MM-15021: Adding new builtin system schema for Guests (#10601)

* MM-15021: Adding new builtin system schema for Guests

* Fixing tests

* Setting properly the permissions

* Adding guests to sampledata

* Restrict more roles updates in the app layer for guests

* Adding comment to explain that permissions migration must go at the end

* Setting the default guest role for custom scheme during migration

* Fixing import and export

* Creating scheme guest roles on migration

* Fixing tests

* Fixing tests

* Fixing tests

model/channel_member.go

@@ -40,6 +40,7 @@ type ChannelMember struct {
 	MentionCount  int64     `json:"mention_count"`
 	NotifyProps   StringMap `json:"notify_props"`
 	LastUpdateAt  int64     `json:"last_update_at"`
+	SchemeGuest   bool      `json:"scheme_guest"`
 	SchemeUser    bool      `json:"scheme_user"`
 	SchemeAdmin   bool      `json:"scheme_admin"`
 	ExplicitRoles string    `json:"explicit_roles"`

model/role.go

@@ -10,17 +10,20 @@ import (
 )
 
 const (
+	SYSTEM_GUEST_ROLE_ID             = "system_guest"
 	SYSTEM_USER_ROLE_ID              = "system_user"
 	SYSTEM_ADMIN_ROLE_ID             = "system_admin"
 	SYSTEM_POST_ALL_ROLE_ID          = "system_post_all"
 	SYSTEM_POST_ALL_PUBLIC_ROLE_ID   = "system_post_all_public"
 	SYSTEM_USER_ACCESS_TOKEN_ROLE_ID = "system_user_access_token"
 
+	TEAM_GUEST_ROLE_ID           = "team_guest"
 	TEAM_USER_ROLE_ID            = "team_user"
 	TEAM_ADMIN_ROLE_ID           = "team_admin"
 	TEAM_POST_ALL_ROLE_ID        = "team_post_all"
 	TEAM_POST_ALL_PUBLIC_ROLE_ID = "team_post_all_public"
 
+	CHANNEL_GUEST_ROLE_ID = "channel_guest"
 	CHANNEL_USER_ROLE_ID  = "channel_user"
 	CHANNEL_ADMIN_ROLE_ID = "channel_admin"
 
@@ -173,6 +176,23 @@ func IsValidRoleName(roleName string) bool {
 func MakeDefaultRoles() map[string]*Role {
 	roles := make(map[string]*Role)
 
+	roles[CHANNEL_GUEST_ROLE_ID] = &Role{
+		Name:        "channel_guest",
+		DisplayName: "authentication.roles.channel_guest.name",
+		Description: "authentication.roles.channel_guest.description",
+		Permissions: []string{
+			PERMISSION_READ_CHANNEL.Id,
+			PERMISSION_ADD_REACTION.Id,
+			PERMISSION_REMOVE_REACTION.Id,
+			PERMISSION_UPLOAD_FILE.Id,
+			PERMISSION_EDIT_POST.Id,
+			PERMISSION_CREATE_POST.Id,
+			PERMISSION_USE_SLASH_COMMANDS.Id,
+		},
+		SchemeManaged: true,
+		BuiltIn:       true,
+	}
+
 	roles[CHANNEL_USER_ROLE_ID] = &Role{
 		Name:        "channel_user",
 		DisplayName: "authentication.roles.channel_user.name",
@@ -202,6 +222,17 @@ func MakeDefaultRoles() map[string]*Role {
 		BuiltIn:       true,
 	}
 
+	roles[TEAM_GUEST_ROLE_ID] = &Role{
+		Name:        "team_guest",
+		DisplayName: "authentication.roles.team_guest.name",
+		Description: "authentication.roles.team_guest.description",
+		Permissions: []string{
+			PERMISSION_VIEW_TEAM.Id,
+		},
+		SchemeManaged: true,
+		BuiltIn:       true,
+	}
+
 	roles[TEAM_USER_ROLE_ID] = &Role{
 		Name:        "team_user",
 		DisplayName: "authentication.roles.team_user.name",
@@ -259,6 +290,18 @@ func MakeDefaultRoles() map[string]*Role {
 		BuiltIn:       true,
 	}
 
+	roles[SYSTEM_GUEST_ROLE_ID] = &Role{
+		Name:        "system_guest",
+		DisplayName: "authentication.roles.global_guest.name",
+		Description: "authentication.roles.global_guest.description",
+		Permissions: []string{
+			PERMISSION_CREATE_DIRECT_CHANNEL.Id,
+			PERMISSION_CREATE_GROUP_CHANNEL.Id,
+		},
+		SchemeManaged: true,
+		BuiltIn:       true,
+	}
+
 	roles[SYSTEM_USER_ROLE_ID] = &Role{
 		Name:        "system_user",
 		DisplayName: "authentication.roles.global_user.name",

model/scheme.go

@@ -29,8 +29,10 @@ type Scheme struct {
 	Scope                   string `json:"scope"`
 	DefaultTeamAdminRole    string `json:"default_team_admin_role"`
 	DefaultTeamUserRole     string `json:"default_team_user_role"`
+	DefaultTeamGuestRole    string `json:"default_team_guest_role"`
 	DefaultChannelAdminRole string `json:"default_channel_admin_role"`
 	DefaultChannelUserRole  string `json:"default_channel_user_role"`
+	DefaultChannelGuestRole string `json:"default_channel_guest_role"`
 }
 
 type SchemePatch struct {
@@ -51,8 +53,10 @@ type SchemeConveyor struct {
 	Scope        string  `json:"scope"`
 	TeamAdmin    string  `json:"default_team_admin_role"`
 	TeamUser     string  `json:"default_team_user_role"`
+	TeamGuest    string  `json:"default_team_guest_role"`
 	ChannelAdmin string  `json:"default_channel_admin_role"`
 	ChannelUser  string  `json:"default_channel_user_role"`
+	ChannelGuest string  `json:"default_channel_guest_role"`
 	Roles        []*Role `json:"roles"`
 }
 
@@ -64,14 +68,17 @@ func (sc *SchemeConveyor) Scheme() *Scheme {
 		Scope:                   sc.Scope,
 		DefaultTeamAdminRole:    sc.TeamAdmin,
 		DefaultTeamUserRole:     sc.TeamUser,
+		DefaultTeamGuestRole:    sc.TeamGuest,
 		DefaultChannelAdminRole: sc.ChannelAdmin,
 		DefaultChannelUserRole:  sc.ChannelUser,
+		DefaultChannelGuestRole: sc.ChannelGuest,
 	}
 }
 
 type SchemeRoles struct {
 	SchemeAdmin bool `json:"scheme_admin"`
 	SchemeUser  bool `json:"scheme_user"`
+	SchemeGuest bool `json:"scheme_guest"`
 }
 
 func (scheme *Scheme) ToJson() string {
@@ -134,6 +141,10 @@ func (scheme *Scheme) IsValidForCreate() bool {
 		return false
 	}
 
+	if !IsValidRoleName(scheme.DefaultChannelGuestRole) {
+		return false
+	}
+
 	if scheme.Scope == SCHEME_SCOPE_TEAM {
 		if !IsValidRoleName(scheme.DefaultTeamAdminRole) {
 			return false
@@ -142,6 +153,10 @@ func (scheme *Scheme) IsValidForCreate() bool {
 		if !IsValidRoleName(scheme.DefaultTeamUserRole) {
 			return false
 		}
+
+		if !IsValidRoleName(scheme.DefaultTeamGuestRole) {
+			return false
+		}
 	}
 
 	if scheme.Scope == SCHEME_SCOPE_CHANNEL {
@@ -152,6 +167,10 @@ func (scheme *Scheme) IsValidForCreate() bool {
 		if len(scheme.DefaultTeamUserRole) != 0 {
 			return false
 		}
+
+		if len(scheme.DefaultTeamGuestRole) != 0 {
+			return false
+		}
 	}
 
 	return true

model/team_member.go

@@ -15,6 +15,7 @@ type TeamMember struct {
 	UserId        string `json:"user_id"`
 	Roles         string `json:"roles"`
 	DeleteAt      int64  `json:"delete_at"`
+	SchemeGuest   bool   `json:"scheme_guest"`
 	SchemeUser    bool   `json:"scheme_user"`
 	SchemeAdmin   bool   `json:"scheme_admin"`
 	ExplicitRoles string `json:"explicit_roles"`

model/user.go

@@ -565,6 +565,12 @@ func IsValidUserRoles(userRoles string) bool {
 	return true
 }
 
+// Make sure you acually want to use this function. In context.go there are functions to check permissions
+// This function should not be used to check permissions.
+func (u *User) IsGuest() bool {
+	return IsInRole(u.Roles, SYSTEM_GUEST_ROLE_ID)
+}
+
 // Make sure you acually want to use this function. In context.go there are functions to check permissions
 // This function should not be used to check permissions.
 func (u *User) IsInRole(inRole string) bool {