MM-22212 & MM-22208: Read from the higher-scoped scheme if the permission is non-moderated. (#13813)
* MM-22212: Read non-moderated permissions from higher-scoped scheme. * MM-2212: Corrects test count in comment. * MM-22212: Adds godoc comment. * MM-2212: Switches to the channel roles check in a few more places. * MM-22212: Refactors and fixes. * MM-22212: Reverts change, no longer required. * MM-22212: Removes translation. * MM-22212: Un-comments merged new permission. * MM-22212: Un-comments merged new permission. * MM-22212: Performance tweak. * MM-22212: Fixes some fmting. * MM-22212: Add unit test for newly-added store methods. * MM-22212: Renames app method. * MM-22212: Re-uses existing function to find string in slice. * MM-22212: Keeps 'higher-scoped' terminology for consistency. * MM-22212: Refactors based on PR feedback. * MM-22212: Fix for some bad merging. * MM-22212: Renamed some things. * MM-22212: Use an 'else' instead of a 'continue' for readability. * MM-22212: Caches (*SqlRoleStore).ChannelRolesUnderTeamRole. * MM-22212: Adds mock to new cache store. * MM-22212: Adds missing open tracing app layer methods. * MM-22212: Adds migration to add moderated permissions to channel_admin if present on channel_user. * MM-22212: Migrates team schemes. Removes unused AppError. * MM-22212: Fix for for if. * MM-22212: Fixes iterator. * MM-22212: Updates open tracing generated methods. * MM-22212: Fix mocks. * MM-22212: Change migration key name. * MM-22212: Switched to data structure from other branch. * MM-22212: Fixes tests after adding 'use_channel_mentions' to the channel_admin role. * MM-22212: Adds tracking of channel moderation. * Revert "MM-22212: Adds tracking of channel moderation." This reverts commit 23689efa22c112e4ba37f6a212535dd7ebfb63db. * MM-22212: Switch some functions to methods and vice versa. * MM-22212: Fix for refactor bug not notifiying websocket about changed role. * MM-22212: Adds test for public/private 'manage_members' handling. * MM-22122 Fix manage channel members edge case for public and private channels (#14049) * MM-22212: Adds moderated permission to team_admin. * MM-22212: Updates migration. * MM-22212: Revert unnecessary update to default roles. * Add channel scheme updated event when channel scheme is deleted or created (#14057) * MM-22212: Adds newline. * MM-22212: Migration fix. * MM-22212: Fix for migration. * MM-22212: Test fix. Co-authored-by: Farhan Munshi <3207297+fm2munsh@users.noreply.github.com>
Этот коммит содержится в:
Martin Kraft
коммит произвёл
GitHub
GitHub
родитель
ace46443b3
Коммит
4d99aa22ba
217
app/role_test.go
Обычный файл
217
app/role_test.go
Обычный файл
@@ -0,0 +1,217 @@
|
||||
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
|
||||
// See LICENSE.txt for license information.
|
||||
|
||||
package app
|
||||
|
||||
import (
|
||||
"encoding/csv"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
"strconv"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/mattermost/mattermost-server/v5/model"
|
||||
"github.com/mattermost/mattermost-server/v5/utils"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
type permissionInheritanceTestData struct {
|
||||
channelRole *model.Role
|
||||
permission *model.Permission
|
||||
shouldHavePermission bool
|
||||
channel *model.Channel
|
||||
higherScopedRole *model.Role
|
||||
truthTableRow []string
|
||||
}
|
||||
|
||||
func TestGetRolesByNames(t *testing.T) {
|
||||
testPermissionInheritance(t, func(t *testing.T, th *TestHelper, testData permissionInheritanceTestData) {
|
||||
actualRoles, err := th.App.GetRolesByNames([]string{testData.channelRole.Name})
|
||||
require.Nil(t, err)
|
||||
require.Len(t, actualRoles, 1)
|
||||
|
||||
actualRole := actualRoles[0]
|
||||
require.NotNil(t, actualRole)
|
||||
require.Equal(t, testData.channelRole.Name, actualRole.Name)
|
||||
|
||||
require.Equal(t, testData.shouldHavePermission, utils.StringInSlice(testData.permission.Id, actualRole.Permissions))
|
||||
})
|
||||
}
|
||||
|
||||
func TestGetRoleByName(t *testing.T) {
|
||||
testPermissionInheritance(t, func(t *testing.T, th *TestHelper, testData permissionInheritanceTestData) {
|
||||
actualRole, err := th.App.GetRoleByName(testData.channelRole.Name)
|
||||
require.Nil(t, err)
|
||||
require.NotNil(t, actualRole)
|
||||
require.Equal(t, testData.channelRole.Name, actualRole.Name)
|
||||
require.Equal(t, testData.shouldHavePermission, utils.StringInSlice(testData.permission.Id, actualRole.Permissions), "row: %+v", testData.truthTableRow)
|
||||
})
|
||||
}
|
||||
|
||||
// testPermissionInheritance tests 48 combinations of scheme, permission, role data.
|
||||
func testPermissionInheritance(t *testing.T, testCallback func(t *testing.T, th *TestHelper, testData permissionInheritanceTestData)) {
|
||||
th := Setup(t).InitBasic()
|
||||
defer th.TearDown()
|
||||
|
||||
th.App.SetLicense(model.NewTestLicense(""))
|
||||
th.App.SetPhase2PermissionsMigrationStatus(true)
|
||||
|
||||
permissionsDefault := []string{
|
||||
model.PERMISSION_MANAGE_CHANNEL_ROLES.Id,
|
||||
model.PERMISSION_MANAGE_PUBLIC_CHANNEL_MEMBERS.Id,
|
||||
}
|
||||
|
||||
// Defer resetting the system scheme permissions
|
||||
systemSchemeRoles, err := th.App.GetRolesByNames([]string{
|
||||
model.CHANNEL_GUEST_ROLE_ID,
|
||||
model.CHANNEL_USER_ROLE_ID,
|
||||
model.CHANNEL_ADMIN_ROLE_ID,
|
||||
})
|
||||
require.Nil(t, err)
|
||||
require.Len(t, systemSchemeRoles, 3)
|
||||
|
||||
// defer resetting the system role permissions
|
||||
for _, systemRole := range systemSchemeRoles {
|
||||
defer th.App.PatchRole(systemRole, &model.RolePatch{
|
||||
Permissions: &systemRole.Permissions,
|
||||
})
|
||||
}
|
||||
|
||||
// Make a channel scheme, clear its permissions
|
||||
channelScheme, err := th.App.CreateScheme(&model.Scheme{
|
||||
Name: model.NewId(),
|
||||
DisplayName: model.NewId(),
|
||||
Scope: model.SCHEME_SCOPE_CHANNEL,
|
||||
})
|
||||
require.Nil(t, err)
|
||||
defer th.App.DeleteScheme(channelScheme.Id)
|
||||
|
||||
team := th.CreateTeam()
|
||||
defer th.App.PermanentDeleteTeamId(team.Id)
|
||||
|
||||
// Make a channel
|
||||
channel := th.CreateChannel(team)
|
||||
defer th.App.PermanentDeleteChannel(channel)
|
||||
|
||||
// Set the channel scheme
|
||||
channel.SchemeId = &channelScheme.Id
|
||||
channel, err = th.App.UpdateChannelScheme(channel)
|
||||
require.Nil(t, err)
|
||||
|
||||
// Get the truth table from CSV
|
||||
file, e := os.Open("tests/channel-role-has-permission.csv")
|
||||
require.Nil(t, e)
|
||||
defer file.Close()
|
||||
|
||||
b, e := ioutil.ReadAll(file)
|
||||
require.Nil(t, e)
|
||||
|
||||
r := csv.NewReader(strings.NewReader(string(b)))
|
||||
records, e := r.ReadAll()
|
||||
require.Nil(t, e)
|
||||
|
||||
test := func(higherScopedGuest, higherScopedUser, higherScopedAdmin string) {
|
||||
for _, roleNameUnderTest := range []string{higherScopedGuest, higherScopedUser, higherScopedAdmin} {
|
||||
for i, row := range records {
|
||||
// skip csv header
|
||||
if i == 0 {
|
||||
continue
|
||||
}
|
||||
|
||||
higherSchemeHasPermission, e := strconv.ParseBool(row[0])
|
||||
require.Nil(t, e)
|
||||
|
||||
permissionIsModerated, e := strconv.ParseBool(row[1])
|
||||
require.Nil(t, e)
|
||||
|
||||
channelSchemeHasPermission, e := strconv.ParseBool(row[2])
|
||||
require.Nil(t, e)
|
||||
|
||||
channelRoleIsChannelAdmin, e := strconv.ParseBool(row[3])
|
||||
require.Nil(t, e)
|
||||
|
||||
shouldHavePermission, e := strconv.ParseBool(row[4])
|
||||
require.Nil(t, e)
|
||||
|
||||
// skip some invalid combinations because of the outer loop iterating all 3 channel roles
|
||||
if (channelRoleIsChannelAdmin && roleNameUnderTest != higherScopedAdmin) || (!channelRoleIsChannelAdmin && roleNameUnderTest == higherScopedAdmin) {
|
||||
continue
|
||||
}
|
||||
|
||||
// select the permission to test (moderated or non-moderated)
|
||||
var permission *model.Permission
|
||||
if permissionIsModerated {
|
||||
permission = model.PERMISSION_CREATE_POST // moderated
|
||||
} else {
|
||||
permission = model.PERMISSION_READ_CHANNEL // non-moderated
|
||||
}
|
||||
|
||||
// add or remove the permission from the higher-scoped scheme
|
||||
higherScopedRole, testErr := th.App.GetRoleByName(roleNameUnderTest)
|
||||
require.Nil(t, testErr)
|
||||
|
||||
var higherScopedPermissions []string
|
||||
if higherSchemeHasPermission {
|
||||
higherScopedPermissions = []string{permission.Id}
|
||||
} else {
|
||||
higherScopedPermissions = permissionsDefault
|
||||
}
|
||||
higherScopedRole, testErr = th.App.PatchRole(higherScopedRole, &model.RolePatch{Permissions: &higherScopedPermissions})
|
||||
require.Nil(t, testErr)
|
||||
|
||||
// get channel role
|
||||
var channelRoleName string
|
||||
switch roleNameUnderTest {
|
||||
case higherScopedGuest:
|
||||
channelRoleName = channelScheme.DefaultChannelGuestRole
|
||||
case higherScopedUser:
|
||||
channelRoleName = channelScheme.DefaultChannelUserRole
|
||||
case higherScopedAdmin:
|
||||
channelRoleName = channelScheme.DefaultChannelAdminRole
|
||||
}
|
||||
channelRole, testErr := th.App.GetRoleByName(channelRoleName)
|
||||
require.Nil(t, testErr)
|
||||
|
||||
// add or remove the permission from the channel scheme
|
||||
var channelSchemePermissions []string
|
||||
if channelSchemeHasPermission {
|
||||
channelSchemePermissions = []string{permission.Id}
|
||||
} else {
|
||||
channelSchemePermissions = permissionsDefault
|
||||
}
|
||||
channelRole, testErr = th.App.PatchRole(channelRole, &model.RolePatch{Permissions: &channelSchemePermissions})
|
||||
require.Nil(t, testErr)
|
||||
|
||||
testCallback(t, th, permissionInheritanceTestData{
|
||||
channelRole: channelRole,
|
||||
permission: permission,
|
||||
shouldHavePermission: shouldHavePermission,
|
||||
channel: channel,
|
||||
higherScopedRole: higherScopedRole,
|
||||
truthTableRow: row,
|
||||
})
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// test 24 combinations where the higher-scoped scheme is the SYSTEM scheme
|
||||
test(model.CHANNEL_GUEST_ROLE_ID, model.CHANNEL_USER_ROLE_ID, model.CHANNEL_ADMIN_ROLE_ID)
|
||||
|
||||
// create a team scheme
|
||||
teamScheme, err := th.App.CreateScheme(&model.Scheme{
|
||||
Name: model.NewId(),
|
||||
DisplayName: model.NewId(),
|
||||
Scope: model.SCHEME_SCOPE_TEAM,
|
||||
})
|
||||
require.Nil(t, err)
|
||||
defer th.App.DeleteScheme(teamScheme.Id)
|
||||
|
||||
// assign the scheme to the team
|
||||
team.SchemeId = &teamScheme.Id
|
||||
team, err = th.App.UpdateTeamScheme(team)
|
||||
require.Nil(t, err)
|
||||
|
||||
// test 24 combinations where the higher-scoped scheme is a TEAM scheme
|
||||
test(teamScheme.DefaultChannelGuestRole, teamScheme.DefaultChannelUserRole, teamScheme.DefaultChannelAdminRole)
|
||||
}
|
||||
Ссылка в новой задаче
Block a user