Merge pull request #1239 from wireapp/release_2020-10-28

CHANGELOG.md

@@ -1,3 +1,31 @@
+# 2020-10-28
+
+## Features
+
+* Onboard password-auth'ed users via SCIM, via existing invitation flow (#1213)
+
+## Bug fixes and other updates
+
+* cargohold: add compatibility mode for Scality RING S3 implementation (#1217, reverted in 4ce798e8d9db, then #1234)
+* update email translations to latest (#1231)
+
+## Documentation
+
+* [brig:docs] Add a note on feature flag: setEmailVisibility (#1235)
+
+## Internal changes
+
+* Upgrade bonanza to geoip2 (#1236)
+* Migrate rex to this repository (#1218)
+* Fix stack warning about bloodhound. (#1237)
+* Distinguish different places that throw the same error. (#1229)
+* make fetch.py compatible with python 3 (#1230)
+* add missing license headers (#1221)
+* More debug logging for native push notifications. (#1220, #1226)
+* add libtinfo/ncurses to docs and nix deps (#1215)
+* Double memory available to cassandra in demo mode (#1216)
+
+
 # 2020-10-05
 
 ## Release Notes

deploy/dockerephemeral/docker-compose.yaml

@@ -104,7 +104,7 @@ services:
     environment:
       # what's present in the jvm.options file by default:
       #- "CS_JAVA_OPTIONS=-Xmx1024M -Xms1024M -Xmn200M"
-      - "CS_JVM_OPTIONS=-Xmx128M -Xms128M -Xmn50M"
+      - "CS_JVM_OPTIONS=-Xmx256M -Xms256M -Xmn100M"
 
       # on nixos, you also may need to run
       #   sysctl -w vm.max_map_count=1048576

docs/developer/dependencies.md

@@ -20,7 +20,7 @@ sudo dnf install -y pkgconfig haskell-platform libstdc++-devel libstdc++-static
 _Note_: Debian is not recommended due to this issue when running local integration tests: [#327](https://github.com/wireapp/wire-server/issues/327). This issue does not occur with Ubuntu.
 
 ```bash
-sudo apt install pkg-config libsodium-dev openssl-dev libtool automake build-essential libicu-dev libsnappy-dev libgeoip-dev protobuf-compiler libxml2-dev zlib1g-dev -y
+sudo apt install pkg-config libsodium-dev openssl-dev libtool automake build-essential libicu-dev libsnappy-dev libgeoip-dev protobuf-compiler libxml2-dev zlib1g-dev libtinfo-dev -y
 ```
 
 If `openssl-dev` does not work for you, try `libssl-dev`.
@@ -30,7 +30,7 @@ If `openssl-dev` does not work for you, try `libssl-dev`.
 ```
 # You might also need 'sudo pacman -S base-devel' if you haven't
 # installed the base-devel group already.
-sudo pacman -S geoip snappy icu openssl
+sudo pacman -S geoip snappy icu openssl ncurses-compat-libs
 ```
 
 ### macOS:
@@ -175,11 +175,6 @@ docker login --username=<MY_DOCKER_USERNAME>
 ## Nix
 
 Using Stack's [Nix integration](https://docs.haskellstack.org/en/stable/nix_integration/), Stack will take care of installing any system
-dependencies automatically - including `cryptobox-c`. If new system dependencies are needed, add them to the `shell.nix` file in the project root.
+dependencies automatically - including `cryptobox-c`. If new system dependencies are needed, add them to the `stack-deps.nix` file in the project root.
 Just type `$ nix-shell` and you will automatically have `make`, `docker-compose` and `stack` in `PATH`.
 You can then run all the builds, and the native dependencies will be automatically present.
-
-We are currently on a snapshot that uses `ghc863` but Nix only ships `ghc864` as `ghc863` is officially deprecated. The releases should be totally compatible, but we need to convince stack that this is true. Hence, we can add the following to our global stack config in `~/.stack/config.yaml`
-```bash
-skip-ghc-check: true
-```

docs/reference/config-options.md

@@ -38,6 +38,7 @@ settings:
     sso: disabled-by-default
     legalhold: disabled-by-default
     teamSearchVisibility: disabled-by-default
+    setEmailVisibility: visible_to_self
 ```
 
 The `featureFlags` field in the galley settings is mandatory, and all
@@ -79,3 +80,7 @@ This sets the default setting for all teams, and can be overridden for
 individual teams by customer support / backoffice. [Allowed
 values](https://github.com/wireapp/wire-server/blob/custom-search-visibility-limit-name-search/libs/galley-types/src/Galley/Types/Teams.hs#L382-L385):
 `disabled-by-default`, `enabled-by-default`.
+
+### Email Visibility
+
+[Allowd values](https://github.com/wireapp/wire-server/blob/0126651a25aabc0c5589edc2b1988bb06550a03a/services/brig/src/Brig/Options.hs#L304-L306) and their [description](https://github.com/wireapp/wire-server/blob/0126651a25aabc0c5589edc2b1988bb06550a03a/services/brig/src/Brig/Options.hs#L290-L299).

libs/brig-types/src/Brig/Types/Intra.hs

@@ -26,6 +26,7 @@ module Brig.Types.Intra
     AccountStatusResp (..),
     ConnectionStatus (..),
     UserAccount (..),
+    NewUserScimInvitation (..),
     UserSet (..),
     ReAuthUser (..),
   )
@@ -35,7 +36,7 @@ import Brig.Types.Connection
 import Brig.Types.User
 import Data.Aeson
 import qualified Data.HashMap.Strict as M
-import Data.Id (UserId)
+import Data.Id (TeamId, UserId)
 import Data.Misc (PlainTextPassword (..))
 import qualified Data.Text as Text
 import Imports
@@ -48,6 +49,10 @@ data AccountStatus
   | Suspended
   | Deleted
   | Ephemeral
+  | -- | for most intents & purposes, this is another form of inactive.  it is used for
+    -- allowing scim to find users that have not accepted their invitation yet after
+    -- creating via scim.
+    PendingInvitation
   deriving (Eq, Show, Generic)
 
 instance FromJSON AccountStatus where
@@ -56,13 +61,15 @@ instance FromJSON AccountStatus where
     "suspended" -> pure Suspended
     "deleted" -> pure Deleted
     "ephemeral" -> pure Ephemeral
+    "pending-invitation" -> pure PendingInvitation
     _ -> fail $ "Invalid account status: " ++ Text.unpack s
 
 instance ToJSON AccountStatus where
   toJSON Active = String "active"
   toJSON Suspended = String "suspended"
   toJSON Deleted = String "deleted"
   toJSON Ephemeral = String "ephemeral"
+  toJSON PendingInvitation = String "pending-invitation"
 
 data AccountStatusResp = AccountStatusResp {fromAccountStatusResp :: AccountStatus}
 
@@ -135,6 +142,34 @@ instance ToJSON UserAccount where
       other ->
         error $ "toJSON UserAccount: not an object: " <> show (encode other)
 
+-------------------------------------------------------------------------------
+-- NewUserScimInvitation
+
+data NewUserScimInvitation = NewUserScimInvitation
+  { newUserScimInvTeamId :: TeamId,
+    newUserScimInvLocale :: Maybe Locale,
+    newUserScimInvName :: Name,
+    newUserScimInvEmail :: Email
+  }
+  deriving (Eq, Show, Generic)
+
+instance FromJSON NewUserScimInvitation where
+  parseJSON = withObject "NewUserScimInvitation" $ \o ->
+    NewUserScimInvitation
+      <$> o .: "team_id"
+      <*> o .:? "locale"
+      <*> o .: "name"
+      <*> o .: "email"
+
+instance ToJSON NewUserScimInvitation where
+  toJSON (NewUserScimInvitation tid loc name email) =
+    object
+      [ "team_id" .= tid,
+        "locale" .= loc,
+        "name" .= name,
+        "email" .= email
+      ]
+
 -------------------------------------------------------------------------------
 -- UserList
 

libs/brig-types/src/Brig/Types/User.hs

@@ -21,6 +21,7 @@ module Brig.Types.User
   ( ManagedByUpdate (..),
     RichInfoUpdate (..),
     PasswordResetPair,
+    HavePendingInvitations (..),
 
     -- * re-exports
     Pict (..),
@@ -80,6 +81,11 @@ import Wire.API.User.RichInfo
 
 newtype ManagedByUpdate = ManagedByUpdate {mbuManagedBy :: ManagedBy} deriving (Eq, Show, Generic)
 
+data HavePendingInvitations
+  = WithPendingInvitations
+  | NoPendingInvitations
+  deriving (Eq, Show, Generic)
+
 newtype RichInfoUpdate = RichInfoUpdate {riuRichInfo :: RichInfoAssocList} deriving (Eq, Show, Generic)
 
 instance FromJSON ManagedByUpdate where

libs/brig-types/test/unit/Test/Brig/Types/User.hs

@@ -27,7 +27,7 @@
 
 module Test.Brig.Types.User where
 
-import Brig.Types.Intra (ReAuthUser (..))
+import Brig.Types.Intra (NewUserScimInvitation (..), ReAuthUser (..))
 import Brig.Types.User (ManagedByUpdate (..), RichInfoUpdate (..))
 import Imports
 import Test.Brig.Roundtrip (testRoundTrip)
@@ -41,7 +41,8 @@ roundtripTests :: [TestTree]
 roundtripTests =
   [ testRoundTrip @ManagedByUpdate,
     testRoundTrip @ReAuthUser,
-    testRoundTrip @RichInfoUpdate
+    testRoundTrip @RichInfoUpdate,
+    testRoundTrip @NewUserScimInvitation
   ]
 
 instance Arbitrary ManagedByUpdate where
@@ -52,3 +53,6 @@ instance Arbitrary RichInfoUpdate where
 
 instance Arbitrary ReAuthUser where
   arbitrary = ReAuthUser <$> arbitrary
+
+instance Arbitrary NewUserScimInvitation where
+  arbitrary = NewUserScimInvitation <$> arbitrary <*> arbitrary <*> arbitrary <*> arbitrary

libs/gundeck-types/src/Gundeck/Types/Push/V2.hs

@@ -255,7 +255,7 @@ data Push = Push
     -- REFACTOR: this make no sense any more since native push notifications have no more payload.
     -- https://github.com/wireapp/wire-server/pull/546
     _pushNativeEncrypt :: !Bool,
-    -- | APNs-specific metadata.  REFACTOR: can this be removed?
+    -- | APNs-specific metadata (needed eg. in "Brig.IO.Intra.toApsData").
     _pushNativeAps :: !(Maybe ApsData),
     -- | Native push priority.
     _pushNativePriority :: !Priority,

libs/wire-api/src/Wire/API/Message.hs

@@ -122,9 +122,8 @@ instance FromJSON NewOtrMessage where
 --------------------------------------------------------------------------------
 -- Priority
 
--- | REFACTOR: do we ever use LowPriority?  to test, (a) remove the constructor and see what goes
--- wrong; (b) log use of 'LowPriority' by clients in production and watch it a few days.  if it is
--- not used anywhere, consider removing the entire type, or just the unused constructor.
+-- | Native push notification priority flag.  'LowPriority' is never used, but might be in the
+-- future.
 --
 -- @neongreen writes: [...] nobody seems to ever set `native_priority` in the client code. Exhibits
 -- A1 and A2:

nix/sources.json

@@ -5,22 +5,22 @@
         "homepage": "https://github.com/nmattia/niv",
         "owner": "nmattia",
         "repo": "niv",
-        "rev": "ab9cc41caf44d1f1d465d8028e4bc0096fd73238",
-        "sha256": "17k52n8zwp832cqifsc4458mhy4044wmk22f807171hf6p7l4xvr",
+        "rev": "9d35b9e4837ab88517210b1701127612c260eccf",
+        "sha256": "0q50xhnm8g2yfyakrh0nly4swyygxpi0a8cb9gp65wcakcgvzvdh",
         "type": "tarball",
-        "url": "https://github.com/nmattia/niv/archive/ab9cc41caf44d1f1d465d8028e4bc0096fd73238.tar.gz",
+        "url": "https://github.com/nmattia/niv/archive/9d35b9e4837ab88517210b1701127612c260eccf.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
     "nixpkgs": {
         "branch": "nixpkgs-unstable",
         "description": "A read-only mirror of NixOS/nixpkgs tracking the released channels. Send issues and PRs to",
         "homepage": "https://github.com/NixOS/nixpkgs",
         "owner": "NixOS",
-        "repo": "nixpkgs-channels",
-        "rev": "6d4b93323e7f78121f8d6db6c59f3889aa1dd931",
-        "sha256": "0g2j41cx2w2an5d9kkqvgmada7ssdxqz1zvjd7hi5vif8ag0v5la",
+        "repo": "nixpkgs",
+        "rev": "502845c3e31ef3de0e424f3fcb09217df2ce6df6",
+        "sha256": "0fcqpsy6y7dgn0y0wgpa56gsg0b0p8avlpjrd79fp4mp9bl18nda",
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs-channels/archive/6d4b93323e7f78121f8d6db6c59f3889aa1dd931.tar.gz",
+        "url": "https://github.com/NixOS/nixpkgs-channels/archive/502845c3e31ef3de0e424f3fcb09217df2ce6df6.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     }
 }

services/brig/deb/opt/brig/bin/fetch.py

@@ -1,28 +1,26 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
 # coding: utf-8
 #
-# Wire
-# Copyright (C) 2018 Wire Swiss GmbH
+# This file is part of the Wire Server implementation.
 #
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
+# Copyright (C) 2020 Wire Swiss GmbH <[email protected]>
 #
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
+# This program is free software: you can redistribute it and/or modify it under
+# the terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, either version 3 of the License, or (at your option) any
+# later version.
 #
-# You should have received a copy of the GNU General Public License
-# along with this program. If not, see http://www.gnu.org/licenses/.
+# This program is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+# FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+# details.
 #
+# You should have received a copy of the GNU Affero General Public License along
+# with this program. If not, see <https://www.gnu.org/licenses/>.
 
 import os
 import shutil
 import sys
-reload(sys)
-sys.setdefaultencoding('utf8')
 
 IGNORE_DIRS = ['billing', 'marketing']
 TEAM_SUPPORT = ['en', 'de']
@@ -52,13 +50,13 @@ def recursive_overwrite(src, dest):
   else:
     shutil.copyfile(src, dest)
 
-print ''
-print '-' * 32
-print 'this script clones github.com/wireapp/wire-emails and copies the changes to', dist
-print 'to list all versions, `cd wire-emails && git tag -l`.'
-print 'reading new version from', template_version_file, '...'
-print '-' * 32
-print ''
+print('')
+print('-' * 32)
+print('this script clones github.com/wireapp/wire-emails and copies the changes to', dist)
+print('to list all versions, `cd wire-emails && git tag -l`.')
+print('reading new version from', template_version_file, '...')
+print('-' * 32)
+print('')
 
 with open(template_version_file) as f:
   new_version = f.readline().replace('\n', '').strip()
@@ -69,12 +67,12 @@ def recursive_overwrite(src, dest):
 except IOError:
   current_version = '0.0.0'
 
-print '-' * 32
-print 'New version:    ', new_version
-print 'Current version:', current_version
-print 'Branch name:    ', pr_branch_name
-print 'Status:         ', 'Up to date' if new_version == current_version else 'Fetching...'
-print '-' * 32
+print('-' * 32)
+print('New version:    ', new_version)
+print('Current version:', current_version)
+print('Branch name:    ', pr_branch_name)
+print('Status:         ', 'Up to date' if new_version == current_version else 'Fetching...')
+print('-' * 32)
 
 if new_version != current_version:
   # Clone the wire-emails project at new version

services/brig/deb/opt/brig/template-version

@@ -1 +1 @@
-v1.0.76
+v1.0.85

services/brig/deb/opt/brig/templates/de/provider/email/activation-subject.txt

@@ -1 +1 @@
-Dein ${brand_service}-Benutzerkonto
+Ihr ${brand_service}-Benutzerkonto