MM-15021: Adding new builtin system schema for Guests (#10601)

* MM-15021: Adding new builtin system schema for Guests * Fixing tests * Setting properly the permissions * Adding guests to sampledata * Restrict more roles updates in the app layer for guests * Adding comment to explain that permissions migration must go at the end * Setting the default guest role for custom scheme during migration * Fixing import and export * Creating scheme guest roles on migration * Fixing tests * Fixing tests * Fixing tests
2019-04-30 20:36:21 +02:00
--- a/api4/apitestlib.go
+++ b/api4/apitestlib.go
@@ -104,8 +104,7 @@ func setupTestHelper(enterprise bool, updateConfig func(*model.Config)) *TestHel
 	web.New(th.Server, th.Server.AppOptions, th.App.Srv.Router)
 	wsapi.Init(th.App, th.App.Srv.WebSocketRouter)
 	th.App.Srv.Store.MarkSystemRanUnitTests()
-	th.App.DoAdvancedPermissionsMigration()
-	th.App.DoEmojisPermissionsMigration()
+	th.App.DoAppMigrations()

 	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.EnableOpenServer = true })

--- a/api4/channel.go
+++ b/api4/channel.go
@@ -1041,7 +1041,7 @@ func updateChannelMemberSchemeRoles(c *Context, w http.ResponseWriter, r *http.R
 		return
 	}

-	if _, err := c.App.UpdateChannelMemberSchemeRoles(c.Params.ChannelId, c.Params.UserId, schemeRoles.SchemeUser, schemeRoles.SchemeAdmin); err != nil {
+	if _, err := c.App.UpdateChannelMemberSchemeRoles(c.Params.ChannelId, c.Params.UserId, schemeRoles.SchemeGuest, schemeRoles.SchemeUser, schemeRoles.SchemeAdmin); err != nil {
 		c.Err = err
 		return
 	}
--- a/api4/channel_test.go
+++ b/api4/channel_test.go
@@ -1767,52 +1767,82 @@ func TestUpdateChannelMemberSchemeRoles(t *testing.T) {
 	s1 := &model.SchemeRoles{
 		SchemeAdmin: false,
 		SchemeUser:  false,
+		SchemeGuest: false,
 	}
 	_, r1 := SystemAdminClient.UpdateChannelMemberSchemeRoles(th.BasicChannel.Id, th.BasicUser.Id, s1)
 	CheckNoError(t, r1)

 	tm1, rtm1 := SystemAdminClient.GetChannelMember(th.BasicChannel.Id, th.BasicUser.Id, "")
 	CheckNoError(t, rtm1)
+	assert.Equal(t, false, tm1.SchemeGuest)
 	assert.Equal(t, false, tm1.SchemeUser)
 	assert.Equal(t, false, tm1.SchemeAdmin)

 	s2 := &model.SchemeRoles{
 		SchemeAdmin: false,
 		SchemeUser:  true,
+		SchemeGuest: false,
 	}
 	_, r2 := SystemAdminClient.UpdateChannelMemberSchemeRoles(th.BasicChannel.Id, th.BasicUser.Id, s2)
 	CheckNoError(t, r2)

 	tm2, rtm2 := SystemAdminClient.GetChannelMember(th.BasicChannel.Id, th.BasicUser.Id, "")
 	CheckNoError(t, rtm2)
+	assert.Equal(t, false, tm2.SchemeGuest)
 	assert.Equal(t, true, tm2.SchemeUser)
 	assert.Equal(t, false, tm2.SchemeAdmin)

 	s3 := &model.SchemeRoles{
 		SchemeAdmin: true,
 		SchemeUser:  false,
+		SchemeGuest: false,
 	}
 	_, r3 := SystemAdminClient.UpdateChannelMemberSchemeRoles(th.BasicChannel.Id, th.BasicUser.Id, s3)
 	CheckNoError(t, r3)

 	tm3, rtm3 := SystemAdminClient.GetChannelMember(th.BasicChannel.Id, th.BasicUser.Id, "")
 	CheckNoError(t, rtm3)
+	assert.Equal(t, false, tm3.SchemeGuest)
 	assert.Equal(t, false, tm3.SchemeUser)
 	assert.Equal(t, true, tm3.SchemeAdmin)

 	s4 := &model.SchemeRoles{
 		SchemeAdmin: true,
 		SchemeUser:  true,
+		SchemeGuest: false,
 	}
 	_, r4 := SystemAdminClient.UpdateChannelMemberSchemeRoles(th.BasicChannel.Id, th.BasicUser.Id, s4)
 	CheckNoError(t, r4)

 	tm4, rtm4 := SystemAdminClient.GetChannelMember(th.BasicChannel.Id, th.BasicUser.Id, "")
 	CheckNoError(t, rtm4)
+	assert.Equal(t, false, tm4.SchemeGuest)
 	assert.Equal(t, true, tm4.SchemeUser)
 	assert.Equal(t, true, tm4.SchemeAdmin)

-	_, resp := SystemAdminClient.UpdateChannelMemberSchemeRoles(model.NewId(), th.BasicUser.Id, s4)
+	s5 := &model.SchemeRoles{
+		SchemeAdmin: false,
+		SchemeUser:  false,
+		SchemeGuest: true,
+	}
+	_, r5 := SystemAdminClient.UpdateChannelMemberSchemeRoles(th.BasicChannel.Id, th.BasicUser.Id, s5)
+	CheckNoError(t, r5)
+
+	tm5, rtm5 := SystemAdminClient.GetChannelMember(th.BasicChannel.Id, th.BasicUser.Id, "")
+	CheckNoError(t, rtm5)
+	assert.Equal(t, true, tm5.SchemeGuest)
+	assert.Equal(t, false, tm5.SchemeUser)
+	assert.Equal(t, false, tm5.SchemeAdmin)
+
+	s6 := &model.SchemeRoles{
+		SchemeAdmin: false,
+		SchemeUser:  true,
+		SchemeGuest: true,
+	}
+	_, resp := SystemAdminClient.UpdateChannelMemberSchemeRoles(th.BasicChannel.Id, th.BasicUser.Id, s6)
+	CheckBadRequestStatus(t, resp)
+
+	_, resp = SystemAdminClient.UpdateChannelMemberSchemeRoles(model.NewId(), th.BasicUser.Id, s4)
 	CheckForbiddenStatus(t, resp)

 	_, resp = SystemAdminClient.UpdateChannelMemberSchemeRoles(th.BasicChannel.Id, model.NewId(), s4)
--- a/api4/scheme_test.go
+++ b/api4/scheme_test.go
@@ -41,8 +41,10 @@ func TestCreateScheme(t *testing.T) {
 	assert.Equal(t, s1.Scope, scheme1.Scope)
 	assert.NotZero(t, len(s1.DefaultTeamAdminRole))
 	assert.NotZero(t, len(s1.DefaultTeamUserRole))
+	assert.NotZero(t, len(s1.DefaultTeamGuestRole))
 	assert.NotZero(t, len(s1.DefaultChannelAdminRole))
 	assert.NotZero(t, len(s1.DefaultChannelUserRole))
+	assert.NotZero(t, len(s1.DefaultChannelGuestRole))

 	// Check the default roles have been created.
 	_, roleRes1 := th.SystemAdminClient.GetRoleByName(s1.DefaultTeamAdminRole)
@@ -53,6 +55,10 @@ func TestCreateScheme(t *testing.T) {
 	CheckNoError(t, roleRes3)
 	_, roleRes4 := th.SystemAdminClient.GetRoleByName(s1.DefaultChannelUserRole)
 	CheckNoError(t, roleRes4)
+	_, roleRes5 := th.SystemAdminClient.GetRoleByName(s1.DefaultTeamGuestRole)
+	CheckNoError(t, roleRes5)
+	_, roleRes6 := th.SystemAdminClient.GetRoleByName(s1.DefaultChannelGuestRole)
+	CheckNoError(t, roleRes6)

 	// Basic Test of a Channel scheme.
 	scheme2 := &model.Scheme{
@@ -74,14 +80,18 @@ func TestCreateScheme(t *testing.T) {
 	assert.Equal(t, s2.Scope, scheme2.Scope)
 	assert.Zero(t, len(s2.DefaultTeamAdminRole))
 	assert.Zero(t, len(s2.DefaultTeamUserRole))
+	assert.Zero(t, len(s2.DefaultTeamGuestRole))
 	assert.NotZero(t, len(s2.DefaultChannelAdminRole))
 	assert.NotZero(t, len(s2.DefaultChannelUserRole))
+	assert.NotZero(t, len(s2.DefaultChannelGuestRole))

 	// Check the default roles have been created.
-	_, roleRes5 := th.SystemAdminClient.GetRoleByName(s2.DefaultChannelAdminRole)
-	CheckNoError(t, roleRes5)
-	_, roleRes6 := th.SystemAdminClient.GetRoleByName(s2.DefaultChannelUserRole)
-	CheckNoError(t, roleRes6)
+	_, roleRes7 := th.SystemAdminClient.GetRoleByName(s2.DefaultChannelAdminRole)
+	CheckNoError(t, roleRes7)
+	_, roleRes8 := th.SystemAdminClient.GetRoleByName(s2.DefaultChannelUserRole)
+	CheckNoError(t, roleRes8)
+	_, roleRes9 := th.SystemAdminClient.GetRoleByName(s2.DefaultChannelGuestRole)
+	CheckNoError(t, roleRes9)

 	// Try and create a scheme with an invalid scope.
 	scheme3 := &model.Scheme{
@@ -178,8 +188,10 @@ func TestGetScheme(t *testing.T) {
 	assert.Equal(t, s1.Scope, scheme1.Scope)
 	assert.NotZero(t, len(s1.DefaultTeamAdminRole))
 	assert.NotZero(t, len(s1.DefaultTeamUserRole))
+	assert.NotZero(t, len(s1.DefaultTeamGuestRole))
 	assert.NotZero(t, len(s1.DefaultChannelAdminRole))
 	assert.NotZero(t, len(s1.DefaultChannelUserRole))
+	assert.NotZero(t, len(s1.DefaultChannelGuestRole))

 	s2, r2 := th.SystemAdminClient.GetScheme(s1.Id)
 	CheckNoError(t, r2)
@@ -490,8 +502,10 @@ func TestPatchScheme(t *testing.T) {
 	assert.Equal(t, s1.Scope, scheme1.Scope)
 	assert.NotZero(t, len(s1.DefaultTeamAdminRole))
 	assert.NotZero(t, len(s1.DefaultTeamUserRole))
+	assert.NotZero(t, len(s1.DefaultTeamGuestRole))
 	assert.NotZero(t, len(s1.DefaultChannelAdminRole))
 	assert.NotZero(t, len(s1.DefaultChannelUserRole))
+	assert.NotZero(t, len(s1.DefaultChannelGuestRole))

 	s2, r2 := th.SystemAdminClient.GetScheme(s1.Id)
 	CheckNoError(t, r2)
@@ -596,11 +610,17 @@ func TestDeleteScheme(t *testing.T) {
 		CheckNoError(t, roleRes3)
 		role4, roleRes4 := th.SystemAdminClient.GetRoleByName(s1.DefaultChannelUserRole)
 		CheckNoError(t, roleRes4)
+		role5, roleRes5 := th.SystemAdminClient.GetRoleByName(s1.DefaultTeamGuestRole)
+		CheckNoError(t, roleRes5)
+		role6, roleRes6 := th.SystemAdminClient.GetRoleByName(s1.DefaultChannelGuestRole)
+		CheckNoError(t, roleRes6)

 		assert.Zero(t, role1.DeleteAt)
 		assert.Zero(t, role2.DeleteAt)
 		assert.Zero(t, role3.DeleteAt)
 		assert.Zero(t, role4.DeleteAt)
+		assert.Zero(t, role5.DeleteAt)
+		assert.Zero(t, role6.DeleteAt)

 		// Make sure this scheme is in use by a team.
 		team, err := th.App.Srv.Store.Team().Save(&model.Team{
@@ -625,11 +645,17 @@ func TestDeleteScheme(t *testing.T) {
 		CheckNoError(t, roleRes3)
 		role4, roleRes4 = th.SystemAdminClient.GetRoleByName(s1.DefaultChannelUserRole)
 		CheckNoError(t, roleRes4)
+		role5, roleRes5 = th.SystemAdminClient.GetRoleByName(s1.DefaultTeamGuestRole)
+		CheckNoError(t, roleRes5)
+		role6, roleRes6 = th.SystemAdminClient.GetRoleByName(s1.DefaultChannelGuestRole)
+		CheckNoError(t, roleRes6)

 		assert.NotZero(t, role1.DeleteAt)
 		assert.NotZero(t, role2.DeleteAt)
 		assert.NotZero(t, role3.DeleteAt)
 		assert.NotZero(t, role4.DeleteAt)
+		assert.NotZero(t, role5.DeleteAt)
+		assert.NotZero(t, role6.DeleteAt)

 		// Check the team now uses the default scheme
 		c2, resp := th.SystemAdminClient.GetTeam(team.Id, "")
@@ -658,9 +684,12 @@ func TestDeleteScheme(t *testing.T) {
 		CheckNoError(t, roleRes3)
 		role4, roleRes4 := th.SystemAdminClient.GetRoleByName(s1.DefaultChannelUserRole)
 		CheckNoError(t, roleRes4)
+		role6, roleRes6 := th.SystemAdminClient.GetRoleByName(s1.DefaultChannelGuestRole)
+		CheckNoError(t, roleRes6)

 		assert.Zero(t, role3.DeleteAt)
 		assert.Zero(t, role4.DeleteAt)
+		assert.Zero(t, role6.DeleteAt)

 		// Make sure this scheme is in use by a team.
 		res := <-th.App.Srv.Store.Channel().Save(&model.Channel{
@@ -682,9 +711,12 @@ func TestDeleteScheme(t *testing.T) {
 		CheckNoError(t, roleRes3)
 		role4, roleRes4 = th.SystemAdminClient.GetRoleByName(s1.DefaultChannelUserRole)
 		CheckNoError(t, roleRes4)
+		role6, roleRes6 = th.SystemAdminClient.GetRoleByName(s1.DefaultChannelGuestRole)
+		CheckNoError(t, roleRes6)

 		assert.NotZero(t, role3.DeleteAt)
 		assert.NotZero(t, role4.DeleteAt)
+		assert.NotZero(t, role6.DeleteAt)

 		// Check the channel now uses the default scheme
 		c2, resp := th.SystemAdminClient.GetChannelByName(channel.Name, channel.TeamId, "")
--- a/api4/team.go
+++ b/api4/team.go
@@ -701,7 +701,7 @@ func updateTeamMemberSchemeRoles(c *Context, w http.ResponseWriter, r *http.Requ
 		return
 	}

-	if _, err := c.App.UpdateTeamMemberSchemeRoles(c.Params.TeamId, c.Params.UserId, schemeRoles.SchemeUser, schemeRoles.SchemeAdmin); err != nil {
+	if _, err := c.App.UpdateTeamMemberSchemeRoles(c.Params.TeamId, c.Params.UserId, schemeRoles.SchemeGuest, schemeRoles.SchemeUser, schemeRoles.SchemeAdmin); err != nil {
 		c.Err = err
 		return
 	}
--- a/api4/team_test.go
+++ b/api4/team_test.go
@@ -1933,52 +1933,82 @@ func TestUpdateTeamMemberSchemeRoles(t *testing.T) {
 	s1 := &model.SchemeRoles{
 		SchemeAdmin: false,
 		SchemeUser:  false,
+		SchemeGuest: false,
 	}
 	_, r1 := SystemAdminClient.UpdateTeamMemberSchemeRoles(th.BasicTeam.Id, th.BasicUser.Id, s1)
 	CheckNoError(t, r1)

 	tm1, rtm1 := SystemAdminClient.GetTeamMember(th.BasicTeam.Id, th.BasicUser.Id, "")
 	CheckNoError(t, rtm1)
+	assert.Equal(t, false, tm1.SchemeGuest)
 	assert.Equal(t, false, tm1.SchemeUser)
 	assert.Equal(t, false, tm1.SchemeAdmin)

 	s2 := &model.SchemeRoles{
 		SchemeAdmin: false,
 		SchemeUser:  true,
+		SchemeGuest: false,
 	}
 	_, r2 := SystemAdminClient.UpdateTeamMemberSchemeRoles(th.BasicTeam.Id, th.BasicUser.Id, s2)
 	CheckNoError(t, r2)

 	tm2, rtm2 := SystemAdminClient.GetTeamMember(th.BasicTeam.Id, th.BasicUser.Id, "")
 	CheckNoError(t, rtm2)
+	assert.Equal(t, false, tm2.SchemeGuest)
 	assert.Equal(t, true, tm2.SchemeUser)
 	assert.Equal(t, false, tm2.SchemeAdmin)

 	s3 := &model.SchemeRoles{
 		SchemeAdmin: true,
 		SchemeUser:  false,
+		SchemeGuest: false,
 	}
 	_, r3 := SystemAdminClient.UpdateTeamMemberSchemeRoles(th.BasicTeam.Id, th.BasicUser.Id, s3)
 	CheckNoError(t, r3)

 	tm3, rtm3 := SystemAdminClient.GetTeamMember(th.BasicTeam.Id, th.BasicUser.Id, "")
 	CheckNoError(t, rtm3)
+	assert.Equal(t, false, tm3.SchemeGuest)
 	assert.Equal(t, false, tm3.SchemeUser)
 	assert.Equal(t, true, tm3.SchemeAdmin)

 	s4 := &model.SchemeRoles{
 		SchemeAdmin: true,
 		SchemeUser:  true,
+		SchemeGuest: false,
 	}
 	_, r4 := SystemAdminClient.UpdateTeamMemberSchemeRoles(th.BasicTeam.Id, th.BasicUser.Id, s4)
 	CheckNoError(t, r4)

 	tm4, rtm4 := SystemAdminClient.GetTeamMember(th.BasicTeam.Id, th.BasicUser.Id, "")
 	CheckNoError(t, rtm4)
+	assert.Equal(t, false, tm4.SchemeGuest)
 	assert.Equal(t, true, tm4.SchemeUser)
 	assert.Equal(t, true, tm4.SchemeAdmin)

-	_, resp := SystemAdminClient.UpdateTeamMemberSchemeRoles(model.NewId(), th.BasicUser.Id, s4)
+	s5 := &model.SchemeRoles{
+		SchemeAdmin: false,
+		SchemeUser:  false,
+		SchemeGuest: true,
+	}
+	_, r5 := SystemAdminClient.UpdateTeamMemberSchemeRoles(th.BasicTeam.Id, th.BasicUser.Id, s5)
+	CheckNoError(t, r5)
+
+	tm5, rtm5 := SystemAdminClient.GetTeamMember(th.BasicTeam.Id, th.BasicUser.Id, "")
+	CheckNoError(t, rtm5)
+	assert.Equal(t, true, tm5.SchemeGuest)
+	assert.Equal(t, false, tm5.SchemeUser)
+	assert.Equal(t, false, tm5.SchemeAdmin)
+
+	s6 := &model.SchemeRoles{
+		SchemeAdmin: false,
+		SchemeUser:  true,
+		SchemeGuest: true,
+	}
+	_, resp := SystemAdminClient.UpdateTeamMemberSchemeRoles(th.BasicTeam.Id, th.BasicUser.Id, s6)
+	CheckBadRequestStatus(t, resp)
+
+	_, resp = SystemAdminClient.UpdateTeamMemberSchemeRoles(model.NewId(), th.BasicUser.Id, s4)
 	CheckNotFoundStatus(t, resp)

 	_, resp = SystemAdminClient.UpdateTeamMemberSchemeRoles(th.BasicTeam.Id, model.NewId(), s4)