Add system console settings for mobile security (#30456)

* Add config settings for additional security features on mobile

* Add system console settings for mobile security

* Update svg and link

* Fix strings

* Add test for the discovery feature

* Fix tests

* Add permission migrations

* Add relevant e2e tests

* Fix key alignment

* fix tests

* Fix lint

* Mock new migration

* Fix playwright prettier

* Add new section to delegated permissions

* Update snapshots

* Fix flakyness in playwright test

---------

Co-authored-by: Elias Nahum <nahumhbl@gmail.com>
Co-authored-by: Mattermost Build <build@mattermost.com>

server/channels/app/permissions_migrations.go

@@ -1154,6 +1154,25 @@ func (a *App) removeGetAnalyticsPermissionMigration() (permissionsMap, error) {
 	return transformations, nil
 }
 
+func (a *App) addSysConsoleMobileSecurityPermission() (permissionsMap, error) {
+	transformations := []permissionTransformation{}
+
+	transformations = append(transformations, permissionTransformation{
+		On:  isExactRole(model.SystemAdminRoleId),
+		Add: []string{model.PermissionSysconsoleWriteEnvironmentMobileSecurity.Id},
+	})
+
+	transformations = append(transformations, permissionTransformation{
+		On: permissionOr(
+			isExactRole(model.SystemAdminRoleId),
+			isExactRole(model.SystemReadOnlyAdminRoleId),
+		),
+		Add: []string{model.PermissionSysconsoleReadEnvironmentMobileSecurity.Id},
+	})
+
+	return transformations, nil
+}
+
 // Only sysadmins, team admins, and users with channels and groups managements have access to "convert channel to public"
 func (a *App) getRestrictAcessToChannelConversionToPublic() (permissionsMap, error) {
 	return []permissionTransformation{
@@ -1223,6 +1242,7 @@ func (s *Server) doPermissionsMigrations() error {
 		{Key: model.RestrictAccessToChannelConversionToPublic, Migration: a.getRestrictAcessToChannelConversionToPublic},
 		{Key: model.MigrationKeyFixReadAuditsPermission, Migration: a.getFixReadAuditsPermissionMigration},
 		{Key: model.MigrationRemoveGetAnalyticsPermission, Migration: a.removeGetAnalyticsPermissionMigration},
+		{Key: model.MigrationAddSysconsoleMobileSecurityPermission, Migration: a.addSysConsoleMobileSecurityPermission},
 	}
 
 	roles, err := s.Store().Role().GetAll()

server/channels/testlib/store.go

@@ -85,6 +85,7 @@ func GetMockStoreForSetupFunctions() *mocks.Store {
 	systemStore.On("GetByName", "CustomGroupAdminRoleCreationMigrationComplete").Return(&model.System{Name: model.MigrationKeyAddPlayboosksManageRolesPermissions, Value: "true"}, nil)
 	systemStore.On("GetByName", "products_boards").Return(&model.System{Name: "products_boards", Value: "true"}, nil)
 	systemStore.On("GetByName", "elasticsearch_fix_channel_index_migration").Return(&model.System{Name: "elasticsearch_fix_channel_index_migration", Value: "true"}, nil)
+	systemStore.On("GetByName", model.MigrationAddSysconsoleMobileSecurityPermission).Return(&model.System{Name: model.MigrationAddSysconsoleMobileSecurityPermission, Value: "true"}, nil)
 	systemStore.On("InsertIfExists", mock.AnythingOfType("*model.System")).Return(&model.System{}, nil).Once()
 	systemStore.On("Save", mock.AnythingOfType("*model.System")).Return(nil)
 

server/public/model/migration.go

@@ -53,4 +53,5 @@ const (
 	RestrictAccessToChannelConversionToPublic          = "restrict_access_to_channel_conversion_to_public_permissions"
 	MigrationKeyFixReadAuditsPermission                = "fix_read_audits_permission"
 	MigrationRemoveGetAnalyticsPermission              = "remove_get_analytics_permission"
+	MigrationAddSysconsoleMobileSecurityPermission     = "add_sysconsole_mobile_security_permission"
 )

server/public/model/permission.go

@@ -252,6 +252,9 @@ var PermissionSysconsoleWriteEnvironmentPerformanceMonitoring *Permission
 var PermissionSysconsoleReadEnvironmentDeveloper *Permission
 var PermissionSysconsoleWriteEnvironmentDeveloper *Permission
 
+var PermissionSysconsoleReadEnvironmentMobileSecurity *Permission
+var PermissionSysconsoleWriteEnvironmentMobileSecurity *Permission
+
 var PermissionSysconsoleReadSite *Permission
 var PermissionSysconsoleWriteSite *Permission
 
@@ -1622,6 +1625,18 @@ func initializePermissions() {
 		"",
 		PermissionScopeSystem,
 	}
+	PermissionSysconsoleReadEnvironmentMobileSecurity = &Permission{
+		"sysconsole_read_environment_mobile_security",
+		"",
+		"",
+		PermissionScopeSystem,
+	}
+	PermissionSysconsoleWriteEnvironmentMobileSecurity = &Permission{
+		"sysconsole_write_environment_mobile_security",
+		"",
+		"",
+		PermissionScopeSystem,
+	}
 	// DEPRECATED
 	PermissionSysconsoleReadSite = &Permission{
 		"sysconsole_read_site",
@@ -2262,6 +2277,7 @@ func initializePermissions() {
 		PermissionSysconsoleReadEnvironmentSessionLengths,
 		PermissionSysconsoleReadEnvironmentPerformanceMonitoring,
 		PermissionSysconsoleReadEnvironmentDeveloper,
+		PermissionSysconsoleReadEnvironmentMobileSecurity,
 		PermissionSysconsoleReadSiteCustomization,
 		PermissionSysconsoleReadSiteLocalization,
 		PermissionSysconsoleReadSiteUsersAndTeams,
@@ -2321,6 +2337,7 @@ func initializePermissions() {
 		PermissionSysconsoleWriteEnvironmentSessionLengths,
 		PermissionSysconsoleWriteEnvironmentPerformanceMonitoring,
 		PermissionSysconsoleWriteEnvironmentDeveloper,
+		PermissionSysconsoleWriteEnvironmentMobileSecurity,
 		PermissionSysconsoleWriteSiteCustomization,
 		PermissionSysconsoleWriteSiteLocalization,
 		PermissionSysconsoleWriteSiteUsersAndTeams,