MM-38150 Adding playbooks permissions (#19096)

* Add playbooks related permissions.

* Add RolesGrantPermission to pluginapi

* Fixing scopes.

* New defaults.

* Fix defaults

* Fix tests.

* Fix migration.

* More test and migration fixes.

* Need to add everything to system admin too.

* Move to 63

* Feedback fixes.

* Fix system manager editing playbook permissions.

app/app_test.go

@@ -89,6 +89,10 @@ func TestDoAdvancedPermissionsMigration(t *testing.T) {
 		"system_user_access_token",
 		"team_post_all",
 		"team_post_all_public",
+		"playbook_admin",
+		"playbook_member",
+		"run_admin",
+		"run_member",
 	}
 
 	roles1, err1 := th.App.GetRolesByNames(roleNames)

app/migrations.go

@@ -16,6 +16,7 @@ const EmojisPermissionsMigrationKey = "EmojisPermissionsMigrationComplete"
 const GuestRolesCreationMigrationKey = "GuestRolesCreationMigrationComplete"
 const SystemConsoleRolesCreationMigrationKey = "SystemConsoleRolesCreationMigrationComplete"
 const ContentExtractionConfigDefaultTrueMigrationKey = "ContentExtractionConfigDefaultTrueMigrationComplete"
+const PlaybookRolesCreationMigrationKey = "PlaybookRolesCreationMigrationComplete"
 
 // This function migrates the default built in roles from code/config to the database.
 func (a *App) DoAdvancedPermissionsMigration() {
@@ -307,6 +308,132 @@ func (s *Server) doContentExtractionConfigDefaultTrueMigration() {
 	}
 }
 
+func (s *Server) doPlaybooksRolesCreationMigration() {
+	// If the migration is already marked as completed, don't do it again.
+	if _, err := s.Store.System().GetByName(PlaybookRolesCreationMigrationKey); err == nil {
+		return
+	}
+
+	roles := model.MakeDefaultRoles()
+
+	allSucceeded := true
+	if _, err := s.Store.Role().GetByName(context.Background(), model.PlaybookAdminRoleId); err != nil {
+		if _, err := s.Store.Role().Save(roles[model.PlaybookAdminRoleId]); err != nil {
+			mlog.Critical("Failed to create new playbook admin role to database.", mlog.Err(err))
+			allSucceeded = false
+		}
+	}
+	if _, err := s.Store.Role().GetByName(context.Background(), model.PlaybookMemberRoleId); err != nil {
+		if _, err := s.Store.Role().Save(roles[model.PlaybookMemberRoleId]); err != nil {
+			mlog.Critical("Failed to create new playbook member role to database.", mlog.Err(err))
+			allSucceeded = false
+		}
+	}
+	if _, err := s.Store.Role().GetByName(context.Background(), model.RunAdminRoleId); err != nil {
+		if _, err := s.Store.Role().Save(roles[model.RunAdminRoleId]); err != nil {
+			mlog.Critical("Failed to create new run admin role to database.", mlog.Err(err))
+			allSucceeded = false
+		}
+	}
+	if _, err := s.Store.Role().GetByName(context.Background(), model.RunMemberRoleId); err != nil {
+		if _, err := s.Store.Role().Save(roles[model.RunMemberRoleId]); err != nil {
+			mlog.Critical("Failed to create new run member role to database.", mlog.Err(err))
+			allSucceeded = false
+		}
+	}
+	schemes, err := s.Store.Scheme().GetAllPage(model.SchemeScopeTeam, 0, 1000000)
+	if err != nil {
+		mlog.Critical("Failed to get all schemes.", mlog.Err(err))
+		allSucceeded = false
+	}
+
+	for _, scheme := range schemes {
+		if scheme.Scope == model.SchemeScopeTeam {
+			if scheme.DefaultPlaybookAdminRole == "" {
+				playbookAdminRole := &model.Role{
+					Name:          model.NewId(),
+					DisplayName:   fmt.Sprintf("Playbook Admin Role for Scheme %s", scheme.Name),
+					Permissions:   roles[model.PlaybookAdminRoleId].Permissions,
+					SchemeManaged: true,
+				}
+
+				if savedRole, err := s.Store.Role().Save(playbookAdminRole); err != nil {
+					mlog.Critical("Failed to create new playbook admin role for existing custom scheme.", mlog.Err(err))
+					allSucceeded = false
+				} else {
+					scheme.DefaultPlaybookAdminRole = savedRole.Name
+				}
+			}
+			if scheme.DefaultPlaybookMemberRole == "" {
+				playbookMember := &model.Role{
+					Name:          model.NewId(),
+					DisplayName:   fmt.Sprintf("Playbook Member Role for Scheme %s", scheme.Name),
+					Permissions:   roles[model.PlaybookMemberRoleId].Permissions,
+					SchemeManaged: true,
+				}
+
+				if savedRole, err := s.Store.Role().Save(playbookMember); err != nil {
+					mlog.Critical("Failed to create new playbook member role for existing custom scheme.", mlog.Err(err))
+					allSucceeded = false
+				} else {
+					scheme.DefaultPlaybookMemberRole = savedRole.Name
+				}
+			}
+
+			if scheme.DefaultRunAdminRole == "" {
+				runAdminRole := &model.Role{
+					Name:          model.NewId(),
+					DisplayName:   fmt.Sprintf("Run Admin Role for Scheme %s", scheme.Name),
+					Permissions:   roles[model.RunAdminRoleId].Permissions,
+					SchemeManaged: true,
+				}
+
+				if savedRole, err := s.Store.Role().Save(runAdminRole); err != nil {
+					mlog.Critical("Failed to create new run admin role for existing custom scheme.", mlog.Err(err))
+					allSucceeded = false
+				} else {
+					scheme.DefaultRunAdminRole = savedRole.Name
+				}
+			}
+
+			if scheme.DefaultRunMemberRole == "" {
+				runMemberRole := &model.Role{
+					Name:          model.NewId(),
+					DisplayName:   fmt.Sprintf("Run Member Role for Scheme %s", scheme.Name),
+					Permissions:   roles[model.RunMemberRoleId].Permissions,
+					SchemeManaged: true,
+				}
+
+				if savedRole, err := s.Store.Role().Save(runMemberRole); err != nil {
+					mlog.Critical("Failed to create new run member role for existing custom scheme.", mlog.Err(err))
+					allSucceeded = false
+				} else {
+					scheme.DefaultRunMemberRole = savedRole.Name
+				}
+			}
+			_, err := s.Store.Scheme().Save(scheme)
+			if err != nil {
+				mlog.Critical("Failed to update custom scheme.", mlog.Err(err))
+				allSucceeded = false
+			}
+		}
+	}
+
+	if !allSucceeded {
+		return
+	}
+
+	system := model.System{
+		Name:  PlaybookRolesCreationMigrationKey,
+		Value: "true",
+	}
+
+	if err := s.Store.System().Save(&system); err != nil {
+		mlog.Critical("Failed to mark playbook roles creation migration as completed.", mlog.Err(err))
+	}
+
+}
+
 func (a *App) DoAppMigrations() {
 	a.Srv().doAppMigrations()
 }
@@ -323,4 +450,5 @@ func (s *Server) doAppMigrations() {
 		mlog.Critical("(app.App).DoPermissionsMigrations failed", mlog.Err(err))
 	}
 	s.doContentExtractionConfigDefaultTrueMigration()
+	s.doPlaybooksRolesCreationMigration()
 }

app/permissions_migrations.go

@@ -915,6 +915,41 @@ func (a *App) getAddTestEmailAncillaryPermission() (permissionsMap, error) {
 	return transformations, nil
 }
 
+func (a *App) getAddPlaybooksPermissions() (permissionsMap, error) {
+	transformations := []permissionTransformation{}
+
+	transformations = append(transformations, permissionTransformation{
+		On: permissionOr(
+			permissionExists(model.PermissionCreatePublicChannel.Id),
+			permissionExists(model.PermissionCreatePrivateChannel.Id),
+		),
+		Add: []string{
+			model.PermissionPublicPlaybookCreate.Id,
+			model.PermissionPrivatePlaybookCreate.Id,
+		},
+	})
+
+	transformations = append(transformations, permissionTransformation{
+		On: isRole(model.SystemAdminRoleId),
+		Add: []string{
+			model.PermissionPublicPlaybookManageProperties.Id,
+			model.PermissionPublicPlaybookManageMembers.Id,
+			model.PermissionPublicPlaybookView.Id,
+			model.PermissionPublicPlaybookMakePrivate.Id,
+			model.PermissionPrivatePlaybookManageProperties.Id,
+			model.PermissionPrivatePlaybookManageMembers.Id,
+			model.PermissionPrivatePlaybookView.Id,
+			model.PermissionPrivatePlaybookMakePublic.Id,
+			model.PermissionRunCreate.Id,
+			model.PermissionRunManageProperties.Id,
+			model.PermissionRunManageMembers.Id,
+			model.PermissionRunView.Id,
+		},
+	})
+
+	return transformations, nil
+}
+
 // DoPermissionsMigrations execute all the permissions migrations need by the current version.
 func (a *App) DoPermissionsMigrations() error {
 	return a.Srv().doPermissionsMigrations()
@@ -953,6 +988,7 @@ func (s *Server) doPermissionsMigrations() error {
 		{Key: model.MigrationKeyAddAboutSubsectionPermissions, Migration: a.getAddAboutSubsectionPermissions},
 		{Key: model.MigrationKeyAddReportingSubsectionPermissions, Migration: a.getAddReportingSubsectionPermissions},
 		{Key: model.MigrationKeyAddTestEmailAncillaryPermission, Migration: a.getAddTestEmailAncillaryPermission},
+		{Key: model.MigrationKeyAddPlaybooksPermissions, Migration: a.getAddPlaybooksPermissions},
 	}
 
 	roles, err := s.Store.Role().GetAll()

app/plugin_api.go

@@ -914,6 +914,10 @@ func (api *PluginAPI) HasPermissionToChannel(userID, channelID string, permissio
 	return api.app.HasPermissionToChannel(userID, channelID, permission)
 }
 
+func (api *PluginAPI) RolesGrantPermission(roleNames []string, permissionId string) bool {
+	return api.app.RolesGrantPermission(roleNames, permissionId)
+}
+
 func (api *PluginAPI) LogDebug(msg string, keyValuePairs ...interface{}) {
 	api.logger.Debugw(msg, keyValuePairs...)
 }

app/scheme.go

@@ -83,6 +83,10 @@ func (a *App) CreateScheme(scheme *model.Scheme) (*model.Scheme, *model.AppError
 	scheme.DefaultChannelAdminRole = ""
 	scheme.DefaultChannelUserRole = ""
 	scheme.DefaultChannelGuestRole = ""
+	scheme.DefaultPlaybookAdminRole = ""
+	scheme.DefaultPlaybookMemberRole = ""
+	scheme.DefaultRunAdminRole = ""
+	scheme.DefaultRunMemberRole = ""
 	scheme.CreateAt = 0
 	scheme.UpdateAt = 0
 	scheme.DeleteAt = 0