From 6cc85c9e7dd513c974b346a30cd1b9cb42c85c58 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Guillermo=20Vay=C3=A1?= <guillermo.vaya@mattermost.com>
Date: Mon, 27 Jan 2025 17:31:14 +0100
Subject: [PATCH] [MM-61928] Add clarifying note on personal token permissions
 (#29585)

---
 .../manage_roles_modal/manage_roles_modal.tsx          | 10 ++++++++++
 webapp/channels/src/i18n/en.json                       |  1 +
 webapp/channels/src/sass/routes/_admin-console.scss    |  3 +++
 3 files changed, 14 insertions(+)

diff --git a/webapp/channels/src/components/admin_console/manage_roles_modal/manage_roles_modal.tsx b/webapp/channels/src/components/admin_console/manage_roles_modal/manage_roles_modal.tsx
index a34b4d7747..dc073397d1 100644
--- a/webapp/channels/src/components/admin_console/manage_roles_modal/manage_roles_modal.tsx
+++ b/webapp/channels/src/components/admin_console/manage_roles_modal/manage_roles_modal.tsx
@@ -234,6 +234,16 @@ export default class ManageRolesModal extends React.PureComponent<Props, State>
                             />
                         </label>
                     </div>
+                    <p>
+                        <FormattedMessage
+                            id='admin.manage_roles.additionalRoles_warning'
+                            defaultMessage='<strong>Note:</strong><span>The permissions granted above apply to the account as a whole, regardless of whether it is authenticated using a session cookie or a personal access token. For example, selecting post:all will allow the account to post to channels it is not a member of, even without using a personal access token.</span>'
+                            values={{
+                                strong: (text) => <strong>{text}</strong>,
+                                span: (text) => <span className='pt-2 pb-2 light'>{text}</span>,
+                            }}
+                        />
+                    </p>
                 </div>
             );
         }
diff --git a/webapp/channels/src/i18n/en.json b/webapp/channels/src/i18n/en.json
index 84d241fc42..bf41112b7f 100644
--- a/webapp/channels/src/i18n/en.json
+++ b/webapp/channels/src/i18n/en.json
@@ -1489,6 +1489,7 @@
   "admin.logs.title": "Server Logs",
   "admin.logs.Warn": "Warn",
   "admin.manage_roles.additionalRoles": "Select additional permissions for the account. <link>Read more about roles and permissions</link>.",
+  "admin.manage_roles.additionalRoles_warning": "<strong>Note:</strong><span>The permissions granted above apply to the account as a whole, regardless of whether it is authenticated using a session cookie or a personal access token. For example, selecting post:all will allow the account to post to channels it is not a member of, even without using a personal access token.</span>",
   "admin.manage_roles.allowUserAccessTokens": "Allow this account to generate <link>personal access tokens</link>.",
   "admin.manage_roles.allowUserAccessTokensDesc": "Removing this permission doesn't delete existing tokens. To delete them, go to the user's Manage Tokens menu.",
   "admin.manage_roles.botAdditionalRoles": "Select additional permissions for the account. <link>Read more about roles and permissions</link>.",
diff --git a/webapp/channels/src/sass/routes/_admin-console.scss b/webapp/channels/src/sass/routes/_admin-console.scss
index f7d4c0c32a..765c3053d2 100644
--- a/webapp/channels/src/sass/routes/_admin-console.scss
+++ b/webapp/channels/src/sass/routes/_admin-console.scss
@@ -966,6 +966,9 @@
         strong {
             margin-right: 10px;
         }
+        p strong {
+            margin-right: 5px;
+        }
     }
 
     .member-row-lone-padding {