From 4ecd0712756e6dd425b913539018bbb724a89d6a Mon Sep 17 00:00:00 2001 From: Christopher Speller Date: Thu, 3 Mar 2022 08:10:41 -0800 Subject: [PATCH] Add new playbooks permissions. (#19661) --- app/permissions_migrations.go | 19 +++++++++++++++++++ model/migration.go | 1 + model/permission.go | 18 ++++++++++++++++++ model/role.go | 2 ++ testlib/store.go | 1 + 5 files changed, 41 insertions(+) diff --git a/app/permissions_migrations.go b/app/permissions_migrations.go index d42bc36e43..dd927c586f 100644 --- a/app/permissions_migrations.go +++ b/app/permissions_migrations.go @@ -973,6 +973,24 @@ func (a *App) getAddPlaybooksPermissions() (permissionsMap, error) { return transformations, nil } +func (a *App) getPlaybooksPermissionsAddManageRoles() (permissionsMap, error) { + transformations := []permissionTransformation{} + + transformations = append(transformations, permissionTransformation{ + On: permissionOr( + isRole(model.PlaybookAdminRoleId), + isRole(model.TeamAdminRoleId), + isRole(model.SystemAdminRoleId), + ), + Add: []string{ + model.PermissionPublicPlaybookManageRoles.Id, + model.PermissionPrivatePlaybookManageRoles.Id, + }, + }) + + return transformations, nil +} + // DoPermissionsMigrations execute all the permissions migrations need by the current version. func (a *App) DoPermissionsMigrations() error { return a.Srv().doPermissionsMigrations() @@ -1013,6 +1031,7 @@ func (s *Server) doPermissionsMigrations() error { {Key: model.MigrationKeyAddTestEmailAncillaryPermission, Migration: a.getAddTestEmailAncillaryPermission}, {Key: model.MigrationKeyAddPlaybooksPermissions, Migration: a.getAddPlaybooksPermissions}, {Key: model.MigrationKeyAddCustomUserGroupsPermissions, Migration: a.getAddCustomUserGroupsPermissions}, + {Key: model.MigrationKeyAddPlayboosksManageRolesPermissions, Migration: a.getPlaybooksPermissionsAddManageRoles}, } roles, err := s.Store.Role().GetAll() diff --git a/model/migration.go b/model/migration.go index 16172e5081..4958f80e85 100644 --- a/model/migration.go +++ b/model/migration.go @@ -37,4 +37,5 @@ const ( MigrationKeyAddIntegrationsSubsectionPermissions = "integrations_subsection_permissions" MigrationKeyAddPlaybooksPermissions = "playbooks_permissions" MigrationKeyAddCustomUserGroupsPermissions = "custom_groups_permissions" + MigrationKeyAddPlayboosksManageRolesPermissions = "playbooks_manage_roles" ) diff --git a/model/permission.go b/model/permission.go index e8d9d2c357..bf1f40238c 100644 --- a/model/permission.go +++ b/model/permission.go @@ -337,12 +337,14 @@ var PermissionSysconsoleWriteExperimentalBleve *Permission var PermissionPublicPlaybookCreate *Permission var PermissionPublicPlaybookManageProperties *Permission var PermissionPublicPlaybookManageMembers *Permission +var PermissionPublicPlaybookManageRoles *Permission var PermissionPublicPlaybookView *Permission var PermissionPublicPlaybookMakePrivate *Permission var PermissionPrivatePlaybookCreate *Permission var PermissionPrivatePlaybookManageProperties *Permission var PermissionPrivatePlaybookManageMembers *Permission +var PermissionPrivatePlaybookManageRoles *Permission var PermissionPrivatePlaybookView *Permission var PermissionPrivatePlaybookMakePublic *Permission @@ -1970,6 +1972,13 @@ func initializePermissions() { PermissionScopePlaybook, } + PermissionPublicPlaybookManageRoles = &Permission{ + "playbook_public_manage_roles", + "", + "", + PermissionScopePlaybook, + } + PermissionPublicPlaybookView = &Permission{ "playbook_public_view", "", @@ -2005,6 +2014,13 @@ func initializePermissions() { PermissionScopePlaybook, } + PermissionPrivatePlaybookManageRoles = &Permission{ + "playbook_private_manage_roles", + "", + "", + PermissionScopePlaybook, + } + PermissionPrivatePlaybookView = &Permission{ "playbook_private_view", "", @@ -2327,10 +2343,12 @@ func initializePermissions() { PlaybookScopedPermissions := []*Permission{ PermissionPublicPlaybookManageProperties, PermissionPublicPlaybookManageMembers, + PermissionPublicPlaybookManageRoles, PermissionPublicPlaybookView, PermissionPublicPlaybookMakePrivate, PermissionPrivatePlaybookManageProperties, PermissionPrivatePlaybookManageMembers, + PermissionPrivatePlaybookManageRoles, PermissionPrivatePlaybookView, PermissionPrivatePlaybookMakePublic, PermissionRunCreate, diff --git a/model/role.go b/model/role.go index 37edec4fb9..081e7b68b8 100644 --- a/model/role.go +++ b/model/role.go @@ -836,8 +836,10 @@ func MakeDefaultRoles() map[string]*Role { Description: "authentication.roles.playbook_admin.description", Permissions: []string{ PermissionPublicPlaybookManageMembers.Id, + PermissionPublicPlaybookManageRoles.Id, PermissionPublicPlaybookManageProperties.Id, PermissionPrivatePlaybookManageMembers.Id, + PermissionPrivatePlaybookManageRoles.Id, PermissionPrivatePlaybookManageProperties.Id, PermissionPublicPlaybookMakePrivate.Id, }, diff --git a/testlib/store.go b/testlib/store.go index d16e4c3a33..10272fcdff 100644 --- a/testlib/store.go +++ b/testlib/store.go @@ -65,6 +65,7 @@ func GetMockStoreForSetupFunctions() *mocks.Store { systemStore.On("GetByName", model.MigrationKeyAddManageSecureConnectionsPermissions).Return(&model.System{Name: model.MigrationKeyAddManageSecureConnectionsPermissions, Value: "true"}, nil) systemStore.On("GetByName", model.MigrationKeyAddPlaybooksPermissions).Return(&model.System{Name: model.MigrationKeyAddPlaybooksPermissions, Value: "true"}, nil) systemStore.On("GetByName", model.MigrationKeyAddCustomUserGroupsPermissions).Return(&model.System{Name: model.MigrationKeyAddCustomUserGroupsPermissions, Value: "true"}, nil) + systemStore.On("GetByName", model.MigrationKeyAddPlayboosksManageRolesPermissions).Return(&model.System{Name: model.MigrationKeyAddPlayboosksManageRolesPermissions, Value: "true"}, nil) systemStore.On("InsertIfExists", mock.AnythingOfType("*model.System")).Return(&model.System{}, nil).Once() systemStore.On("Save", mock.AnythingOfType("*model.System")).Return(nil)