[MM-36444] Manage config deprecations for 6.0 (#18035)

* removing deprecated stuff

* removing deprecations and marking others for deprecations

* removing some of the configs

* partially remove ExperimentalChannelOrganization

* fixing merge issues

* moving default permissions to defaultroles function

* removing experimentaltownsquare

* removing old tests and remove legacysidebar config

* fixing test

* removing log

* removing unused variables

* MM-36444: Fix for renamed functions.

* MM-36444: go mod tidy and go mod vendor.

* MM-36444: Vendored go modules.

* MM-36444: Removes UseExperimentalGossip config field from model.

* Fix vendors

* fixing test

Co-authored-by: Benjamin Cooke <benjamincooke@Benjamins-MacBook-Pro.local>
Co-authored-by: Mattermod <mattermod@users.noreply.github.com>
Co-authored-by: Martin Kraft <martin@upspin.org>
Co-authored-by: Claudio Costa <cstcld91@gmail.com>

api4/post.go

@@ -725,7 +725,6 @@ func saveIsPinnedPost(c *Context, w http.ResponseWriter, isPinned bool) {
 	}
 
 	if c.App.Srv().License() != nil &&
-		*c.App.Config().TeamSettings.ExperimentalTownSquareIsReadOnly &&
 		channel.Name == model.DefaultChannelName &&
 		!c.App.RolesGrantPermission(user.GetRoles(), model.PermissionManageSystem.Id) {
 		c.Err = model.NewAppError("saveIsPinnedPost", "api.post.save_is_pinned_post.town_square_read_only", nil, "", http.StatusForbidden)

api4/post_test.go

@@ -1006,23 +1006,6 @@ func TestPinPost(t *testing.T) {
 	require.Error(t, err)
 	CheckForbiddenStatus(t, resp)
 
-	t.Run("unable-to-pin-post-in-read-only-town-square", func(t *testing.T) {
-		townSquareIsReadOnly := *th.App.Config().TeamSettings.ExperimentalTownSquareIsReadOnly
-		th.App.Srv().SetLicense(model.NewTestLicense())
-		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = true })
-
-		defer th.App.Srv().RemoveLicense()
-		defer th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = townSquareIsReadOnly })
-
-		channel, appErr := th.App.GetChannelByName("town-square", th.BasicTeam.Id, true)
-		assert.Nil(t, appErr)
-		adminPost := th.CreatePostWithClient(th.SystemAdminClient, channel)
-
-		resp, err = client.PinPost(adminPost.Id)
-		require.Error(t, err)
-		CheckForbiddenStatus(t, resp)
-	})
-
 	client.Logout()
 	resp, err = client.PinPost(post.Id)
 	require.Error(t, err)

api4/reaction_test.go

@@ -165,34 +165,6 @@ func TestSaveReaction(t *testing.T) {
 		th.AddPermissionToRole(model.PermissionAddReaction.Id, model.ChannelUserRoleId)
 	})
 
-	t.Run("unable-to-react-in-read-only-town-square", func(t *testing.T) {
-		th.LoginBasic()
-
-		channel, appErr := th.App.GetChannelByName("town-square", th.BasicTeam.Id, true)
-		assert.Nil(t, appErr)
-		post := th.CreatePostWithClient(th.Client, channel)
-
-		th.App.Srv().SetLicense(model.NewTestLicense())
-		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = true })
-
-		reaction := &model.Reaction{
-			UserId:    userId,
-			PostId:    post.Id,
-			EmojiName: "smile",
-		}
-
-		_, resp, err := client.SaveReaction(reaction)
-		require.Error(t, err)
-		CheckForbiddenStatus(t, resp)
-
-		reactions, appErr := th.App.GetReactionsForPost(post.Id)
-		require.Nil(t, appErr)
-		require.Equal(t, 0, len(reactions), "should have not created a reaction")
-
-		th.App.Srv().RemoveLicense()
-		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = false })
-	})
-
 	t.Run("unable-to-react-in-an-archived-channel", func(t *testing.T) {
 		th.LoginBasic()
 
@@ -501,42 +473,6 @@ func TestDeleteReaction(t *testing.T) {
 		th.AddPermissionToRole(model.PermissionRemoveOthersReactions.Id, model.SystemAdminRoleId)
 	})
 
-	t.Run("unable-to-delete-reactions-in-read-only-town-square", func(t *testing.T) {
-		th.LoginBasic()
-
-		channel, appErr := th.App.GetChannelByName("town-square", th.BasicTeam.Id, true)
-		assert.Nil(t, appErr)
-		post := th.CreatePostWithClient(th.Client, channel)
-
-		th.App.Srv().SetLicense(model.NewTestLicense())
-
-		reaction := &model.Reaction{
-			UserId:    userId,
-			PostId:    post.Id,
-			EmojiName: "smile",
-		}
-
-		r1, _, err := client.SaveReaction(reaction)
-		require.NoError(t, err)
-
-		reactions, appErr := th.App.GetReactionsForPost(postId)
-		require.Nil(t, appErr)
-		require.Equal(t, 1, len(reactions), "should have created a reaction")
-
-		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = true })
-
-		resp, err := th.SystemAdminClient.DeleteReaction(r1)
-		require.Error(t, err)
-		CheckForbiddenStatus(t, resp)
-
-		reactions, appErr = th.App.GetReactionsForPost(postId)
-		require.Nil(t, appErr)
-		require.Equal(t, 1, len(reactions), "should have not deleted a reaction")
-
-		th.App.Srv().RemoveLicense()
-		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = false })
-	})
-
 	t.Run("unable-to-delete-reactions-in-an-archived-channel", func(t *testing.T) {
 		th.LoginBasic()
 

api4/user.go

@@ -57,7 +57,6 @@ func (api *API) InitUser() {
 
 	api.BaseRoutes.User.Handle("/auth", api.APISessionRequiredTrustRequester(updateUserAuth)).Methods("PUT")
 
-	api.BaseRoutes.Users.Handle("/mfa", api.APIHandler(checkUserMfa)).Methods("POST")
 	api.BaseRoutes.User.Handle("/mfa", api.APISessionRequiredMfa(updateUserMfa)).Methods("PUT")
 	api.BaseRoutes.User.Handle("/mfa/generate", api.APISessionRequiredMfa(generateMfaSecret)).Methods("POST")
 
@@ -1510,40 +1509,6 @@ func updateUserAuth(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-// Deprecated: checkUserMfa is deprecated and should not be used anymore, starting with version 6.0 it will be disabled.
-//			   Clients should attempt a login without MFA and will receive a MFA error when it's required.
-func checkUserMfa(c *Context, w http.ResponseWriter, r *http.Request) {
-
-	if *c.App.Config().ServiceSettings.DisableLegacyMFA {
-		http.NotFound(w, r)
-		return
-	}
-
-	props := model.MapFromJSON(r.Body)
-
-	loginId := props["login_id"]
-	if loginId == "" {
-		c.SetInvalidParam("login_id")
-		return
-	}
-
-	resp := map[string]interface{}{}
-	resp["mfa_required"] = false
-
-	if !*c.App.Config().ServiceSettings.EnableMultifactorAuthentication {
-		w.Write([]byte(model.StringInterfaceToJSON(resp)))
-		return
-	}
-
-	if *c.App.Config().ServiceSettings.ExperimentalEnableHardenedMode {
-		resp["mfa_required"] = true
-	} else if user, err := c.App.GetUserForLogin("", loginId); err == nil {
-		resp["mfa_required"] = user.MfaActive
-	}
-
-	w.Write([]byte(model.StringInterfaceToJSON(resp)))
-}
-
 func updateUserMfa(c *Context, w http.ResponseWriter, r *http.Request) {
 	c.RequireUserId()
 	if c.Err != nil {

api4/user_test.go

@@ -2769,7 +2769,6 @@ func TestUserLoginMFAFlow(t *testing.T) {
 	defer th.TearDown()
 
 	th.App.UpdateConfig(func(c *model.Config) {
-		*c.ServiceSettings.DisableLegacyMFA = true
 		*c.ServiceSettings.EnableMultifactorAuthentication = true
 	})
 

app/app_test.go

@@ -186,25 +186,7 @@ func TestDoAdvancedPermissionsMigration(t *testing.T) {
 		assert.Nil(t, err)
 		assert.Equal(t, role.Permissions, permissions, fmt.Sprintf("role %q didn't match", name))
 	}
-	// Add a license and change the policy config.
-	restrictPublicChannel := *th.App.Config().TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement
-	restrictPrivateChannel := *th.App.Config().TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement
 
-	defer func() {
-		th.App.UpdateConfig(func(cfg *model.Config) {
-			*cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement = restrictPublicChannel
-		})
-		th.App.UpdateConfig(func(cfg *model.Config) {
-			*cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement = restrictPrivateChannel
-		})
-	}()
-
-	th.App.UpdateConfig(func(cfg *model.Config) {
-		*cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement = model.PermissionsTeamAdmin
-	})
-	th.App.UpdateConfig(func(cfg *model.Config) {
-		*cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement = model.PermissionsTeamAdmin
-	})
 	th.App.Srv().SetLicense(model.NewTestLicense())
 
 	// Check the migration doesn't change anything if run again.
@@ -219,235 +201,15 @@ func TestDoAdvancedPermissionsMigration(t *testing.T) {
 		assert.Nil(t, err)
 		assert.Equal(t, permissions, role.Permissions)
 	}
-
-	// Reset the database
-	th.ResetRoleMigration()
-
-	// Do the migration again with different policy config settings and a license.
-	th.App.DoAdvancedPermissionsMigration()
-
-	// Check the role permissions.
-	expected2 := map[string][]string{
-		"channel_user": {
-			model.PermissionReadChannel.Id,
-			model.PermissionAddReaction.Id,
-			model.PermissionRemoveReaction.Id,
-			model.PermissionManagePublicChannelMembers.Id,
-			model.PermissionUploadFile.Id,
-			model.PermissionGetPublicLink.Id,
-			model.PermissionCreatePost.Id,
-			model.PermissionUseChannelMentions.Id,
-			model.PermissionUseSlashCommands.Id,
-			model.PermissionDeletePublicChannel.Id,
-			model.PermissionDeletePrivateChannel.Id,
-			model.PermissionManagePrivateChannelMembers.Id,
-			model.PermissionDeletePost.Id,
-			model.PermissionEditPost.Id,
-		},
-		"channel_admin": {
-			model.PermissionManageChannelRoles.Id,
-			model.PermissionUseGroupMentions.Id,
-		},
-		"team_user": {
-			model.PermissionListTeamChannels.Id,
-			model.PermissionJoinPublicChannels.Id,
-			model.PermissionReadPublicChannel.Id,
-			model.PermissionViewTeam.Id,
-			model.PermissionCreatePublicChannel.Id,
-			model.PermissionCreatePrivateChannel.Id,
-			model.PermissionInviteUser.Id,
-			model.PermissionAddUserToTeam.Id,
-		},
-		"team_post_all": {
-			model.PermissionCreatePost.Id,
-			model.PermissionUseChannelMentions.Id,
-		},
-		"team_post_all_public": {
-			model.PermissionCreatePostPublic.Id,
-			model.PermissionUseChannelMentions.Id,
-		},
-		"team_admin": {
-			model.PermissionRemoveUserFromTeam.Id,
-			model.PermissionManageTeam.Id,
-			model.PermissionImportTeam.Id,
-			model.PermissionManageTeamRoles.Id,
-			model.PermissionManageChannelRoles.Id,
-			model.PermissionManageOthersIncomingWebhooks.Id,
-			model.PermissionManageOthersOutgoingWebhooks.Id,
-			model.PermissionManageSlashCommands.Id,
-			model.PermissionManageOthersSlashCommands.Id,
-			model.PermissionManageIncomingWebhooks.Id,
-			model.PermissionManageOutgoingWebhooks.Id,
-			model.PermissionConvertPublicChannelToPrivate.Id,
-			model.PermissionConvertPrivateChannelToPublic.Id,
-			model.PermissionManagePublicChannelProperties.Id,
-			model.PermissionManagePrivateChannelProperties.Id,
-			model.PermissionDeletePost.Id,
-			model.PermissionDeleteOthersPosts.Id,
-		},
-		"system_user": {
-			model.PermissionListPublicTeams.Id,
-			model.PermissionJoinPublicTeams.Id,
-			model.PermissionCreateDirectChannel.Id,
-			model.PermissionCreateGroupChannel.Id,
-			model.PermissionViewMembers.Id,
-			model.PermissionCreateTeam.Id,
-		},
-		"system_post_all": {
-			model.PermissionCreatePost.Id,
-			model.PermissionUseChannelMentions.Id,
-		},
-		"system_post_all_public": {
-			model.PermissionCreatePostPublic.Id,
-			model.PermissionUseChannelMentions.Id,
-		},
-		"system_user_access_token": {
-			model.PermissionCreateUserAccessToken.Id,
-			model.PermissionReadUserAccessToken.Id,
-			model.PermissionRevokeUserAccessToken.Id,
-		},
-		"system_admin": allPermissionIDs,
-	}
-
-	roles3, err3 := th.App.GetRolesByNames(roleNames)
-	assert.Nil(t, err3)
-	assert.Equal(t, len(roles3), len(roleNames))
-
-	for name, permissions := range expected2 {
-		role, err := th.App.GetRoleByName(context.Background(), name)
-		assert.Nil(t, err)
-		assert.Equal(t, permissions, role.Permissions, fmt.Sprintf("'%v' did not have expected permissions", name))
-	}
-
-	// Remove the license.
-	th.App.Srv().SetLicense(nil)
-
-	// Do the migration again.
-	th.ResetRoleMigration()
-	th.App.DoAdvancedPermissionsMigration()
-
-	// Check the role permissions.
-	roles4, err4 := th.App.GetRolesByNames(roleNames)
-	assert.Nil(t, err4)
-	assert.Equal(t, len(roles4), len(roleNames))
-
-	for name, permissions := range expected1 {
-		role, err := th.App.GetRoleByName(context.Background(), name)
-		assert.Nil(t, err)
-		assert.Equal(t, permissions, role.Permissions)
-	}
-
-	// Check that the config setting for "always" and "time_limit" edit posts is updated correctly.
-	th.ResetRoleMigration()
-
-	allowEditPost := *th.App.Config().ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost
-	postEditTimeLimit := *th.App.Config().ServiceSettings.PostEditTimeLimit
-
-	defer func() {
-		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost = allowEditPost })
-		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.PostEditTimeLimit = postEditTimeLimit })
-	}()
-
-	th.App.UpdateConfig(func(cfg *model.Config) {
-		*cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost = "always"
-		*cfg.ServiceSettings.PostEditTimeLimit = 300
-	})
-
-	th.App.DoAdvancedPermissionsMigration()
-
-	config := th.App.Config()
-	assert.Equal(t, -1, *config.ServiceSettings.PostEditTimeLimit)
-
-	th.ResetRoleMigration()
-
-	th.App.UpdateConfig(func(cfg *model.Config) {
-		*cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost = "time_limit"
-		*cfg.ServiceSettings.PostEditTimeLimit = 300
-	})
-
-	th.App.DoAdvancedPermissionsMigration()
-	config = th.App.Config()
-	assert.Equal(t, 300, *config.ServiceSettings.PostEditTimeLimit)
 }
 
 func TestDoEmojisPermissionsMigration(t *testing.T) {
 	th := SetupWithoutPreloadMigrations(t)
 	defer th.TearDown()
 
-	// Add a license and change the policy config.
-	restrictCustomEmojiCreation := *th.App.Config().ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation
-
-	defer func() {
-		th.App.UpdateConfig(func(cfg *model.Config) {
-			*cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation = restrictCustomEmojiCreation
-		})
-	}()
-
-	th.App.UpdateConfig(func(cfg *model.Config) {
-		*cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation = model.RestrictEmojiCreationSystemAdmin
-	})
-
-	th.ResetEmojisMigration()
-	th.App.DoEmojisPermissionsMigration()
-
 	expectedSystemAdmin := allPermissionIDs
 	sort.Strings(expectedSystemAdmin)
 
-	role1, err1 := th.App.GetRoleByName(context.Background(), model.SystemAdminRoleId)
-	assert.Nil(t, err1)
-	sort.Strings(role1.Permissions)
-	assert.Equal(t, expectedSystemAdmin, role1.Permissions, fmt.Sprintf("'%v' did not have expected permissions", model.SystemAdminRoleId))
-
-	th.App.UpdateConfig(func(cfg *model.Config) {
-		*cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation = model.RestrictEmojiCreationAdmin
-	})
-
-	th.ResetEmojisMigration()
-	th.App.DoEmojisPermissionsMigration()
-
-	role2, err2 := th.App.GetRoleByName(context.Background(), model.TeamAdminRoleId)
-	assert.Nil(t, err2)
-	expected2 := []string{
-		model.PermissionRemoveUserFromTeam.Id,
-		model.PermissionManageTeam.Id,
-		model.PermissionImportTeam.Id,
-		model.PermissionManageTeamRoles.Id,
-		model.PermissionReadPublicChannelGroups.Id,
-		model.PermissionReadPrivateChannelGroups.Id,
-		model.PermissionManageChannelRoles.Id,
-		model.PermissionManageOthersIncomingWebhooks.Id,
-		model.PermissionManageOthersOutgoingWebhooks.Id,
-		model.PermissionManageSlashCommands.Id,
-		model.PermissionManageOthersSlashCommands.Id,
-		model.PermissionManageIncomingWebhooks.Id,
-		model.PermissionManageOutgoingWebhooks.Id,
-		model.PermissionDeletePost.Id,
-		model.PermissionDeleteOthersPosts.Id,
-		model.PermissionCreateEmojis.Id,
-		model.PermissionDeleteEmojis.Id,
-		model.PermissionAddReaction.Id,
-		model.PermissionCreatePost.Id,
-		model.PermissionManagePublicChannelMembers.Id,
-		model.PermissionManagePrivateChannelMembers.Id,
-		model.PermissionRemoveReaction.Id,
-		model.PermissionUseChannelMentions.Id,
-		model.PermissionUseGroupMentions.Id,
-		model.PermissionConvertPublicChannelToPrivate.Id,
-		model.PermissionConvertPrivateChannelToPublic.Id,
-	}
-	sort.Strings(expected2)
-	sort.Strings(role2.Permissions)
-	assert.Equal(t, expected2, role2.Permissions, fmt.Sprintf("'%v' did not have expected permissions", model.TeamAdminRoleId))
-
-	systemAdmin1, systemAdminErr1 := th.App.GetRoleByName(context.Background(), model.SystemAdminRoleId)
-	assert.Nil(t, systemAdminErr1)
-	sort.Strings(systemAdmin1.Permissions)
-	assert.Equal(t, expectedSystemAdmin, systemAdmin1.Permissions, fmt.Sprintf("'%v' did not have expected permissions", model.SystemAdminRoleId))
-
-	th.App.UpdateConfig(func(cfg *model.Config) {
-		*cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation = model.RestrictEmojiCreationAll
-	})
-
 	th.ResetEmojisMigration()
 	th.App.DoEmojisPermissionsMigration()
 

app/migrations.go

@@ -10,7 +10,6 @@ import (
 
 	"github.com/mattermost/mattermost-server/v6/model"
 	"github.com/mattermost/mattermost-server/v6/shared/mlog"
-	"github.com/mattermost/mattermost-server/v6/utils"
 )
 
 const EmojisPermissionsMigrationKey = "EmojisPermissionsMigrationComplete"
@@ -31,7 +30,6 @@ func (s *Server) doAdvancedPermissionsMigration() {
 
 	mlog.Info("Migrating roles to database.")
 	roles := model.MakeDefaultRoles()
-	roles = utils.SetRolePermissionsFromConfig(roles, s.Config(), s.License() != nil)
 
 	allSucceeded := true
 
@@ -68,11 +66,9 @@ func (s *Server) doAdvancedPermissionsMigration() {
 	}
 
 	config := s.Config()
-	if *config.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost == model.AllowEditPostAlways {
+	*config.ServiceSettings.PostEditTimeLimit = -1
-		*config.ServiceSettings.PostEditTimeLimit = -1
+	if _, _, err := s.SaveConfig(config, true); err != nil {
-		if _, _, err := s.SaveConfig(config, true); err != nil {
+		mlog.Error("Failed to update config in Advanced Permissions Phase 1 Migration.", mlog.Err(err))
-			mlog.Error("Failed to update config in Advanced Permissions Phase 1 Migration.", mlog.Err(err))
-		}
 	}
 
 	system := model.System{
@@ -110,23 +106,11 @@ func (s *Server) doEmojisPermissionsMigration() {
 	var err *model.AppError
 
 	mlog.Info("Migrating emojis config to database.")
-	switch *s.Config().ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation {
+
-	case model.RestrictEmojiCreationAll:
+	// Emoji creation is set to all by default
-		role, err = s.GetRoleByName(context.Background(), model.SystemUserRoleId)
+	role, err = s.GetRoleByName(context.Background(), model.SystemUserRoleId)
-		if err != nil {
+	if err != nil {
-			mlog.Critical("Failed to migrate emojis creation permissions from mattermost config.", mlog.Err(err))
+		mlog.Critical("Failed to migrate emojis creation permissions from mattermost config.", mlog.Err(err))
-			return
-		}
-	case model.RestrictEmojiCreationAdmin:
-		role, err = s.GetRoleByName(context.Background(), model.TeamAdminRoleId)
-		if err != nil {
-			mlog.Critical("Failed to migrate emojis creation permissions from mattermost config.", mlog.Err(err))
-			return
-		}
-	case model.RestrictEmojiCreationSystemAdmin:
-		role = nil
-	default:
-		mlog.Critical("Failed to migrate emojis creation permissions from mattermost config. Invalid restrict emoji creation setting")
 		return
 	}
 

app/post.go

@@ -213,7 +213,7 @@ func (a *App) CreatePost(c *request.Context, post *model.Post, channel *model.Ch
 		post.AddProp("from_bot", "true")
 	}
 
-	if a.Srv().License() != nil && *a.Config().TeamSettings.ExperimentalTownSquareIsReadOnly &&
+	if a.Srv().License() != nil &&
 		!post.IsSystemMessage() &&
 		channel.Name == model.DefaultChannelName &&
 		!a.RolesGrantPermission(user.GetRoles(), model.PermissionManageSystem.Id) {

app/reaction.go

@@ -29,7 +29,7 @@ func (a *App) SaveReactionForPost(c *request.Context, reaction *model.Reaction)
 		return nil, model.NewAppError("deleteReactionForPost", "api.reaction.save.archived_channel.app_error", nil, "", http.StatusForbidden)
 	}
 
-	if a.Srv().License() != nil && *a.Config().TeamSettings.ExperimentalTownSquareIsReadOnly && channel.Name == model.DefaultChannelName {
+	if a.Srv().License() != nil && channel.Name == model.DefaultChannelName {
 		var user *model.User
 		user, err = a.GetUser(reaction.UserId)
 		if err != nil {
@@ -123,7 +123,7 @@ func (a *App) DeleteReactionForPost(c *request.Context, reaction *model.Reaction
 		return model.NewAppError("DeleteReactionForPost", "api.reaction.delete.archived_channel.app_error", nil, "", http.StatusForbidden)
 	}
 
-	if a.Srv().License() != nil && *a.Config().TeamSettings.ExperimentalTownSquareIsReadOnly && channel.Name == model.DefaultChannelName {
+	if a.Srv().License() != nil && channel.Name == model.DefaultChannelName {
 		user, err := a.GetUser(reaction.UserId)
 		if err != nil {
 			return err

app/webhook.go

@@ -777,7 +777,7 @@ func (a *App) HandleIncomingWebhook(c *request.Context, hookID string, req *mode
 	}
 	user = result.Data.(*model.User)
 
-	if a.Srv().License() != nil && *a.Config().TeamSettings.ExperimentalTownSquareIsReadOnly &&
+	if a.Srv().License() != nil &&
 		channel.Name == model.DefaultChannelName && !a.RolesGrantPermission(user.GetRoles(), model.PermissionManageSystem.Id) {
 		return model.NewAppError("HandleIncomingWebhook", "api.post.create_post.town_square_read_only", nil, "", http.StatusForbidden)
 	}

config/client.go

@@ -18,7 +18,6 @@ func GenerateClientConfig(c *model.Config, telemetryID string, license *model.Li
 	props["EnableCustomUserStatuses"] = strconv.FormatBool(*c.TeamSettings.EnableCustomUserStatuses)
 	props["EnableUserDeactivation"] = strconv.FormatBool(*c.TeamSettings.EnableUserDeactivation)
 	props["RestrictDirectMessage"] = *c.TeamSettings.RestrictDirectMessage
-	props["EnableXToLeaveChannelsFromLHS"] = strconv.FormatBool(*c.TeamSettings.EnableXToLeaveChannelsFromLHS)
 	props["TeammateNameDisplay"] = *c.TeamSettings.TeammateNameDisplay
 	props["LockTeammateNameDisplay"] = strconv.FormatBool(*c.TeamSettings.LockTeammateNameDisplay)
 	props["ExperimentalPrimaryTeam"] = *c.TeamSettings.ExperimentalPrimaryTeam
@@ -39,7 +38,6 @@ func GenerateClientConfig(c *model.Config, telemetryID string, license *model.Li
 	props["EnableDeveloper"] = strconv.FormatBool(*c.ServiceSettings.EnableDeveloper)
 	props["PostEditTimeLimit"] = fmt.Sprintf("%v", *c.ServiceSettings.PostEditTimeLimit)
 	props["MinimumHashtagLength"] = fmt.Sprintf("%v", *c.ServiceSettings.MinimumHashtagLength)
-	props["CloseUnusedDirectMessages"] = strconv.FormatBool(*c.ServiceSettings.CloseUnusedDirectMessages)
 	props["EnablePreviewFeatures"] = strconv.FormatBool(*c.ServiceSettings.EnablePreviewFeatures)
 	props["EnableTutorial"] = strconv.FormatBool(*c.ServiceSettings.EnableTutorial)
 	props["EnableOnboardingFlow"] = strconv.FormatBool(*c.ServiceSettings.EnableOnboardingFlow)
@@ -58,11 +56,6 @@ func GenerateClientConfig(c *model.Config, telemetryID string, license *model.Li
 
 	props["ExperimentalCloudUserLimit"] = strconv.FormatInt(*c.ExperimentalSettings.CloudUserLimit, 10)
 	props["ExperimentalCloudBilling"] = strconv.FormatBool(*c.ExperimentalSettings.CloudBilling)
-	if *c.ServiceSettings.ExperimentalChannelOrganization || *c.ServiceSettings.ExperimentalGroupUnreadChannels != model.GroupUnreadChannelsDisabled {
-		props["ExperimentalChannelOrganization"] = strconv.FormatBool(true)
-	} else {
-		props["ExperimentalChannelOrganization"] = strconv.FormatBool(false)
-	}
 
 	props["ExperimentalEnableAutomaticReplies"] = strconv.FormatBool(*c.TeamSettings.ExperimentalEnableAutomaticReplies)
 	props["ExperimentalTimezone"] = strconv.FormatBool(*c.DisplaySettings.ExperimentalTimezone)
@@ -101,13 +94,9 @@ func GenerateClientConfig(c *model.Config, telemetryID string, license *model.Li
 
 	props["CloudUserLimit"] = strconv.FormatInt(*c.ExperimentalSettings.CloudUserLimit, 10)
 
-	props["EnableLegacySidebar"] = strconv.FormatBool(*c.ServiceSettings.EnableLegacySidebar)
-
 	props["EnableReliableWebSockets"] = strconv.FormatBool(*c.ServiceSettings.EnableReliableWebSockets)
 
 	// Set default values for all options that require a license.
-	props["ExperimentalHideTownSquareinLHS"] = "false"
-	props["ExperimentalTownSquareIsReadOnly"] = "false"
 	props["ExperimentalEnableAuthenticationTransfer"] = "true"
 	props["LdapNicknameAttributeSet"] = "false"
 	props["LdapFirstNameAttributeSet"] = "false"
@@ -144,8 +133,6 @@ func GenerateClientConfig(c *model.Config, telemetryID string, license *model.Li
 	props["CollapsedThreads"] = *c.ServiceSettings.CollapsedThreads
 
 	if license != nil {
-		props["ExperimentalHideTownSquareinLHS"] = strconv.FormatBool(*c.TeamSettings.ExperimentalHideTownSquareinLHS)
-		props["ExperimentalTownSquareIsReadOnly"] = strconv.FormatBool(*c.TeamSettings.ExperimentalTownSquareIsReadOnly)
 		props["ExperimentalEnableAuthenticationTransfer"] = strconv.FormatBool(*c.ServiceSettings.ExperimentalEnableAuthenticationTransfer)
 
 		if *license.Features.LDAP {

config/client_test.go

@@ -111,33 +111,6 @@ func TestGetClientConfig(t *testing.T) {
 				"EnforceMultifactorAuthentication": "true",
 			},
 		},
-		{
-			"experimental channel organization enabled",
-			&model.Config{
-				ServiceSettings: model.ServiceSettings{
-					ExperimentalChannelOrganization: model.NewBool(true),
-				},
-			},
-			"tag1",
-			nil,
-			map[string]string{
-				"ExperimentalChannelOrganization": "true",
-			},
-		},
-		{
-			"experimental channel organization disabled, but experimental group unread channels on",
-			&model.Config{
-				ServiceSettings: model.ServiceSettings{
-					ExperimentalChannelOrganization: model.NewBool(false),
-					ExperimentalGroupUnreadChannels: model.NewString(model.GroupUnreadChannelsDefaultOn),
-				},
-			},
-			"tag1",
-			nil,
-			map[string]string{
-				"ExperimentalChannelOrganization": "true",
-			},
-		},
 		{
 			"default marketplace",
 			&model.Config{

model/config.go

@@ -79,10 +79,6 @@ const (
 	PermissionsDeletePostTeamAdmin   = "team_admin"
 	PermissionsDeletePostSystemAdmin = "system_admin"
 
-	AllowEditPostAlways    = "always"
-	AllowEditPostNever     = "never"
-	AllowEditPostTimeLimit = "time_limit"
-
 	GroupUnreadChannelsDisabled   = "disabled"
 	GroupUnreadChannelsDefaultOn  = "default_on"
 	GroupUnreadChannelsDefaultOff = "default_off"
@@ -301,7 +297,6 @@ type ServiceSettings struct {
 	EnablePostUsernameOverride                        *bool    `access:"integrations_integration_management"`
 	EnablePostIconOverride                            *bool    `access:"integrations_integration_management"`
 	GoogleDeveloperKey                                *string  `access:"site_posts,write_restrictable,cloud_restrictable"`
-	DEPRECATED_DO_NOT_USE_EnableOnlyAdminIntegrations *bool    `json:"EnableOnlyAdminIntegrations" mapstructure:"EnableOnlyAdminIntegrations"` // Deprecated: do not use
 	EnableLinkPreviews                                *bool    `access:"site_posts"`
 	EnablePermalinkPreviews                           *bool    `access:"site_posts"`
 	RestrictLinkPreviews                              *string  `access:"site_posts"`
@@ -333,9 +328,6 @@ type ServiceSettings struct {
 	GfycatAPISecret                                   *string  `access:"integrations_gif"`
 	EnableCustomEmoji                                 *bool    `access:"site_emoji"`
 	EnableEmojiPicker                                 *bool    `access:"site_emoji"`
-	DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation *string  `json:"RestrictCustomEmojiCreation" mapstructure:"RestrictCustomEmojiCreation"` // Deprecated: do not use
-	DEPRECATED_DO_NOT_USE_RestrictPostDelete          *string  `json:"RestrictPostDelete" mapstructure:"RestrictPostDelete"`                   // Deprecated: do not use
-	DEPRECATED_DO_NOT_USE_AllowEditPost               *string  `json:"AllowEditPost" mapstructure:"AllowEditPost"`                             // Deprecated: do not use
 	PostEditTimeLimit                                 *int     `access:"user_management_permissions"`
 	TimeBetweenUserTypingUpdatesMilliseconds          *int64   `access:"experimental_features,write_restrictable,cloud_restrictable"`
 	EnablePostSearch                                  *bool    `access:"write_restrictable,cloud_restrictable"`
@@ -346,20 +338,14 @@ type ServiceSettings struct {
 	EnableUserStatuses                                *bool    `access:"write_restrictable,cloud_restrictable"`
 	ExperimentalEnableAuthenticationTransfer          *bool    `access:"experimental_features,write_restrictable,cloud_restrictable"`
 	ClusterLogTimeoutMilliseconds                     *int     `access:"write_restrictable,cloud_restrictable"`
-	CloseUnusedDirectMessages                         *bool    `access:"experimental_features"`
 	EnablePreviewFeatures                             *bool    `access:"experimental_features"`
 	EnableTutorial                                    *bool    `access:"experimental_features"`
 	EnableOnboardingFlow                              *bool    `access:"experimental_features"`
 	ExperimentalEnableDefaultChannelLeaveJoinMessages *bool    `access:"experimental_features"`
 	ExperimentalGroupUnreadChannels                   *string  `access:"experimental_features"`
-	ExperimentalChannelOrganization                   *bool    `access:"experimental_features"`
-	DEPRECATED_DO_NOT_USE_ImageProxyType              *string  `json:"ImageProxyType" mapstructure:"ImageProxyType"`       // Deprecated: do not use
-	DEPRECATED_DO_NOT_USE_ImageProxyURL               *string  `json:"ImageProxyURL" mapstructure:"ImageProxyURL"`         // Deprecated: do not use
-	DEPRECATED_DO_NOT_USE_ImageProxyOptions           *string  `json:"ImageProxyOptions" mapstructure:"ImageProxyOptions"` // Deprecated: do not use
 	EnableAPITeamDeletion                             *bool
 	EnableAPIUserDeletion                             *bool
 	ExperimentalEnableHardenedMode                    *bool `access:"experimental_features"`
-	DisableLegacyMFA                                  *bool `access:"write_restrictable,cloud_restrictable"`
 	ExperimentalStrictCSRFEnforcement                 *bool `access:"experimental_features,write_restrictable,cloud_restrictable"`
 	EnableEmailInvitations                            *bool `access:"authentication_signup"`
 	DisableBotsWhenOwnerIsDeactivated                 *bool `access:"integrations_bot_accounts,write_restrictable,cloud_restrictable"`
@@ -377,7 +363,6 @@ type ServiceSettings struct {
 	ThreadAutoFollow                                  *bool   `access:"experimental_features"`
 	CollapsedThreads                                  *string `access:"experimental_features"`
 	ManagedResourcePaths                              *string `access:"environment_web_server,write_restrictable,cloud_restrictable"`
-	EnableLegacySidebar                               *bool   `access:"experimental_features"`
 	EnableReliableWebSockets                          *bool   `access:"experimental_features"` // telemetry: none
 }
 
@@ -577,10 +562,6 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) {
 		s.ClusterLogTimeoutMilliseconds = NewInt(2000)
 	}
 
-	if s.CloseUnusedDirectMessages == nil {
-		s.CloseUnusedDirectMessages = NewBool(false)
-	}
-
 	if s.EnableTutorial == nil {
 		s.EnableTutorial = NewBool(true)
 	}
@@ -626,10 +607,6 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) {
 		s.EnableCommands = NewBool(true)
 	}
 
-	if s.DEPRECATED_DO_NOT_USE_EnableOnlyAdminIntegrations == nil {
-		s.DEPRECATED_DO_NOT_USE_EnableOnlyAdminIntegrations = NewBool(true)
-	}
-
 	if s.EnablePostUsernameOverride == nil {
 		s.EnablePostUsernameOverride = NewBool(false)
 	}
@@ -692,18 +669,6 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) {
 		s.GfycatAPISecret = NewString(ServiceSettingsDefaultGfycatAPISecret)
 	}
 
-	if s.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation == nil {
-		s.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation = NewString(RestrictEmojiCreationAll)
-	}
-
-	if s.DEPRECATED_DO_NOT_USE_RestrictPostDelete == nil {
-		s.DEPRECATED_DO_NOT_USE_RestrictPostDelete = NewString(PermissionsDeletePostAll)
-	}
-
-	if s.DEPRECATED_DO_NOT_USE_AllowEditPost == nil {
-		s.DEPRECATED_DO_NOT_USE_AllowEditPost = NewString(AllowEditPostAlways)
-	}
-
 	if s.ExperimentalEnableAuthenticationTransfer == nil {
 		s.ExperimentalEnableAuthenticationTransfer = NewBool(true)
 	}
@@ -728,23 +693,6 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) {
 		s.ExperimentalGroupUnreadChannels = NewString(GroupUnreadChannelsDefaultOn)
 	}
 
-	if s.ExperimentalChannelOrganization == nil {
-		experimentalUnreadEnabled := *s.ExperimentalGroupUnreadChannels != GroupUnreadChannelsDisabled
-		s.ExperimentalChannelOrganization = NewBool(experimentalUnreadEnabled)
-	}
-
-	if s.DEPRECATED_DO_NOT_USE_ImageProxyType == nil {
-		s.DEPRECATED_DO_NOT_USE_ImageProxyType = NewString("")
-	}
-
-	if s.DEPRECATED_DO_NOT_USE_ImageProxyURL == nil {
-		s.DEPRECATED_DO_NOT_USE_ImageProxyURL = NewString("")
-	}
-
-	if s.DEPRECATED_DO_NOT_USE_ImageProxyOptions == nil {
-		s.DEPRECATED_DO_NOT_USE_ImageProxyOptions = NewString("")
-	}
-
 	if s.EnableAPITeamDeletion == nil {
 		s.EnableAPITeamDeletion = NewBool(false)
 	}
@@ -761,10 +709,6 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) {
 		s.ExperimentalEnableHardenedMode = NewBool(false)
 	}
 
-	if s.DisableLegacyMFA == nil {
-		s.DisableLegacyMFA = NewBool(!isUpdate)
-	}
-
 	if s.ExperimentalStrictCSRFEnforcement == nil {
 		s.ExperimentalStrictCSRFEnforcement = NewBool(false)
 	}
@@ -833,32 +777,27 @@ func (s *ServiceSettings) SetDefaults(isUpdate bool) {
 		s.ManagedResourcePaths = NewString("")
 	}
 
-	if s.EnableLegacySidebar == nil {
-		s.EnableLegacySidebar = NewBool(false)
-	}
-
 	if s.EnableReliableWebSockets == nil {
 		s.EnableReliableWebSockets = NewBool(true)
 	}
 }
 
 type ClusterSettings struct {
-	Enable                                      *bool   `access:"environment_high_availability,write_restrictable"`
+	Enable                             *bool   `access:"environment_high_availability,write_restrictable"`
-	ClusterName                                 *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
+	ClusterName                        *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
-	OverrideHostname                            *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
+	OverrideHostname                   *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
-	NetworkInterface                            *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
+	NetworkInterface                   *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
-	BindAddress                                 *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
+	BindAddress                        *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
-	AdvertiseAddress                            *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
+	AdvertiseAddress                   *string `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
-	UseIPAddress                                *bool   `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
+	UseIPAddress                       *bool   `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
-	DEPRECATED_DO_NOT_USE_UseExperimentalGossip *bool   `json:"UseExperimentalGossip" access:"environment_high_availability,write_restrictable,cloud_restrictable"` // Deprecated: do not use
+	EnableGossipCompression            *bool   `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
-	EnableGossipCompression                     *bool   `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
+	EnableExperimentalGossipEncryption *bool   `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
-	EnableExperimentalGossipEncryption          *bool   `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
+	ReadOnlyConfig                     *bool   `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
-	ReadOnlyConfig                              *bool   `access:"environment_high_availability,write_restrictable,cloud_restrictable"`
+	GossipPort                         *int    `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
-	GossipPort                                  *int    `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
+	StreamingPort                      *int    `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
-	StreamingPort                               *int    `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
+	MaxIdleConns                       *int    `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
-	MaxIdleConns                                *int    `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
+	MaxIdleConnsPerHost                *int    `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
-	MaxIdleConnsPerHost                         *int    `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
+	IdleConnTimeoutMilliseconds        *int    `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
-	IdleConnTimeoutMilliseconds                 *int    `access:"environment_high_availability,write_restrictable,cloud_restrictable"` // telemetry: none
 }
 
 func (s *ClusterSettings) SetDefaults() {
@@ -890,10 +829,6 @@ func (s *ClusterSettings) SetDefaults() {
 		s.UseIPAddress = NewBool(true)
 	}
 
-	if s.DEPRECATED_DO_NOT_USE_UseExperimentalGossip == nil {
-		s.DEPRECATED_DO_NOT_USE_UseExperimentalGossip = NewBool(true)
-	}
-
 	if s.EnableExperimentalGossipEncryption == nil {
 		s.EnableExperimentalGossipEncryption = NewBool(false)
 	}
@@ -1930,39 +1865,27 @@ func (s *ThemeSettings) SetDefaults() {
 }
 
 type TeamSettings struct {
-	SiteName                                                  *string  `access:"site_customization"`
+	SiteName                            *string  `access:"site_customization"`
-	MaxUsersPerTeam                                           *int     `access:"site_users_and_teams"`
+	MaxUsersPerTeam                     *int     `access:"site_users_and_teams"`
-	DEPRECATED_DO_NOT_USE_EnableTeamCreation                  *bool    `json:"EnableTeamCreation" mapstructure:"EnableTeamCreation"` // Deprecated: do not use
+	EnableUserCreation                  *bool    `access:"authentication_signup"`
-	EnableUserCreation                                        *bool    `access:"authentication_signup"`
+	EnableOpenServer                    *bool    `access:"authentication_signup"`
-	EnableOpenServer                                          *bool    `access:"authentication_signup"`
+	EnableUserDeactivation              *bool    `access:"experimental_features"`
-	EnableUserDeactivation                                    *bool    `access:"experimental_features"`
+	RestrictCreationToDomains           *string  `access:"authentication_signup"` // telemetry: none
-	RestrictCreationToDomains                                 *string  `access:"authentication_signup"` // telemetry: none
+	EnableCustomUserStatuses            *bool    `access:"site_users_and_teams"`
-	EnableCustomUserStatuses                                  *bool    `access:"site_users_and_teams"`
+	EnableCustomBrand                   *bool    `access:"site_customization"`
-	EnableCustomBrand                                         *bool    `access:"site_customization"`
+	CustomBrandText                     *string  `access:"site_customization"`
-	CustomBrandText                                           *string  `access:"site_customization"`
+	CustomDescriptionText               *string  `access:"site_customization"`
-	CustomDescriptionText                                     *string  `access:"site_customization"`
+	RestrictDirectMessage               *string  `access:"site_users_and_teams"`
-	RestrictDirectMessage                                     *string  `access:"site_users_and_teams"`
+	UserStatusAwayTimeout               *int64   `access:"experimental_features"`
-	DEPRECATED_DO_NOT_USE_RestrictTeamInvite                  *string  `json:"RestrictTeamInvite" mapstructure:"RestrictTeamInvite"`                                   // Deprecated: do not use
+	MaxChannelsPerTeam                  *int64   `access:"site_users_and_teams"`
-	DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement     *string  `json:"RestrictPublicChannelManagement" mapstructure:"RestrictPublicChannelManagement"`         // Deprecated: do not use
+	MaxNotificationsPerChannel          *int64   `access:"environment_push_notification_server"`
-	DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement    *string  `json:"RestrictPrivateChannelManagement" mapstructure:"RestrictPrivateChannelManagement"`       // Deprecated: do not use
+	EnableConfirmNotificationsToChannel *bool    `access:"site_notifications"`
-	DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation       *string  `json:"RestrictPublicChannelCreation" mapstructure:"RestrictPublicChannelCreation"`             // Deprecated: do not use
+	TeammateNameDisplay                 *string  `access:"site_users_and_teams"`
-	DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation      *string  `json:"RestrictPrivateChannelCreation" mapstructure:"RestrictPrivateChannelCreation"`           // Deprecated: do not use
+	ExperimentalViewArchivedChannels    *bool    `access:"experimental_features,site_users_and_teams"`
-	DEPRECATED_DO_NOT_USE_RestrictPublicChannelDeletion       *string  `json:"RestrictPublicChannelDeletion" mapstructure:"RestrictPublicChannelDeletion"`             // Deprecated: do not use
+	ExperimentalEnableAutomaticReplies  *bool    `access:"experimental_features"`
-	DEPRECATED_DO_NOT_USE_RestrictPrivateChannelDeletion      *string  `json:"RestrictPrivateChannelDeletion" mapstructure:"RestrictPrivateChannelDeletion"`           // Deprecated: do not use
+	LockTeammateNameDisplay             *bool    `access:"site_users_and_teams"`
-	DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManageMembers *string  `json:"RestrictPrivateChannelManageMembers" mapstructure:"RestrictPrivateChannelManageMembers"` // Deprecated: do not use
+	ExperimentalPrimaryTeam             *string  `access:"experimental_features"`
-	EnableXToLeaveChannelsFromLHS                             *bool    `access:"experimental_features"`
+	ExperimentalDefaultChannels         []string `access:"experimental_features"`
-	UserStatusAwayTimeout                                     *int64   `access:"experimental_features"`
-	MaxChannelsPerTeam                                        *int64   `access:"site_users_and_teams"`
-	MaxNotificationsPerChannel                                *int64   `access:"environment_push_notification_server"`
-	EnableConfirmNotificationsToChannel                       *bool    `access:"site_notifications"`
-	TeammateNameDisplay                                       *string  `access:"site_users_and_teams"`
-	ExperimentalViewArchivedChannels                          *bool    `access:"experimental_features,site_users_and_teams"`
-	ExperimentalEnableAutomaticReplies                        *bool    `access:"experimental_features"`
-	ExperimentalHideTownSquareinLHS                           *bool    `access:"experimental_features"`
-	ExperimentalTownSquareIsReadOnly                          *bool    `access:"experimental_features"`
-	LockTeammateNameDisplay                                   *bool    `access:"site_users_and_teams"`
-	ExperimentalPrimaryTeam                                   *string  `access:"experimental_features"`
-	ExperimentalDefaultChannels                               []string `access:"experimental_features"`
 }
 
 func (s *TeamSettings) SetDefaults() {
@@ -1975,10 +1898,6 @@ func (s *TeamSettings) SetDefaults() {
 		s.MaxUsersPerTeam = NewInt(TeamSettingsDefaultMaxUsersPerTeam)
 	}
 
-	if s.DEPRECATED_DO_NOT_USE_EnableTeamCreation == nil {
-		s.DEPRECATED_DO_NOT_USE_EnableTeamCreation = NewBool(true)
-	}
-
 	if s.EnableUserCreation == nil {
 		s.EnableUserCreation = NewBool(true)
 	}
@@ -2015,55 +1934,6 @@ func (s *TeamSettings) SetDefaults() {
 		s.RestrictDirectMessage = NewString(DirectMessageAny)
 	}
 
-	if s.DEPRECATED_DO_NOT_USE_RestrictTeamInvite == nil {
-		s.DEPRECATED_DO_NOT_USE_RestrictTeamInvite = NewString(PermissionsAll)
-	}
-
-	if s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement == nil {
-		s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement = NewString(PermissionsAll)
-	}
-
-	if s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement == nil {
-		s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement = NewString(PermissionsAll)
-	}
-
-	if s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation == nil {
-		s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation = new(string)
-		// If this setting does not exist, assume migration from <3.6, so use management setting as default.
-		if *s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement == PermissionsChannelAdmin {
-			*s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation = PermissionsTeamAdmin
-		} else {
-			*s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation = *s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement
-		}
-	}
-
-	if s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation == nil {
-		// If this setting does not exist, assume migration from <3.6, so use management setting as default.
-		if *s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement == PermissionsChannelAdmin {
-			s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation = NewString(PermissionsTeamAdmin)
-		} else {
-			s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation = NewString(*s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement)
-		}
-	}
-
-	if s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelDeletion == nil {
-		// If this setting does not exist, assume migration from <3.6, so use management setting as default.
-		s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelDeletion = NewString(*s.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement)
-	}
-
-	if s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelDeletion == nil {
-		// If this setting does not exist, assume migration from <3.6, so use management setting as default.
-		s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelDeletion = NewString(*s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement)
-	}
-
-	if s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManageMembers == nil {
-		s.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManageMembers = NewString(PermissionsAll)
-	}
-
-	if s.EnableXToLeaveChannelsFromLHS == nil {
-		s.EnableXToLeaveChannelsFromLHS = NewBool(false)
-	}
-
 	if s.UserStatusAwayTimeout == nil {
 		s.UserStatusAwayTimeout = NewInt64(TeamSettingsDefaultUserStatusAwayTimeout)
 	}
@@ -2084,14 +1954,6 @@ func (s *TeamSettings) SetDefaults() {
 		s.ExperimentalEnableAutomaticReplies = NewBool(false)
 	}
 
-	if s.ExperimentalHideTownSquareinLHS == nil {
-		s.ExperimentalHideTownSquareinLHS = NewBool(false)
-	}
-
-	if s.ExperimentalTownSquareIsReadOnly == nil {
-		s.ExperimentalTownSquareIsReadOnly = NewBool(false)
-	}
-
 	if s.ExperimentalPrimaryTeam == nil {
 		s.ExperimentalPrimaryTeam = NewString("")
 	}
@@ -2100,10 +1962,6 @@ func (s *TeamSettings) SetDefaults() {
 		s.ExperimentalDefaultChannels = []string{}
 	}
 
-	if s.DEPRECATED_DO_NOT_USE_EnableTeamCreation == nil {
-		s.DEPRECATED_DO_NOT_USE_EnableTeamCreation = NewBool(true)
-	}
-
 	if s.EnableUserCreation == nil {
 		s.EnableUserCreation = NewBool(true)
 	}
@@ -3001,37 +2859,21 @@ type ImageProxySettings struct {
 	RemoteImageProxyOptions *string `access:"environment_image_proxy"`
 }
 
-func (s *ImageProxySettings) SetDefaults(ss ServiceSettings) {
+func (s *ImageProxySettings) SetDefaults() {
 	if s.Enable == nil {
-		if ss.DEPRECATED_DO_NOT_USE_ImageProxyType == nil || *ss.DEPRECATED_DO_NOT_USE_ImageProxyType == "" {
+		s.Enable = NewBool(false)
-			s.Enable = NewBool(false)
-		} else {
-			s.Enable = NewBool(true)
-		}
 	}
 
 	if s.ImageProxyType == nil {
-		if ss.DEPRECATED_DO_NOT_USE_ImageProxyType == nil || *ss.DEPRECATED_DO_NOT_USE_ImageProxyType == "" {
+		s.ImageProxyType = NewString(ImageProxyTypeLocal)
-			s.ImageProxyType = NewString(ImageProxyTypeLocal)
-		} else {
-			s.ImageProxyType = ss.DEPRECATED_DO_NOT_USE_ImageProxyType
-		}
 	}
 
 	if s.RemoteImageProxyURL == nil {
-		if ss.DEPRECATED_DO_NOT_USE_ImageProxyURL == nil {
+		s.RemoteImageProxyURL = NewString("")
-			s.RemoteImageProxyURL = NewString("")
-		} else {
-			s.RemoteImageProxyURL = ss.DEPRECATED_DO_NOT_USE_ImageProxyURL
-		}
 	}
 
 	if s.RemoteImageProxyOptions == nil {
-		if ss.DEPRECATED_DO_NOT_USE_ImageProxyOptions == nil {
+		s.RemoteImageProxyOptions = NewString("")
-			s.RemoteImageProxyOptions = NewString("")
-		} else {
-			s.RemoteImageProxyOptions = ss.DEPRECATED_DO_NOT_USE_ImageProxyOptions
-		}
 	}
 }
 
@@ -3282,7 +3124,7 @@ func (o *Config) SetDefaults() {
 	o.MessageExportSettings.SetDefaults()
 	o.DisplaySettings.SetDefaults()
 	o.GuestAccountsSettings.SetDefaults()
-	o.ImageProxySettings.SetDefaults(o.ServiceSettings)
+	o.ImageProxySettings.SetDefaults()
 	o.CloudSettings.SetDefaults()
 	if o.FeatureFlags == nil {
 		o.FeatureFlags = &FeatureFlags{}

model/config_test.go

@@ -814,49 +814,15 @@ func TestListenAddressIsValidated(t *testing.T) {
 }
 
 func TestImageProxySettingsSetDefaults(t *testing.T) {
-	ss := ServiceSettings{
+	t.Run("default settings", func(t *testing.T) {
-		DEPRECATED_DO_NOT_USE_ImageProxyType:    NewString(ImageProxyTypeAtmosCamo),
-		DEPRECATED_DO_NOT_USE_ImageProxyURL:     NewString("http://images.example.com"),
-		DEPRECATED_DO_NOT_USE_ImageProxyOptions: NewString("1234abcd"),
-	}
-
-	t.Run("default, no old settings", func(t *testing.T) {
 		ips := ImageProxySettings{}
-		ips.SetDefaults(ServiceSettings{})
+		ips.SetDefaults()
 
 		assert.Equal(t, false, *ips.Enable)
 		assert.Equal(t, ImageProxyTypeLocal, *ips.ImageProxyType)
 		assert.Equal(t, "", *ips.RemoteImageProxyURL)
 		assert.Equal(t, "", *ips.RemoteImageProxyOptions)
 	})
-
-	t.Run("default, old settings", func(t *testing.T) {
-		ips := ImageProxySettings{}
-		ips.SetDefaults(ss)
-
-		assert.Equal(t, true, *ips.Enable)
-		assert.Equal(t, *ss.DEPRECATED_DO_NOT_USE_ImageProxyType, *ips.ImageProxyType)
-		assert.Equal(t, *ss.DEPRECATED_DO_NOT_USE_ImageProxyURL, *ips.RemoteImageProxyURL)
-		assert.Equal(t, *ss.DEPRECATED_DO_NOT_USE_ImageProxyOptions, *ips.RemoteImageProxyOptions)
-	})
-
-	t.Run("not default, old settings", func(t *testing.T) {
-		url := "http://images.mattermost.com"
-		options := "aaaaaaaa"
-
-		ips := ImageProxySettings{
-			Enable:                  NewBool(false),
-			ImageProxyType:          NewString(ImageProxyTypeLocal),
-			RemoteImageProxyURL:     &url,
-			RemoteImageProxyOptions: &options,
-		}
-		ips.SetDefaults(ss)
-
-		assert.Equal(t, false, *ips.Enable)
-		assert.Equal(t, ImageProxyTypeLocal, *ips.ImageProxyType)
-		assert.Equal(t, url, *ips.RemoteImageProxyURL)
-		assert.Equal(t, options, *ips.RemoteImageProxyOptions)
-	})
 }
 
 func TestImageProxySettingsIsValid(t *testing.T) {

model/role.go

@@ -705,6 +705,13 @@ func MakeDefaultRoles() map[string]*Role {
 			PermissionCreatePost.Id,
 			PermissionUseChannelMentions.Id,
 			PermissionUseSlashCommands.Id,
+			PermissionManagePublicChannelProperties.Id,
+			PermissionDeletePublicChannel.Id,
+			PermissionManagePrivateChannelProperties.Id,
+			PermissionDeletePrivateChannel.Id,
+			PermissionManagePrivateChannelMembers.Id,
+			PermissionDeletePost.Id,
+			PermissionEditPost.Id,
 		},
 		SchemeManaged: true,
 		BuiltIn:       true,
@@ -742,6 +749,10 @@ func MakeDefaultRoles() map[string]*Role {
 			PermissionJoinPublicChannels.Id,
 			PermissionReadPublicChannel.Id,
 			PermissionViewTeam.Id,
+			PermissionCreatePublicChannel.Id,
+			PermissionCreatePrivateChannel.Id,
+			PermissionInviteUser.Id,
+			PermissionAddUserToTeam.Id,
 		},
 		SchemeManaged: true,
 		BuiltIn:       true,
@@ -789,6 +800,8 @@ func MakeDefaultRoles() map[string]*Role {
 			PermissionManageOutgoingWebhooks.Id,
 			PermissionConvertPublicChannelToPrivate.Id,
 			PermissionConvertPrivateChannelToPublic.Id,
+			PermissionDeletePost.Id,
+			PermissionDeleteOthersPosts.Id,
 		},
 		SchemeManaged: true,
 		BuiltIn:       true,
@@ -816,6 +829,7 @@ func MakeDefaultRoles() map[string]*Role {
 			PermissionCreateDirectChannel.Id,
 			PermissionCreateGroupChannel.Id,
 			PermissionViewMembers.Id,
+			PermissionCreateTeam.Id,
 		},
 		SchemeManaged: true,
 		BuiltIn:       true,

scripts/config_generator/main_test.go

@@ -25,7 +25,6 @@ func TestDefaultsGenerator(t *testing.T) {
 	b, err := ioutil.ReadFile(tmpFile.Name())
 	require.NoError(t, err)
 	require.NoError(t, json.Unmarshal(b, &config))
-	require.True(t, *config.ServiceSettings.DisableLegacyMFA)
 	require.Equal(t, *config.SqlSettings.AtRestEncryptKey, "")
 	require.Equal(t, *config.FileSettings.PublicLinkSalt, "")
 

services/telemetry/telemetry.go

@@ -366,7 +366,6 @@ func (ts *TelemetryService) trackConfig() {
 		"enable_incoming_webhooks":                                cfg.ServiceSettings.EnableIncomingWebhooks,
 		"enable_outgoing_webhooks":                                cfg.ServiceSettings.EnableOutgoingWebhooks,
 		"enable_commands":                                         *cfg.ServiceSettings.EnableCommands,
-		"enable_only_admin_integrations":                          *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_EnableOnlyAdminIntegrations,
 		"enable_post_username_override":                           cfg.ServiceSettings.EnablePostUsernameOverride,
 		"enable_post_icon_override":                               cfg.ServiceSettings.EnablePostIconOverride,
 		"enable_user_access_tokens":                               *cfg.ServiceSettings.EnableUserAccessTokens,
@@ -376,7 +375,6 @@ func (ts *TelemetryService) trackConfig() {
 		"gfycat_api_key":                                          isDefault(*cfg.ServiceSettings.GfycatAPIKey, model.ServiceSettingsDefaultGfycatAPIKey),
 		"gfycat_api_secret":                                       isDefault(*cfg.ServiceSettings.GfycatAPISecret, model.ServiceSettingsDefaultGfycatAPISecret),
 		"experimental_enable_authentication_transfer":             *cfg.ServiceSettings.ExperimentalEnableAuthenticationTransfer,
-		"restrict_custom_emoji_creation":                          *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictCustomEmojiCreation,
 		"enable_testing":                                          cfg.ServiceSettings.EnableTesting,
 		"enable_developer":                                        *cfg.ServiceSettings.EnableDeveloper,
 		"enable_multifactor_authentication":                       *cfg.ServiceSettings.EnableMultifactorAuthentication,
@@ -405,8 +403,6 @@ func (ts *TelemetryService) trackConfig() {
 		"cors_allow_credentials":                                  *cfg.ServiceSettings.CorsAllowCredentials,
 		"cors_debug":                                              *cfg.ServiceSettings.CorsDebug,
 		"isdefault_allowed_untrusted_internal_connections":        isDefault(*cfg.ServiceSettings.AllowedUntrustedInternalConnections, ""),
-		"restrict_post_delete":                                    *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictPostDelete,
-		"allow_edit_post":                                         *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost,
 		"post_edit_time_limit":                                    *cfg.ServiceSettings.PostEditTimeLimit,
 		"enable_user_typing_messages":                             *cfg.ServiceSettings.EnableUserTypingMessages,
 		"enable_channel_viewed_messages":                          *cfg.ServiceSettings.EnableChannelViewedMessages,
@@ -415,7 +411,6 @@ func (ts *TelemetryService) trackConfig() {
 		"enable_post_search":                                      *cfg.ServiceSettings.EnablePostSearch,
 		"minimum_hashtag_length":                                  *cfg.ServiceSettings.MinimumHashtagLength,
 		"enable_user_statuses":                                    *cfg.ServiceSettings.EnableUserStatuses,
-		"close_unused_direct_messages":                            *cfg.ServiceSettings.CloseUnusedDirectMessages,
 		"enable_preview_features":                                 *cfg.ServiceSettings.EnablePreviewFeatures,
 		"enable_tutorial":                                         *cfg.ServiceSettings.EnableTutorial,
 		"enable_onboarding_flow":                                  *cfg.ServiceSettings.EnableOnboardingFlow,
@@ -428,10 +423,8 @@ func (ts *TelemetryService) trackConfig() {
 		"enable_api_user_deletion":                                *cfg.ServiceSettings.EnableAPIUserDeletion,
 		"enable_api_channel_deletion":                             *cfg.ServiceSettings.EnableAPIChannelDeletion,
 		"experimental_enable_hardened_mode":                       *cfg.ServiceSettings.ExperimentalEnableHardenedMode,
-		"disable_legacy_mfa":                                      *cfg.ServiceSettings.DisableLegacyMFA,
 		"experimental_strict_csrf_enforcement":                    *cfg.ServiceSettings.ExperimentalStrictCSRFEnforcement,
 		"enable_email_invitations":                                *cfg.ServiceSettings.EnableEmailInvitations,
-		"experimental_channel_organization":                       *cfg.ServiceSettings.ExperimentalChannelOrganization,
 		"disable_bots_when_owner_is_deactivated":                  *cfg.ServiceSettings.DisableBotsWhenOwnerIsDeactivated,
 		"enable_bot_account_creation":                             *cfg.ServiceSettings.EnableBotAccountCreation,
 		"enable_svgs":                                             *cfg.ServiceSettings.EnableSVGs,
@@ -440,7 +433,6 @@ func (ts *TelemetryService) trackConfig() {
 		"enable_opentracing":                                      *cfg.ServiceSettings.EnableOpenTracing,
 		"enable_local_mode":                                       *cfg.ServiceSettings.EnableLocalMode,
 		"managed_resource_paths":                                  isDefault(*cfg.ServiceSettings.ManagedResourcePaths, ""),
-		"enable_legacy_sidebar":                                   *cfg.ServiceSettings.EnableLegacySidebar,
 		"thread_auto_follow":                                      *cfg.ServiceSettings.ThreadAutoFollow,
 		"enable_link_previews":                                    *cfg.ServiceSettings.EnableLinkPreviews,
 		"enable_permalink_previews":                               *cfg.ServiceSettings.EnablePermalinkPreviews,
@@ -449,38 +441,26 @@ func (ts *TelemetryService) trackConfig() {
 	})
 
 	ts.sendTelemetry(TrackConfigTeam, map[string]interface{}{
-		"enable_user_creation":                      cfg.TeamSettings.EnableUserCreation,
+		"enable_user_creation":                    cfg.TeamSettings.EnableUserCreation,
-		"enable_team_creation":                      *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_EnableTeamCreation,
+		"enable_open_server":                      *cfg.TeamSettings.EnableOpenServer,
-		"restrict_team_invite":                      *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictTeamInvite,
+		"enable_user_deactivation":                *cfg.TeamSettings.EnableUserDeactivation,
-		"restrict_public_channel_creation":          *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation,
+		"enable_custom_user_statuses":             *cfg.TeamSettings.EnableCustomUserStatuses,
-		"restrict_private_channel_creation":         *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation,
+		"enable_custom_brand":                     *cfg.TeamSettings.EnableCustomBrand,
-		"restrict_public_channel_management":        *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement,
+		"restrict_direct_message":                 *cfg.TeamSettings.RestrictDirectMessage,
-		"restrict_private_channel_management":       *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement,
+		"max_notifications_per_channel":           *cfg.TeamSettings.MaxNotificationsPerChannel,
-		"restrict_public_channel_deletion":          *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelDeletion,
+		"enable_confirm_notifications_to_channel": *cfg.TeamSettings.EnableConfirmNotificationsToChannel,
-		"restrict_private_channel_deletion":         *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelDeletion,
+		"max_users_per_team":                      *cfg.TeamSettings.MaxUsersPerTeam,
-		"enable_open_server":                        *cfg.TeamSettings.EnableOpenServer,
+		"max_channels_per_team":                   *cfg.TeamSettings.MaxChannelsPerTeam,
-		"enable_user_deactivation":                  *cfg.TeamSettings.EnableUserDeactivation,
+		"teammate_name_display":                   *cfg.TeamSettings.TeammateNameDisplay,
-		"enable_custom_user_statuses":               *cfg.TeamSettings.EnableCustomUserStatuses,
+		"experimental_view_archived_channels":     *cfg.TeamSettings.ExperimentalViewArchivedChannels,
-		"enable_custom_brand":                       *cfg.TeamSettings.EnableCustomBrand,
+		"lock_teammate_name_display":              *cfg.TeamSettings.LockTeammateNameDisplay,
-		"restrict_direct_message":                   *cfg.TeamSettings.RestrictDirectMessage,
+		"isdefault_site_name":                     isDefault(cfg.TeamSettings.SiteName, "Mattermost"),
-		"max_notifications_per_channel":             *cfg.TeamSettings.MaxNotificationsPerChannel,
+		"isdefault_custom_brand_text":             isDefault(*cfg.TeamSettings.CustomBrandText, model.TeamSettingsDefaultCustomBrandText),
-		"enable_confirm_notifications_to_channel":   *cfg.TeamSettings.EnableConfirmNotificationsToChannel,
+		"isdefault_custom_description_text":       isDefault(*cfg.TeamSettings.CustomDescriptionText, model.TeamSettingsDefaultCustomDescriptionText),
-		"max_users_per_team":                        *cfg.TeamSettings.MaxUsersPerTeam,
+		"isdefault_user_status_away_timeout":      isDefault(*cfg.TeamSettings.UserStatusAwayTimeout, model.TeamSettingsDefaultUserStatusAwayTimeout),
-		"max_channels_per_team":                     *cfg.TeamSettings.MaxChannelsPerTeam,
+		"experimental_enable_automatic_replies":   *cfg.TeamSettings.ExperimentalEnableAutomaticReplies,
-		"teammate_name_display":                     *cfg.TeamSettings.TeammateNameDisplay,
+		"experimental_primary_team":               isDefault(*cfg.TeamSettings.ExperimentalPrimaryTeam, ""),
-		"experimental_view_archived_channels":       *cfg.TeamSettings.ExperimentalViewArchivedChannels,
+		"experimental_default_channels":           len(cfg.TeamSettings.ExperimentalDefaultChannels),
-		"lock_teammate_name_display":                *cfg.TeamSettings.LockTeammateNameDisplay,
-		"isdefault_site_name":                       isDefault(cfg.TeamSettings.SiteName, "Mattermost"),
-		"isdefault_custom_brand_text":               isDefault(*cfg.TeamSettings.CustomBrandText, model.TeamSettingsDefaultCustomBrandText),
-		"isdefault_custom_description_text":         isDefault(*cfg.TeamSettings.CustomDescriptionText, model.TeamSettingsDefaultCustomDescriptionText),
-		"isdefault_user_status_away_timeout":        isDefault(*cfg.TeamSettings.UserStatusAwayTimeout, model.TeamSettingsDefaultUserStatusAwayTimeout),
-		"restrict_private_channel_manage_members":   *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManageMembers,
-		"enable_X_to_leave_channels_from_LHS":       *cfg.TeamSettings.EnableXToLeaveChannelsFromLHS,
-		"experimental_enable_automatic_replies":     *cfg.TeamSettings.ExperimentalEnableAutomaticReplies,
-		"experimental_town_square_is_hidden_in_lhs": *cfg.TeamSettings.ExperimentalHideTownSquareinLHS,
-		"experimental_town_square_is_read_only":     *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly,
-		"experimental_primary_team":                 isDefault(*cfg.TeamSettings.ExperimentalPrimaryTeam, ""),
-		"experimental_default_channels":             len(cfg.TeamSettings.ExperimentalDefaultChannels),
 	})
 
 	ts.sendTelemetry(TrackConfigClientReq, map[string]interface{}{

tests/test-config.json

@@ -19,7 +19,6 @@
         "EnableIncomingWebhooks": true,
         "EnableOutgoingWebhooks": true,
         "EnableCommands": true,
-        "EnableOnlyAdminIntegrations": true,
         "EnablePostUsernameOverride": false,
         "EnablePostIconOverride": false,
         "EnableLinkPreviews": false,
@@ -45,9 +44,6 @@
         "WebserverMode": "gzip",
         "EnableCustomEmoji": false,
         "EnableEmojiPicker": true,
-        "RestrictCustomEmojiCreation": "all",
-        "RestrictPostDelete": "all",
-        "AllowEditPost": "always",
         "PostEditTimeLimit": -1,
         "TimeBetweenUserTypingUpdatesMilliseconds": 5000,
         "EnablePostSearch": true,
@@ -57,22 +53,17 @@
         "EnableUserStatuses": true,
         "ExperimentalEnableAuthenticationTransfer": true,
         "ClusterLogTimeoutMilliseconds": 2000,
-        "CloseUnusedDirectMessages": false,
         "EnablePreviewFeatures": true,
         "EnableTutorial": true,
         "EnableOnboardingFlow": true,
         "ExperimentalEnableDefaultChannelLeaveJoinMessages": true,
         "ExperimentalGroupUnreadChannels": "disabled",
-        "ImageProxyType": "",
-        "ImageProxyURL": "",
-        "ImageProxyOptions": "",
         "EnableAPITeamDeletion": false,
-        "ExperimentalEnableHardenedMode": false,
+        "ExperimentalEnableHardenedMode": false
     },
     "TeamSettings": {
         "SiteName": "Mattermost",
         "MaxUsersPerTeam": 50,
-        "EnableTeamCreation": true,
         "EnableUserCreation": true,
         "EnableOpenServer": false,
         "EnableUserDeactivation": false,
@@ -81,23 +72,12 @@
         "CustomBrandText": "",
         "CustomDescriptionText": "",
         "RestrictDirectMessage": "any",
-        "RestrictTeamInvite": "all",
-        "RestrictPublicChannelManagement": "all",
-        "RestrictPrivateChannelManagement": "all",
-        "RestrictPublicChannelCreation": "all",
-        "RestrictPrivateChannelCreation": "all",
-        "RestrictPublicChannelDeletion": "all",
-        "RestrictPrivateChannelDeletion": "all",
-        "RestrictPrivateChannelManageMembers": "all",
-        "EnableXToLeaveChannelsFromLHS": false,
         "UserStatusAwayTimeout": 300,
         "MaxChannelsPerTeam": 2000,
         "MaxNotificationsPerChannel": 1000,
         "EnableConfirmNotificationsToChannel": true,
         "TeammateNameDisplay": "username",
         "ExperimentalEnableAutomaticReplies": false,
-        "ExperimentalHideTownSquareinLHS": false,
-        "ExperimentalTownSquareIsReadOnly": false,
         "ExperimentalPrimaryTeam": ""
     },
     "ClientRequirements": {

utils/authorization.go

@@ -1,295 +0,0 @@
-// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
-// See LICENSE.txt for license information.
-
-package utils
-
-import (
-	"github.com/mattermost/mattermost-server/v6/model"
-)
-
-func SetRolePermissionsFromConfig(roles map[string]*model.Role, cfg *model.Config, isLicensed bool) map[string]*model.Role {
-	if isLicensed {
-		switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation {
-		case model.PermissionsAll:
-			roles[model.TeamUserRoleId].Permissions = append(
-				roles[model.TeamUserRoleId].Permissions,
-				model.PermissionCreatePublicChannel.Id,
-			)
-		case model.PermissionsTeamAdmin:
-			roles[model.TeamAdminRoleId].Permissions = append(
-				roles[model.TeamAdminRoleId].Permissions,
-				model.PermissionCreatePublicChannel.Id,
-			)
-		}
-	} else {
-		roles[model.TeamUserRoleId].Permissions = append(
-			roles[model.TeamUserRoleId].Permissions,
-			model.PermissionCreatePublicChannel.Id,
-		)
-	}
-
-	if isLicensed {
-		switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement {
-		case model.PermissionsAll:
-			roles[model.ChannelUserRoleId].Permissions = append(
-				roles[model.ChannelUserRoleId].Permissions,
-				model.PermissionManagePublicChannelProperties.Id,
-			)
-		case model.PermissionsChannelAdmin:
-			roles[model.TeamAdminRoleId].Permissions = append(
-				roles[model.TeamAdminRoleId].Permissions,
-				model.PermissionManagePublicChannelProperties.Id,
-			)
-			roles[model.ChannelAdminRoleId].Permissions = append(
-				roles[model.ChannelAdminRoleId].Permissions,
-				model.PermissionManagePublicChannelProperties.Id,
-			)
-		case model.PermissionsTeamAdmin:
-			roles[model.TeamAdminRoleId].Permissions = append(
-				roles[model.TeamAdminRoleId].Permissions,
-				model.PermissionManagePublicChannelProperties.Id,
-			)
-		}
-	} else {
-		roles[model.ChannelUserRoleId].Permissions = append(
-			roles[model.ChannelUserRoleId].Permissions,
-			model.PermissionManagePublicChannelProperties.Id,
-		)
-	}
-
-	if isLicensed {
-		switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelDeletion {
-		case model.PermissionsAll:
-			roles[model.ChannelUserRoleId].Permissions = append(
-				roles[model.ChannelUserRoleId].Permissions,
-				model.PermissionDeletePublicChannel.Id,
-			)
-		case model.PermissionsChannelAdmin:
-			roles[model.TeamAdminRoleId].Permissions = append(
-				roles[model.TeamAdminRoleId].Permissions,
-				model.PermissionDeletePublicChannel.Id,
-			)
-			roles[model.ChannelAdminRoleId].Permissions = append(
-				roles[model.ChannelAdminRoleId].Permissions,
-				model.PermissionDeletePublicChannel.Id,
-			)
-		case model.PermissionsTeamAdmin:
-			roles[model.TeamAdminRoleId].Permissions = append(
-				roles[model.TeamAdminRoleId].Permissions,
-				model.PermissionDeletePublicChannel.Id,
-			)
-		}
-	} else {
-		roles[model.ChannelUserRoleId].Permissions = append(
-			roles[model.ChannelUserRoleId].Permissions,
-			model.PermissionDeletePublicChannel.Id,
-		)
-	}
-
-	if isLicensed {
-		switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation {
-		case model.PermissionsAll:
-			roles[model.TeamUserRoleId].Permissions = append(
-				roles[model.TeamUserRoleId].Permissions,
-				model.PermissionCreatePrivateChannel.Id,
-			)
-		case model.PermissionsTeamAdmin:
-			roles[model.TeamAdminRoleId].Permissions = append(
-				roles[model.TeamAdminRoleId].Permissions,
-				model.PermissionCreatePrivateChannel.Id,
-			)
-		}
-	} else {
-		roles[model.TeamUserRoleId].Permissions = append(
-			roles[model.TeamUserRoleId].Permissions,
-			model.PermissionCreatePrivateChannel.Id,
-		)
-	}
-
-	if isLicensed {
-		switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement {
-		case model.PermissionsAll:
-			roles[model.ChannelUserRoleId].Permissions = append(
-				roles[model.ChannelUserRoleId].Permissions,
-				model.PermissionManagePrivateChannelProperties.Id,
-			)
-		case model.PermissionsChannelAdmin:
-			roles[model.TeamAdminRoleId].Permissions = append(
-				roles[model.TeamAdminRoleId].Permissions,
-				model.PermissionManagePrivateChannelProperties.Id,
-			)
-			roles[model.ChannelAdminRoleId].Permissions = append(
-				roles[model.ChannelAdminRoleId].Permissions,
-				model.PermissionManagePrivateChannelProperties.Id,
-			)
-		case model.PermissionsTeamAdmin:
-			roles[model.TeamAdminRoleId].Permissions = append(
-				roles[model.TeamAdminRoleId].Permissions,
-				model.PermissionManagePrivateChannelProperties.Id,
-			)
-		}
-	} else {
-		roles[model.ChannelUserRoleId].Permissions = append(
-			roles[model.ChannelUserRoleId].Permissions,
-			model.PermissionManagePrivateChannelProperties.Id,
-		)
-	}
-
-	if isLicensed {
-		switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelDeletion {
-		case model.PermissionsAll:
-			roles[model.ChannelUserRoleId].Permissions = append(
-				roles[model.ChannelUserRoleId].Permissions,
-				model.PermissionDeletePrivateChannel.Id,
-			)
-		case model.PermissionsChannelAdmin:
-			roles[model.TeamAdminRoleId].Permissions = append(
-				roles[model.TeamAdminRoleId].Permissions,
-				model.PermissionDeletePrivateChannel.Id,
-			)
-			roles[model.ChannelAdminRoleId].Permissions = append(
-				roles[model.ChannelAdminRoleId].Permissions,
-				model.PermissionDeletePrivateChannel.Id,
-			)
-		case model.PermissionsTeamAdmin:
-			roles[model.TeamAdminRoleId].Permissions = append(
-				roles[model.TeamAdminRoleId].Permissions,
-				model.PermissionDeletePrivateChannel.Id,
-			)
-		}
-	} else {
-		roles[model.ChannelUserRoleId].Permissions = append(
-			roles[model.ChannelUserRoleId].Permissions,
-			model.PermissionDeletePrivateChannel.Id,
-		)
-	}
-
-	// Restrict permissions for Private Channel Manage Members
-	if isLicensed {
-		switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManageMembers {
-		case model.PermissionsAll:
-			roles[model.ChannelUserRoleId].Permissions = append(
-				roles[model.ChannelUserRoleId].Permissions,
-				model.PermissionManagePrivateChannelMembers.Id,
-			)
-		case model.PermissionsChannelAdmin:
-			roles[model.TeamAdminRoleId].Permissions = append(
-				roles[model.TeamAdminRoleId].Permissions,
-				model.PermissionManagePrivateChannelMembers.Id,
-			)
-			roles[model.ChannelAdminRoleId].Permissions = append(
-				roles[model.ChannelAdminRoleId].Permissions,
-				model.PermissionManagePrivateChannelMembers.Id,
-			)
-		case model.PermissionsTeamAdmin:
-			roles[model.TeamAdminRoleId].Permissions = append(
-				roles[model.TeamAdminRoleId].Permissions,
-				model.PermissionManagePrivateChannelMembers.Id,
-			)
-		}
-	} else {
-		roles[model.ChannelUserRoleId].Permissions = append(
-			roles[model.ChannelUserRoleId].Permissions,
-			model.PermissionManagePrivateChannelMembers.Id,
-		)
-	}
-
-	if !*cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_EnableOnlyAdminIntegrations {
-		roles[model.TeamUserRoleId].Permissions = append(
-			roles[model.TeamUserRoleId].Permissions,
-			model.PermissionManageIncomingWebhooks.Id,
-			model.PermissionManageOutgoingWebhooks.Id,
-			model.PermissionManageSlashCommands.Id,
-		)
-		roles[model.SystemUserRoleId].Permissions = append(
-			roles[model.SystemUserRoleId].Permissions,
-			model.PermissionManageOAuth.Id,
-		)
-	}
-
-	// Grant permissions for inviting and adding users to a team.
-	if isLicensed {
-		if *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictTeamInvite == model.PermissionsTeamAdmin {
-			roles[model.TeamAdminRoleId].Permissions = append(
-				roles[model.TeamAdminRoleId].Permissions,
-				model.PermissionInviteUser.Id,
-				model.PermissionAddUserToTeam.Id,
-			)
-		} else if *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictTeamInvite == model.PermissionsAll {
-			roles[model.TeamUserRoleId].Permissions = append(
-				roles[model.TeamUserRoleId].Permissions,
-				model.PermissionInviteUser.Id,
-				model.PermissionAddUserToTeam.Id,
-			)
-		}
-	} else {
-		roles[model.TeamUserRoleId].Permissions = append(
-			roles[model.TeamUserRoleId].Permissions,
-			model.PermissionInviteUser.Id,
-			model.PermissionAddUserToTeam.Id,
-		)
-	}
-
-	if isLicensed {
-		switch *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictPostDelete {
-		case model.PermissionsDeletePostAll:
-			roles[model.ChannelUserRoleId].Permissions = append(
-				roles[model.ChannelUserRoleId].Permissions,
-				model.PermissionDeletePost.Id,
-			)
-			roles[model.TeamAdminRoleId].Permissions = append(
-				roles[model.TeamAdminRoleId].Permissions,
-				model.PermissionDeletePost.Id,
-				model.PermissionDeleteOthersPosts.Id,
-			)
-		case model.PermissionsDeletePostTeamAdmin:
-			roles[model.TeamAdminRoleId].Permissions = append(
-				roles[model.TeamAdminRoleId].Permissions,
-				model.PermissionDeletePost.Id,
-				model.PermissionDeleteOthersPosts.Id,
-			)
-		}
-	} else {
-		roles[model.ChannelUserRoleId].Permissions = append(
-			roles[model.ChannelUserRoleId].Permissions,
-			model.PermissionDeletePost.Id,
-		)
-		roles[model.TeamAdminRoleId].Permissions = append(
-			roles[model.TeamAdminRoleId].Permissions,
-			model.PermissionDeletePost.Id,
-			model.PermissionDeleteOthersPosts.Id,
-		)
-	}
-
-	if *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_EnableTeamCreation {
-		roles[model.SystemUserRoleId].Permissions = append(
-			roles[model.SystemUserRoleId].Permissions,
-			model.PermissionCreateTeam.Id,
-		)
-	}
-
-	if isLicensed {
-		switch *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost {
-		case model.AllowEditPostAlways, model.AllowEditPostTimeLimit:
-			roles[model.ChannelUserRoleId].Permissions = append(
-				roles[model.ChannelUserRoleId].Permissions,
-				model.PermissionEditPost.Id,
-			)
-			roles[model.SystemAdminRoleId].Permissions = append(
-				roles[model.SystemAdminRoleId].Permissions,
-				model.PermissionEditPost.Id,
-			)
-		}
-	} else {
-		roles[model.ChannelUserRoleId].Permissions = append(
-			roles[model.ChannelUserRoleId].Permissions,
-			model.PermissionEditPost.Id,
-		)
-		roles[model.SystemAdminRoleId].Permissions = append(
-			roles[model.SystemAdminRoleId].Permissions,
-			model.PermissionEditPost.Id,
-		)
-	}
-
-	return roles
-}

utils/authorization_test.go

@@ -1,133 +0,0 @@
-// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
-// See LICENSE.txt for license information.
-
-package utils
-
-import (
-	"encoding/json"
-	"fmt"
-	"io/ioutil"
-	"reflect"
-	"strconv"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/mattermost/mattermost-server/v6/model"
-)
-
-type RoleState struct {
-	RoleName   string `json:"roleName"`
-	Permission string `json:"permission"`
-	ShouldHave bool   `json:"shouldHave"`
-}
-
-func mockConfig() *model.Config {
-	config := model.Config{}
-	config.SetDefaults()
-	return &config
-}
-
-func mapping() (map[string]map[string][]RoleState, error) {
-
-	policiesRolesMapping := make(map[string]map[string][]RoleState)
-
-	raw, err := ioutil.ReadFile("./policies-roles-mapping.json")
-	if err != nil {
-		return policiesRolesMapping, err
-	}
-
-	var f map[string]interface{}
-	err = json.Unmarshal(raw, &f)
-	if err != nil {
-		return policiesRolesMapping, err
-	}
-
-	for policyName, value := range f {
-
-		capitalizedName := fmt.Sprintf("%v%v", strings.ToUpper(policyName[:1]), policyName[1:])
-		policiesRolesMapping[capitalizedName] = make(map[string][]RoleState)
-
-		for policyValue, roleStatesMappings := range value.(map[string]interface{}) {
-
-			var roleStates []RoleState
-			for _, roleStateMapping := range roleStatesMappings.([]interface{}) {
-
-				roleStateMappingJSON, _ := json.Marshal(roleStateMapping)
-				var roleState RoleState
-				_ = json.Unmarshal(roleStateMappingJSON, &roleState)
-
-				roleStates = append(roleStates, roleState)
-
-			}
-
-			policiesRolesMapping[capitalizedName][policyValue] = roleStates
-
-		}
-
-	}
-
-	return policiesRolesMapping, nil
-}
-
-func TestSetRolePermissionsFromConfig(t *testing.T) {
-
-	mapping, err := mapping()
-	if err != nil {
-		require.NoError(t, err)
-	}
-
-	for policyName, v := range mapping {
-		for policyValue, rolesMappings := range v {
-
-			config := mockConfig()
-			updateConfig(config, "DEPRECATED_DO_NOT_USE_"+policyName, policyValue)
-			roles := model.MakeDefaultRoles()
-			SetRolePermissionsFromConfig(roles, config, true)
-
-			for _, roleMappingItem := range rolesMappings {
-				role := roles[roleMappingItem.RoleName]
-
-				permission := roleMappingItem.Permission
-				hasPermission := roleHasPermission(role, permission)
-
-				if (roleMappingItem.ShouldHave && !hasPermission) || (!roleMappingItem.ShouldHave && hasPermission) {
-					wording := "not to"
-					if roleMappingItem.ShouldHave {
-						wording = "to"
-					}
-					t.Errorf("Expected '%v' %v have '%v' permission when '%v' is set to '%v'.", role.Name, wording, permission, policyName, policyValue)
-				}
-
-			}
-
-		}
-	}
-}
-
-func updateConfig(config *model.Config, key string, value string) {
-	v := reflect.ValueOf(config.ServiceSettings)
-	field := v.FieldByName(key)
-	if !field.IsValid() {
-		v = reflect.ValueOf(config.TeamSettings)
-		field = v.FieldByName(key)
-	}
-
-	switch value {
-	case "true", "false":
-		b, _ := strconv.ParseBool(value)
-		field.Elem().SetBool(b)
-	default:
-		field.Elem().SetString(value)
-	}
-}
-
-func roleHasPermission(role *model.Role, permission string) bool {
-	for _, p := range role.Permissions {
-		if p == permission {
-			return true
-		}
-	}
-	return false
-}

web/webhook_test.go

@@ -129,32 +129,6 @@ func TestIncomingWebhook(t *testing.T) {
 		assert.Equal(t, http.StatusOK, resp.StatusCode)
 	})
 
-	t.Run("WebhookExperimentalReadOnly", func(t *testing.T) {
-		th.App.Srv().SetLicense(model.NewTestLicense())
-		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = true })
-
-		// Read only default channel should fail.
-		resp, err := http.Post(url, "application/json", strings.NewReader(fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", model.DefaultChannelName)))
-		require.NoError(t, err)
-		assert.True(t, resp.StatusCode != http.StatusOK)
-
-		// None-default channel should still work.
-		resp, err = http.Post(url, "application/json", strings.NewReader(fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", th.BasicChannel.Name)))
-		require.NoError(t, err)
-		assert.True(t, resp.StatusCode == http.StatusOK)
-
-		// System-Admin Owned Hook
-		adminHook, appErr := th.App.CreateIncomingWebhookForChannel(th.SystemAdminUser.Id, th.BasicChannel, &model.IncomingWebhook{ChannelId: th.BasicChannel.Id})
-		require.Nil(t, appErr)
-		adminURL := apiClient.URL + "/hooks/" + adminHook.Id
-
-		resp, err = http.Post(adminURL, "application/json", strings.NewReader(fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", model.DefaultChannelName)))
-		require.NoError(t, err)
-		assert.Equal(t, http.StatusOK, resp.StatusCode)
-
-		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = false })
-	})
-
 	t.Run("WebhookAttachments", func(t *testing.T) {
 		attachmentPayload := `{
 	       "text": "this is a test",