MM-22212 & MM-22208: Read from the higher-scoped scheme if the permission is non-moderated. (#13813)
* MM-22212: Read non-moderated permissions from higher-scoped scheme. * MM-2212: Corrects test count in comment. * MM-22212: Adds godoc comment. * MM-2212: Switches to the channel roles check in a few more places. * MM-22212: Refactors and fixes. * MM-22212: Reverts change, no longer required. * MM-22212: Removes translation. * MM-22212: Un-comments merged new permission. * MM-22212: Un-comments merged new permission. * MM-22212: Performance tweak. * MM-22212: Fixes some fmting. * MM-22212: Add unit test for newly-added store methods. * MM-22212: Renames app method. * MM-22212: Re-uses existing function to find string in slice. * MM-22212: Keeps 'higher-scoped' terminology for consistency. * MM-22212: Refactors based on PR feedback. * MM-22212: Fix for some bad merging. * MM-22212: Renamed some things. * MM-22212: Use an 'else' instead of a 'continue' for readability. * MM-22212: Caches (*SqlRoleStore).ChannelRolesUnderTeamRole. * MM-22212: Adds mock to new cache store. * MM-22212: Adds missing open tracing app layer methods. * MM-22212: Adds migration to add moderated permissions to channel_admin if present on channel_user. * MM-22212: Migrates team schemes. Removes unused AppError. * MM-22212: Fix for for if. * MM-22212: Fixes iterator. * MM-22212: Updates open tracing generated methods. * MM-22212: Fix mocks. * MM-22212: Change migration key name. * MM-22212: Switched to data structure from other branch. * MM-22212: Fixes tests after adding 'use_channel_mentions' to the channel_admin role. * MM-22212: Adds tracking of channel moderation. * Revert "MM-22212: Adds tracking of channel moderation." This reverts commit 23689efa22c112e4ba37f6a212535dd7ebfb63db. * MM-22212: Switch some functions to methods and vice versa. * MM-22212: Fix for refactor bug not notifiying websocket about changed role. * MM-22212: Adds test for public/private 'manage_members' handling. * MM-22122 Fix manage channel members edge case for public and private channels (#14049) * MM-22212: Adds moderated permission to team_admin. * MM-22212: Updates migration. * MM-22212: Revert unnecessary update to default roles. * Add channel scheme updated event when channel scheme is deleted or created (#14057) * MM-22212: Adds newline. * MM-22212: Migration fix. * MM-22212: Fix for migration. * MM-22212: Test fix. Co-authored-by: Farhan Munshi <3207297+fm2munsh@users.noreply.github.com>
Этот коммит содержится в:
Martin Kraft
коммит произвёл
GitHub
GitHub
родитель
ace46443b3
Коммит
4d99aa22ba
@@ -9,6 +9,7 @@ import (
|
||||
"net/http"
|
||||
"strings"
|
||||
|
||||
sq "github.com/Masterminds/squirrel"
|
||||
"github.com/mattermost/gorp"
|
||||
"github.com/mattermost/mattermost-server/v5/model"
|
||||
"github.com/mattermost/mattermost-server/v5/store"
|
||||
@@ -31,6 +32,15 @@ type Role struct {
|
||||
BuiltIn bool
|
||||
}
|
||||
|
||||
type channelRolesPermissions struct {
|
||||
GuestRoleName string
|
||||
UserRoleName string
|
||||
AdminRoleName string
|
||||
HigherScopedGuestPermissions string
|
||||
HigherScopedUserPermissions string
|
||||
HigherScopedAdminPermissions string
|
||||
}
|
||||
|
||||
func NewRoleFromModel(role *model.Role) *Role {
|
||||
permissionsMap := make(map[string]bool)
|
||||
permissions := ""
|
||||
@@ -85,9 +95,6 @@ func newSqlRoleStore(sqlStore SqlStore) store.RoleStore {
|
||||
return s
|
||||
}
|
||||
|
||||
func (s SqlRoleStore) createIndexesIfNotExists() {
|
||||
}
|
||||
|
||||
func (s *SqlRoleStore) Save(role *model.Role) (*model.Role, *model.AppError) {
|
||||
// Check the role is valid before proceeding.
|
||||
if !role.IsValidWithoutId() {
|
||||
@@ -240,3 +247,142 @@ func (s *SqlRoleStore) PermanentDeleteAll() *model.AppError {
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func (s *SqlRoleStore) channelHigherScopedPermissionsQuery(roleNames []string) string {
|
||||
sqlTmpl := `
|
||||
SELECT
|
||||
RoleSchemes.DefaultChannelGuestRole AS GuestRoleName,
|
||||
RoleSchemes.DefaultChannelUserRole AS UserRoleName,
|
||||
RoleSchemes.DefaultChannelAdminRole AS AdminRoleName,
|
||||
GuestRoles.Permissions AS HigherScopedGuestPermissions,
|
||||
UserRoles.Permissions AS HigherScopedUserPermissions,
|
||||
AdminRoles.Permissions AS HigherScopedAdminPermissions
|
||||
FROM
|
||||
Schemes AS RoleSchemes
|
||||
JOIN Channels ON Channels.SchemeId = RoleSchemes.Id
|
||||
JOIN Teams ON Teams.Id = Channels.TeamId
|
||||
JOIN Schemes ON Schemes.Id = Teams.SchemeId
|
||||
JOIN Roles AS GuestRoles ON GuestRoles.Name = Schemes.DefaultChannelGuestRole
|
||||
JOIN Roles AS UserRoles ON UserRoles.Name = Schemes.DefaultChannelUserRole
|
||||
JOIN Roles AS AdminRoles ON AdminRoles.Name = Schemes.DefaultChannelAdminRole
|
||||
WHERE
|
||||
RoleSchemes.DefaultChannelGuestRole IN ('%[1]s')
|
||||
OR RoleSchemes.DefaultChannelUserRole IN ('%[1]s')
|
||||
OR RoleSchemes.DefaultChannelAdminRole IN ('%[1]s')
|
||||
UNION
|
||||
SELECT
|
||||
Schemes.DefaultChannelGuestRole AS GuestRoleName,
|
||||
Schemes.DefaultChannelUserRole AS UserRoleName,
|
||||
Schemes.DefaultChannelAdminRole AS AdminRoleName,
|
||||
GuestRoles.Permissions AS HigherScopedGuestPermissions,
|
||||
UserRoles.Permissions AS HigherScopedUserPermissions,
|
||||
AdminRoles.Permissions AS HigherScopedAdminPermissions
|
||||
FROM
|
||||
Schemes
|
||||
JOIN Channels ON Channels.SchemeId = Schemes.Id
|
||||
JOIN Teams ON Teams.Id = Channels.TeamId
|
||||
JOIN Roles AS GuestRoles ON GuestRoles.Name = '%[2]s'
|
||||
JOIN Roles AS UserRoles ON UserRoles.Name = '%[3]s'
|
||||
JOIN Roles AS AdminRoles ON AdminRoles.Name = '%[4]s'
|
||||
WHERE
|
||||
(Schemes.DefaultChannelGuestRole IN ('%[1]s')
|
||||
OR Schemes.DefaultChannelUserRole IN ('%[1]s')
|
||||
OR Schemes.DefaultChannelAdminRole IN ('%[1]s'))
|
||||
AND (Teams.SchemeId = ''
|
||||
OR Teams.SchemeId IS NULL)
|
||||
`
|
||||
|
||||
// The below three channel role names are referenced by their name value because there is no system scheme
|
||||
// record that ships with Mattermost, otherwise the system scheme would be referenced by name and the channel
|
||||
// roles would be referenced by their column names.
|
||||
return fmt.Sprintf(
|
||||
sqlTmpl,
|
||||
strings.Join(roleNames, "', '"),
|
||||
model.CHANNEL_GUEST_ROLE_ID,
|
||||
model.CHANNEL_USER_ROLE_ID,
|
||||
model.CHANNEL_ADMIN_ROLE_ID,
|
||||
)
|
||||
}
|
||||
|
||||
func (s *SqlRoleStore) ChannelHigherScopedPermissions(roleNames []string) (map[string]*model.RolePermissions, *model.AppError) {
|
||||
sql := s.channelHigherScopedPermissionsQuery(roleNames)
|
||||
|
||||
var rolesPermissions []*channelRolesPermissions
|
||||
if _, err := s.GetReplica().Select(&rolesPermissions, sql); err != nil {
|
||||
return nil, model.NewAppError("SqlRoleStore.HigherScopedPermissions", "store.sql_role.get_by_names.app_error", nil, err.Error(), http.StatusInternalServerError)
|
||||
}
|
||||
|
||||
roleNameHigherScopedPermissions := map[string]*model.RolePermissions{}
|
||||
|
||||
for _, rp := range rolesPermissions {
|
||||
roleNameHigherScopedPermissions[rp.GuestRoleName] = &model.RolePermissions{RoleID: model.CHANNEL_GUEST_ROLE_ID, Permissions: strings.Split(rp.HigherScopedGuestPermissions, " ")}
|
||||
roleNameHigherScopedPermissions[rp.UserRoleName] = &model.RolePermissions{RoleID: model.CHANNEL_USER_ROLE_ID, Permissions: strings.Split(rp.HigherScopedUserPermissions, " ")}
|
||||
roleNameHigherScopedPermissions[rp.AdminRoleName] = &model.RolePermissions{RoleID: model.CHANNEL_ADMIN_ROLE_ID, Permissions: strings.Split(rp.HigherScopedAdminPermissions, " ")}
|
||||
}
|
||||
|
||||
return roleNameHigherScopedPermissions, nil
|
||||
}
|
||||
|
||||
func (s *SqlRoleStore) AllChannelSchemeRoles() ([]*model.Role, *model.AppError) {
|
||||
query := s.getQueryBuilder().
|
||||
Select("Roles.*").
|
||||
From("Schemes").
|
||||
Join("Roles ON Schemes.DefaultChannelGuestRole = Roles.Name OR Schemes.DefaultChannelUserRole = Roles.Name OR Schemes.DefaultChannelAdminRole = Roles.Name").
|
||||
Where(sq.Eq{"Schemes.Scope": model.SCHEME_SCOPE_CHANNEL}).
|
||||
Where(sq.Eq{"Roles.DeleteAt": 0}).
|
||||
Where(sq.Eq{"Schemes.DeleteAt": 0})
|
||||
|
||||
queryString, args, err := query.ToSql()
|
||||
if err != nil {
|
||||
return nil, model.NewAppError("SqlRoleStore.AllChannelSchemeManagedRoles", "store.sql.build_query.app_error", nil, err.Error(), http.StatusInternalServerError)
|
||||
}
|
||||
|
||||
var dbRoles []*Role
|
||||
if _, err = s.GetReplica().Select(&dbRoles, queryString, args...); err != nil {
|
||||
return nil, model.NewAppError("SqlRoleStore.AllChannelSchemeManagedRoles", "store.sql_role.get.app_error", nil, err.Error(), http.StatusInternalServerError)
|
||||
}
|
||||
|
||||
var roles []*model.Role
|
||||
for _, dbRole := range dbRoles {
|
||||
roles = append(roles, dbRole.ToModel())
|
||||
}
|
||||
|
||||
return roles, nil
|
||||
}
|
||||
|
||||
// ChannelRolesUnderTeamRole finds all of the channel-scheme roles under the team of the given team-scheme role.
|
||||
func (s *SqlRoleStore) ChannelRolesUnderTeamRole(roleName string) ([]*model.Role, *model.AppError) {
|
||||
query := s.getQueryBuilder().
|
||||
Select("ChannelSchemeRoles.*").
|
||||
From("Roles AS HigherScopedRoles").
|
||||
Join("Schemes AS HigherScopedSchemes ON (HigherScopedRoles.Name = HigherScopedSchemes.DefaultChannelGuestRole OR HigherScopedRoles.Name = HigherScopedSchemes.DefaultChannelUserRole OR HigherScopedRoles.Name = HigherScopedSchemes.DefaultChannelAdminRole)").
|
||||
Join("Teams ON Teams.SchemeId = HigherScopedSchemes.Id").
|
||||
Join("Channels ON Channels.TeamId = Teams.Id").
|
||||
Join("Schemes AS ChannelSchemes ON Channels.SchemeId = ChannelSchemes.Id").
|
||||
Join("Roles AS ChannelSchemeRoles ON (ChannelSchemeRoles.Name = ChannelSchemes.DefaultChannelGuestRole OR ChannelSchemeRoles.Name = ChannelSchemes.DefaultChannelUserRole OR ChannelSchemeRoles.Name = ChannelSchemes.DefaultChannelAdminRole)").
|
||||
Where(sq.Eq{"HigherScopedSchemes.Scope": model.SCHEME_SCOPE_TEAM}).
|
||||
Where(sq.Eq{"HigherScopedRoles.Name": roleName}).
|
||||
Where(sq.Eq{"HigherScopedRoles.DeleteAt": 0}).
|
||||
Where(sq.Eq{"HigherScopedSchemes.DeleteAt": 0}).
|
||||
Where(sq.Eq{"Teams.DeleteAt": 0}).
|
||||
Where(sq.Eq{"Channels.DeleteAt": 0}).
|
||||
Where(sq.Eq{"ChannelSchemes.DeleteAt": 0}).
|
||||
Where(sq.Eq{"ChannelSchemeRoles.DeleteAt": 0})
|
||||
|
||||
queryString, args, err := query.ToSql()
|
||||
if err != nil {
|
||||
return nil, model.NewAppError("SqlRoleStore.ChannelRolesUnderTeamRole", "store.sql.build_query.app_error", nil, err.Error(), http.StatusInternalServerError)
|
||||
}
|
||||
|
||||
var dbRoles []*Role
|
||||
if _, err = s.GetReplica().Select(&dbRoles, queryString, args...); err != nil {
|
||||
return nil, model.NewAppError("SqlRoleStore.ChannelRolesUnderTeamRole", "store.sql_role.get.app_error", nil, err.Error(), http.StatusInternalServerError)
|
||||
}
|
||||
|
||||
var roles []*model.Role
|
||||
for _, dbRole := range dbRoles {
|
||||
roles = append(roles, dbRole.ToModel())
|
||||
}
|
||||
|
||||
return roles, nil
|
||||
}
|
||||
|
||||
Ссылка в новой задаче
Block a user