MM-22212 & MM-22208: Read from the higher-scoped scheme if the permission is non-moderated. (#13813)

* MM-22212: Read non-moderated permissions from higher-scoped scheme. * MM-2212: Corrects test count in comment. * MM-22212: Adds godoc comment. * MM-2212: Switches to the channel roles check in a few more places. * MM-22212: Refactors and fixes. * MM-22212: Reverts change, no longer required. * MM-22212: Removes translation. * MM-22212: Un-comments merged new permission. * MM-22212: Un-comments merged new permission. * MM-22212: Performance tweak. * MM-22212: Fixes some fmting. * MM-22212: Add unit test for newly-added store methods. * MM-22212: Renames app method. * MM-22212: Re-uses existing function to find string in slice. * MM-22212: Keeps 'higher-scoped' terminology for consistency. * MM-22212: Refactors based on PR feedback. * MM-22212: Fix for some bad merging. * MM-22212: Renamed some things. * MM-22212: Use an 'else' instead of a 'continue' for readability. * MM-22212: Caches (*SqlRoleStore).ChannelRolesUnderTeamRole. * MM-22212: Adds mock to new cache store. * MM-22212: Adds missing open tracing app layer methods. * MM-22212: Adds migration to add moderated permissions to channel_admin if present on channel_user. * MM-22212: Migrates team schemes. Removes unused AppError. * MM-22212: Fix for for if. * MM-22212: Fixes iterator. * MM-22212: Updates open tracing generated methods. * MM-22212: Fix mocks. * MM-22212: Change migration key name. * MM-22212: Switched to data structure from other branch. * MM-22212: Fixes tests after adding 'use_channel_mentions' to the channel_admin role. * MM-22212: Adds tracking of channel moderation. * Revert "MM-22212: Adds tracking of channel moderation." This reverts commit 23689efa22c112e4ba37f6a212535dd7ebfb63db. * MM-22212: Switch some functions to methods and vice versa. * MM-22212: Fix for refactor bug not notifiying websocket about changed role. * MM-22212: Adds test for public/private 'manage_members' handling. * MM-22122 Fix manage channel members edge case for public and private channels (#14049) * MM-22212: Adds moderated permission to team_admin. * MM-22212: Updates migration. * MM-22212: Revert unnecessary update to default roles. * Add channel scheme updated event when channel scheme is deleted or created (#14057) * MM-22212: Adds newline. * MM-22212: Migration fix. * MM-22212: Fix for migration. * MM-22212: Test fix. Co-authored-by: Farhan Munshi <3207297+fm2munsh@users.noreply.github.com>
2020-03-23 13:44:20 -04:00
--- a/store/localcachelayer/layer.go
+++ b/store/localcachelayer/layer.go
@@ -71,8 +71,9 @@ type LocalCacheStore struct {
 	fileInfo      LocalCacheFileInfoStore
 	fileInfoCache cache.Cache

-	role      LocalCacheRoleStore
-	roleCache cache.Cache
+	role                 LocalCacheRoleStore
+	roleCache            cache.Cache
+	rolePermissionsCache cache.Cache

 	scheme      LocalCacheSchemeStore
 	schemeCache cache.Cache
@@ -118,6 +119,7 @@ func NewLocalCacheLayer(baseStore store.Store, metrics einterfaces.MetricsInterf

 	// Roles
 	localCacheStore.roleCache = cacheProvider.NewCacheWithParams(ROLE_CACHE_SIZE, "Role", ROLE_CACHE_SEC, model.CLUSTER_EVENT_INVALIDATE_CACHE_FOR_ROLES)
+	localCacheStore.rolePermissionsCache = cacheProvider.NewCacheWithParams(ROLE_CACHE_SIZE, "RolePermission", ROLE_CACHE_SEC, model.CLUSTER_EVENT_INVALIDATE_CACHE_FOR_ROLE_PERMISSIONS)
 	localCacheStore.role = LocalCacheRoleStore{RoleStore: baseStore.Role(), rootStore: &localCacheStore}

 	// Schemes
@@ -165,6 +167,7 @@ func NewLocalCacheLayer(baseStore store.Store, metrics einterfaces.MetricsInterf
 	if cluster != nil {
 		cluster.RegisterClusterMessageHandler(model.CLUSTER_EVENT_INVALIDATE_CACHE_FOR_REACTIONS, localCacheStore.reaction.handleClusterInvalidateReaction)
 		cluster.RegisterClusterMessageHandler(model.CLUSTER_EVENT_INVALIDATE_CACHE_FOR_ROLES, localCacheStore.role.handleClusterInvalidateRole)
+		cluster.RegisterClusterMessageHandler(model.CLUSTER_EVENT_INVALIDATE_CACHE_FOR_ROLE_PERMISSIONS, localCacheStore.role.handleClusterInvalidateRolePermissions)
 		cluster.RegisterClusterMessageHandler(model.CLUSTER_EVENT_INVALIDATE_CACHE_FOR_SCHEMES, localCacheStore.scheme.handleClusterInvalidateScheme)
 		cluster.RegisterClusterMessageHandler(model.CLUSTER_EVENT_INVALIDATE_CACHE_FOR_FILE_INFOS, localCacheStore.fileInfo.handleClusterInvalidateFileInfo)
 		cluster.RegisterClusterMessageHandler(model.CLUSTER_EVENT_INVALIDATE_CACHE_FOR_LAST_POST_TIME, localCacheStore.post.handleClusterInvalidateLastPostTime)
@@ -294,4 +297,6 @@ func (s *LocalCacheStore) Invalidate() {
 	s.doClearCacheCluster(s.userProfileByIdsCache)
 	s.doClearCacheCluster(s.profilesInChannelCache)
 	s.doClearCacheCluster(s.teamAllTeamIdsForUserCache)
+	s.doClearCacheCluster(s.roleCache)
+	s.doClearCacheCluster(s.rolePermissionsCache)
 }
--- a/store/localcachelayer/main_test.go
+++ b/store/localcachelayer/main_test.go
@@ -32,6 +32,12 @@ func getMockCacheProvider() *mocks.CacheProvider {
 		mock.AnythingOfType("int64"),
 		mock.AnythingOfType("string")).Return(lru.New(128))

+	mockCacheProvider.On("NewCacheWithParams",
+		mock.AnythingOfType("int"),
+		"RolePermission",
+		mock.AnythingOfType("int64"),
+		mock.AnythingOfType("string")).Return(lru.New(128))
+
 	mockCacheProvider.On("NewCacheWithParams",
 		mock.AnythingOfType("int"),
 		"Scheme",
--- a/store/localcachelayer/role_layer.go
+++ b/store/localcachelayer/role_layer.go
@@ -4,6 +4,9 @@
 package localcachelayer

 import (
+	"sort"
+	"strings"
+
 	"github.com/mattermost/mattermost-server/v5/model"
 	"github.com/mattermost/mattermost-server/v5/store"
 )
@@ -21,9 +24,18 @@ func (s *LocalCacheRoleStore) handleClusterInvalidateRole(msg *model.ClusterMess
 	}
 }

+func (s *LocalCacheRoleStore) handleClusterInvalidateRolePermissions(msg *model.ClusterMessage) {
+	if msg.Data == CLEAR_CACHE_MESSAGE_DATA {
+		s.rootStore.rolePermissionsCache.Purge()
+	} else {
+		s.rootStore.rolePermissionsCache.Remove(msg.Data)
+	}
+}
+
 func (s LocalCacheRoleStore) Save(role *model.Role) (*model.Role, *model.AppError) {
 	if len(role.Name) != 0 {
 		defer s.rootStore.doInvalidateCacheCluster(s.rootStore.roleCache, role.Name)
+		defer s.rootStore.doClearCacheCluster(s.rootStore.rolePermissionsCache) // TODO: This in other places?
 	}
 	return s.RoleStore.Save(role)
 }
@@ -67,6 +79,7 @@ func (s LocalCacheRoleStore) Delete(roleId string) (*model.Role, *model.AppError

 	if err == nil {
 		s.rootStore.doInvalidateCacheCluster(s.rootStore.roleCache, role.Name)
+		defer s.rootStore.doClearCacheCluster(s.rootStore.rolePermissionsCache)
 	}
 	return role, err
 }
@@ -74,6 +87,23 @@ func (s LocalCacheRoleStore) Delete(roleId string) (*model.Role, *model.AppError
 func (s LocalCacheRoleStore) PermanentDeleteAll() *model.AppError {
 	defer s.rootStore.roleCache.Purge()
 	defer s.rootStore.doClearCacheCluster(s.rootStore.roleCache)
+	defer s.rootStore.doClearCacheCluster(s.rootStore.rolePermissionsCache)

 	return s.RoleStore.PermanentDeleteAll()
 }
+
+func (s LocalCacheRoleStore) ChannelHigherScopedPermissions(roleNames []string) (map[string]*model.RolePermissions, *model.AppError) {
+	sort.Strings(roleNames)
+	cacheKey := strings.Join(roleNames, "/")
+	if rolePermissionsMap := s.rootStore.doStandardReadCache(s.rootStore.rolePermissionsCache, cacheKey); rolePermissionsMap != nil {
+		return rolePermissionsMap.(map[string]*model.RolePermissions), nil
+	}
+
+	rolePermissionsMap, err := s.RoleStore.ChannelHigherScopedPermissions(roleNames)
+	if err != nil {
+		return nil, err
+	}
+
+	s.rootStore.doStandardAddToCache(s.rootStore.rolePermissionsCache, cacheKey, rolePermissionsMap)
+	return rolePermissionsMap, nil
+}
--- a/store/opentracing_layer.go
+++ b/store/opentracing_layer.go
@@ -5179,7 +5179,61 @@ func (s *OpenTracingLayerReactionStore) Save(reaction *model.Reaction) (*model.R
 	return resultVar0, resultVar1
 }

-func (s *OpenTracingLayerRoleStore) Delete(roldId string) (*model.Role, *model.AppError) {
+func (s *OpenTracingLayerRoleStore) AllChannelSchemeRoles() ([]*model.Role, *model.AppError) {
+	origCtx := s.Root.Store.Context()
+	span, newCtx := tracing.StartSpanWithParentByContext(s.Root.Store.Context(), "RoleStore.AllChannelSchemeRoles")
+	s.Root.Store.SetContext(newCtx)
+	defer func() {
+		s.Root.Store.SetContext(origCtx)
+	}()
+
+	defer span.Finish()
+	resultVar0, resultVar1 := s.RoleStore.AllChannelSchemeRoles()
+	if resultVar1 != nil {
+		span.LogFields(spanlog.Error(resultVar1))
+		ext.Error.Set(span, true)
+	}
+
+	return resultVar0, resultVar1
+}
+
+func (s *OpenTracingLayerRoleStore) ChannelHigherScopedPermissions(roleNames []string) (map[string]*model.RolePermissions, *model.AppError) {
+	origCtx := s.Root.Store.Context()
+	span, newCtx := tracing.StartSpanWithParentByContext(s.Root.Store.Context(), "RoleStore.ChannelHigherScopedPermissions")
+	s.Root.Store.SetContext(newCtx)
+	defer func() {
+		s.Root.Store.SetContext(origCtx)
+	}()
+
+	defer span.Finish()
+	resultVar0, resultVar1 := s.RoleStore.ChannelHigherScopedPermissions(roleNames)
+	if resultVar1 != nil {
+		span.LogFields(spanlog.Error(resultVar1))
+		ext.Error.Set(span, true)
+	}
+
+	return resultVar0, resultVar1
+}
+
+func (s *OpenTracingLayerRoleStore) ChannelRolesUnderTeamRole(roleName string) ([]*model.Role, *model.AppError) {
+	origCtx := s.Root.Store.Context()
+	span, newCtx := tracing.StartSpanWithParentByContext(s.Root.Store.Context(), "RoleStore.ChannelRolesUnderTeamRole")
+	s.Root.Store.SetContext(newCtx)
+	defer func() {
+		s.Root.Store.SetContext(origCtx)
+	}()
+
+	defer span.Finish()
+	resultVar0, resultVar1 := s.RoleStore.ChannelRolesUnderTeamRole(roleName)
+	if resultVar1 != nil {
+		span.LogFields(spanlog.Error(resultVar1))
+		ext.Error.Set(span, true)
+	}
+
+	return resultVar0, resultVar1
+}
+
+func (s *OpenTracingLayerRoleStore) Delete(roleId string) (*model.Role, *model.AppError) {
 	origCtx := s.Root.Store.Context()
 	span, newCtx := tracing.StartSpanWithParentByContext(s.Root.Store.Context(), "RoleStore.Delete")
 	s.Root.Store.SetContext(newCtx)
@@ -5188,7 +5242,7 @@ func (s *OpenTracingLayerRoleStore) Delete(roldId string) (*model.Role, *model.A
 	}()

 	defer span.Finish()
-	resultVar0, resultVar1 := s.RoleStore.Delete(roldId)
+	resultVar0, resultVar1 := s.RoleStore.Delete(roleId)
 	if resultVar1 != nil {
 		span.LogFields(spanlog.Error(resultVar1))
 		ext.Error.Set(span, true)
--- a/store/sqlstore/channel_store.go
+++ b/store/sqlstore/channel_store.go
@@ -353,6 +353,7 @@ func (s SqlChannelStore) createIndexesIfNotExists() {
 		s.CreateIndexIfNotExists("idx_publicchannels_displayname_lower", "PublicChannels", "lower(DisplayName)")
 	}
 	s.CreateFullTextIndexIfNotExists("idx_publicchannels_search_txt", "PublicChannels", "Name, DisplayName, Purpose")
+	s.CreateIndexIfNotExists("idx_channels_scheme_id", "Channels", "SchemeId")
 }

 // MigratePublicChannels initializes the PublicChannels table with data created before this version
--- a/store/sqlstore/role_store.go
+++ b/store/sqlstore/role_store.go
@@ -9,6 +9,7 @@ import (
 	"net/http"
 	"strings"

+	sq "github.com/Masterminds/squirrel"
 	"github.com/mattermost/gorp"
 	"github.com/mattermost/mattermost-server/v5/model"
 	"github.com/mattermost/mattermost-server/v5/store"
@@ -31,6 +32,15 @@ type Role struct {
 	BuiltIn       bool
 }

+type channelRolesPermissions struct {
+	GuestRoleName                string
+	UserRoleName                 string
+	AdminRoleName                string
+	HigherScopedGuestPermissions string
+	HigherScopedUserPermissions  string
+	HigherScopedAdminPermissions string
+}
+
 func NewRoleFromModel(role *model.Role) *Role {
 	permissionsMap := make(map[string]bool)
 	permissions := ""
@@ -85,9 +95,6 @@ func newSqlRoleStore(sqlStore SqlStore) store.RoleStore {
 	return s
 }

-func (s SqlRoleStore) createIndexesIfNotExists() {
-}
-
 func (s *SqlRoleStore) Save(role *model.Role) (*model.Role, *model.AppError) {
 	// Check the role is valid before proceeding.
 	if !role.IsValidWithoutId() {
@@ -240,3 +247,142 @@ func (s *SqlRoleStore) PermanentDeleteAll() *model.AppError {

 	return nil
 }
+
+func (s *SqlRoleStore) channelHigherScopedPermissionsQuery(roleNames []string) string {
+	sqlTmpl := `
+		SELECT
+			RoleSchemes.DefaultChannelGuestRole AS GuestRoleName,
+			RoleSchemes.DefaultChannelUserRole AS UserRoleName,
+			RoleSchemes.DefaultChannelAdminRole AS AdminRoleName,
+			GuestRoles.Permissions AS HigherScopedGuestPermissions,
+			UserRoles.Permissions AS HigherScopedUserPermissions,
+			AdminRoles.Permissions AS HigherScopedAdminPermissions
+		FROM
+			Schemes AS RoleSchemes
+			JOIN Channels ON Channels.SchemeId = RoleSchemes.Id
+			JOIN Teams ON Teams.Id = Channels.TeamId
+			JOIN Schemes ON Schemes.Id = Teams.SchemeId
+			JOIN Roles AS GuestRoles ON GuestRoles.Name = Schemes.DefaultChannelGuestRole
+			JOIN Roles AS UserRoles ON UserRoles.Name = Schemes.DefaultChannelUserRole
+			JOIN Roles AS AdminRoles ON AdminRoles.Name = Schemes.DefaultChannelAdminRole
+		WHERE
+			RoleSchemes.DefaultChannelGuestRole IN ('%[1]s')
+			OR RoleSchemes.DefaultChannelUserRole IN ('%[1]s')
+			OR RoleSchemes.DefaultChannelAdminRole IN ('%[1]s')
+		UNION
+		SELECT
+			Schemes.DefaultChannelGuestRole AS GuestRoleName,
+			Schemes.DefaultChannelUserRole AS UserRoleName,
+			Schemes.DefaultChannelAdminRole AS AdminRoleName,
+			GuestRoles.Permissions AS HigherScopedGuestPermissions,
+			UserRoles.Permissions AS HigherScopedUserPermissions,
+			AdminRoles.Permissions AS HigherScopedAdminPermissions
+		FROM
+			Schemes
+			JOIN Channels ON Channels.SchemeId = Schemes.Id
+			JOIN Teams ON Teams.Id = Channels.TeamId
+			JOIN Roles AS GuestRoles ON GuestRoles.Name = '%[2]s'
+			JOIN Roles AS UserRoles ON UserRoles.Name = '%[3]s'
+			JOIN Roles AS AdminRoles ON AdminRoles.Name = '%[4]s'
+		WHERE
+			(Schemes.DefaultChannelGuestRole IN ('%[1]s')
+			OR Schemes.DefaultChannelUserRole IN ('%[1]s')
+			OR Schemes.DefaultChannelAdminRole IN ('%[1]s'))
+		AND (Teams.SchemeId = ''
+			OR Teams.SchemeId IS NULL)
+	`
+
+	// The below three channel role names are referenced by their name value because there is no system scheme
+	// record that ships with Mattermost, otherwise the system scheme would be referenced by name and the channel
+	// roles would be referenced by their column names.
+	return fmt.Sprintf(
+		sqlTmpl,
+		strings.Join(roleNames, "', '"),
+		model.CHANNEL_GUEST_ROLE_ID,
+		model.CHANNEL_USER_ROLE_ID,
+		model.CHANNEL_ADMIN_ROLE_ID,
+	)
+}
+
+func (s *SqlRoleStore) ChannelHigherScopedPermissions(roleNames []string) (map[string]*model.RolePermissions, *model.AppError) {
+	sql := s.channelHigherScopedPermissionsQuery(roleNames)
+
+	var rolesPermissions []*channelRolesPermissions
+	if _, err := s.GetReplica().Select(&rolesPermissions, sql); err != nil {
+		return nil, model.NewAppError("SqlRoleStore.HigherScopedPermissions", "store.sql_role.get_by_names.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	roleNameHigherScopedPermissions := map[string]*model.RolePermissions{}
+
+	for _, rp := range rolesPermissions {
+		roleNameHigherScopedPermissions[rp.GuestRoleName] = &model.RolePermissions{RoleID: model.CHANNEL_GUEST_ROLE_ID, Permissions: strings.Split(rp.HigherScopedGuestPermissions, " ")}
+		roleNameHigherScopedPermissions[rp.UserRoleName] = &model.RolePermissions{RoleID: model.CHANNEL_USER_ROLE_ID, Permissions: strings.Split(rp.HigherScopedUserPermissions, " ")}
+		roleNameHigherScopedPermissions[rp.AdminRoleName] = &model.RolePermissions{RoleID: model.CHANNEL_ADMIN_ROLE_ID, Permissions: strings.Split(rp.HigherScopedAdminPermissions, " ")}
+	}
+
+	return roleNameHigherScopedPermissions, nil
+}
+
+func (s *SqlRoleStore) AllChannelSchemeRoles() ([]*model.Role, *model.AppError) {
+	query := s.getQueryBuilder().
+		Select("Roles.*").
+		From("Schemes").
+		Join("Roles ON Schemes.DefaultChannelGuestRole = Roles.Name OR Schemes.DefaultChannelUserRole = Roles.Name OR Schemes.DefaultChannelAdminRole = Roles.Name").
+		Where(sq.Eq{"Schemes.Scope": model.SCHEME_SCOPE_CHANNEL}).
+		Where(sq.Eq{"Roles.DeleteAt": 0}).
+		Where(sq.Eq{"Schemes.DeleteAt": 0})
+
+	queryString, args, err := query.ToSql()
+	if err != nil {
+		return nil, model.NewAppError("SqlRoleStore.AllChannelSchemeManagedRoles", "store.sql.build_query.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	var dbRoles []*Role
+	if _, err = s.GetReplica().Select(&dbRoles, queryString, args...); err != nil {
+		return nil, model.NewAppError("SqlRoleStore.AllChannelSchemeManagedRoles", "store.sql_role.get.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	var roles []*model.Role
+	for _, dbRole := range dbRoles {
+		roles = append(roles, dbRole.ToModel())
+	}
+
+	return roles, nil
+}
+
+// ChannelRolesUnderTeamRole finds all of the channel-scheme roles under the team of the given team-scheme role.
+func (s *SqlRoleStore) ChannelRolesUnderTeamRole(roleName string) ([]*model.Role, *model.AppError) {
+	query := s.getQueryBuilder().
+		Select("ChannelSchemeRoles.*").
+		From("Roles AS HigherScopedRoles").
+		Join("Schemes AS HigherScopedSchemes ON (HigherScopedRoles.Name = HigherScopedSchemes.DefaultChannelGuestRole OR HigherScopedRoles.Name = HigherScopedSchemes.DefaultChannelUserRole OR HigherScopedRoles.Name = HigherScopedSchemes.DefaultChannelAdminRole)").
+		Join("Teams ON Teams.SchemeId = HigherScopedSchemes.Id").
+		Join("Channels ON Channels.TeamId = Teams.Id").
+		Join("Schemes AS ChannelSchemes ON Channels.SchemeId = ChannelSchemes.Id").
+		Join("Roles AS ChannelSchemeRoles ON (ChannelSchemeRoles.Name = ChannelSchemes.DefaultChannelGuestRole OR ChannelSchemeRoles.Name = ChannelSchemes.DefaultChannelUserRole OR ChannelSchemeRoles.Name = ChannelSchemes.DefaultChannelAdminRole)").
+		Where(sq.Eq{"HigherScopedSchemes.Scope": model.SCHEME_SCOPE_TEAM}).
+		Where(sq.Eq{"HigherScopedRoles.Name": roleName}).
+		Where(sq.Eq{"HigherScopedRoles.DeleteAt": 0}).
+		Where(sq.Eq{"HigherScopedSchemes.DeleteAt": 0}).
+		Where(sq.Eq{"Teams.DeleteAt": 0}).
+		Where(sq.Eq{"Channels.DeleteAt": 0}).
+		Where(sq.Eq{"ChannelSchemes.DeleteAt": 0}).
+		Where(sq.Eq{"ChannelSchemeRoles.DeleteAt": 0})
+
+	queryString, args, err := query.ToSql()
+	if err != nil {
+		return nil, model.NewAppError("SqlRoleStore.ChannelRolesUnderTeamRole", "store.sql.build_query.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	var dbRoles []*Role
+	if _, err = s.GetReplica().Select(&dbRoles, queryString, args...); err != nil {
+		return nil, model.NewAppError("SqlRoleStore.ChannelRolesUnderTeamRole", "store.sql_role.get.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	var roles []*model.Role
+	for _, dbRole := range dbRoles {
+		roles = append(roles, dbRole.ToModel())
+	}
+
+	return roles, nil
+}
--- a/store/sqlstore/scheme_store.go
+++ b/store/sqlstore/scheme_store.go
@@ -41,6 +41,9 @@ func newSqlSchemeStore(sqlStore SqlStore) store.SchemeStore {
 }

 func (s SqlSchemeStore) createIndexesIfNotExists() {
+	s.CreateIndexIfNotExists("idx_schemes_channel_guest_role", "Schemes", "DefaultChannelGuestRole")
+	s.CreateIndexIfNotExists("idx_schemes_channel_user_role", "Schemes", "DefaultChannelUserRole")
+	s.CreateIndexIfNotExists("idx_schemes_channel_admin_role", "Schemes", "DefaultChannelAdminRole")
 }

 func (s *SqlSchemeStore) Save(scheme *model.Scheme) (*model.Scheme, *model.AppError) {
@@ -152,6 +155,7 @@ func (s *SqlSchemeStore) createScheme(scheme *model.Scheme, transaction *gorp.Tr
 		}
 		scheme.DefaultTeamGuestRole = savedRole.Name
 	}
+
 	if scheme.Scope == model.SCHEME_SCOPE_TEAM || scheme.Scope == model.SCHEME_SCOPE_CHANNEL {
 		// Channel Admin Role
 		channelAdminRole := &model.Role{
@@ -161,6 +165,10 @@ func (s *SqlSchemeStore) createScheme(scheme *model.Scheme, transaction *gorp.Tr
 			SchemeManaged: true,
 		}

+		if scheme.Scope == model.SCHEME_SCOPE_CHANNEL {
+			channelAdminRole.Permissions = []string{}
+		}
+
 		savedRole, err := s.SqlStore.Role().(*SqlRoleStore).createRole(channelAdminRole, transaction)
 		if err != nil {
 			return nil, err
@@ -175,6 +183,10 @@ func (s *SqlSchemeStore) createScheme(scheme *model.Scheme, transaction *gorp.Tr
 			SchemeManaged: true,
 		}

+		if scheme.Scope == model.SCHEME_SCOPE_CHANNEL {
+			channelUserRole.Permissions = filterModerated(channelUserRole.Permissions)
+		}
+
 		savedRole, err = s.SqlStore.Role().(*SqlRoleStore).createRole(channelUserRole, transaction)
 		if err != nil {
 			return nil, err
@@ -189,6 +201,10 @@ func (s *SqlSchemeStore) createScheme(scheme *model.Scheme, transaction *gorp.Tr
 			SchemeManaged: true,
 		}

+		if scheme.Scope == model.SCHEME_SCOPE_CHANNEL {
+			channelGuestRole.Permissions = filterModerated(channelGuestRole.Permissions)
+		}
+
 		savedRole, err = s.SqlStore.Role().(*SqlRoleStore).createRole(channelGuestRole, transaction)
 		if err != nil {
 			return nil, err
@@ -215,6 +231,16 @@ func (s *SqlSchemeStore) createScheme(scheme *model.Scheme, transaction *gorp.Tr
 	return scheme, nil
 }

+func filterModerated(permissions []string) []string {
+	filteredPermissions := []string{}
+	for _, perm := range permissions {
+		if _, ok := model.CHANNEL_MODERATED_PERMISSIONS_MAP[perm]; ok {
+			filteredPermissions = append(filteredPermissions, perm)
+		}
+	}
+	return filteredPermissions
+}
+
 func (s *SqlSchemeStore) Get(schemeId string) (*model.Scheme, *model.AppError) {
 	var scheme model.Scheme
 	if err := s.GetReplica().SelectOne(&scheme, "SELECT * from Schemes WHERE Id = :Id", map[string]interface{}{"Id": schemeId}); err != nil {
--- a/store/sqlstore/supplier.go
+++ b/store/sqlstore/supplier.go
@@ -205,10 +205,8 @@ func NewSqlSupplier(settings model.SqlSettings, metrics einterfaces.MetricsInter
 	supplier.stores.TermsOfService.(SqlTermsOfServiceStore).createIndexesIfNotExists()
 	supplier.stores.UserTermsOfService.(SqlUserTermsOfServiceStore).createIndexesIfNotExists()
 	supplier.stores.linkMetadata.(*SqlLinkMetadataStore).createIndexesIfNotExists()
-	supplier.stores.reaction.(*SqlReactionStore).createIndexesIfNotExists()
-	supplier.stores.role.(*SqlRoleStore).createIndexesIfNotExists()
-	supplier.stores.scheme.(*SqlSchemeStore).createIndexesIfNotExists()
 	supplier.stores.group.(*SqlGroupStore).createIndexesIfNotExists()
+	supplier.stores.scheme.(*SqlSchemeStore).createIndexesIfNotExists()
 	supplier.stores.preference.(*SqlPreferenceStore).deleteUnusedFeatures()

 	return supplier
--- a/store/sqlstore/supplier_reactions.go
+++ b/store/sqlstore/supplier_reactions.go
@@ -29,9 +29,6 @@ func newSqlReactionStore(sqlStore SqlStore) store.ReactionStore {
 	return s
 }

-func (s SqlReactionStore) createIndexesIfNotExists() {
-}
-
 func (s *SqlReactionStore) Save(reaction *model.Reaction) (*model.Reaction, *model.AppError) {
 	reaction.PreSave()
 	if err := reaction.IsValid(); err != nil {
--- a/store/sqlstore/team_store.go
+++ b/store/sqlstore/team_store.go
@@ -183,6 +183,7 @@ func (s SqlTeamStore) createIndexesIfNotExists() {
 	s.CreateIndexIfNotExists("idx_teams_update_at", "Teams", "UpdateAt")
 	s.CreateIndexIfNotExists("idx_teams_create_at", "Teams", "CreateAt")
 	s.CreateIndexIfNotExists("idx_teams_delete_at", "Teams", "DeleteAt")
+	s.CreateIndexIfNotExists("idx_teams_scheme_id", "Teams", "SchemeId")

 	s.CreateIndexIfNotExists("idx_teammembers_team_id", "TeamMembers", "TeamId")
 	s.CreateIndexIfNotExists("idx_teammembers_user_id", "TeamMembers", "UserId")
--- a/store/sqlstore/upgrade.go
+++ b/store/sqlstore/upgrade.go
@@ -772,8 +772,13 @@ func upgradeDatabaseToVersion521(sqlStore SqlStore) {
 }

 func upgradeDatabaseToVersion522(sqlStore SqlStore) {
-	// TODO: Uncomment following condition when version 5.22.0 is released
 	// if shouldPerformUpgrade(sqlStore, VERSION_5_21_0, VERSION_5_22_0) {
+	sqlStore.CreateIndexIfNotExists("idx_teams_scheme_id", "Teams", "SchemeId")
+	sqlStore.CreateIndexIfNotExists("idx_channels_scheme_id", "Channels", "SchemeId")
+	sqlStore.CreateIndexIfNotExists("idx_channels_scheme_id", "Channels", "SchemeId")
+	sqlStore.CreateIndexIfNotExists("idx_schemes_channel_guest_role", "Schemes", "DefaultChannelGuestRole")
+	sqlStore.CreateIndexIfNotExists("idx_schemes_channel_user_role", "Schemes", "DefaultChannelUserRole")
+	sqlStore.CreateIndexIfNotExists("idx_schemes_channel_admin_role", "Schemes", "DefaultChannelAdminRole")
 	// sqlStore.CreateColumnIfNotExistsNoDefault("Bots", "LastIconUpdate", "bigint", "bigint")
 	// sqlStore.AlterPrimaryKey("Reactions", []string{"PostId", "UserId", "EmojiName"})

--- a/store/store.go
+++ b/store/store.go
@@ -569,8 +569,19 @@ type RoleStore interface {
 	GetAll() ([]*model.Role, *model.AppError)
 	GetByName(name string) (*model.Role, *model.AppError)
 	GetByNames(names []string) ([]*model.Role, *model.AppError)
-	Delete(roldId string) (*model.Role, *model.AppError)
+	Delete(roleId string) (*model.Role, *model.AppError)
 	PermanentDeleteAll() *model.AppError
+
+	// HigherScopedPermissions retrieves the higher-scoped permissions of a list of role names. The higher-scope
+	// (either team scheme or system scheme) is determined based on whether the team has a scheme or not.
+	ChannelHigherScopedPermissions(roleNames []string) (map[string]*model.RolePermissions, *model.AppError)
+
+	// AllChannelSchemeRoles returns all of the roles associated to channel schemes.
+	AllChannelSchemeRoles() ([]*model.Role, *model.AppError)
+
+	// ChannelRolesUnderTeamRole returns all of the non-deleted roles that are affected by updates to the
+	// given role.
+	ChannelRolesUnderTeamRole(roleName string) ([]*model.Role, *model.AppError)
 }

 type SchemeStore interface {
--- a/store/storetest/group_store.go
+++ b/store/storetest/group_store.go
@@ -16,6 +16,7 @@ import (

 	"github.com/mattermost/mattermost-server/v5/model"
 	"github.com/mattermost/mattermost-server/v5/store"
+	"github.com/mattermost/mattermost-server/v5/utils"
 )

 func TestGroupStore(t *testing.T, ss store.Store) {
@@ -3620,15 +3621,6 @@ func groupTestpUpdateMembersRoleTeam(t *testing.T, ss store.Store) {
 		},
 	}

-	includes := func(list []string, item string) bool {
-		for _, it := range list {
-			if it == item {
-				return true
-			}
-		}
-		return false
-	}
-
 	for _, tt := range tests {
 		t.Run(tt.testName, func(t *testing.T) {
 			err = ss.Team().UpdateMembersRole(team.Id, tt.inUserIDs)
@@ -3639,7 +3631,7 @@ func groupTestpUpdateMembersRoleTeam(t *testing.T, ss store.Store) {
 			require.GreaterOrEqual(t, len(members), 4) // sanity check for team membership

 			for _, member := range members {
-				if includes(tt.inUserIDs, member.UserId) {
+				if utils.StringInSlice(member.UserId, tt.inUserIDs) {
 					require.True(t, member.SchemeAdmin)
 				} else {
 					require.False(t, member.SchemeAdmin)
@@ -3738,15 +3730,6 @@ func groupTestpUpdateMembersRoleChannel(t *testing.T, ss store.Store) {
 		},
 	}

-	includes := func(list []string, item string) bool {
-		for _, it := range list {
-			if it == item {
-				return true
-			}
-		}
-		return false
-	}
-
 	for _, tt := range tests {
 		t.Run(tt.testName, func(t *testing.T) {
 			err = ss.Channel().UpdateMembersRole(channel.Id, tt.inUserIDs)
@@ -3758,7 +3741,7 @@ func groupTestpUpdateMembersRoleChannel(t *testing.T, ss store.Store) {
 			require.GreaterOrEqual(t, len(*members), 4) // sanity check for channel membership

 			for _, member := range *members {
-				if includes(tt.inUserIDs, member.UserId) {
+				if utils.StringInSlice(member.UserId, tt.inUserIDs) {
 					require.True(t, member.SchemeAdmin)
 				} else {
 					require.False(t, member.SchemeAdmin)
--- a/store/storetest/mocks/RoleStore.go
+++ b/store/storetest/mocks/RoleStore.go
@@ -14,13 +14,88 @@ type RoleStore struct {
 	mock.Mock
 }

-// Delete provides a mock function with given fields: roldId
-func (_m *RoleStore) Delete(roldId string) (*model.Role, *model.AppError) {
-	ret := _m.Called(roldId)
+// AllChannelSchemeRoles provides a mock function with given fields:
+func (_m *RoleStore) AllChannelSchemeRoles() ([]*model.Role, *model.AppError) {
+	ret := _m.Called()
+
+	var r0 []*model.Role
+	if rf, ok := ret.Get(0).(func() []*model.Role); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]*model.Role)
+		}
+	}
+
+	var r1 *model.AppError
+	if rf, ok := ret.Get(1).(func() *model.AppError); ok {
+		r1 = rf()
+	} else {
+		if ret.Get(1) != nil {
+			r1 = ret.Get(1).(*model.AppError)
+		}
+	}
+
+	return r0, r1
+}
+
+// ChannelHigherScopedPermissions provides a mock function with given fields: roleNames
+func (_m *RoleStore) ChannelHigherScopedPermissions(roleNames []string) (map[string]*model.RolePermissions, *model.AppError) {
+	ret := _m.Called(roleNames)
+
+	var r0 map[string]*model.RolePermissions
+	if rf, ok := ret.Get(0).(func([]string) map[string]*model.RolePermissions); ok {
+		r0 = rf(roleNames)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(map[string]*model.RolePermissions)
+		}
+	}
+
+	var r1 *model.AppError
+	if rf, ok := ret.Get(1).(func([]string) *model.AppError); ok {
+		r1 = rf(roleNames)
+	} else {
+		if ret.Get(1) != nil {
+			r1 = ret.Get(1).(*model.AppError)
+		}
+	}
+
+	return r0, r1
+}
+
+// ChannelRolesUnderTeamRole provides a mock function with given fields: roleName
+func (_m *RoleStore) ChannelRolesUnderTeamRole(roleName string) ([]*model.Role, *model.AppError) {
+	ret := _m.Called(roleName)
+
+	var r0 []*model.Role
+	if rf, ok := ret.Get(0).(func(string) []*model.Role); ok {
+		r0 = rf(roleName)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]*model.Role)
+		}
+	}
+
+	var r1 *model.AppError
+	if rf, ok := ret.Get(1).(func(string) *model.AppError); ok {
+		r1 = rf(roleName)
+	} else {
+		if ret.Get(1) != nil {
+			r1 = ret.Get(1).(*model.AppError)
+		}
+	}
+
+	return r0, r1
+}
+
+// Delete provides a mock function with given fields: roleId
+func (_m *RoleStore) Delete(roleId string) (*model.Role, *model.AppError) {
+	ret := _m.Called(roleId)

 	var r0 *model.Role
 	if rf, ok := ret.Get(0).(func(string) *model.Role); ok {
-		r0 = rf(roldId)
+		r0 = rf(roleId)
 	} else {
 		if ret.Get(0) != nil {
 			r0 = ret.Get(0).(*model.Role)
@@ -29,7 +104,7 @@ func (_m *RoleStore) Delete(roldId string) (*model.Role, *model.AppError) {

 	var r1 *model.AppError
 	if rf, ok := ret.Get(1).(func(string) *model.AppError); ok {
-		r1 = rf(roldId)
+		r1 = rf(roleId)
 	} else {
 		if ret.Get(1) != nil {
 			r1 = ret.Get(1).(*model.AppError)
--- a/store/storetest/role_store.go
+++ b/store/storetest/role_store.go
@@ -21,6 +21,7 @@ func TestRoleStore(t *testing.T, ss store.Store) {
 	t.Run("GetNames", func(t *testing.T) { testRoleStoreGetByNames(t, ss) })
 	t.Run("Delete", func(t *testing.T) { testRoleStoreDelete(t, ss) })
 	t.Run("PermanentDeleteAll", func(t *testing.T) { testRoleStorePermanentDeleteAll(t, ss) })
+	t.Run("LowerScopedChannelSchemeRoles_AllChannelSchemeRoles", func(t *testing.T) { testRoleStoreLowerScopedChannelSchemeRoles(t, ss) })
 }

 func testRoleStoreSave(t *testing.T, ss store.Store) {
@@ -356,3 +357,159 @@ func testRoleStorePermanentDeleteAll(t *testing.T, ss store.Store) {
 	assert.Nil(t, err)
 	assert.Empty(t, roles)
 }
+
+func testRoleStoreLowerScopedChannelSchemeRoles(t *testing.T, ss store.Store) {
+	createDefaultRoles(t, ss)
+
+	teamScheme1 := &model.Scheme{
+		DisplayName: model.NewId(),
+		Name:        model.NewId(),
+		Description: model.NewId(),
+		Scope:       model.SCHEME_SCOPE_TEAM,
+	}
+	teamScheme1, err := ss.Scheme().Save(teamScheme1)
+	require.Nil(t, err)
+	defer ss.Scheme().Delete(teamScheme1.Id)
+
+	teamScheme2 := &model.Scheme{
+		DisplayName: model.NewId(),
+		Name:        model.NewId(),
+		Description: model.NewId(),
+		Scope:       model.SCHEME_SCOPE_TEAM,
+	}
+	teamScheme2, err = ss.Scheme().Save(teamScheme2)
+	require.Nil(t, err)
+	defer ss.Scheme().Delete(teamScheme2.Id)
+
+	channelScheme1 := &model.Scheme{
+		DisplayName: model.NewId(),
+		Name:        model.NewId(),
+		Description: model.NewId(),
+		Scope:       model.SCHEME_SCOPE_CHANNEL,
+	}
+	channelScheme1, err = ss.Scheme().Save(channelScheme1)
+	require.Nil(t, err)
+	defer ss.Scheme().Delete(channelScheme1.Id)
+
+	channelScheme2 := &model.Scheme{
+		DisplayName: model.NewId(),
+		Name:        model.NewId(),
+		Description: model.NewId(),
+		Scope:       model.SCHEME_SCOPE_CHANNEL,
+	}
+	channelScheme2, err = ss.Scheme().Save(channelScheme2)
+	require.Nil(t, err)
+	defer ss.Scheme().Delete(channelScheme1.Id)
+
+	team1 := &model.Team{
+		DisplayName: "Name",
+		Name:        "zz" + model.NewId(),
+		Email:       MakeEmail(),
+		Type:        model.TEAM_OPEN,
+		SchemeId:    &teamScheme1.Id,
+	}
+	team1, err = ss.Team().Save(team1)
+	require.Nil(t, err)
+	defer ss.Team().PermanentDelete(team1.Id)
+
+	team2 := &model.Team{
+		DisplayName: "Name",
+		Name:        "zz" + model.NewId(),
+		Email:       MakeEmail(),
+		Type:        model.TEAM_OPEN,
+		SchemeId:    &teamScheme2.Id,
+	}
+	team2, err = ss.Team().Save(team2)
+	require.Nil(t, err)
+	defer ss.Team().PermanentDelete(team2.Id)
+
+	channel1 := &model.Channel{
+		TeamId:      team1.Id,
+		DisplayName: "Display " + model.NewId(),
+		Name:        "zz" + model.NewId() + "b",
+		Type:        model.CHANNEL_OPEN,
+		SchemeId:    &channelScheme1.Id,
+	}
+	channel1, err = ss.Channel().Save(channel1, -1)
+	require.Nil(t, err)
+	defer ss.Channel().Delete(channel1.Id, 0)
+
+	channel2 := &model.Channel{
+		TeamId:      team2.Id,
+		DisplayName: "Display " + model.NewId(),
+		Name:        "zz" + model.NewId() + "b",
+		Type:        model.CHANNEL_OPEN,
+		SchemeId:    &channelScheme2.Id,
+	}
+	channel2, err = ss.Channel().Save(channel2, -1)
+	require.Nil(t, err)
+	defer ss.Channel().Delete(channel2.Id, 0)
+
+	t.Run("ChannelRolesUnderTeamRole", func(t *testing.T) {
+		t.Run("guest role for the right team's channels are returned", func(t *testing.T) {
+			actualRoles, err := ss.Role().ChannelRolesUnderTeamRole(teamScheme1.DefaultChannelGuestRole)
+			require.Nil(t, err)
+
+			var actualRoleNames []string
+			for _, role := range actualRoles {
+				actualRoleNames = append(actualRoleNames, role.Name)
+			}
+
+			require.Contains(t, actualRoleNames, channelScheme1.DefaultChannelGuestRole)
+			require.NotContains(t, actualRoleNames, channelScheme2.DefaultChannelGuestRole)
+		})
+
+		t.Run("user role for the right team's channels are returned", func(t *testing.T) {
+			actualRoles, err := ss.Role().ChannelRolesUnderTeamRole(teamScheme1.DefaultChannelUserRole)
+			require.Nil(t, err)
+
+			var actualRoleNames []string
+			for _, role := range actualRoles {
+				actualRoleNames = append(actualRoleNames, role.Name)
+			}
+
+			require.Contains(t, actualRoleNames, channelScheme1.DefaultChannelUserRole)
+			require.NotContains(t, actualRoleNames, channelScheme2.DefaultChannelUserRole)
+		})
+
+		t.Run("admin role for the right team's channels are returned", func(t *testing.T) {
+			actualRoles, err := ss.Role().ChannelRolesUnderTeamRole(teamScheme1.DefaultChannelAdminRole)
+			require.Nil(t, err)
+
+			var actualRoleNames []string
+			for _, role := range actualRoles {
+				actualRoleNames = append(actualRoleNames, role.Name)
+			}
+
+			require.Contains(t, actualRoleNames, channelScheme1.DefaultChannelAdminRole)
+			require.NotContains(t, actualRoleNames, channelScheme2.DefaultChannelAdminRole)
+		})
+	})
+
+	t.Run("AllChannelSchemeRoles", func(t *testing.T) {
+		t.Run("guest role for the right team's channels are returned", func(t *testing.T) {
+			actualRoles, err := ss.Role().AllChannelSchemeRoles()
+			require.Nil(t, err)
+
+			var actualRoleNames []string
+			for _, role := range actualRoles {
+				actualRoleNames = append(actualRoleNames, role.Name)
+			}
+
+			allRoleNames := []string{
+				channelScheme1.DefaultChannelGuestRole,
+				channelScheme2.DefaultChannelGuestRole,
+
+				channelScheme1.DefaultChannelUserRole,
+				channelScheme2.DefaultChannelUserRole,
+
+				channelScheme1.DefaultChannelAdminRole,
+				channelScheme2.DefaultChannelAdminRole,
+			}
+
+			for _, roleName := range allRoleNames {
+				require.Contains(t, actualRoleNames, roleName)
+			}
+		})
+	})
+}
--- a/store/timer_layer.go
+++ b/store/timer_layer.go
@@ -4716,10 +4716,58 @@ func (s *TimerLayerReactionStore) Save(reaction *model.Reaction) (*model.Reactio
 	return resultVar0, resultVar1
 }

-func (s *TimerLayerRoleStore) Delete(roldId string) (*model.Role, *model.AppError) {
+func (s *TimerLayerRoleStore) AllChannelSchemeRoles() ([]*model.Role, *model.AppError) {
 	start := timemodule.Now()

-	resultVar0, resultVar1 := s.RoleStore.Delete(roldId)
+	resultVar0, resultVar1 := s.RoleStore.AllChannelSchemeRoles()
+
+	elapsed := float64(timemodule.Since(start)) / float64(timemodule.Second)
+	if s.Root.Metrics != nil {
+		success := "false"
+		if resultVar1 == nil {
+			success = "true"
+		}
+		s.Root.Metrics.ObserveStoreMethodDuration("RoleStore.AllChannelSchemeRoles", success, elapsed)
+	}
+	return resultVar0, resultVar1
+}
+
+func (s *TimerLayerRoleStore) ChannelHigherScopedPermissions(roleNames []string) (map[string]*model.RolePermissions, *model.AppError) {
+	start := timemodule.Now()
+
+	resultVar0, resultVar1 := s.RoleStore.ChannelHigherScopedPermissions(roleNames)
+
+	elapsed := float64(timemodule.Since(start)) / float64(timemodule.Second)
+	if s.Root.Metrics != nil {
+		success := "false"
+		if resultVar1 == nil {
+			success = "true"
+		}
+		s.Root.Metrics.ObserveStoreMethodDuration("RoleStore.ChannelHigherScopedPermissions", success, elapsed)
+	}
+	return resultVar0, resultVar1
+}
+
+func (s *TimerLayerRoleStore) ChannelRolesUnderTeamRole(roleName string) ([]*model.Role, *model.AppError) {
+	start := timemodule.Now()
+
+	resultVar0, resultVar1 := s.RoleStore.ChannelRolesUnderTeamRole(roleName)
+
+	elapsed := float64(timemodule.Since(start)) / float64(timemodule.Second)
+	if s.Root.Metrics != nil {
+		success := "false"
+		if resultVar1 == nil {
+			success = "true"
+		}
+		s.Root.Metrics.ObserveStoreMethodDuration("RoleStore.ChannelRolesUnderTeamRole", success, elapsed)
+	}
+	return resultVar0, resultVar1
+}
+
+func (s *TimerLayerRoleStore) Delete(roleId string) (*model.Role, *model.AppError) {
+	start := timemodule.Now()
+
+	resultVar0, resultVar1 := s.RoleStore.Delete(roleId)

 	elapsed := float64(timemodule.Since(start)) / float64(timemodule.Second)
 	if s.Root.Metrics != nil {