Add new playbooks permissions. (#19661)

app/permissions_migrations.go

@@ -973,6 +973,24 @@ func (a *App) getAddPlaybooksPermissions() (permissionsMap, error) {
 	return transformations, nil
 }
 
+func (a *App) getPlaybooksPermissionsAddManageRoles() (permissionsMap, error) {
+	transformations := []permissionTransformation{}
+
+	transformations = append(transformations, permissionTransformation{
+		On: permissionOr(
+			isRole(model.PlaybookAdminRoleId),
+			isRole(model.TeamAdminRoleId),
+			isRole(model.SystemAdminRoleId),
+		),
+		Add: []string{
+			model.PermissionPublicPlaybookManageRoles.Id,
+			model.PermissionPrivatePlaybookManageRoles.Id,
+		},
+	})
+
+	return transformations, nil
+}
+
 // DoPermissionsMigrations execute all the permissions migrations need by the current version.
 func (a *App) DoPermissionsMigrations() error {
 	return a.Srv().doPermissionsMigrations()
@@ -1013,6 +1031,7 @@ func (s *Server) doPermissionsMigrations() error {
 		{Key: model.MigrationKeyAddTestEmailAncillaryPermission, Migration: a.getAddTestEmailAncillaryPermission},
 		{Key: model.MigrationKeyAddPlaybooksPermissions, Migration: a.getAddPlaybooksPermissions},
 		{Key: model.MigrationKeyAddCustomUserGroupsPermissions, Migration: a.getAddCustomUserGroupsPermissions},
+		{Key: model.MigrationKeyAddPlayboosksManageRolesPermissions, Migration: a.getPlaybooksPermissionsAddManageRoles},
 	}
 
 	roles, err := s.Store.Role().GetAll()

model/migration.go

@@ -37,4 +37,5 @@ const (
 	MigrationKeyAddIntegrationsSubsectionPermissions   = "integrations_subsection_permissions"
 	MigrationKeyAddPlaybooksPermissions                = "playbooks_permissions"
 	MigrationKeyAddCustomUserGroupsPermissions         = "custom_groups_permissions"
+	MigrationKeyAddPlayboosksManageRolesPermissions    = "playbooks_manage_roles"
 )

model/permission.go

@@ -337,12 +337,14 @@ var PermissionSysconsoleWriteExperimentalBleve *Permission
 var PermissionPublicPlaybookCreate *Permission
 var PermissionPublicPlaybookManageProperties *Permission
 var PermissionPublicPlaybookManageMembers *Permission
+var PermissionPublicPlaybookManageRoles *Permission
 var PermissionPublicPlaybookView *Permission
 var PermissionPublicPlaybookMakePrivate *Permission
 
 var PermissionPrivatePlaybookCreate *Permission
 var PermissionPrivatePlaybookManageProperties *Permission
 var PermissionPrivatePlaybookManageMembers *Permission
+var PermissionPrivatePlaybookManageRoles *Permission
 var PermissionPrivatePlaybookView *Permission
 var PermissionPrivatePlaybookMakePublic *Permission
 
@@ -1970,6 +1972,13 @@ func initializePermissions() {
 		PermissionScopePlaybook,
 	}
 
+	PermissionPublicPlaybookManageRoles = &Permission{
+		"playbook_public_manage_roles",
+		"",
+		"",
+		PermissionScopePlaybook,
+	}
+
 	PermissionPublicPlaybookView = &Permission{
 		"playbook_public_view",
 		"",
@@ -2005,6 +2014,13 @@ func initializePermissions() {
 		PermissionScopePlaybook,
 	}
 
+	PermissionPrivatePlaybookManageRoles = &Permission{
+		"playbook_private_manage_roles",
+		"",
+		"",
+		PermissionScopePlaybook,
+	}
+
 	PermissionPrivatePlaybookView = &Permission{
 		"playbook_private_view",
 		"",
@@ -2327,10 +2343,12 @@ func initializePermissions() {
 	PlaybookScopedPermissions := []*Permission{
 		PermissionPublicPlaybookManageProperties,
 		PermissionPublicPlaybookManageMembers,
+		PermissionPublicPlaybookManageRoles,
 		PermissionPublicPlaybookView,
 		PermissionPublicPlaybookMakePrivate,
 		PermissionPrivatePlaybookManageProperties,
 		PermissionPrivatePlaybookManageMembers,
+		PermissionPrivatePlaybookManageRoles,
 		PermissionPrivatePlaybookView,
 		PermissionPrivatePlaybookMakePublic,
 		PermissionRunCreate,

model/role.go

@@ -836,8 +836,10 @@ func MakeDefaultRoles() map[string]*Role {
 		Description: "authentication.roles.playbook_admin.description",
 		Permissions: []string{
 			PermissionPublicPlaybookManageMembers.Id,
+			PermissionPublicPlaybookManageRoles.Id,
 			PermissionPublicPlaybookManageProperties.Id,
 			PermissionPrivatePlaybookManageMembers.Id,
+			PermissionPrivatePlaybookManageRoles.Id,
 			PermissionPrivatePlaybookManageProperties.Id,
 			PermissionPublicPlaybookMakePrivate.Id,
 		},

testlib/store.go

@@ -65,6 +65,7 @@ func GetMockStoreForSetupFunctions() *mocks.Store {
 	systemStore.On("GetByName", model.MigrationKeyAddManageSecureConnectionsPermissions).Return(&model.System{Name: model.MigrationKeyAddManageSecureConnectionsPermissions, Value: "true"}, nil)
 	systemStore.On("GetByName", model.MigrationKeyAddPlaybooksPermissions).Return(&model.System{Name: model.MigrationKeyAddPlaybooksPermissions, Value: "true"}, nil)
 	systemStore.On("GetByName", model.MigrationKeyAddCustomUserGroupsPermissions).Return(&model.System{Name: model.MigrationKeyAddCustomUserGroupsPermissions, Value: "true"}, nil)
+	systemStore.On("GetByName", model.MigrationKeyAddPlayboosksManageRolesPermissions).Return(&model.System{Name: model.MigrationKeyAddPlayboosksManageRolesPermissions, Value: "true"}, nil)
 	systemStore.On("InsertIfExists", mock.AnythingOfType("*model.System")).Return(&model.System{}, nil).Once()
 	systemStore.On("Save", mock.AnythingOfType("*model.System")).Return(nil)