levels: failed to type assertion on array")
+	}
+
+	out := []string{}
+	for _, level := range allowed {
+		value, ok := level.(tcontainer.MarshalMap)
+		if !ok {
+			return nil, errors.New("error parsing user security levels: failed to type assertion on map")
+		}
+
+		id, ok := value["id"].(string)
+		if !ok {
+			return nil, errors.New("error parsing user security levels: failed to type assertion on string")
+		}
+
+		out = append(out, id)
+	}
+
+	return out, nil
+}
+
 func (p *Plugin) editChannelSubscription(instanceID types.ID, modifiedSubscription *ChannelSubscription, client Client) error {
 	subKey := keyWithInstanceID(instanceID, JiraSubscriptionsKey)
 	return p.atomicModify(subKey, func(initialBytes []byte) ([]byte, error) {