From 7740eb9d431f8cd2704decc9e0e9149965e117dc Mon Sep 17 00:00:00 2001 From: Scott Bishel Date: Fri, 31 Jan 2025 07:08:34 -0700 Subject: [PATCH] MM-61751 -Enforce permissions on role detail form. (#29361) * enforce permissions on role admin form * update for more missing Hidden checks on detail pages * add description to roles settings * update snapshots * update strings * remove padding --------- Co-authored-by: Mattermost Build --- .../src/components/admin_console/admin_definition.tsx | 7 +++++++ .../__snapshots__/system_role_permissions.test.tsx.snap | 2 ++ .../admin_console/system_roles/system_role/strings.tsx | 4 ++++ .../system_roles/system_role/system_role_permissions.scss | 1 - .../system_roles/system_role/system_role_permissions.tsx | 2 +- webapp/channels/src/i18n/en.json | 3 ++- 6 files changed, 16 insertions(+), 3 deletions(-) diff --git a/webapp/channels/src/components/admin_console/admin_definition.tsx b/webapp/channels/src/components/admin_console/admin_definition.tsx index 3757c19590..47220aed71 100644 --- a/webapp/channels/src/components/admin_console/admin_definition.tsx +++ b/webapp/channels/src/components/admin_console/admin_definition.tsx @@ -573,6 +573,7 @@ const AdminDefinition: AdminDefinitionType = { }, systemScheme: { url: 'user_management/permissions/system_scheme', + isHidden: it.not(it.userHasReadPermissionOnResource(RESOURCE_KEYS.USER_MANAGEMENT.PERMISSIONS)), isDisabled: it.not(it.userHasWritePermissionOnResource(RESOURCE_KEYS.USER_MANAGEMENT.PERMISSIONS)), schema: { id: 'PermissionSystemScheme', @@ -581,6 +582,7 @@ const AdminDefinition: AdminDefinitionType = { }, teamSchemeDetail: { url: `user_management/permissions/team_override_scheme/:scheme_id(${ID_PATH_PATTERN})`, + isHidden: it.not(it.userHasReadPermissionOnResource(RESOURCE_KEYS.USER_MANAGEMENT.PERMISSIONS)), isDisabled: it.not(it.userHasWritePermissionOnResource(RESOURCE_KEYS.USER_MANAGEMENT.PERMISSIONS)), schema: { id: 'PermissionSystemScheme', @@ -589,6 +591,7 @@ const AdminDefinition: AdminDefinitionType = { }, teamScheme: { url: 'user_management/permissions/team_override_scheme', + isHidden: it.not(it.userHasReadPermissionOnResource(RESOURCE_KEYS.USER_MANAGEMENT.PERMISSIONS)), isDisabled: it.not(it.userHasWritePermissionOnResource(RESOURCE_KEYS.USER_MANAGEMENT.PERMISSIONS)), schema: { id: 'PermissionSystemScheme', @@ -610,6 +613,10 @@ const AdminDefinition: AdminDefinitionType = { }, system_role: { url: `user_management/system_roles/:role_id(${ID_PATH_PATTERN})`, + isHidden: it.any( + it.not(it.licensedForFeature('LDAPGroups')), + it.not(it.userHasReadPermissionOnResource(RESOURCE_KEYS.USER_MANAGEMENT.SYSTEM_ROLES)), + ), isDisabled: it.not(it.userHasWritePermissionOnResource(RESOURCE_KEYS.USER_MANAGEMENT.SYSTEM_ROLES)), schema: { id: 'SystemRole', diff --git a/webapp/channels/src/components/admin_console/system_roles/system_role/__snapshots__/system_role_permissions.test.tsx.snap b/webapp/channels/src/components/admin_console/system_roles/system_role/__snapshots__/system_role_permissions.test.tsx.snap index 13b477dea8..aff4505ac8 100644 --- a/webapp/channels/src/components/admin_console/system_roles/system_role/__snapshots__/system_role_permissions.test.tsx.snap +++ b/webapp/channels/src/components/admin_console/system_roles/system_role/__snapshots__/system_role_permissions.test.tsx.snap @@ -108,6 +108,7 @@ exports[`admin_console/system_role_permissions should match snapshot 1`] = ` }, Object { "disabled": true, + "hasDescription": true, "name": "user_management_system_roles", }, ], @@ -483,6 +484,7 @@ exports[`admin_console/system_role_permissions should match snapshot with isLice }, Object { "disabled": true, + "hasDescription": true, "name": "user_management_system_roles", }, ], diff --git a/webapp/channels/src/components/admin_console/system_roles/system_role/strings.tsx b/webapp/channels/src/components/admin_console/system_roles/system_role/strings.tsx index 45cdfda659..b5631ef818 100644 --- a/webapp/channels/src/components/admin_console/system_roles/system_role/strings.tsx +++ b/webapp/channels/src/components/admin_console/system_roles/system_role/strings.tsx @@ -107,6 +107,10 @@ export const sectionStrings: Record> = id: 'admin.permissions.sysconsole_section_user_management_system_roles.name', defaultMessage: 'Delegated Granular Administration', }, + description: { + id: 'admin.permissions.sysconsole_section_user_management_system_roles.description', + defaultMessage: 'Restricts the System Console interface only. The underlying API endpoints are accessible to all users in a read-only state for basic product functionality.', + }, }), environment: defineMessages({ name: { diff --git a/webapp/channels/src/components/admin_console/system_roles/system_role/system_role_permissions.scss b/webapp/channels/src/components/admin_console/system_roles/system_role/system_role_permissions.scss index c14d587d0b..ed78d11f3f 100644 --- a/webapp/channels/src/components/admin_console/system_roles/system_role/system_role_permissions.scss +++ b/webapp/channels/src/components/admin_console/system_roles/system_role/system_role_permissions.scss @@ -151,7 +151,6 @@ .PermissionSection_description { span { - padding: 0 4px; border-radius: 2px; background: rgba(var(--sys-center-channel-color-rgb), 0.08); } diff --git a/webapp/channels/src/components/admin_console/system_roles/system_role/system_role_permissions.tsx b/webapp/channels/src/components/admin_console/system_roles/system_role/system_role_permissions.tsx index 36a6d5ef0f..85f13c6c02 100644 --- a/webapp/channels/src/components/admin_console/system_roles/system_role/system_role_permissions.tsx +++ b/webapp/channels/src/components/admin_console/system_roles/system_role/system_role_permissions.tsx @@ -62,7 +62,7 @@ const sectionsList: SystemSection[] = [ {name: 'user_management_teams'}, {name: 'user_management_channels'}, {name: 'user_management_permissions'}, - {name: 'user_management_system_roles', disabled: true}, + {name: 'user_management_system_roles', hasDescription: true, disabled: true}, ], }, { diff --git a/webapp/channels/src/i18n/en.json b/webapp/channels/src/i18n/en.json index 0c6f9f9029..9f9c45f1fe 100644 --- a/webapp/channels/src/i18n/en.json +++ b/webapp/channels/src/i18n/en.json @@ -1878,7 +1878,8 @@ "admin.permissions.sysconsole_section_user_management_channels.name": "Channels", "admin.permissions.sysconsole_section_user_management_groups.name": "Groups", "admin.permissions.sysconsole_section_user_management_permissions.name": "Permissions", - "admin.permissions.sysconsole_section_user_management_system_roles.name": "System Roles", + "admin.permissions.sysconsole_section_user_management_system_roles.description": "Setting \"No Access\" restricts the System Console interface only. The underlying API endpoints are accessible to all users in a read-only state for basic product functionality.", + "admin.permissions.sysconsole_section_user_management_system_roles.name": "Delegated Granular Administration", "admin.permissions.sysconsole_section_user_management_teams.name": "Teams", "admin.permissions.sysconsole_section_user_management_users.description": "Cannot reset admin passwords", "admin.permissions.sysconsole_section_user_management_users.name": "Users",