MM-25543: New Admin Roles (#14960)
* MM-23832: Initial set of changes * MM-23832: further iteration * MM-23832: further iteration * MM-23832: further iteration * MM-23832: Fixes merge. * create migration for new Roles * MM-23832: Renames some roles. * MM-23832: Adds ability to see logs. * MM-23832: Removes manage roles from restricted admin. * MM-23832: Make authentication section read-only for restricted admin. * MM-23832: Allow restricted admin to purge caches. * MM-23832: Adds ability to recycle DB connections. * MM-23832: Adds ability to purge indexes. * MM-23832: Adds ability to test email and S3 config. * MM-23832: Adds abilituy to read job status. * MM-23832: Adds ability to read plugin statuses. * MM-23832: Renames Restricted Admin to System Manager. * MM-23832: Adds manage team roles to system_user_manager. * MM-23832: Updates some permissions. * MM-23832: Allow get all channels and get moderations. * MM-23832: Adds some permissions to User Manager. * MM-23832: Remove write users from user manager. * MM-23832: Changes permissions for the usermanagement > users sysconsole section. * MM-23832: Removes read_settings and write_settings permissions. Ensures the usermanagement parent permissions encompass the sub-permissions. * MM-23832: Updates permissions. * MM-23832: Changes some permissions checks, adds new permissions to roles. * MM-23832: Adds ability to update a role. * MM-23832: Permissions updates. * MM-23832: Removes write access to plugins for system manager. * MM-23832: Removes read compliance from new roles. * MM-23832: Adds mock for new roles creation migration. * MM-23832: Changes to variadic param. * MM-23832: Removes some duplication in the permissions model. Renames some permissions constants. * MM-23832: Updates some migrations. * MM-23832: Removes some unnecessary constants. * MM-23832: Changes back to old app method name. * MM-23832: Fixes incorrect permission check. * MM-23832: Changes write to read permission check. * MM-23832: Removes the authentication permission from link/unlink group. * MM-23832: Enable testing LDAP with read permissions. * MM-23832: Make testing elasticsearch a read permission. * MM-23832: Warn metrics are associated to any system console read permissions. * MM-23832: Updates some permissions checks. * MM-23832: Removes non-systemconsole permissions from roles. * MM-23832: Update default permission assignment of sysadmin. * MM-23832: Fixes incorrect permission check. Removes some unused stuff. * MM-23832: Update permission to check. * MM-23832: Switches to struct tags. * MM-23832: Adds some docs for the permissions tag. * MM-23832: Removes whitespace. * MM-23832: Combines system admin restricted access with other acess-control tag. * MM-23832: Fixes some tests. * MM-23832: Clarifies docs, does not assume prior permission check in '-' access value case. * MM-23832: Updates to correct access tag value. * MM-23832: Adds test of the config settings tag access. * MM-23832: Undoes whitespace change. * MM-23832: Removes comment. * MM-23832: Adds the permissions to the new roles rather than using OR conditions on the permissions checks. * MM-23832: Removes or condition on permission check. * MM-23832: Updates mapping. * MM-23832: Typo fix. * MM-23832: Adds new 'read_jobs' permission. * MM-23832: Add read_jobs to all roles with manage_jobs. * MM-23832: Adds new permission read_other_users_teams. * MM-23832: Adds read filtering of config. * MM-23932: Change tag value. * MM-23832: Fixes some tests. Adds test for read config access tag. * MM-23832: Adds permissions to list teams. * MM-23832: Removes the '-' tag value. Adds a new permission read_channel_groups. Updates a permission check. * MM-23832: Removes unnecessary parent permission for user_management. Fixes permission check change error. * MM-23832: Removes unused parameter to filter/merge function. * MM-23832: Renames migration name. * MM-23832: Fix for godoc. * MM-23832: Fixes tests. * MM-23832: Only makes a map once rather than every function call. Doesn't require access tag on config field structs. Reverts one test update and fixes another. * MM-23832: Removes all of the unnecessary uses of (*App).SessionHasPermissionToAny since removing the user_management parent permission. * MM-23832: Updates constant type. * MM-23832: Removes unnecessary comment. * MM-23832: Renames permissions. * MM-23832: Fix for permission name changes. * MM-23832: Adds missing config access tags. Adds some requirec ancillary permissions for write_usermanagement_teams. * MM-23832: Adds local API endpoint for getting config. * MM-23832: If tag value is blank or restrict_sys_admin_write then don't do the permission check. * MM-23832: nil check for strings prior to dereferencing. * MM-23832: Fix for config display logic. * MM-23832: Updates godoc. * MM-23832: Delays the unrestricted check for parity with other permissions checks if the channel id does not exist. * MM-23832: Removes tautology. * MM-23832: Re-adds status code check. * MM-23832: Adds new permission to edit brand image. * MM-23832: Exports variable for use by mmctl. * MM-23832: Initialize exported map for use by mmctl. * MM-23832: Accept deprecated permissions as valid. * MM-23832: Adds missing permissions to archive a channel. * MM-23832: Adds missing permissions for managing team. * MM-23832: Properly filters config values in patch and update API responses. * MM-23832: Fixes license viewing and writing permissions. * MM-23832: Require license to assign 'new system roles'. * MM-23832: Adds translation keys. * MM-23832: Updates translation order. * MM-27529: Splits read_channel_groups into read_public_channel_groups and read_private_channel_groups. * MM-23832: Prevent read-only permissions from editing site url test parameter. * MM-23832: Prevent read permissions from sniffing ports and elastic password. * MM-23832: Adds missing permission required for write user management channels. * MM-23832: Allows new roles to search for channels. * MM-23832: Adds ability for system_manager to manage jobs. * MM-23832: Cluster status access by sysconsole permission, not manage_system. * MM-23832: Adds 'add_user_to_team' permission to sysconsole write usermanagement teams. * MM-23832: Fixes lint. * MM-23832: Test fix. * MM-23832: Test fix. Co-authored-by: Catalin Tomai <catalin.tomai@mattermost.com> Co-authored-by: Scott Bishel <scott.bishel@mattermost.com> Co-authored-by: Mattermod <mattermod@users.noreply.github.com>
Этот коммит содержится в:
Martin Kraft
коммит произвёл
GitHub
GitHub
родитель
52611a1761
Коммит
8354206e5c
@@ -4,6 +4,7 @@
|
||||
package api4
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
"os"
|
||||
"strings"
|
||||
@@ -54,6 +55,43 @@ func TestGetConfig(t *testing.T) {
|
||||
})
|
||||
}
|
||||
|
||||
func TestGetConfigWithAccessTag(t *testing.T) {
|
||||
th := Setup(t)
|
||||
defer th.TearDown()
|
||||
|
||||
varyByHeader := *&th.App.Config().RateLimitSettings.VaryByHeader // environment perm.
|
||||
supportEmail := *&th.App.Config().SupportSettings.SupportEmail // site perm.
|
||||
defer th.App.UpdateConfig(func(cfg *model.Config) {
|
||||
cfg.RateLimitSettings.VaryByHeader = varyByHeader
|
||||
cfg.SupportSettings.SupportEmail = supportEmail
|
||||
})
|
||||
|
||||
// set some values so that we know they're not blank
|
||||
mockVaryByHeader := model.NewId()
|
||||
mockSupportEmail := model.NewId() + "@mattermost.com"
|
||||
th.App.UpdateConfig(func(cfg *model.Config) {
|
||||
cfg.RateLimitSettings.VaryByHeader = mockVaryByHeader
|
||||
cfg.SupportSettings.SupportEmail = &mockSupportEmail
|
||||
})
|
||||
|
||||
th.Client.Login(th.BasicUser.Username, th.BasicUser.Password)
|
||||
|
||||
// add read sysconsole environment config
|
||||
th.AddPermissionToRole(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT.Id, model.SYSTEM_USER_ROLE_ID)
|
||||
defer th.RemovePermissionFromRole(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT.Id, model.SYSTEM_USER_ROLE_ID)
|
||||
|
||||
cfg, resp := th.Client.GetConfig()
|
||||
CheckNoError(t, resp)
|
||||
|
||||
t.Run("Cannot read value without permission", func(t *testing.T) {
|
||||
assert.Nil(t, cfg.SupportSettings.SupportEmail)
|
||||
})
|
||||
|
||||
t.Run("Can read value with permission", func(t *testing.T) {
|
||||
assert.Equal(t, mockVaryByHeader, cfg.RateLimitSettings.VaryByHeader)
|
||||
})
|
||||
}
|
||||
|
||||
func TestReloadConfig(t *testing.T) {
|
||||
th := Setup(t)
|
||||
defer th.TearDown()
|
||||
@@ -108,7 +146,7 @@ func TestUpdateConfig(t *testing.T) {
|
||||
require.Equal(t, SiteName, cfg.TeamSettings.SiteName, "It should update the SiteName")
|
||||
|
||||
t.Run("Should set defaults for missing fields", func(t *testing.T) {
|
||||
_, appErr := th.SystemAdminClient.DoApiPut(th.SystemAdminClient.GetConfigRoute(), `{"ServiceSettings":{}}`)
|
||||
_, appErr := th.SystemAdminClient.DoApiPut(th.SystemAdminClient.GetConfigRoute(), fmt.Sprintf(`{"ServiceSettings":{"SiteURL":"%s"}}`, *cfg.ServiceSettings.SiteURL))
|
||||
require.Nil(t, appErr)
|
||||
})
|
||||
|
||||
@@ -179,6 +217,88 @@ func TestUpdateConfig(t *testing.T) {
|
||||
})
|
||||
}
|
||||
|
||||
func TestGetConfigWithoutManageSystemPermission(t *testing.T) {
|
||||
th := Setup(t)
|
||||
defer th.TearDown()
|
||||
th.Client.Login(th.BasicUser.Username, th.BasicUser.Password)
|
||||
|
||||
t.Run("any sysconsole read permission provides config read access", func(t *testing.T) {
|
||||
// forbidden by default
|
||||
_, resp := th.Client.GetConfig()
|
||||
CheckForbiddenStatus(t, resp)
|
||||
|
||||
// add any sysconsole read permission
|
||||
th.AddPermissionToRole(model.SysconsoleReadPermissions[0].Id, model.SYSTEM_USER_ROLE_ID)
|
||||
_, resp = th.Client.GetConfig()
|
||||
|
||||
// should be readable now
|
||||
CheckNoError(t, resp)
|
||||
})
|
||||
}
|
||||
|
||||
func TestUpdateConfigWithoutManageSystemPermission(t *testing.T) {
|
||||
th := Setup(t)
|
||||
defer th.TearDown()
|
||||
th.Client.Login(th.BasicUser.Username, th.BasicUser.Password)
|
||||
|
||||
// add read sysconsole integrations config
|
||||
th.AddPermissionToRole(model.PERMISSION_SYSCONSOLE_READ_INTEGRATIONS.Id, model.SYSTEM_USER_ROLE_ID)
|
||||
defer th.RemovePermissionFromRole(model.PERMISSION_SYSCONSOLE_READ_INTEGRATIONS.Id, model.SYSTEM_USER_ROLE_ID)
|
||||
|
||||
t.Run("sysconsole read permission does not provides config write access", func(t *testing.T) {
|
||||
// should be readable because has a sysconsole read permission
|
||||
cfg, resp := th.Client.GetConfig()
|
||||
CheckNoError(t, resp)
|
||||
|
||||
_, resp = th.Client.UpdateConfig(cfg)
|
||||
|
||||
CheckForbiddenStatus(t, resp)
|
||||
})
|
||||
|
||||
t.Run("the wrong write permission does not grant access", func(t *testing.T) {
|
||||
// should be readable because has a sysconsole read permission
|
||||
cfg, resp := th.SystemAdminClient.GetConfig()
|
||||
CheckNoError(t, resp)
|
||||
|
||||
originalValue := *cfg.ServiceSettings.AllowCorsFrom
|
||||
|
||||
// add the wrong write permission
|
||||
th.AddPermissionToRole(model.PERMISSION_SYSCONSOLE_WRITE_ABOUT.Id, model.SYSTEM_USER_ROLE_ID)
|
||||
defer th.RemovePermissionFromRole(model.PERMISSION_SYSCONSOLE_WRITE_ABOUT.Id, model.SYSTEM_USER_ROLE_ID)
|
||||
|
||||
// try update a config value allowed by sysconsole WRITE integrations
|
||||
mockVal := model.NewId()
|
||||
cfg.ServiceSettings.AllowCorsFrom = &mockVal
|
||||
_, resp = th.Client.UpdateConfig(cfg)
|
||||
CheckNoError(t, resp)
|
||||
|
||||
// ensure the config setting was not updated
|
||||
cfg, resp = th.Client.GetConfig()
|
||||
CheckNoError(t, resp)
|
||||
assert.Equal(t, *cfg.ServiceSettings.AllowCorsFrom, originalValue)
|
||||
})
|
||||
|
||||
t.Run("config value is writeable by specific system console permission", func(t *testing.T) {
|
||||
// should be readable because has a sysconsole read permission
|
||||
cfg, resp := th.SystemAdminClient.GetConfig()
|
||||
CheckNoError(t, resp)
|
||||
|
||||
th.AddPermissionToRole(model.PERMISSION_SYSCONSOLE_WRITE_INTEGRATIONS.Id, model.SYSTEM_USER_ROLE_ID)
|
||||
defer th.RemovePermissionFromRole(model.PERMISSION_SYSCONSOLE_WRITE_INTEGRATIONS.Id, model.SYSTEM_USER_ROLE_ID)
|
||||
|
||||
// try update a config value allowed by sysconsole WRITE integrations
|
||||
mockVal := model.NewId()
|
||||
cfg.ServiceSettings.AllowCorsFrom = &mockVal
|
||||
_, resp = th.Client.UpdateConfig(cfg)
|
||||
CheckNoError(t, resp)
|
||||
|
||||
// ensure the config setting was updated
|
||||
cfg, resp = th.Client.GetConfig()
|
||||
CheckNoError(t, resp)
|
||||
assert.Equal(t, *cfg.ServiceSettings.AllowCorsFrom, mockVal)
|
||||
})
|
||||
}
|
||||
|
||||
func TestUpdateConfigMessageExportSpecialHandling(t *testing.T) {
|
||||
th := Setup(t)
|
||||
defer th.TearDown()
|
||||
|
||||
Ссылка в новой задаче
Block a user