[MM-44842] Add restore_group permission (#21806)

* Add restore_group permission

* Fix tests failing due to new permission in groups

* Add new migration to add custom_group_restore permission

* Add mock for new migration function

* Fix tests

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

api4/group.go

@@ -1185,8 +1185,8 @@ func restoreGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if !c.App.SessionHasPermissionToGroup(*c.AppContext.Session(), c.Params.GroupId, model.PermissionDeleteCustomGroup) {
-		c.SetPermissionError(model.PermissionDeleteCustomGroup)
+	if !c.App.SessionHasPermissionToGroup(*c.AppContext.Session(), c.Params.GroupId, model.PermissionRestoreCustomGroup) {
+		c.SetPermissionError(model.PermissionRestoreCustomGroup)
 		return
 	}
 

api4/group_test.go

@@ -231,7 +231,13 @@ func TestUndeleteGroup(t *testing.T) {
 	_, response, err := th.Client.DeleteGroup(validGroup.Id)
 	require.NoError(t, err)
 	CheckOKStatus(t, response)
+	th.RemovePermissionFromRole(model.PermissionRestoreCustomGroup.Id, model.SystemUserRoleId)
+	// shouldn't allow restoring unless user has required permission
+	_, response, err = th.Client.RestoreGroup(validGroup.Id, "")
+	require.Error(t, err)
+	CheckForbiddenStatus(t, response)
 
+	th.AddPermissionToRole(model.PermissionRestoreCustomGroup.Id, model.SystemUserRoleId)
 	_, response, err = th.Client.RestoreGroup(validGroup.Id, "")
 	require.NoError(t, err)
 	CheckOKStatus(t, response)

app/app_test.go

@@ -168,6 +168,7 @@ func TestDoAdvancedPermissionsMigration(t *testing.T) {
 			model.PermissionCreateCustomGroup.Id,
 			model.PermissionEditCustomGroup.Id,
 			model.PermissionDeleteCustomGroup.Id,
+			model.PermissionRestoreCustomGroup.Id,
 			model.PermissionManageCustomGroupMembers.Id,
 		},
 		"system_post_all": {
@@ -228,6 +229,7 @@ func TestDoEmojisPermissionsMigration(t *testing.T) {
 		model.PermissionEditCustomGroup.Id,
 		model.PermissionDeleteCustomGroup.Id,
 		model.PermissionManageCustomGroupMembers.Id,
+		model.PermissionRestoreCustomGroup.Id,
 		model.PermissionListPublicTeams.Id,
 		model.PermissionJoinPublicTeams.Id,
 		model.PermissionCreateDirectChannel.Id,

app/permissions_migrations.go

@@ -994,6 +994,30 @@ func (a *App) getAddCustomUserGroupsPermissions() (permissionsMap, error) {
 	return t, nil
 }
 
+func (a *App) getAddCustomUserGroupsPermissionRestore() (permissionsMap, error) {
+	t := []permissionTransformation{}
+
+	customGroupPermissions := []string{
+		model.PermissionRestoreCustomGroup.Id,
+	}
+
+	t = append(t, permissionTransformation{
+		On:  isExactRole(model.SystemUserRoleId),
+		Add: customGroupPermissions,
+	})
+
+	t = append(t, permissionTransformation{
+		On:  isExactRole(model.SystemAdminRoleId),
+		Add: customGroupPermissions,
+	})
+
+	t = append(t, permissionTransformation{
+		On:  isExactRole(model.SystemCustomGroupAdminRoleId),
+		Add: customGroupPermissions,
+	})
+	return t, nil
+}
+
 func (a *App) getAddPlaybooksPermissions() (permissionsMap, error) {
 	transformations := []permissionTransformation{}
 
@@ -1110,6 +1134,7 @@ func (s *Server) doPermissionsMigrations() error {
 		{Key: model.MigrationKeyAddCustomUserGroupsPermissions, Migration: a.getAddCustomUserGroupsPermissions},
 		{Key: model.MigrationKeyAddPlayboosksManageRolesPermissions, Migration: a.getPlaybooksPermissionsAddManageRoles},
 		{Key: model.MigrationKeyAddProductsBoardsPermissions, Migration: a.getProductsBoardsPermissions},
+		{Key: model.MigrationKeyAddCustomUserGroupsPermissionRestore, Migration: a.getAddCustomUserGroupsPermissionRestore},
 	}
 
 	roles, err := s.Store().Role().GetAll()

model/migration.go

@@ -39,4 +39,5 @@ const (
 	MigrationKeyAddCustomUserGroupsPermissions         = "custom_groups_permissions"
 	MigrationKeyAddPlayboosksManageRolesPermissions    = "playbooks_manage_roles"
 	MigrationKeyAddProductsBoardsPermissions           = "products_boards"
+	MigrationKeyAddCustomUserGroupsPermissionRestore   = "custom_groups_permission_restore"
 )

model/permission.go

@@ -366,6 +366,7 @@ var PermissionCreateCustomGroup *Permission
 var PermissionManageCustomGroupMembers *Permission
 var PermissionEditCustomGroup *Permission
 var PermissionDeleteCustomGroup *Permission
+var PermissionRestoreCustomGroup *Permission
 
 var AllPermissions []*Permission
 var DeprecatedPermissions []*Permission
@@ -1960,6 +1961,13 @@ func initializePermissions() {
 		PermissionScopeGroup,
 	}
 
+	PermissionRestoreCustomGroup = &Permission{
+		"restore_custom_group",
+		"authentication.permissions.restore_custom_group.name",
+		"authentication.permissions.restore_custom_group.description",
+		PermissionScopeGroup,
+	}
+
 	// Playbooks
 	PermissionPublicPlaybookCreate = &Permission{
 		"playbook_public_create",
@@ -2340,6 +2348,7 @@ func initializePermissions() {
 		PermissionManageCustomGroupMembers,
 		PermissionEditCustomGroup,
 		PermissionDeleteCustomGroup,
+		PermissionRestoreCustomGroup,
 	}
 
 	DeprecatedPermissions = []*Permission{

model/role.go

@@ -348,6 +348,7 @@ func init() {
 		PermissionCreateCustomGroup.Id,
 		PermissionEditCustomGroup.Id,
 		PermissionDeleteCustomGroup.Id,
+		PermissionRestoreCustomGroup.Id,
 		PermissionManageCustomGroupMembers.Id,
 	}
 
@@ -953,6 +954,7 @@ func MakeDefaultRoles() map[string]*Role {
 			PermissionCreateCustomGroup.Id,
 			PermissionEditCustomGroup.Id,
 			PermissionDeleteCustomGroup.Id,
+			PermissionRestoreCustomGroup.Id,
 			PermissionManageCustomGroupMembers.Id,
 		},
 		SchemeManaged: true,

testlib/store.go

@@ -68,6 +68,7 @@ func GetMockStoreForSetupFunctions() *mocks.Store {
 	systemStore.On("GetByName", model.MigrationKeyAddPlaybooksPermissions).Return(&model.System{Name: model.MigrationKeyAddPlaybooksPermissions, Value: "true"}, nil)
 	systemStore.On("GetByName", model.MigrationKeyAddCustomUserGroupsPermissions).Return(&model.System{Name: model.MigrationKeyAddCustomUserGroupsPermissions, Value: "true"}, nil)
 	systemStore.On("GetByName", model.MigrationKeyAddPlayboosksManageRolesPermissions).Return(&model.System{Name: model.MigrationKeyAddPlayboosksManageRolesPermissions, Value: "true"}, nil)
+	systemStore.On("GetByName", model.MigrationKeyAddCustomUserGroupsPermissionRestore).Return(&model.System{Name: model.MigrationKeyAddCustomUserGroupsPermissionRestore, Value: "true"}, nil)
 	systemStore.On("GetByName", "CustomGroupAdminRoleCreationMigrationComplete").Return(&model.System{Name: model.MigrationKeyAddPlayboosksManageRolesPermissions, Value: "true"}, nil)
 	systemStore.On("GetByName", "products_boards").Return(&model.System{Name: "products_boards", Value: "true"}, nil)
 	systemStore.On("InsertIfExists", mock.AnythingOfType("*model.System")).Return(&model.System{}, nil).Once()