Moving the creation of the new bot permissions to permissions migrations (#10588)

app/permissions_migrations.go

@@ -19,6 +19,7 @@ const (
 	MIGRATION_KEY_WEBHOOK_PERMISSIONS_SPLIT      = "webhook_permissions_split"
 	MIGRATION_KEY_LIST_JOIN_PUBLIC_PRIVATE_TEAMS = "list_join_public_private_teams"
 	MIGRATION_KEY_REMOVE_PERMANENT_DELETE_USER   = "remove_permanent_delete_user"
+	MIGRATION_KEY_ADD_BOT_PERMISSIONS            = "add_bot_permissions"
 
 	PERMISSION_MANAGE_SYSTEM                   = "manage_system"
 	PERMISSION_MANAGE_EMOJIS                   = "manage_emojis"
@@ -37,6 +38,11 @@ const (
 	PERMISSION_JOIN_PUBLIC_TEAMS               = "join_public_teams"
 	PERMISSION_JOIN_PRIVATE_TEAMS              = "join_private_teams"
 	PERMISSION_PERMANENT_DELETE_USER           = "permanent_delete_user"
+	PERMISSION_CREATE_BOT                      = "create_bot"
+	PERMISSION_READ_BOTS                       = "read_bots"
+	PERMISSION_READ_OTHERS_BOTS                = "read_others_bots"
+	PERMISSION_MANAGE_BOTS                     = "manage_bots"
+	PERMISSION_MANAGE_OTHERS_BOTS              = "manage_others_bots"
 )
 
 func isRole(role string) func(string, map[string]bool) bool {
@@ -184,6 +190,16 @@ func removePermanentDeleteUserMigration() permissionsMap {
 	}
 }
 
+func getAddBotPermissionsMigration() permissionsMap {
+	return permissionsMap{
+		permissionTransformation{
+			On:     isRole(model.SYSTEM_ADMIN_ROLE_ID),
+			Add:    []string{PERMISSION_CREATE_BOT, PERMISSION_READ_BOTS, PERMISSION_READ_OTHERS_BOTS, PERMISSION_MANAGE_BOTS, PERMISSION_MANAGE_OTHERS_BOTS},
+			Remove: []string{},
+		},
+	}
+}
+
 // DoPermissionsMigrations execute all the permissions migrations need by the current version.
 func (a *App) DoPermissionsMigrations() *model.AppError {
 	PermissionsMigrations := []struct {
@@ -194,6 +210,7 @@ func (a *App) DoPermissionsMigrations() *model.AppError {
 		{Key: MIGRATION_KEY_WEBHOOK_PERMISSIONS_SPLIT, Migration: getWebhooksPermissionsSplitMigration},
 		{Key: MIGRATION_KEY_LIST_JOIN_PUBLIC_PRIVATE_TEAMS, Migration: getListJoinPublicPrivateTeamsPermissionsMigration},
 		{Key: MIGRATION_KEY_REMOVE_PERMANENT_DELETE_USER, Migration: removePermanentDeleteUserMigration},
+		{Key: MIGRATION_KEY_ADD_BOT_PERMISSIONS, Migration: getAddBotPermissionsMigration},
 	}
 
 	for _, migration := range PermissionsMigrations {

store/sqlstore/upgrade.go

@@ -616,27 +616,6 @@ func UpgradeDatabaseToVersion59(sqlStore SqlStore) {
 
 func UpgradeDatabaseToVersion510(sqlStore SqlStore) {
 	if shouldPerformUpgrade(sqlStore, VERSION_5_9_0, VERSION_5_10_0) {
-
-		// Grant new bot permissions to the system admin. Ideally we'd use the RoleStore directly,
-		// but it uses the new supplier model, which isn't initialized in the UpgradeDatabase code
-		// path. Also, the role won't exist for new servers, so don't fail on fetch, and don't
-		// bother inserting since it will be created with the new permissions anyway.
-		if role, err := getRole(sqlStore, model.SYSTEM_ADMIN_ROLE_ID); err != nil {
-			mlog.Warn("Failed to find role " + model.SYSTEM_ADMIN_ROLE_ID + " for upgrade: " + err.Error())
-		} else {
-			role.Permissions = append(role.Permissions, model.PERMISSION_CREATE_BOT.Id)
-			role.Permissions = append(role.Permissions, model.PERMISSION_READ_BOTS.Id)
-			role.Permissions = append(role.Permissions, model.PERMISSION_READ_OTHERS_BOTS.Id)
-			role.Permissions = append(role.Permissions, model.PERMISSION_MANAGE_BOTS.Id)
-			role.Permissions = append(role.Permissions, model.PERMISSION_MANAGE_OTHERS_BOTS.Id)
-
-			if err := saveRole(sqlStore, role); err != nil {
-				mlog.Critical(err.Error())
-				time.Sleep(time.Second)
-				os.Exit(EXIT_ROLE_MIGRATION_FAILED)
-			}
-		}
-
 		sqlStore.CreateColumnIfNotExistsNoDefault("Channels", "GroupConstrained", "tinyint(4)", "boolean")
 		sqlStore.CreateColumnIfNotExistsNoDefault("Teams", "GroupConstrained", "tinyint(4)", "boolean")