Reduce number of IDE warnings in permissions_migrations.go (#29605)
* Reduce number of IDE warnings in permissions_migrations.go * Fix comment language
Этот коммит содержится в:
enzowritescode
коммит произвёл
GitHub
GitHub
родитель
882654d898
Коммит
0c213eae9e
@@ -83,7 +83,7 @@ func isExactRole(roleName string) func(*model.Role, map[string]map[string]bool)
|
||||
}
|
||||
}
|
||||
|
||||
// isRole returns true if roleName matches a role's name field or if the a team
|
||||
// isRole returns true if roleName matches a role's name field or if the team
|
||||
// or channel scheme role matches a "common name". A common name is one of the following role
|
||||
// that is common among the system scheme and the team and/or channel schemes:
|
||||
//
|
||||
@@ -470,7 +470,7 @@ func (a *App) channelModerationPermissionsMigration() (permissionsMap, error) {
|
||||
model.ChannelGuestRoleId,
|
||||
)...)
|
||||
|
||||
// ensure system admin has all of the moderated permissions
|
||||
// ensure system admin has all the moderated permissions
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
On: isExactRole(model.SystemAdminRoleId),
|
||||
Add: append(moderatedPermissionsMinusCreatePost, PermissionCreatePost),
|
||||
@@ -499,51 +499,43 @@ func (a *App) getAddUseGroupMentionsPermissionMigration() (permissionsMap, error
|
||||
}
|
||||
|
||||
func (a *App) getAddSystemConsolePermissionsMigration() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
permissionsToAdd := []string{}
|
||||
for _, permission := range append(model.SysconsoleReadPermissions, model.SysconsoleWritePermissions...) {
|
||||
permissionsToAdd = append(permissionsToAdd, permission.Id)
|
||||
}
|
||||
|
||||
return permissionsMap{
|
||||
// add the new permissions to system admin
|
||||
transformations = append(transformations,
|
||||
permissionTransformation{
|
||||
On: isExactRole(model.SystemAdminRoleId),
|
||||
Add: permissionsToAdd,
|
||||
})
|
||||
|
||||
},
|
||||
// add read_jobs to all roles with manage_jobs
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(PermissionManageJobs),
|
||||
Add: []string{PermissionReadJobs},
|
||||
})
|
||||
|
||||
},
|
||||
// add read_other_users_teams to all roles with edit_other_users
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(PermissionEditOtherUsers),
|
||||
Add: []string{PermissionReadOtherUsersTeams},
|
||||
})
|
||||
|
||||
},
|
||||
// add read_public_channel_groups to all roles with manage_public_channel_members
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(PermissionManagePublicChannelMembers),
|
||||
Add: []string{PermissionReadPublicChannelGroups},
|
||||
})
|
||||
|
||||
},
|
||||
// add read_private_channel_groups to all roles with manage_private_channel_members
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(PermissionManagePrivateChannelMembers),
|
||||
Add: []string{PermissionReadPrivateChannelGroups},
|
||||
})
|
||||
|
||||
},
|
||||
// add edit_brand to all roles with manage_system
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(PermissionManageSystem),
|
||||
Add: []string{PermissionEditBrand},
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddConvertChannelPermissionsMigration() (permissionsMap, error) {
|
||||
@@ -583,178 +575,141 @@ func (a *App) getBillingPermissionsMigration() (permissionsMap, error) {
|
||||
}
|
||||
|
||||
func (a *App) getAddManageSecureConnectionsPermissionsMigration() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
return permissionsMap{
|
||||
// add the new permission to system admin
|
||||
transformations = append(transformations,
|
||||
permissionTransformation{
|
||||
On: isExactRole(model.SystemAdminRoleId),
|
||||
Add: []string{PermissionManageSecureConnections},
|
||||
})
|
||||
|
||||
},
|
||||
// remote the deprecated permission from system admin
|
||||
transformations = append(transformations,
|
||||
permissionTransformation{
|
||||
On: isExactRole(model.SystemAdminRoleId),
|
||||
Remove: []string{PermissionManageRemoteClusters},
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddDownloadComplianceExportResult() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
permissionsToAddComplianceRead := []string{model.PermissionDownloadComplianceExportResult.Id, model.PermissionReadDataRetentionJob.Id}
|
||||
permissionsToAddComplianceWrite := []string{model.PermissionManageJobs.Id}
|
||||
|
||||
return permissionsMap{
|
||||
// add the new permissions to system admin
|
||||
transformations = append(transformations,
|
||||
permissionTransformation{
|
||||
On: isExactRole(model.SystemAdminRoleId),
|
||||
Add: []string{model.PermissionDownloadComplianceExportResult.Id},
|
||||
})
|
||||
|
||||
},
|
||||
// add Download Compliance Export Result and Read Jobs to all roles with sysconsole_read_compliance
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadCompliance.Id),
|
||||
Add: permissionsToAddComplianceRead,
|
||||
})
|
||||
|
||||
Add: []string{model.PermissionDownloadComplianceExportResult.Id, model.PermissionReadDataRetentionJob.Id},
|
||||
},
|
||||
// add manage_jobs to all roles with sysconsole_write_compliance
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteCompliance.Id),
|
||||
Add: permissionsToAddComplianceWrite,
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
Add: []string{model.PermissionManageJobs.Id},
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddExperimentalSubsectionPermissions() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
permissionsExperimentalRead := []string{model.PermissionSysconsoleReadExperimentalBleve.Id, model.PermissionSysconsoleReadExperimentalFeatures.Id, model.PermissionSysconsoleReadExperimentalFeatureFlags.Id}
|
||||
permissionsExperimentalWrite := []string{model.PermissionSysconsoleWriteExperimentalBleve.Id, model.PermissionSysconsoleWriteExperimentalFeatures.Id, model.PermissionSysconsoleWriteExperimentalFeatureFlags.Id}
|
||||
|
||||
return permissionsMap{
|
||||
// Give the new subsection READ permissions to any user with READ_EXPERIMENTAL
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadExperimental.Id),
|
||||
Add: permissionsExperimentalRead,
|
||||
})
|
||||
|
||||
Add: []string{model.PermissionSysconsoleReadExperimentalBleve.Id, model.PermissionSysconsoleReadExperimentalFeatures.Id, model.PermissionSysconsoleReadExperimentalFeatureFlags.Id},
|
||||
},
|
||||
// Give the new subsection WRITE permissions to any user with WRITE_EXPERIMENTAL
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteExperimental.Id),
|
||||
Add: permissionsExperimentalWrite,
|
||||
})
|
||||
|
||||
Add: []string{model.PermissionSysconsoleWriteExperimentalBleve.Id, model.PermissionSysconsoleWriteExperimentalFeatures.Id, model.PermissionSysconsoleWriteExperimentalFeatureFlags.Id},
|
||||
},
|
||||
// Give the ancillary permissions MANAGE_JOBS and PURGE_BLEVE_INDEXES to anyone with WRITE_EXPERIMENTAL_BLEVE
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteExperimentalBleve.Id),
|
||||
Add: []string{model.PermissionCreatePostBleveIndexesJob.Id, model.PermissionPurgeBleveIndexes.Id},
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddIntegrationsSubsectionPermissions() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
permissionsIntegrationsRead := []string{model.PermissionSysconsoleReadIntegrationsIntegrationManagement.Id, model.PermissionSysconsoleReadIntegrationsBotAccounts.Id, model.PermissionSysconsoleReadIntegrationsGif.Id, model.PermissionSysconsoleReadIntegrationsCors.Id}
|
||||
permissionsIntegrationsWrite := []string{model.PermissionSysconsoleWriteIntegrationsIntegrationManagement.Id, model.PermissionSysconsoleWriteIntegrationsBotAccounts.Id, model.PermissionSysconsoleWriteIntegrationsGif.Id, model.PermissionSysconsoleWriteIntegrationsCors.Id}
|
||||
|
||||
return permissionsMap{
|
||||
// Give the new subsection READ permissions to any user with READ_INTEGRATIONS
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadIntegrations.Id),
|
||||
Add: permissionsIntegrationsRead,
|
||||
})
|
||||
|
||||
},
|
||||
// Give the new subsection WRITE permissions to any user with WRITE_EXPERIMENTAL
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteIntegrations.Id),
|
||||
Add: permissionsIntegrationsWrite,
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddSiteSubsectionPermissions() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
permissionsSiteRead := []string{model.PermissionSysconsoleReadSiteCustomization.Id, model.PermissionSysconsoleReadSiteLocalization.Id, model.PermissionSysconsoleReadSiteUsersAndTeams.Id, model.PermissionSysconsoleReadSiteNotifications.Id, model.PermissionSysconsoleReadSiteAnnouncementBanner.Id, model.PermissionSysconsoleReadSiteEmoji.Id, model.PermissionSysconsoleReadSitePosts.Id, model.PermissionSysconsoleReadSiteFileSharingAndDownloads.Id, model.PermissionSysconsoleReadSitePublicLinks.Id, model.PermissionSysconsoleReadSiteNotices.Id}
|
||||
permissionsSiteWrite := []string{model.PermissionSysconsoleWriteSiteCustomization.Id, model.PermissionSysconsoleWriteSiteLocalization.Id, model.PermissionSysconsoleWriteSiteUsersAndTeams.Id, model.PermissionSysconsoleWriteSiteNotifications.Id, model.PermissionSysconsoleWriteSiteAnnouncementBanner.Id, model.PermissionSysconsoleWriteSiteEmoji.Id, model.PermissionSysconsoleWriteSitePosts.Id, model.PermissionSysconsoleWriteSiteFileSharingAndDownloads.Id, model.PermissionSysconsoleWriteSitePublicLinks.Id, model.PermissionSysconsoleWriteSiteNotices.Id}
|
||||
|
||||
return permissionsMap{
|
||||
// Give the new subsection READ permissions to any user with READ_SITE
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadSite.Id),
|
||||
Add: permissionsSiteRead,
|
||||
})
|
||||
|
||||
},
|
||||
// Give the new subsection WRITE permissions to any user with WRITE_SITE
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteSite.Id),
|
||||
Add: permissionsSiteWrite,
|
||||
})
|
||||
|
||||
},
|
||||
// Give the ancillary permissions EDIT_BRAND to anyone with WRITE_SITE_CUSTOMIZATION
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteSiteCustomization.Id),
|
||||
Add: []string{model.PermissionEditBrand.Id},
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddComplianceSubsectionPermissions() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
permissionsComplianceRead := []string{model.PermissionSysconsoleReadComplianceDataRetentionPolicy.Id, model.PermissionSysconsoleReadComplianceComplianceExport.Id, model.PermissionSysconsoleReadComplianceComplianceMonitoring.Id, model.PermissionSysconsoleReadComplianceCustomTermsOfService.Id}
|
||||
permissionsComplianceWrite := []string{model.PermissionSysconsoleWriteComplianceDataRetentionPolicy.Id, model.PermissionSysconsoleWriteComplianceComplianceExport.Id, model.PermissionSysconsoleWriteComplianceComplianceMonitoring.Id, model.PermissionSysconsoleWriteComplianceCustomTermsOfService.Id}
|
||||
|
||||
return permissionsMap{
|
||||
// Give the new subsection READ permissions to any user with READ_COMPLIANCE
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadCompliance.Id),
|
||||
Add: permissionsComplianceRead,
|
||||
})
|
||||
|
||||
},
|
||||
// Give the new subsection WRITE permissions to any user with WRITE_COMPLIANCE
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteCompliance.Id),
|
||||
Add: permissionsComplianceWrite,
|
||||
})
|
||||
|
||||
},
|
||||
// Ancillary permissions
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteComplianceDataRetentionPolicy.Id),
|
||||
Add: []string{model.PermissionCreateDataRetentionJob.Id},
|
||||
})
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
},
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadComplianceDataRetentionPolicy.Id),
|
||||
Add: []string{model.PermissionReadDataRetentionJob.Id},
|
||||
})
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
},
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteComplianceComplianceExport.Id),
|
||||
Add: []string{model.PermissionCreateComplianceExportJob.Id, model.PermissionDownloadComplianceExportResult.Id},
|
||||
})
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
},
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadComplianceComplianceExport.Id),
|
||||
Add: []string{model.PermissionReadComplianceExportJob.Id, model.PermissionDownloadComplianceExportResult.Id},
|
||||
})
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
},
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadComplianceCustomTermsOfService.Id),
|
||||
Add: []string{model.PermissionReadAudits.Id},
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddEnvironmentSubsectionPermissions() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
permissionsEnvironmentRead := []string{
|
||||
model.PermissionSysconsoleReadEnvironmentWebServer.Id,
|
||||
model.PermissionSysconsoleReadEnvironmentDatabase.Id,
|
||||
@@ -786,95 +741,88 @@ func (a *App) getAddEnvironmentSubsectionPermissions() (permissionsMap, error) {
|
||||
model.PermissionSysconsoleWriteEnvironmentDeveloper.Id,
|
||||
}
|
||||
|
||||
// Give the new subsection READ permissions to any user with READ_ENVIRONMENT
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadEnvironment.Id),
|
||||
Add: permissionsEnvironmentRead,
|
||||
})
|
||||
|
||||
// Give the new subsection WRITE permissions to any user with WRITE_ENVIRONMENT
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteEnvironment.Id),
|
||||
Add: permissionsEnvironmentWrite,
|
||||
})
|
||||
|
||||
// Give these ancillary permissions to anyone with READ_ENVIRONMENT_ELASTICSEARCH
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadEnvironmentElasticsearch.Id),
|
||||
Add: []string{
|
||||
permissionsElasticsearchRead := []string{
|
||||
model.PermissionReadElasticsearchPostIndexingJob.Id,
|
||||
model.PermissionReadElasticsearchPostAggregationJob.Id,
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
// Give these ancillary permissions to anyone with WRITE_ENVIRONMENT_WEB_SERVER
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteEnvironmentWebServer.Id),
|
||||
Add: []string{
|
||||
model.PermissionTestSiteURL.Id,
|
||||
model.PermissionReloadConfig.Id,
|
||||
model.PermissionInvalidateCaches.Id,
|
||||
},
|
||||
})
|
||||
|
||||
// Give these ancillary permissions to anyone with WRITE_ENVIRONMENT_DATABASE
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteEnvironmentDatabase.Id),
|
||||
Add: []string{model.PermissionRecycleDatabaseConnections.Id},
|
||||
})
|
||||
|
||||
// Give these ancillary permissions to anyone with WRITE_ENVIRONMENT_ELASTICSEARCH
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteEnvironmentElasticsearch.Id),
|
||||
Add: []string{
|
||||
permissionsElasticsearchWrite := []string{
|
||||
model.PermissionTestElasticsearch.Id,
|
||||
model.PermissionCreateElasticsearchPostIndexingJob.Id,
|
||||
model.PermissionCreateElasticsearchPostAggregationJob.Id,
|
||||
model.PermissionPurgeElasticsearchIndexes.Id,
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
permissionsWebServerWrite := []string{
|
||||
model.PermissionTestSiteURL.Id,
|
||||
model.PermissionReloadConfig.Id,
|
||||
model.PermissionInvalidateCaches.Id,
|
||||
}
|
||||
|
||||
return permissionsMap{
|
||||
// Give the new subsection READ permissions to any user with READ_ENVIRONMENT
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadEnvironment.Id),
|
||||
Add: permissionsEnvironmentRead,
|
||||
},
|
||||
// Give the new subsection WRITE permissions to any user with WRITE_ENVIRONMENT
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteEnvironment.Id),
|
||||
Add: permissionsEnvironmentWrite,
|
||||
},
|
||||
// Give these ancillary permissions to anyone with READ_ENVIRONMENT_ELASTICSEARCH
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadEnvironmentElasticsearch.Id),
|
||||
Add: permissionsElasticsearchRead,
|
||||
},
|
||||
// Give these ancillary permissions to anyone with WRITE_ENVIRONMENT_WEB_SERVER
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteEnvironmentWebServer.Id),
|
||||
Add: permissionsWebServerWrite,
|
||||
},
|
||||
// Give these ancillary permissions to anyone with WRITE_ENVIRONMENT_DATABASE
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteEnvironmentDatabase.Id),
|
||||
Add: []string{model.PermissionRecycleDatabaseConnections.Id},
|
||||
},
|
||||
// Give these ancillary permissions to anyone with WRITE_ENVIRONMENT_ELASTICSEARCH
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteEnvironmentElasticsearch.Id),
|
||||
Add: permissionsElasticsearchWrite,
|
||||
},
|
||||
// Give these ancillary permissions to anyone with WRITE_ENVIRONMENT_FILE_STORAGE
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteEnvironmentFileStorage.Id),
|
||||
Add: []string{model.PermissionTestS3.Id},
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddAboutSubsectionPermissions() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
permissionsAboutRead := []string{model.PermissionSysconsoleReadAboutEditionAndLicense.Id}
|
||||
permissionsAboutWrite := []string{model.PermissionSysconsoleWriteAboutEditionAndLicense.Id}
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
return permissionsMap{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadAbout.Id),
|
||||
Add: permissionsAboutRead,
|
||||
})
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
},
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteAbout.Id),
|
||||
Add: permissionsAboutWrite,
|
||||
})
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
},
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadAboutEditionAndLicense.Id),
|
||||
Add: []string{model.PermissionReadLicenseInformation.Id},
|
||||
})
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
},
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteAboutEditionAndLicense.Id),
|
||||
Add: []string{model.PermissionManageLicenseInformation.Id},
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddReportingSubsectionPermissions() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
permissionsReportingRead := []string{
|
||||
model.PermissionSysconsoleReadReportingSiteStatistics.Id,
|
||||
model.PermissionSysconsoleReadReportingTeamStatistics.Id,
|
||||
@@ -886,94 +834,81 @@ func (a *App) getAddReportingSubsectionPermissions() (permissionsMap, error) {
|
||||
model.PermissionSysconsoleWriteReportingServerLogs.Id,
|
||||
}
|
||||
|
||||
return permissionsMap{
|
||||
// Give the new subsection READ permissions to any user with READ_REPORTING
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadReporting.Id),
|
||||
Add: permissionsReportingRead,
|
||||
})
|
||||
|
||||
},
|
||||
// Give the new subsection WRITE permissions to any user with WRITE_REPORTING
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteReporting.Id),
|
||||
Add: permissionsReportingWrite,
|
||||
})
|
||||
},
|
||||
|
||||
// Give the ancillary permissions PERMISSION_GET_ANALYTICS to anyone with PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_USERS or PERMISSION_SYSCONSOLE_READ_REPORTING_SITE_STATISTICS
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionOr(permissionExists(model.PermissionSysconsoleReadUserManagementUsers.Id), permissionExists(model.PermissionSysconsoleReadReportingSiteStatistics.Id)),
|
||||
Add: []string{model.PermissionGetAnalytics.Id},
|
||||
})
|
||||
|
||||
},
|
||||
// Give the ancillary permissions PERMISSION_GET_LOGS to anyone with PERMISSION_SYSCONSOLE_READ_REPORTING_SERVER_LOGS
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadReportingServerLogs.Id),
|
||||
Add: []string{model.PermissionGetLogs.Id},
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddAuthenticationSubsectionPermissions() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
permissionsAuthenticationRead := []string{model.PermissionSysconsoleReadAuthenticationSignup.Id, model.PermissionSysconsoleReadAuthenticationEmail.Id, model.PermissionSysconsoleReadAuthenticationPassword.Id, model.PermissionSysconsoleReadAuthenticationMfa.Id, model.PermissionSysconsoleReadAuthenticationLdap.Id, model.PermissionSysconsoleReadAuthenticationSaml.Id, model.PermissionSysconsoleReadAuthenticationOpenid.Id, model.PermissionSysconsoleReadAuthenticationGuestAccess.Id}
|
||||
permissionsAuthenticationWrite := []string{model.PermissionSysconsoleWriteAuthenticationSignup.Id, model.PermissionSysconsoleWriteAuthenticationEmail.Id, model.PermissionSysconsoleWriteAuthenticationPassword.Id, model.PermissionSysconsoleWriteAuthenticationMfa.Id, model.PermissionSysconsoleWriteAuthenticationLdap.Id, model.PermissionSysconsoleWriteAuthenticationSaml.Id, model.PermissionSysconsoleWriteAuthenticationOpenid.Id, model.PermissionSysconsoleWriteAuthenticationGuestAccess.Id}
|
||||
|
||||
return permissionsMap{
|
||||
// Give the new subsection READ permissions to any user with READ_AUTHENTICATION
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadAuthentication.Id),
|
||||
Add: permissionsAuthenticationRead,
|
||||
})
|
||||
|
||||
},
|
||||
// Give the new subsection WRITE permissions to any user with WRITE_AUTHENTICATION
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteAuthentication.Id),
|
||||
Add: permissionsAuthenticationWrite,
|
||||
})
|
||||
|
||||
},
|
||||
// Give the ancillary permissions for LDAP to anyone with WRITE_AUTHENTICATION_LDAP
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteAuthenticationLdap.Id),
|
||||
Add: []string{model.PermissionCreateLdapSyncJob.Id, model.PermissionTestLdap.Id, model.PermissionAddLdapPublicCert.Id, model.PermissionAddLdapPrivateCert.Id, model.PermissionRemoveLdapPublicCert.Id, model.PermissionRemoveLdapPrivateCert.Id},
|
||||
})
|
||||
|
||||
},
|
||||
// Give the ancillary permissions PERMISSION_TEST_LDAP to anyone with READ_AUTHENTICATION_LDAP
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleReadAuthenticationLdap.Id),
|
||||
Add: []string{model.PermissionReadLdapSyncJob.Id},
|
||||
})
|
||||
|
||||
},
|
||||
// Give the ancillary permissions PERMISSION_INVALIDATE_EMAIL_INVITE to anyone with WRITE_AUTHENTICATION_EMAIL
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteAuthenticationEmail.Id),
|
||||
Add: []string{model.PermissionInvalidateEmailInvite.Id},
|
||||
})
|
||||
|
||||
},
|
||||
// Give the ancillary permissions for SAML to anyone with WRITE_AUTHENTICATION_SAML
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteAuthenticationSaml.Id),
|
||||
Add: []string{model.PermissionGetSamlMetadataFromIdp.Id, model.PermissionAddSamlPublicCert.Id, model.PermissionAddSamlPrivateCert.Id, model.PermissionAddSamlIdpCert.Id, model.PermissionRemoveSamlPublicCert.Id, model.PermissionRemoveSamlPrivateCert.Id, model.PermissionRemoveSamlIdpCert.Id, model.PermissionGetSamlCertStatus.Id},
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
// This migration fixes https://github.com/mattermost/mattermost-server/issues/17642 where this particular ancillary permission was forgotten during the initial migrations
|
||||
func (a *App) getAddTestEmailAncillaryPermission() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
return permissionsMap{
|
||||
// Give these ancillary permissions to anyone with WRITE_ENVIRONMENT_SMTP
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteEnvironmentSMTP.Id),
|
||||
Add: []string{model.PermissionTestEmail.Id},
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddCustomUserGroupsPermissions() (permissionsMap, error) {
|
||||
t := []permissionTransformation{}
|
||||
|
||||
customGroupPermissions := []string{
|
||||
model.PermissionCreateCustomGroup.Id,
|
||||
model.PermissionManageCustomGroupMembers.Id,
|
||||
@@ -981,47 +916,42 @@ func (a *App) getAddCustomUserGroupsPermissions() (permissionsMap, error) {
|
||||
model.PermissionDeleteCustomGroup.Id,
|
||||
}
|
||||
|
||||
t = append(t, permissionTransformation{
|
||||
return permissionsMap{
|
||||
permissionTransformation{
|
||||
On: isExactRole(model.SystemUserRoleId),
|
||||
Add: customGroupPermissions,
|
||||
})
|
||||
|
||||
t = append(t, permissionTransformation{
|
||||
},
|
||||
permissionTransformation{
|
||||
On: isExactRole(model.SystemAdminRoleId),
|
||||
Add: customGroupPermissions,
|
||||
})
|
||||
|
||||
return t, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddCustomUserGroupsPermissionRestore() (permissionsMap, error) {
|
||||
t := []permissionTransformation{}
|
||||
|
||||
customGroupPermissions := []string{
|
||||
model.PermissionRestoreCustomGroup.Id,
|
||||
}
|
||||
|
||||
t = append(t, permissionTransformation{
|
||||
return permissionsMap{
|
||||
permissionTransformation{
|
||||
On: isExactRole(model.SystemUserRoleId),
|
||||
Add: customGroupPermissions,
|
||||
})
|
||||
|
||||
t = append(t, permissionTransformation{
|
||||
},
|
||||
permissionTransformation{
|
||||
On: isExactRole(model.SystemAdminRoleId),
|
||||
Add: customGroupPermissions,
|
||||
})
|
||||
|
||||
t = append(t, permissionTransformation{
|
||||
},
|
||||
permissionTransformation{
|
||||
On: isExactRole(model.SystemCustomGroupAdminRoleId),
|
||||
Add: customGroupPermissions,
|
||||
})
|
||||
return t, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddPlaybooksPermissions() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
return permissionsMap{
|
||||
permissionTransformation{
|
||||
On: permissionOr(
|
||||
permissionExists(model.PermissionCreatePublicChannel.Id),
|
||||
permissionExists(model.PermissionCreatePrivateChannel.Id),
|
||||
@@ -1030,9 +960,8 @@ func (a *App) getAddPlaybooksPermissions() (permissionsMap, error) {
|
||||
model.PermissionPublicPlaybookCreate.Id,
|
||||
model.PermissionPrivatePlaybookCreate.Id,
|
||||
},
|
||||
})
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
},
|
||||
permissionTransformation{
|
||||
On: isExactRole(model.SystemAdminRoleId),
|
||||
Add: []string{
|
||||
model.PermissionPublicPlaybookManageProperties.Id,
|
||||
@@ -1048,15 +977,13 @@ func (a *App) getAddPlaybooksPermissions() (permissionsMap, error) {
|
||||
model.PermissionRunManageMembers.Id,
|
||||
model.PermissionRunView.Id,
|
||||
},
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getPlaybooksPermissionsAddManageRoles() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
return permissionsMap{
|
||||
permissionTransformation{
|
||||
On: permissionOr(
|
||||
isExactRole(model.PlaybookAdminRoleId),
|
||||
isExactRole(model.TeamAdminRoleId),
|
||||
@@ -1066,43 +993,32 @@ func (a *App) getPlaybooksPermissionsAddManageRoles() (permissionsMap, error) {
|
||||
model.PermissionPublicPlaybookManageRoles.Id,
|
||||
model.PermissionPrivatePlaybookManageRoles.Id,
|
||||
},
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getProductsBoardsPermissions() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
permissionsProductsRead := []string{model.PermissionSysconsoleReadProductsBoards.Id}
|
||||
permissionsProductsWrite := []string{model.PermissionSysconsoleWriteProductsBoards.Id}
|
||||
|
||||
return permissionsMap{
|
||||
// Give the new subsection READ permissions to any user with SYSTEM_MANAGER
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionOr(isExactRole(model.SystemManagerRoleId)),
|
||||
Add: permissionsProductsRead,
|
||||
})
|
||||
Add: []string{model.PermissionSysconsoleReadProductsBoards.Id},
|
||||
},
|
||||
|
||||
// Give the new subsection WRITE permissions to any user with SYSTEM_ADMIN
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionOr(isExactRole(model.SystemAdminRoleId)),
|
||||
Add: permissionsProductsWrite,
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
Add: []string{model.PermissionSysconsoleWriteProductsBoards.Id},
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddChannelReadContentPermissions() (permissionsMap, error) {
|
||||
t := []permissionTransformation{}
|
||||
|
||||
readChannelContentPermissions := []string{
|
||||
model.PermissionReadChannelContent.Id,
|
||||
}
|
||||
|
||||
return permissionsMap{
|
||||
// Migrate all roles including custom roles that have the read_channel permission
|
||||
// but exclude system console roles system_read_only_admin system_user_manager & system_manager
|
||||
// as this system roles are for the admin console use only
|
||||
t = append(t, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionAnd(
|
||||
permissionAnd(
|
||||
isNotRole(model.SystemUserManagerRoleId),
|
||||
@@ -1111,55 +1027,45 @@ func (a *App) getAddChannelReadContentPermissions() (permissionsMap, error) {
|
||||
),
|
||||
permissionExists(model.PermissionReadChannel.Id),
|
||||
),
|
||||
Add: readChannelContentPermissions,
|
||||
})
|
||||
|
||||
return t, nil
|
||||
Add: []string{
|
||||
model.PermissionReadChannelContent.Id,
|
||||
},
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddIPFilterPermissionsMigration() (permissionsMap, error) {
|
||||
t := []permissionTransformation{}
|
||||
|
||||
ipFilterPermissionsRead := []string{
|
||||
return permissionsMap{
|
||||
permissionTransformation{
|
||||
On: permissionOr(isExactRole(model.SystemAdminRoleId)),
|
||||
Add: []string{
|
||||
model.PermissionSysconsoleReadIPFilters.Id,
|
||||
}
|
||||
},
|
||||
},
|
||||
|
||||
ipFilterPermissionsWrite := []string{
|
||||
permissionTransformation{
|
||||
On: permissionOr(isExactRole(model.SystemAdminRoleId)),
|
||||
Add: []string{
|
||||
model.PermissionSysconsoleWriteIPFilters.Id,
|
||||
}
|
||||
|
||||
t = append(t, permissionTransformation{
|
||||
On: permissionOr(isExactRole(model.SystemAdminRoleId)),
|
||||
Add: ipFilterPermissionsRead,
|
||||
})
|
||||
|
||||
t = append(t, permissionTransformation{
|
||||
On: permissionOr(isExactRole(model.SystemAdminRoleId)),
|
||||
Add: ipFilterPermissionsWrite,
|
||||
})
|
||||
|
||||
return t, nil
|
||||
},
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddOutgoingOAuthConnectionsPermissions() (permissionsMap, error) {
|
||||
t := []permissionTransformation{}
|
||||
|
||||
permissionManageOutgoingOAuthConnections := []string{
|
||||
model.PermissionManageOutgoingOAuthConnections.Id,
|
||||
}
|
||||
|
||||
t = append(t, permissionTransformation{
|
||||
return permissionsMap{
|
||||
permissionTransformation{
|
||||
On: permissionOr(isExactRole(model.SystemAdminRoleId)),
|
||||
Add: permissionManageOutgoingOAuthConnections,
|
||||
})
|
||||
|
||||
return t, nil
|
||||
Add: []string{
|
||||
model.PermissionManageOutgoingOAuthConnections.Id,
|
||||
},
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddChannelBookmarksPermissionsMigration() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
return permissionsMap{
|
||||
permissionTransformation{
|
||||
On: permissionOr(
|
||||
isRole(model.ChannelUserRoleId),
|
||||
isRole(model.ChannelAdminRoleId),
|
||||
@@ -1176,54 +1082,46 @@ func (a *App) getAddChannelBookmarksPermissionsMigration() (permissionsMap, erro
|
||||
model.PermissionDeleteBookmarkPrivateChannel.Id,
|
||||
model.PermissionOrderBookmarkPrivateChannel.Id,
|
||||
},
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddManageJobAncillaryPermissionsMigration() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
return permissionsMap{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteAuthenticationLdap.Id),
|
||||
Add: []string{model.PermissionManageLdapSyncJob.Id},
|
||||
})
|
||||
},
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteComplianceDataRetentionPolicy.Id),
|
||||
Add: []string{model.PermissionManageDataRetentionJob.Id},
|
||||
})
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
},
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteExperimentalBleve.Id),
|
||||
Add: []string{model.PermissionManagePostBleveIndexesJob.Id},
|
||||
})
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
},
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteComplianceComplianceExport.Id),
|
||||
Add: []string{model.PermissionManageComplianceExportJob.Id},
|
||||
})
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
},
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionSysconsoleWriteEnvironmentElasticsearch.Id),
|
||||
Add: []string{
|
||||
model.PermissionManageElasticsearchPostIndexingJob.Id,
|
||||
model.PermissionManageElasticsearchPostAggregationJob.Id,
|
||||
},
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (a *App) getAddUploadFilePermissionMigration() (permissionsMap, error) {
|
||||
transformations := []permissionTransformation{}
|
||||
|
||||
transformations = append(transformations, permissionTransformation{
|
||||
return permissionsMap{
|
||||
permissionTransformation{
|
||||
On: permissionExists(model.PermissionCreatePost.Id),
|
||||
Add: []string{model.PermissionUploadFile.Id},
|
||||
})
|
||||
|
||||
return transformations, nil
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
// DoPermissionsMigrations execute all the permissions migrations need by the current version.
|
||||
|
||||
Ссылка в новой задаче
Block a user