MM-22212 & MM-22208: Read from the higher-scoped scheme if the permission is non-moderated. (#13813)

* MM-22212: Read non-moderated permissions from higher-scoped scheme. * MM-2212: Corrects test count in comment. * MM-22212: Adds godoc comment. * MM-2212: Switches to the channel roles check in a few more places. * MM-22212: Refactors and fixes. * MM-22212: Reverts change, no longer required. * MM-22212: Removes translation. * MM-22212: Un-comments merged new permission. * MM-22212: Un-comments merged new permission. * MM-22212: Performance tweak. * MM-22212: Fixes some fmting. * MM-22212: Add unit test for newly-added store methods. * MM-22212: Renames app method. * MM-22212: Re-uses existing function to find string in slice. * MM-22212: Keeps 'higher-scoped' terminology for consistency. * MM-22212: Refactors based on PR feedback. * MM-22212: Fix for some bad merging. * MM-22212: Renamed some things. * MM-22212: Use an 'else' instead of a 'continue' for readability. * MM-22212: Caches (*SqlRoleStore).ChannelRolesUnderTeamRole. * MM-22212: Adds mock to new cache store. * MM-22212: Adds missing open tracing app layer methods. * MM-22212: Adds migration to add moderated permissions to channel_admin if present on channel_user. * MM-22212: Migrates team schemes. Removes unused AppError. * MM-22212: Fix for for if. * MM-22212: Fixes iterator. * MM-22212: Updates open tracing generated methods. * MM-22212: Fix mocks. * MM-22212: Change migration key name. * MM-22212: Switched to data structure from other branch. * MM-22212: Fixes tests after adding 'use_channel_mentions' to the channel_admin role. * MM-22212: Adds tracking of channel moderation. * Revert "MM-22212: Adds tracking of channel moderation." This reverts commit 23689efa22c112e4ba37f6a212535dd7ebfb63db. * MM-22212: Switch some functions to methods and vice versa. * MM-22212: Fix for refactor bug not notifiying websocket about changed role. * MM-22212: Adds test for public/private 'manage_members' handling. * MM-22122 Fix manage channel members edge case for public and private channels (#14049) * MM-22212: Adds moderated permission to team_admin. * MM-22212: Updates migration. * MM-22212: Revert unnecessary update to default roles. * Add channel scheme updated event when channel scheme is deleted or created (#14057) * MM-22212: Adds newline. * MM-22212: Migration fix. * MM-22212: Fix for migration. * MM-22212: Test fix. Co-authored-by: Farhan Munshi <3207297+fm2munsh@users.noreply.github.com>
2020-03-23 13:44:20 -04:00
--- a/store/sqlstore/channel_store.go
+++ b/store/sqlstore/channel_store.go
@@ -353,6 +353,7 @@ func (s SqlChannelStore) createIndexesIfNotExists() {
 		s.CreateIndexIfNotExists("idx_publicchannels_displayname_lower", "PublicChannels", "lower(DisplayName)")
 	}
 	s.CreateFullTextIndexIfNotExists("idx_publicchannels_search_txt", "PublicChannels", "Name, DisplayName, Purpose")
+	s.CreateIndexIfNotExists("idx_channels_scheme_id", "Channels", "SchemeId")
 }

 // MigratePublicChannels initializes the PublicChannels table with data created before this version
--- a/store/sqlstore/role_store.go
+++ b/store/sqlstore/role_store.go
@@ -9,6 +9,7 @@ import (
 	"net/http"
 	"strings"

+	sq "github.com/Masterminds/squirrel"
 	"github.com/mattermost/gorp"
 	"github.com/mattermost/mattermost-server/v5/model"
 	"github.com/mattermost/mattermost-server/v5/store"
@@ -31,6 +32,15 @@ type Role struct {
 	BuiltIn       bool
 }

+type channelRolesPermissions struct {
+	GuestRoleName                string
+	UserRoleName                 string
+	AdminRoleName                string
+	HigherScopedGuestPermissions string
+	HigherScopedUserPermissions  string
+	HigherScopedAdminPermissions string
+}
+
 func NewRoleFromModel(role *model.Role) *Role {
 	permissionsMap := make(map[string]bool)
 	permissions := ""
@@ -85,9 +95,6 @@ func newSqlRoleStore(sqlStore SqlStore) store.RoleStore {
 	return s
 }

-func (s SqlRoleStore) createIndexesIfNotExists() {
-}
-
 func (s *SqlRoleStore) Save(role *model.Role) (*model.Role, *model.AppError) {
 	// Check the role is valid before proceeding.
 	if !role.IsValidWithoutId() {
@@ -240,3 +247,142 @@ func (s *SqlRoleStore) PermanentDeleteAll() *model.AppError {

 	return nil
 }
+
+func (s *SqlRoleStore) channelHigherScopedPermissionsQuery(roleNames []string) string {
+	sqlTmpl := `
+		SELECT
+			RoleSchemes.DefaultChannelGuestRole AS GuestRoleName,
+			RoleSchemes.DefaultChannelUserRole AS UserRoleName,
+			RoleSchemes.DefaultChannelAdminRole AS AdminRoleName,
+			GuestRoles.Permissions AS HigherScopedGuestPermissions,
+			UserRoles.Permissions AS HigherScopedUserPermissions,
+			AdminRoles.Permissions AS HigherScopedAdminPermissions
+		FROM
+			Schemes AS RoleSchemes
+			JOIN Channels ON Channels.SchemeId = RoleSchemes.Id
+			JOIN Teams ON Teams.Id = Channels.TeamId
+			JOIN Schemes ON Schemes.Id = Teams.SchemeId
+			JOIN Roles AS GuestRoles ON GuestRoles.Name = Schemes.DefaultChannelGuestRole
+			JOIN Roles AS UserRoles ON UserRoles.Name = Schemes.DefaultChannelUserRole
+			JOIN Roles AS AdminRoles ON AdminRoles.Name = Schemes.DefaultChannelAdminRole
+		WHERE
+			RoleSchemes.DefaultChannelGuestRole IN ('%[1]s')
+			OR RoleSchemes.DefaultChannelUserRole IN ('%[1]s')
+			OR RoleSchemes.DefaultChannelAdminRole IN ('%[1]s')
+		UNION
+		SELECT
+			Schemes.DefaultChannelGuestRole AS GuestRoleName,
+			Schemes.DefaultChannelUserRole AS UserRoleName,
+			Schemes.DefaultChannelAdminRole AS AdminRoleName,
+			GuestRoles.Permissions AS HigherScopedGuestPermissions,
+			UserRoles.Permissions AS HigherScopedUserPermissions,
+			AdminRoles.Permissions AS HigherScopedAdminPermissions
+		FROM
+			Schemes
+			JOIN Channels ON Channels.SchemeId = Schemes.Id
+			JOIN Teams ON Teams.Id = Channels.TeamId
+			JOIN Roles AS GuestRoles ON GuestRoles.Name = '%[2]s'
+			JOIN Roles AS UserRoles ON UserRoles.Name = '%[3]s'
+			JOIN Roles AS AdminRoles ON AdminRoles.Name = '%[4]s'
+		WHERE
+			(Schemes.DefaultChannelGuestRole IN ('%[1]s')
+			OR Schemes.DefaultChannelUserRole IN ('%[1]s')
+			OR Schemes.DefaultChannelAdminRole IN ('%[1]s'))
+		AND (Teams.SchemeId = ''
+			OR Teams.SchemeId IS NULL)
+	`
+
+	// The below three channel role names are referenced by their name value because there is no system scheme
+	// record that ships with Mattermost, otherwise the system scheme would be referenced by name and the channel
+	// roles would be referenced by their column names.
+	return fmt.Sprintf(
+		sqlTmpl,
+		strings.Join(roleNames, "', '"),
+		model.CHANNEL_GUEST_ROLE_ID,
+		model.CHANNEL_USER_ROLE_ID,
+		model.CHANNEL_ADMIN_ROLE_ID,
+	)
+}
+
+func (s *SqlRoleStore) ChannelHigherScopedPermissions(roleNames []string) (map[string]*model.RolePermissions, *model.AppError) {
+	sql := s.channelHigherScopedPermissionsQuery(roleNames)
+
+	var rolesPermissions []*channelRolesPermissions
+	if _, err := s.GetReplica().Select(&rolesPermissions, sql); err != nil {
+		return nil, model.NewAppError("SqlRoleStore.HigherScopedPermissions", "store.sql_role.get_by_names.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	roleNameHigherScopedPermissions := map[string]*model.RolePermissions{}
+
+	for _, rp := range rolesPermissions {
+		roleNameHigherScopedPermissions[rp.GuestRoleName] = &model.RolePermissions{RoleID: model.CHANNEL_GUEST_ROLE_ID, Permissions: strings.Split(rp.HigherScopedGuestPermissions, " ")}
+		roleNameHigherScopedPermissions[rp.UserRoleName] = &model.RolePermissions{RoleID: model.CHANNEL_USER_ROLE_ID, Permissions: strings.Split(rp.HigherScopedUserPermissions, " ")}
+		roleNameHigherScopedPermissions[rp.AdminRoleName] = &model.RolePermissions{RoleID: model.CHANNEL_ADMIN_ROLE_ID, Permissions: strings.Split(rp.HigherScopedAdminPermissions, " ")}
+	}
+
+	return roleNameHigherScopedPermissions, nil
+}
+
+func (s *SqlRoleStore) AllChannelSchemeRoles() ([]*model.Role, *model.AppError) {
+	query := s.getQueryBuilder().
+		Select("Roles.*").
+		From("Schemes").
+		Join("Roles ON Schemes.DefaultChannelGuestRole = Roles.Name OR Schemes.DefaultChannelUserRole = Roles.Name OR Schemes.DefaultChannelAdminRole = Roles.Name").
+		Where(sq.Eq{"Schemes.Scope": model.SCHEME_SCOPE_CHANNEL}).
+		Where(sq.Eq{"Roles.DeleteAt": 0}).
+		Where(sq.Eq{"Schemes.DeleteAt": 0})
+
+	queryString, args, err := query.ToSql()
+	if err != nil {
+		return nil, model.NewAppError("SqlRoleStore.AllChannelSchemeManagedRoles", "store.sql.build_query.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	var dbRoles []*Role
+	if _, err = s.GetReplica().Select(&dbRoles, queryString, args...); err != nil {
+		return nil, model.NewAppError("SqlRoleStore.AllChannelSchemeManagedRoles", "store.sql_role.get.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	var roles []*model.Role
+	for _, dbRole := range dbRoles {
+		roles = append(roles, dbRole.ToModel())
+	}
+
+	return roles, nil
+}
+
+// ChannelRolesUnderTeamRole finds all of the channel-scheme roles under the team of the given team-scheme role.
+func (s *SqlRoleStore) ChannelRolesUnderTeamRole(roleName string) ([]*model.Role, *model.AppError) {
+	query := s.getQueryBuilder().
+		Select("ChannelSchemeRoles.*").
+		From("Roles AS HigherScopedRoles").
+		Join("Schemes AS HigherScopedSchemes ON (HigherScopedRoles.Name = HigherScopedSchemes.DefaultChannelGuestRole OR HigherScopedRoles.Name = HigherScopedSchemes.DefaultChannelUserRole OR HigherScopedRoles.Name = HigherScopedSchemes.DefaultChannelAdminRole)").
+		Join("Teams ON Teams.SchemeId = HigherScopedSchemes.Id").
+		Join("Channels ON Channels.TeamId = Teams.Id").
+		Join("Schemes AS ChannelSchemes ON Channels.SchemeId = ChannelSchemes.Id").
+		Join("Roles AS ChannelSchemeRoles ON (ChannelSchemeRoles.Name = ChannelSchemes.DefaultChannelGuestRole OR ChannelSchemeRoles.Name = ChannelSchemes.DefaultChannelUserRole OR ChannelSchemeRoles.Name = ChannelSchemes.DefaultChannelAdminRole)").
+		Where(sq.Eq{"HigherScopedSchemes.Scope": model.SCHEME_SCOPE_TEAM}).
+		Where(sq.Eq{"HigherScopedRoles.Name": roleName}).
+		Where(sq.Eq{"HigherScopedRoles.DeleteAt": 0}).
+		Where(sq.Eq{"HigherScopedSchemes.DeleteAt": 0}).
+		Where(sq.Eq{"Teams.DeleteAt": 0}).
+		Where(sq.Eq{"Channels.DeleteAt": 0}).
+		Where(sq.Eq{"ChannelSchemes.DeleteAt": 0}).
+		Where(sq.Eq{"ChannelSchemeRoles.DeleteAt": 0})
+
+	queryString, args, err := query.ToSql()
+	if err != nil {
+		return nil, model.NewAppError("SqlRoleStore.ChannelRolesUnderTeamRole", "store.sql.build_query.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	var dbRoles []*Role
+	if _, err = s.GetReplica().Select(&dbRoles, queryString, args...); err != nil {
+		return nil, model.NewAppError("SqlRoleStore.ChannelRolesUnderTeamRole", "store.sql_role.get.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	var roles []*model.Role
+	for _, dbRole := range dbRoles {
+		roles = append(roles, dbRole.ToModel())
+	}
+
+	return roles, nil
+}
--- a/store/sqlstore/scheme_store.go
+++ b/store/sqlstore/scheme_store.go
@@ -41,6 +41,9 @@ func newSqlSchemeStore(sqlStore SqlStore) store.SchemeStore {
 }

 func (s SqlSchemeStore) createIndexesIfNotExists() {
+	s.CreateIndexIfNotExists("idx_schemes_channel_guest_role", "Schemes", "DefaultChannelGuestRole")
+	s.CreateIndexIfNotExists("idx_schemes_channel_user_role", "Schemes", "DefaultChannelUserRole")
+	s.CreateIndexIfNotExists("idx_schemes_channel_admin_role", "Schemes", "DefaultChannelAdminRole")
 }

 func (s *SqlSchemeStore) Save(scheme *model.Scheme) (*model.Scheme, *model.AppError) {
@@ -152,6 +155,7 @@ func (s *SqlSchemeStore) createScheme(scheme *model.Scheme, transaction *gorp.Tr
 		}
 		scheme.DefaultTeamGuestRole = savedRole.Name
 	}
+
 	if scheme.Scope == model.SCHEME_SCOPE_TEAM || scheme.Scope == model.SCHEME_SCOPE_CHANNEL {
 		// Channel Admin Role
 		channelAdminRole := &model.Role{
@@ -161,6 +165,10 @@ func (s *SqlSchemeStore) createScheme(scheme *model.Scheme, transaction *gorp.Tr
 			SchemeManaged: true,
 		}

+		if scheme.Scope == model.SCHEME_SCOPE_CHANNEL {
+			channelAdminRole.Permissions = []string{}
+		}
+
 		savedRole, err := s.SqlStore.Role().(*SqlRoleStore).createRole(channelAdminRole, transaction)
 		if err != nil {
 			return nil, err
@@ -175,6 +183,10 @@ func (s *SqlSchemeStore) createScheme(scheme *model.Scheme, transaction *gorp.Tr
 			SchemeManaged: true,
 		}

+		if scheme.Scope == model.SCHEME_SCOPE_CHANNEL {
+			channelUserRole.Permissions = filterModerated(channelUserRole.Permissions)
+		}
+
 		savedRole, err = s.SqlStore.Role().(*SqlRoleStore).createRole(channelUserRole, transaction)
 		if err != nil {
 			return nil, err
@@ -189,6 +201,10 @@ func (s *SqlSchemeStore) createScheme(scheme *model.Scheme, transaction *gorp.Tr
 			SchemeManaged: true,
 		}

+		if scheme.Scope == model.SCHEME_SCOPE_CHANNEL {
+			channelGuestRole.Permissions = filterModerated(channelGuestRole.Permissions)
+		}
+
 		savedRole, err = s.SqlStore.Role().(*SqlRoleStore).createRole(channelGuestRole, transaction)
 		if err != nil {
 			return nil, err
@@ -215,6 +231,16 @@ func (s *SqlSchemeStore) createScheme(scheme *model.Scheme, transaction *gorp.Tr
 	return scheme, nil
 }

+func filterModerated(permissions []string) []string {
+	filteredPermissions := []string{}
+	for _, perm := range permissions {
+		if _, ok := model.CHANNEL_MODERATED_PERMISSIONS_MAP[perm]; ok {
+			filteredPermissions = append(filteredPermissions, perm)
+		}
+	}
+	return filteredPermissions
+}
+
 func (s *SqlSchemeStore) Get(schemeId string) (*model.Scheme, *model.AppError) {
 	var scheme model.Scheme
 	if err := s.GetReplica().SelectOne(&scheme, "SELECT * from Schemes WHERE Id = :Id", map[string]interface{}{"Id": schemeId}); err != nil {
--- a/store/sqlstore/supplier.go
+++ b/store/sqlstore/supplier.go
@@ -205,10 +205,8 @@ func NewSqlSupplier(settings model.SqlSettings, metrics einterfaces.MetricsInter
 	supplier.stores.TermsOfService.(SqlTermsOfServiceStore).createIndexesIfNotExists()
 	supplier.stores.UserTermsOfService.(SqlUserTermsOfServiceStore).createIndexesIfNotExists()
 	supplier.stores.linkMetadata.(*SqlLinkMetadataStore).createIndexesIfNotExists()
-	supplier.stores.reaction.(*SqlReactionStore).createIndexesIfNotExists()
-	supplier.stores.role.(*SqlRoleStore).createIndexesIfNotExists()
-	supplier.stores.scheme.(*SqlSchemeStore).createIndexesIfNotExists()
 	supplier.stores.group.(*SqlGroupStore).createIndexesIfNotExists()
+	supplier.stores.scheme.(*SqlSchemeStore).createIndexesIfNotExists()
 	supplier.stores.preference.(*SqlPreferenceStore).deleteUnusedFeatures()

 	return supplier
--- a/store/sqlstore/supplier_reactions.go
+++ b/store/sqlstore/supplier_reactions.go
@@ -29,9 +29,6 @@ func newSqlReactionStore(sqlStore SqlStore) store.ReactionStore {
 	return s
 }

-func (s SqlReactionStore) createIndexesIfNotExists() {
-}
-
 func (s *SqlReactionStore) Save(reaction *model.Reaction) (*model.Reaction, *model.AppError) {
 	reaction.PreSave()
 	if err := reaction.IsValid(); err != nil {
--- a/store/sqlstore/team_store.go
+++ b/store/sqlstore/team_store.go
@@ -183,6 +183,7 @@ func (s SqlTeamStore) createIndexesIfNotExists() {
 	s.CreateIndexIfNotExists("idx_teams_update_at", "Teams", "UpdateAt")
 	s.CreateIndexIfNotExists("idx_teams_create_at", "Teams", "CreateAt")
 	s.CreateIndexIfNotExists("idx_teams_delete_at", "Teams", "DeleteAt")
+	s.CreateIndexIfNotExists("idx_teams_scheme_id", "Teams", "SchemeId")

 	s.CreateIndexIfNotExists("idx_teammembers_team_id", "TeamMembers", "TeamId")
 	s.CreateIndexIfNotExists("idx_teammembers_user_id", "TeamMembers", "UserId")
--- a/store/sqlstore/upgrade.go
+++ b/store/sqlstore/upgrade.go
@@ -772,8 +772,13 @@ func upgradeDatabaseToVersion521(sqlStore SqlStore) {
 }

 func upgradeDatabaseToVersion522(sqlStore SqlStore) {
-	// TODO: Uncomment following condition when version 5.22.0 is released
 	// if shouldPerformUpgrade(sqlStore, VERSION_5_21_0, VERSION_5_22_0) {
+	sqlStore.CreateIndexIfNotExists("idx_teams_scheme_id", "Teams", "SchemeId")
+	sqlStore.CreateIndexIfNotExists("idx_channels_scheme_id", "Channels", "SchemeId")
+	sqlStore.CreateIndexIfNotExists("idx_channels_scheme_id", "Channels", "SchemeId")
+	sqlStore.CreateIndexIfNotExists("idx_schemes_channel_guest_role", "Schemes", "DefaultChannelGuestRole")
+	sqlStore.CreateIndexIfNotExists("idx_schemes_channel_user_role", "Schemes", "DefaultChannelUserRole")
+	sqlStore.CreateIndexIfNotExists("idx_schemes_channel_admin_role", "Schemes", "DefaultChannelAdminRole")
 	// sqlStore.CreateColumnIfNotExistsNoDefault("Bots", "LastIconUpdate", "bigint", "bigint")
 	// sqlStore.AlterPrimaryKey("Reactions", []string{"PostId", "UserId", "EmojiName"})