MM-61751 -Enforce permissions on role detail form. (#29361)

* enforce permissions on role admin form

* update for more missing Hidden checks on detail pages

* add description to roles settings

* update snapshots

* update strings

* remove padding

---------

Co-authored-by: Mattermost Build <build@mattermost.com>

webapp/channels/src/components/admin_console/admin_definition.tsx

@@ -573,6 +573,7 @@ const AdminDefinition: AdminDefinitionType = {
             },
             systemScheme: {
                 url: 'user_management/permissions/system_scheme',
+                isHidden: it.not(it.userHasReadPermissionOnResource(RESOURCE_KEYS.USER_MANAGEMENT.PERMISSIONS)),
                 isDisabled: it.not(it.userHasWritePermissionOnResource(RESOURCE_KEYS.USER_MANAGEMENT.PERMISSIONS)),
                 schema: {
                     id: 'PermissionSystemScheme',
@@ -581,6 +582,7 @@ const AdminDefinition: AdminDefinitionType = {
             },
             teamSchemeDetail: {
                 url: `user_management/permissions/team_override_scheme/:scheme_id(${ID_PATH_PATTERN})`,
+                isHidden: it.not(it.userHasReadPermissionOnResource(RESOURCE_KEYS.USER_MANAGEMENT.PERMISSIONS)),
                 isDisabled: it.not(it.userHasWritePermissionOnResource(RESOURCE_KEYS.USER_MANAGEMENT.PERMISSIONS)),
                 schema: {
                     id: 'PermissionSystemScheme',
@@ -589,6 +591,7 @@ const AdminDefinition: AdminDefinitionType = {
             },
             teamScheme: {
                 url: 'user_management/permissions/team_override_scheme',
+                isHidden: it.not(it.userHasReadPermissionOnResource(RESOURCE_KEYS.USER_MANAGEMENT.PERMISSIONS)),
                 isDisabled: it.not(it.userHasWritePermissionOnResource(RESOURCE_KEYS.USER_MANAGEMENT.PERMISSIONS)),
                 schema: {
                     id: 'PermissionSystemScheme',
@@ -610,6 +613,10 @@ const AdminDefinition: AdminDefinitionType = {
             },
             system_role: {
                 url: `user_management/system_roles/:role_id(${ID_PATH_PATTERN})`,
+                isHidden: it.any(
+                    it.not(it.licensedForFeature('LDAPGroups')),
+                    it.not(it.userHasReadPermissionOnResource(RESOURCE_KEYS.USER_MANAGEMENT.SYSTEM_ROLES)),
+                ),
                 isDisabled: it.not(it.userHasWritePermissionOnResource(RESOURCE_KEYS.USER_MANAGEMENT.SYSTEM_ROLES)),
                 schema: {
                     id: 'SystemRole',

webapp/channels/src/components/admin_console/system_roles/system_role/__snapshots__/system_role_permissions.test.tsx.snap

@@ -108,6 +108,7 @@ exports[`admin_console/system_role_permissions should match snapshot 1`] = `
             },
             Object {
               "disabled": true,
+              "hasDescription": true,
               "name": "user_management_system_roles",
             },
           ],
@@ -483,6 +484,7 @@ exports[`admin_console/system_role_permissions should match snapshot with isLice
             },
             Object {
               "disabled": true,
+              "hasDescription": true,
               "name": "user_management_system_roles",
             },
           ],

webapp/channels/src/components/admin_console/system_roles/system_role/strings.tsx

@@ -107,6 +107,10 @@ export const sectionStrings: Record<string, Record<string, MessageDescriptor>> =
             id: 'admin.permissions.sysconsole_section_user_management_system_roles.name',
             defaultMessage: 'Delegated Granular Administration',
         },
+        description: {
+            id: 'admin.permissions.sysconsole_section_user_management_system_roles.description',
+            defaultMessage: 'Restricts the System Console interface only. The underlying API endpoints are accessible to all users in a read-only state for basic product functionality.',
+        },
     }),
     environment: defineMessages({
         name: {

webapp/channels/src/components/admin_console/system_roles/system_role/system_role_permissions.scss

@@ -151,7 +151,6 @@
 
                 .PermissionSection_description {
                     span {
-                        padding: 0 4px;
                         border-radius: 2px;
                         background: rgba(var(--sys-center-channel-color-rgb), 0.08);
                     }

webapp/channels/src/components/admin_console/system_roles/system_role/system_role_permissions.tsx

@@ -62,7 +62,7 @@ const sectionsList: SystemSection[] = [
             {name: 'user_management_teams'},
             {name: 'user_management_channels'},
             {name: 'user_management_permissions'},
-            {name: 'user_management_system_roles', disabled: true},
+            {name: 'user_management_system_roles', hasDescription: true, disabled: true},
         ],
     },
     {

webapp/channels/src/i18n/en.json

@@ -1878,7 +1878,8 @@
   "admin.permissions.sysconsole_section_user_management_channels.name": "Channels",
   "admin.permissions.sysconsole_section_user_management_groups.name": "Groups",
   "admin.permissions.sysconsole_section_user_management_permissions.name": "Permissions",
-  "admin.permissions.sysconsole_section_user_management_system_roles.name": "System Roles",
+  "admin.permissions.sysconsole_section_user_management_system_roles.description": "Setting \"No Access\" restricts the System Console interface only. The underlying API endpoints are accessible to all users in a read-only state for basic product functionality.",
+  "admin.permissions.sysconsole_section_user_management_system_roles.name": "Delegated Granular Administration",
   "admin.permissions.sysconsole_section_user_management_teams.name": "Teams",
   "admin.permissions.sysconsole_section_user_management_users.description": "Cannot reset admin passwords",
   "admin.permissions.sysconsole_section_user_management_users.name": "Users",