MM-33905 -always add FeatureFlags to config (#17163)

* always add FeatureFlags to config

* update const to TitleCase

* gofmt

* update method to use 'access:all'

* update method to use 'access:all'

* fix lint

* gofmt

* added comments

* update name of access tag for any

* fix bad save

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

api4/config.go

@@ -22,8 +22,10 @@ var permissionMap map[string]*model.Permission
 
 type filterType string
 
-const filterTypeWrite filterType = "write"
-const filterTypeRead filterType = "read"
+const (
+	FilterTypeWrite filterType = "write"
+	FilterTypeRead  filterType = "read"
+)
 
 func (api *API) InitConfig() {
 	api.BaseRoutes.ApiRoot.Handle("/config", api.ApiSessionRequired(getConfig)).Methods("GET")
@@ -36,8 +38,8 @@ func (api *API) InitConfig() {
 }
 
 func init() {
-	writeFilter = makeFilterConfigByPermission(filterTypeWrite)
-	readFilter = makeFilterConfigByPermission(filterTypeRead)
+	writeFilter = makeFilterConfigByPermission(FilterTypeWrite)
+	readFilter = makeFilterConfigByPermission(FilterTypeRead)
 	permissionMap = map[string]*model.Permission{}
 	for _, p := range model.AllPermissions {
 		permissionMap[p.Id] = p
@@ -301,7 +303,7 @@ func makeFilterConfigByPermission(accessType filterType) func(c *Context, struct
 			}
 			// ConfigAccessTagWriteRestrictable trumps all other permissions
 			if tagValue == model.ConfigAccessTagWriteRestrictable || tagValue == model.ConfigAccessTagCloudRestrictable {
-				if *c.App.Config().ExperimentalSettings.RestrictSystemAdmin && accessType == filterTypeWrite {
+				if *c.App.Config().ExperimentalSettings.RestrictSystemAdmin && accessType == FilterTypeWrite {
 					return false
 				}
 				continue
@@ -320,6 +322,11 @@ func makeFilterConfigByPermission(accessType filterType) func(c *Context, struct
 			if tagValue == model.ConfigAccessTagCloudRestrictable {
 				continue
 			}
+			if tagValue == model.ConfigAccessTagAnySysConsoleRead && accessType == FilterTypeRead &&
+				c.App.SessionHasPermissionToAny(*c.App.Session(), model.SysconsoleReadPermissions) {
+				return true
+			}
+
 			permissionID := fmt.Sprintf("sysconsole_%s_%s", accessType, tagValue)
 			if permission, ok := permissionMap[permissionID]; ok {
 				if c.App.SessionHasPermissionTo(*c.App.Session(), permission) {

api4/config_test.go

@@ -90,6 +90,32 @@ func TestGetConfigWithAccessTag(t *testing.T) {
 	t.Run("Can read value with permission", func(t *testing.T) {
 		assert.Equal(t, mockVaryByHeader, cfg.RateLimitSettings.VaryByHeader)
 	})
+
+	t.Run("Contains Feature Flags", func(t *testing.T) {
+		assert.NotNil(t, cfg.FeatureFlags)
+	})
+}
+
+func TestGetConfigAnyFlagsAccess(t *testing.T) {
+	th := Setup(t)
+	defer th.TearDown()
+
+	th.Client.Login(th.BasicUser.Username, th.BasicUser.Password)
+	cfg, resp := th.Client.GetConfig()
+
+	t.Run("Check permissions error with no sysconsole read permission", func(t *testing.T) {
+		CheckForbiddenStatus(t, resp)
+	})
+
+	// add read sysconsole environment config
+	th.AddPermissionToRole(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT.Id, model.SYSTEM_USER_ROLE_ID)
+	defer th.RemovePermissionFromRole(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT.Id, model.SYSTEM_USER_ROLE_ID)
+
+	cfg, resp = th.Client.GetConfig()
+	CheckNoError(t, resp)
+	t.Run("Can read value with permission", func(t *testing.T) {
+		assert.NotNil(t, cfg.FeatureFlags)
+	})
 }
 
 func TestReloadConfig(t *testing.T) {