MM-38150 Adding playbooks permissions (#19096)

* Add playbooks related permissions. * Add RolesGrantPermission to pluginapi * Fixing scopes. * New defaults. * Fix defaults * Fix tests. * Fix migration. * More test and migration fixes. * Need to add everything to system admin too. * Move to 63 * Feedback fixes. * Fix system manager editing playbook permissions.
2021-12-07 09:43:33 -08:00
--- a/model/migration.go
+++ b/model/migration.go
@@ -36,4 +36,5 @@ const (
 	MigrationKeyAddAboutSubsectionPermissions          = "about_subsection_permissions"
 	MigrationKeyAddIntegrationsSubsectionPermissions   = "integrations_subsection_permissions"
 	MigrationKeyFixCRTChannelUnreads                   = "fix_crt_channel_unreads"
+	MigrationKeyAddPlaybooksPermissions                = "playbooks_permissions"
 )
--- a/model/permission.go
+++ b/model/permission.go
@@ -4,9 +4,11 @@
 package model

 const (
-	PermissionScopeSystem  = "system_scope"
-	PermissionScopeTeam    = "team_scope"
-	PermissionScopeChannel = "channel_scope"
+	PermissionScopeSystem   = "system_scope"
+	PermissionScopeTeam     = "team_scope"
+	PermissionScopeChannel  = "channel_scope"
+	PermissionScopePlaybook = "playbook_scope"
+	PermissionScopeRun      = "run_scope"
 )

 type Permission struct {
@@ -331,6 +333,23 @@ var PermissionSysconsoleWriteExperimentalFeatureFlags *Permission
 var PermissionSysconsoleReadExperimentalBleve *Permission
 var PermissionSysconsoleWriteExperimentalBleve *Permission

+var PermissionPublicPlaybookCreate *Permission
+var PermissionPublicPlaybookManageProperties *Permission
+var PermissionPublicPlaybookManageMembers *Permission
+var PermissionPublicPlaybookView *Permission
+var PermissionPublicPlaybookMakePrivate *Permission
+
+var PermissionPrivatePlaybookCreate *Permission
+var PermissionPrivatePlaybookManageProperties *Permission
+var PermissionPrivatePlaybookManageMembers *Permission
+var PermissionPrivatePlaybookView *Permission
+var PermissionPrivatePlaybookMakePublic *Permission
+
+var PermissionRunCreate *Permission
+var PermissionRunManageProperties *Permission
+var PermissionRunManageMembers *Permission
+var PermissionRunView *Permission
+
 // General permission that encompasses all system admin functions
 // in the future this could be broken up to allow access to some
 // admin functions but not others
@@ -1895,6 +1914,105 @@ func initializePermissions() {
 		PermissionScopeSystem,
 	}

+	// Playbooks
+	PermissionPublicPlaybookCreate = &Permission{
+		"playbook_public_create",
+		"",
+		"",
+		PermissionScopeTeam,
+	}
+
+	PermissionPublicPlaybookManageProperties = &Permission{
+		"playbook_public_manage_properties",
+		"",
+		"",
+		PermissionScopePlaybook,
+	}
+
+	PermissionPublicPlaybookManageMembers = &Permission{
+		"playbook_public_manage_members",
+		"",
+		"",
+		PermissionScopePlaybook,
+	}
+
+	PermissionPublicPlaybookView = &Permission{
+		"playbook_public_view",
+		"",
+		"",
+		PermissionScopePlaybook,
+	}
+
+	PermissionPublicPlaybookMakePrivate = &Permission{
+		"playbook_public_make_private",
+		"",
+		"",
+		PermissionScopePlaybook,
+	}
+
+	PermissionPrivatePlaybookCreate = &Permission{
+		"playbook_private_create",
+		"",
+		"",
+		PermissionScopeTeam,
+	}
+
+	PermissionPrivatePlaybookManageProperties = &Permission{
+		"playbook_private_manage_properties",
+		"",
+		"",
+		PermissionScopePlaybook,
+	}
+
+	PermissionPrivatePlaybookManageMembers = &Permission{
+		"playbook_private_manage_members",
+		"",
+		"",
+		PermissionScopePlaybook,
+	}
+
+	PermissionPrivatePlaybookView = &Permission{
+		"playbook_private_view",
+		"",
+		"",
+		PermissionScopePlaybook,
+	}
+
+	PermissionPrivatePlaybookMakePublic = &Permission{
+		"playbook_private_make_public",
+		"",
+		"",
+		PermissionScopePlaybook,
+	}
+
+	PermissionRunCreate = &Permission{
+		"run_create",
+		"",
+		"",
+		PermissionScopePlaybook,
+	}
+
+	PermissionRunManageProperties = &Permission{
+		"run_manage_properties",
+		"",
+		"",
+		PermissionScopeRun,
+	}
+
+	PermissionRunManageMembers = &Permission{
+		"run_manage_members",
+		"",
+		"",
+		PermissionScopeRun,
+	}
+
+	PermissionRunView = &Permission{
+		"run_view",
+		"",
+		"",
+		PermissionScopeRun,
+	}
+
 	SysconsoleReadPermissions = []*Permission{
 		PermissionSysconsoleReadAboutEditionAndLicense,
 		PermissionSysconsoleReadBilling,
@@ -2108,6 +2226,8 @@ func initializePermissions() {
 		PermissionViewTeam,
 		PermissionViewMembers,
 		PermissionInviteGuest,
+		PermissionPublicPlaybookCreate,
+		PermissionPrivatePlaybookCreate,
 	}

 	ChannelScopedPermissions := []*Permission{
@@ -2163,12 +2283,32 @@ func initializePermissions() {
 		PermissionSysconsoleWriteCompliance,
 	}

+	PlaybookScopedPermissions := []*Permission{
+		PermissionPublicPlaybookManageProperties,
+		PermissionPublicPlaybookManageMembers,
+		PermissionPublicPlaybookView,
+		PermissionPublicPlaybookMakePrivate,
+		PermissionPrivatePlaybookManageProperties,
+		PermissionPrivatePlaybookManageMembers,
+		PermissionPrivatePlaybookView,
+		PermissionPrivatePlaybookMakePublic,
+		PermissionRunCreate,
+	}
+
+	RunScopedPermissions := []*Permission{
+		PermissionRunManageProperties,
+		PermissionRunManageMembers,
+		PermissionRunView,
+	}
+
 	AllPermissions = []*Permission{}
 	AllPermissions = append(AllPermissions, SystemScopedPermissionsMinusSysconsole...)
 	AllPermissions = append(AllPermissions, TeamScopedPermissions...)
 	AllPermissions = append(AllPermissions, ChannelScopedPermissions...)
 	AllPermissions = append(AllPermissions, SysconsoleReadPermissions...)
 	AllPermissions = append(AllPermissions, SysconsoleWritePermissions...)
+	AllPermissions = append(AllPermissions, PlaybookScopedPermissions...)
+	AllPermissions = append(AllPermissions, RunScopedPermissions...)

 	ChannelModeratedPermissions = []string{
 		PermissionCreatePost.Id,
--- a/model/role.go
+++ b/model/role.go
@@ -41,6 +41,11 @@ func init() {
 		ChannelGuestRoleId,
 		ChannelUserRoleId,
 		ChannelAdminRoleId,
+
+		PlaybookAdminRoleId,
+		PlaybookMemberRoleId,
+		RunAdminRoleId,
+		RunMemberRoleId,
 	}, NewSystemRoleIDs...)

 	// When updating the values here, the values in mattermost-redux must also be updated.
@@ -362,6 +367,11 @@ const (
 	ChannelUserRoleId  = "channel_user"
 	ChannelAdminRoleId = "channel_admin"

+	PlaybookAdminRoleId  = "playbook_admin"
+	PlaybookMemberRoleId = "playbook_member"
+	RunAdminRoleId       = "run_admin"
+	RunMemberRoleId      = "run_member"
+
 	RoleNameMaxLength        = 64
 	RoleDisplayNameMaxLength = 128
 	RoleDescriptionMaxLength = 1024
@@ -807,6 +817,61 @@ func MakeDefaultRoles() map[string]*Role {
 		BuiltIn:       true,
 	}

+	roles[PlaybookAdminRoleId] = &Role{
+		Name:        PlaybookAdminRoleId,
+		DisplayName: "authentication.roles.playbook_admin.name",
+		Description: "authentication.roles.playbook_admin.description",
+		Permissions: []string{
+			PermissionPublicPlaybookManageMembers.Id,
+			PermissionPublicPlaybookManageProperties.Id,
+			PermissionPrivatePlaybookManageMembers.Id,
+			PermissionPrivatePlaybookManageProperties.Id,
+			PermissionPublicPlaybookMakePrivate.Id,
+		},
+		SchemeManaged: true,
+		BuiltIn:       true,
+	}
+
+	roles[PlaybookMemberRoleId] = &Role{
+		Name:        PlaybookMemberRoleId,
+		DisplayName: "authentication.roles.playbook_member.name",
+		Description: "authentication.roles.playbook_member.description",
+		Permissions: []string{
+			PermissionPublicPlaybookView.Id,
+			PermissionPublicPlaybookManageMembers.Id,
+			PermissionPublicPlaybookManageProperties.Id,
+			PermissionPrivatePlaybookView.Id,
+			PermissionPrivatePlaybookManageMembers.Id,
+			PermissionPrivatePlaybookManageProperties.Id,
+			PermissionRunCreate.Id,
+		},
+		SchemeManaged: true,
+		BuiltIn:       true,
+	}
+
+	roles[RunAdminRoleId] = &Role{
+		Name:        RunAdminRoleId,
+		DisplayName: "authentication.roles.run_admin.name",
+		Description: "authentication.roles.run_admin.description",
+		Permissions: []string{
+			PermissionRunManageMembers.Id,
+			PermissionRunManageProperties.Id,
+		},
+		SchemeManaged: true,
+		BuiltIn:       true,
+	}
+
+	roles[RunMemberRoleId] = &Role{
+		Name:        RunMemberRoleId,
+		DisplayName: "authentication.roles.run_member.name",
+		Description: "authentication.roles.run_member.description",
+		Permissions: []string{
+			PermissionRunView.Id,
+		},
+		SchemeManaged: true,
+		BuiltIn:       true,
+	}
+
 	roles[SystemGuestRoleId] = &Role{
 		Name:        "system_guest",
 		DisplayName: "authentication.roles.global_guest.name",
--- a/model/scheme.go
+++ b/model/scheme.go
@@ -14,23 +14,29 @@ const (
 	SchemeDescriptionMaxLength = 1024
 	SchemeScopeTeam            = "team"
 	SchemeScopeChannel         = "channel"
+	SchemeScopePlaybook        = "playbook"
+	SchemeScopeRun             = "run"
 )

 type Scheme struct {
-	Id                      string `json:"id"`
-	Name                    string `json:"name"`
-	DisplayName             string `json:"display_name"`
-	Description             string `json:"description"`
-	CreateAt                int64  `json:"create_at"`
-	UpdateAt                int64  `json:"update_at"`
-	DeleteAt                int64  `json:"delete_at"`
-	Scope                   string `json:"scope"`
-	DefaultTeamAdminRole    string `json:"default_team_admin_role"`
-	DefaultTeamUserRole     string `json:"default_team_user_role"`
-	DefaultChannelAdminRole string `json:"default_channel_admin_role"`
-	DefaultChannelUserRole  string `json:"default_channel_user_role"`
-	DefaultTeamGuestRole    string `json:"default_team_guest_role"`
-	DefaultChannelGuestRole string `json:"default_channel_guest_role"`
+	Id                        string `json:"id"`
+	Name                      string `json:"name"`
+	DisplayName               string `json:"display_name"`
+	Description               string `json:"description"`
+	CreateAt                  int64  `json:"create_at"`
+	UpdateAt                  int64  `json:"update_at"`
+	DeleteAt                  int64  `json:"delete_at"`
+	Scope                     string `json:"scope"`
+	DefaultTeamAdminRole      string `json:"default_team_admin_role"`
+	DefaultTeamUserRole       string `json:"default_team_user_role"`
+	DefaultChannelAdminRole   string `json:"default_channel_admin_role"`
+	DefaultChannelUserRole    string `json:"default_channel_user_role"`
+	DefaultTeamGuestRole      string `json:"default_team_guest_role"`
+	DefaultChannelGuestRole   string `json:"default_channel_guest_role"`
+	DefaultPlaybookAdminRole  string `json:"default_playbook_admin_role"`
+	DefaultPlaybookMemberRole string `json:"default_playbook_member_role"`
+	DefaultRunAdminRole       string `json:"default_run_admin_role"`
+	DefaultRunMemberRole      string `json:"default_run_member_role"`
 }

 type SchemePatch struct {
@@ -45,31 +51,39 @@ type SchemeIDPatch struct {

 // SchemeConveyor is used for importing and exporting a Scheme and its associated Roles.
 type SchemeConveyor struct {
-	Name         string  `json:"name"`
-	DisplayName  string  `json:"display_name"`
-	Description  string  `json:"description"`
-	Scope        string  `json:"scope"`
-	TeamAdmin    string  `json:"default_team_admin_role"`
-	TeamUser     string  `json:"default_team_user_role"`
-	TeamGuest    string  `json:"default_team_guest_role"`
-	ChannelAdmin string  `json:"default_channel_admin_role"`
-	ChannelUser  string  `json:"default_channel_user_role"`
-	ChannelGuest string  `json:"default_channel_guest_role"`
-	Roles        []*Role `json:"roles"`
+	Name           string  `json:"name"`
+	DisplayName    string  `json:"display_name"`
+	Description    string  `json:"description"`
+	Scope          string  `json:"scope"`
+	TeamAdmin      string  `json:"default_team_admin_role"`
+	TeamUser       string  `json:"default_team_user_role"`
+	TeamGuest      string  `json:"default_team_guest_role"`
+	ChannelAdmin   string  `json:"default_channel_admin_role"`
+	ChannelUser    string  `json:"default_channel_user_role"`
+	ChannelGuest   string  `json:"default_channel_guest_role"`
+	PlaybookAdmin  string  `json:"default_playbook_admin_role"`
+	PlaybookMember string  `json:"default_playbook_member_role"`
+	RunAdmin       string  `json:"default_run_admin_role"`
+	RunMember      string  `json:"default_run_member_role"`
+	Roles          []*Role `json:"roles"`
 }

 func (sc *SchemeConveyor) Scheme() *Scheme {
 	return &Scheme{
-		DisplayName:             sc.DisplayName,
-		Name:                    sc.Name,
-		Description:             sc.Description,
-		Scope:                   sc.Scope,
-		DefaultTeamAdminRole:    sc.TeamAdmin,
-		DefaultTeamUserRole:     sc.TeamUser,
-		DefaultTeamGuestRole:    sc.TeamGuest,
-		DefaultChannelAdminRole: sc.ChannelAdmin,
-		DefaultChannelUserRole:  sc.ChannelUser,
-		DefaultChannelGuestRole: sc.ChannelGuest,
+		DisplayName:               sc.DisplayName,
+		Name:                      sc.Name,
+		Description:               sc.Description,
+		Scope:                     sc.Scope,
+		DefaultTeamAdminRole:      sc.TeamAdmin,
+		DefaultTeamUserRole:       sc.TeamUser,
+		DefaultTeamGuestRole:      sc.TeamGuest,
+		DefaultChannelAdminRole:   sc.ChannelAdmin,
+		DefaultChannelUserRole:    sc.ChannelUser,
+		DefaultChannelGuestRole:   sc.ChannelGuest,
+		DefaultPlaybookAdminRole:  sc.PlaybookAdmin,
+		DefaultPlaybookMemberRole: sc.PlaybookMember,
+		DefaultRunAdminRole:       sc.RunAdmin,
+		DefaultRunMemberRole:      sc.RunMember,
 	}
 }

@@ -101,7 +115,7 @@ func (scheme *Scheme) IsValidForCreate() bool {
 	}

 	switch scheme.Scope {
-	case SchemeScopeTeam, SchemeScopeChannel:
+	case SchemeScopeTeam, SchemeScopeChannel, SchemeScopePlaybook, SchemeScopeRun:
 	default:
 		return false
 	}
@@ -130,6 +144,22 @@ func (scheme *Scheme) IsValidForCreate() bool {
 		if !IsValidRoleName(scheme.DefaultTeamGuestRole) {
 			return false
 		}
+
+		if !IsValidRoleName(scheme.DefaultPlaybookAdminRole) {
+			return false
+		}
+
+		if !IsValidRoleName(scheme.DefaultPlaybookMemberRole) {
+			return false
+		}
+
+		if !IsValidRoleName(scheme.DefaultRunAdminRole) {
+			return false
+		}
+
+		if !IsValidRoleName(scheme.DefaultRunMemberRole) {
+			return false
+		}
 	}

 	if scheme.Scope == SchemeScopeChannel {