[MM-28000] Fix system manager can download export files without right permissions (#16569)

Automatic Merge

model/migration.go

@@ -25,4 +25,5 @@ const (
 	MIGRATION_KEY_ADD_BILLING_PERMISSIONS                     = "add_billing_permissions"
 	MIGRATION_KEY_ADD_MANAGE_SHARED_CHANNEL_PERMISSIONS       = "manage_shared_channel_permissions"
 	MIGRATION_KEY_ADD_MANAGE_REMOTE_CLUSTERS_PERMISSIONS      = "manage_remote_clusters_permissions"
+	MIGRATION_KEY_ADD_DOWNLOAD_COMPLIANCE_EXPORT_RESULTS      = "download_compliance_export_results"
 )

model/permission.go

@@ -101,6 +101,7 @@ var PERMISSION_READ_OTHER_USERS_TEAMS *Permission
 var PERMISSION_EDIT_BRAND *Permission
 var PERMISSION_MANAGE_SHARED_CHANNELS *Permission
 var PERMISSION_MANAGE_REMOTE_CLUSTERS *Permission
+var PERMISSION_DOWNLOAD_COMPLIANCE_EXPORT_RESULT *Permission
 
 var PERMISSION_SYSCONSOLE_READ_ABOUT *Permission
 var PERMISSION_SYSCONSOLE_WRITE_ABOUT *Permission
@@ -536,6 +537,14 @@ func initializePermissions() {
 		"authentication.permissions.manage_remote_clusters.description",
 		PermissionScopeSystem,
 	}
+
+	PERMISSION_DOWNLOAD_COMPLIANCE_EXPORT_RESULT = &Permission{
+		"download_compliance_export_result",
+		"authentication.permissions.download_compliance_export_result.name",
+		"authentication.permissions.download_compliance_export_result.description",
+		PermissionScopeSystem,
+	}
+
 	PERMISSION_REMOVE_USER_FROM_TEAM = &Permission{
 		"remove_user_from_team",
 		"authentication.permissions.remove_user_from_team.name",
@@ -962,6 +971,7 @@ func initializePermissions() {
 		PERMISSION_EDIT_BRAND,
 		PERMISSION_MANAGE_SHARED_CHANNELS,
 		PERMISSION_MANAGE_REMOTE_CLUSTERS,
+		PERMISSION_DOWNLOAD_COMPLIANCE_EXPORT_RESULT,
 	}
 
 	TeamScopedPermissions := []*Permission{

model/role.go

@@ -61,6 +61,13 @@ func init() {
 			PERMISSION_LIST_PUBLIC_TEAMS,
 			PERMISSION_VIEW_TEAM,
 		},
+		PERMISSION_SYSCONSOLE_WRITE_COMPLIANCE.Id: {
+			PERMISSION_MANAGE_JOBS,
+		},
+		PERMISSION_SYSCONSOLE_READ_COMPLIANCE.Id: {
+			PERMISSION_READ_JOBS,
+			PERMISSION_DOWNLOAD_COMPLIANCE_EXPORT_RESULT,
+		},
 		PERMISSION_SYSCONSOLE_READ_ENVIRONMENT.Id: {
 			PERMISSION_READ_JOBS,
 		},