Mattermost-server: Incident should be immutable for archived channels

[mattermod]

Help contribute to the Incident Management Plugin!

Once an incident channel is archived, consider the corresponding incident metadata to be immutable (just like you can't post in the channel anymore).

Let’s start checking if a channel is archived across the REST API for incident response, and rejecting with an error if so. Then, let’s proactively detect this in the frontend and grey out the various controls (commander dropdown, checkboxes, buttons, etc.)

---

If you're interested please comment here and come join our "Contributors" community channel on our daily build server, where you can discuss questions with community members and the Mattermost core team. For technical advice or questions, please join our "Developers" community channel.

New contributors please see our Developer's Guide.

JIRA: https://mattermost.atlassian.net/browse/MM-29375

[arjunagl]

I would like to pick this up

[lieut-data]

Thanks, @arjunagl!

[arjunagl]

@lieut-data when you say incident metadata can you please let me know exactly what you mean, is it stuff like the channel header channel title ?

[lieut-data]

@arjunagl, when an incident is open, the right hand side contains a number of pieces of information, such as the active stage, current commander, task list, etc. These should all be considered immutable once the channel is archived.

There are two parts to this:

• Across the REST API in the plugin, check if the corresponding channel is archived and fail the request outright if a mutation is requested.
• On the frontend, disable / hide / grey out (whatever makes the most sense) the widgets that would otherwise encourage mutation.

Feel free to ping us in https://community.mattermost.com/core/channels/ee-incident-response if you want to chat in real-time or even hop on a quick call with the team -- and thanks for your help here!!

[arjunagl]

thanks @lieut-data

[lieut-data]

@arjunagl, is there anything I can do to help you with this issue?

[arjunagl]

thanks @lieut-data due to the vacation, I could not spent much time on this, I have started tinkering with this item this week. So far I'm ok, will reach out if I need help.

[arjunagl]

@lieut-data I managed to make some progress on this. Given is the link to the branch. Just want to make sure I'm heading in the right direction. Please have a look and let me know.

https://github.com/arjunagl/mattermost-plugin-incident-management/tree/16401-Archived-Immutable.

[lieut-data]

Hey @arjunagl! Thanks for taking a stab at this! A few thoughts after looking at https://github.com/arjunagl/mattermost-plugin-incident-management/commit/1afed89ed2f75b971dcba2052534a642e5725af0:

• I really like the approach of wrapping the handler. I wonder if we should follow a similar paradigm to how permissions are handled, i.e. incidentRouterAuthorized.Use(handler.checkEditPermissions)?
• The definition of a channel being archived is the DeleteAt property on the incident /channel/, not the incident itself. Where necessary, you can lookup the channel from the incident's ChannelID.

This should be sufficient to deny changes to archived incidents on the server side. Do you need any points on how to modify the user interface client-side when a channel is archived to "discourage" trying to change things?