MM-58776 - Change Ancillary Permissions API to POST (#27504)

* make /ancillary a post

* remove get from client, fix tests

* Update permissions.yaml

server/channels/api4/permission.go

@@ -12,7 +12,9 @@ import (
 )
 
 func (api *API) InitPermissions() {
+	// to be deprecated - kept for backward compatibility
 	api.BaseRoutes.Permissions.Handle("/ancillary", api.APISessionRequired(appendAncillaryPermissions)).Methods("GET")
+	api.BaseRoutes.Permissions.Handle("/ancillary", api.APISessionRequired(appendAncillaryPermissionsPost)).Methods("POST")
 }
 
 func appendAncillaryPermissions(c *Context, w http.ResponseWriter, r *http.Request) {
@@ -32,3 +34,17 @@ func appendAncillaryPermissions(c *Context, w http.ResponseWriter, r *http.Reque
 
 	w.Write(b)
 }
+
+func appendAncillaryPermissionsPost(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissions, err := model.NonSortedArrayFromJSON(r.Body)
+	if err != nil || len(permissions) < 1 {
+		c.Err = model.NewAppError("appendAncillaryPermissionsPost", model.PayloadParseError, nil, "", http.StatusBadRequest).Wrap(err)
+		return
+	}
+	b, err := json.Marshal(model.AddAncillaryPermissions(permissions))
+	if err != nil {
+		c.SetJSONEncodingError(err)
+		return
+	}
+	w.Write(b)
+}

server/public/model/client4.go

@@ -8852,8 +8852,8 @@ func (c *Client4) DeleteRemoteCluster(ctx context.Context, remoteClusterId strin
 
 func (c *Client4) GetAncillaryPermissions(ctx context.Context, subsectionPermissions []string) ([]string, *Response, error) {
 	var returnedPermissions []string
-	url := fmt.Sprintf("%s/ancillary?subsection_permissions=%s", c.permissionsRoute(), strings.Join(subsectionPermissions, ","))
-	r, err := c.DoAPIGet(ctx, url, "")
+	url := fmt.Sprintf("%s/ancillary", c.permissionsRoute())
+	r, err := c.DoAPIPost(ctx, url, ArrayToJSON(subsectionPermissions))
 	if err != nil {
 		return returnedPermissions, BuildResponse(r), err
 	}