MM-25543: New Admin Roles (#14960)
* MM-23832: Initial set of changes * MM-23832: further iteration * MM-23832: further iteration * MM-23832: further iteration * MM-23832: Fixes merge. * create migration for new Roles * MM-23832: Renames some roles. * MM-23832: Adds ability to see logs. * MM-23832: Removes manage roles from restricted admin. * MM-23832: Make authentication section read-only for restricted admin. * MM-23832: Allow restricted admin to purge caches. * MM-23832: Adds ability to recycle DB connections. * MM-23832: Adds ability to purge indexes. * MM-23832: Adds ability to test email and S3 config. * MM-23832: Adds abilituy to read job status. * MM-23832: Adds ability to read plugin statuses. * MM-23832: Renames Restricted Admin to System Manager. * MM-23832: Adds manage team roles to system_user_manager. * MM-23832: Updates some permissions. * MM-23832: Allow get all channels and get moderations. * MM-23832: Adds some permissions to User Manager. * MM-23832: Remove write users from user manager. * MM-23832: Changes permissions for the usermanagement > users sysconsole section. * MM-23832: Removes read_settings and write_settings permissions. Ensures the usermanagement parent permissions encompass the sub-permissions. * MM-23832: Updates permissions. * MM-23832: Changes some permissions checks, adds new permissions to roles. * MM-23832: Adds ability to update a role. * MM-23832: Permissions updates. * MM-23832: Removes write access to plugins for system manager. * MM-23832: Removes read compliance from new roles. * MM-23832: Adds mock for new roles creation migration. * MM-23832: Changes to variadic param. * MM-23832: Removes some duplication in the permissions model. Renames some permissions constants. * MM-23832: Updates some migrations. * MM-23832: Removes some unnecessary constants. * MM-23832: Changes back to old app method name. * MM-23832: Fixes incorrect permission check. * MM-23832: Changes write to read permission check. * MM-23832: Removes the authentication permission from link/unlink group. * MM-23832: Enable testing LDAP with read permissions. * MM-23832: Make testing elasticsearch a read permission. * MM-23832: Warn metrics are associated to any system console read permissions. * MM-23832: Updates some permissions checks. * MM-23832: Removes non-systemconsole permissions from roles. * MM-23832: Update default permission assignment of sysadmin. * MM-23832: Fixes incorrect permission check. Removes some unused stuff. * MM-23832: Update permission to check. * MM-23832: Switches to struct tags. * MM-23832: Adds some docs for the permissions tag. * MM-23832: Removes whitespace. * MM-23832: Combines system admin restricted access with other acess-control tag. * MM-23832: Fixes some tests. * MM-23832: Clarifies docs, does not assume prior permission check in '-' access value case. * MM-23832: Updates to correct access tag value. * MM-23832: Adds test of the config settings tag access. * MM-23832: Undoes whitespace change. * MM-23832: Removes comment. * MM-23832: Adds the permissions to the new roles rather than using OR conditions on the permissions checks. * MM-23832: Removes or condition on permission check. * MM-23832: Updates mapping. * MM-23832: Typo fix. * MM-23832: Adds new 'read_jobs' permission. * MM-23832: Add read_jobs to all roles with manage_jobs. * MM-23832: Adds new permission read_other_users_teams. * MM-23832: Adds read filtering of config. * MM-23932: Change tag value. * MM-23832: Fixes some tests. Adds test for read config access tag. * MM-23832: Adds permissions to list teams. * MM-23832: Removes the '-' tag value. Adds a new permission read_channel_groups. Updates a permission check. * MM-23832: Removes unnecessary parent permission for user_management. Fixes permission check change error. * MM-23832: Removes unused parameter to filter/merge function. * MM-23832: Renames migration name. * MM-23832: Fix for godoc. * MM-23832: Fixes tests. * MM-23832: Only makes a map once rather than every function call. Doesn't require access tag on config field structs. Reverts one test update and fixes another. * MM-23832: Removes all of the unnecessary uses of (*App).SessionHasPermissionToAny since removing the user_management parent permission. * MM-23832: Updates constant type. * MM-23832: Removes unnecessary comment. * MM-23832: Renames permissions. * MM-23832: Fix for permission name changes. * MM-23832: Adds missing config access tags. Adds some requirec ancillary permissions for write_usermanagement_teams. * MM-23832: Adds local API endpoint for getting config. * MM-23832: If tag value is blank or restrict_sys_admin_write then don't do the permission check. * MM-23832: nil check for strings prior to dereferencing. * MM-23832: Fix for config display logic. * MM-23832: Updates godoc. * MM-23832: Delays the unrestricted check for parity with other permissions checks if the channel id does not exist. * MM-23832: Removes tautology. * MM-23832: Re-adds status code check. * MM-23832: Adds new permission to edit brand image. * MM-23832: Exports variable for use by mmctl. * MM-23832: Initialize exported map for use by mmctl. * MM-23832: Accept deprecated permissions as valid. * MM-23832: Adds missing permissions to archive a channel. * MM-23832: Adds missing permissions for managing team. * MM-23832: Properly filters config values in patch and update API responses. * MM-23832: Fixes license viewing and writing permissions. * MM-23832: Require license to assign 'new system roles'. * MM-23832: Adds translation keys. * MM-23832: Updates translation order. * MM-27529: Splits read_channel_groups into read_public_channel_groups and read_private_channel_groups. * MM-23832: Prevent read-only permissions from editing site url test parameter. * MM-23832: Prevent read permissions from sniffing ports and elastic password. * MM-23832: Adds missing permission required for write user management channels. * MM-23832: Allows new roles to search for channels. * MM-23832: Adds ability for system_manager to manage jobs. * MM-23832: Cluster status access by sysconsole permission, not manage_system. * MM-23832: Adds 'add_user_to_team' permission to sysconsole write usermanagement teams. * MM-23832: Fixes lint. * MM-23832: Test fix. * MM-23832: Test fix. Co-authored-by: Catalin Tomai <catalin.tomai@mattermost.com> Co-authored-by: Scott Bishel <scott.bishel@mattermost.com> Co-authored-by: Mattermod <mattermod@users.noreply.github.com>
Этот коммит содержится в:
Martin Kraft
коммит произвёл
GitHub
GitHub
родитель
52611a1761
Коммит
8354206e5c
881
model/config.go
881
model/config.go
Разница между файлами не показана из-за своего большого размера
Загрузить разницу
@@ -17,4 +17,6 @@ const (
|
||||
MIGRATION_KEY_ADD_MANAGE_GUESTS_PERMISSIONS = "add_manage_guests_permissions"
|
||||
MIGRATION_KEY_CHANNEL_MODERATIONS_PERMISSIONS = "channel_moderations_permissions"
|
||||
MIGRATION_KEY_ADD_USE_GROUP_MENTIONS_PERMISSION = "add_use_group_mentions_permission"
|
||||
MIGRATION_KEY_ADD_SYSTEM_CONSOLE_PERMISSIONS = "add_system_console_permissions"
|
||||
MIGRATION_KEY_SIDEBAR_CATEGORIES_PHASE_2 = "migration_sidebar_categories_phase_2"
|
||||
)
|
||||
|
||||
Разница между файлами не показана из-за своего большого размера
Загрузить разницу
@@ -13,7 +13,7 @@ import (
|
||||
// in the database column for role permissions.
|
||||
func TestPermissionsLength(t *testing.T) {
|
||||
permissionsString := ""
|
||||
for _, permission := range ALL_PERMISSIONS {
|
||||
for _, permission := range AllPermissions {
|
||||
permissionsString += " " + permission.Id
|
||||
}
|
||||
|
||||
|
||||
231
model/role.go
231
model/role.go
@@ -9,10 +9,21 @@ import (
|
||||
"strings"
|
||||
)
|
||||
|
||||
// SysconsoleAncillaryPermissions maps the non-sysconsole permissions required by each sysconsole view.
|
||||
var SysconsoleAncillaryPermissions map[string][]*Permission
|
||||
|
||||
var BuiltInSchemeManagedRoleIDs []string
|
||||
|
||||
var NewSystemRoleIDs []string
|
||||
|
||||
func init() {
|
||||
BuiltInSchemeManagedRoleIDs = []string{
|
||||
NewSystemRoleIDs = []string{
|
||||
SYSTEM_USER_MANAGER_ROLE_ID,
|
||||
SYSTEM_READ_ONLY_ADMIN_ROLE_ID,
|
||||
SYSTEM_MANAGER_ROLE_ID,
|
||||
}
|
||||
|
||||
BuiltInSchemeManagedRoleIDs = append([]string{
|
||||
SYSTEM_GUEST_ROLE_ID,
|
||||
SYSTEM_USER_ROLE_ID,
|
||||
SYSTEM_ADMIN_ROLE_ID,
|
||||
@@ -29,6 +40,58 @@ func init() {
|
||||
CHANNEL_GUEST_ROLE_ID,
|
||||
CHANNEL_USER_ROLE_ID,
|
||||
CHANNEL_ADMIN_ROLE_ID,
|
||||
}, NewSystemRoleIDs...)
|
||||
|
||||
SysconsoleAncillaryPermissions = map[string][]*Permission{
|
||||
PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_CHANNELS.Id: {
|
||||
PERMISSION_READ_PUBLIC_CHANNEL,
|
||||
PERMISSION_READ_CHANNEL,
|
||||
PERMISSION_READ_PUBLIC_CHANNEL_GROUPS,
|
||||
PERMISSION_READ_PRIVATE_CHANNEL_GROUPS,
|
||||
},
|
||||
PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_USERS.Id: {
|
||||
PERMISSION_READ_OTHER_USERS_TEAMS,
|
||||
},
|
||||
PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_TEAMS.Id: {
|
||||
PERMISSION_LIST_PRIVATE_TEAMS,
|
||||
PERMISSION_LIST_PUBLIC_TEAMS,
|
||||
PERMISSION_VIEW_TEAM,
|
||||
},
|
||||
PERMISSION_SYSCONSOLE_READ_ENVIRONMENT.Id: {
|
||||
PERMISSION_READ_JOBS,
|
||||
},
|
||||
PERMISSION_SYSCONSOLE_READ_AUTHENTICATION.Id: {
|
||||
PERMISSION_READ_JOBS,
|
||||
},
|
||||
PERMISSION_SYSCONSOLE_READ_REPORTING.Id: {
|
||||
PERMISSION_VIEW_TEAM,
|
||||
},
|
||||
PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_CHANNELS.Id: {
|
||||
PERMISSION_MANAGE_TEAM,
|
||||
PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES,
|
||||
PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES,
|
||||
PERMISSION_DELETE_PRIVATE_CHANNEL,
|
||||
PERMISSION_DELETE_PUBLIC_CHANNEL,
|
||||
PERMISSION_MANAGE_CHANNEL_ROLES,
|
||||
},
|
||||
PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_TEAMS.Id: {
|
||||
PERMISSION_MANAGE_TEAM_ROLES,
|
||||
PERMISSION_REMOVE_USER_FROM_TEAM,
|
||||
PERMISSION_JOIN_PRIVATE_TEAMS,
|
||||
PERMISSION_JOIN_PUBLIC_TEAMS,
|
||||
PERMISSION_ADD_USER_TO_TEAM,
|
||||
},
|
||||
PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_GROUPS.Id: {
|
||||
PERMISSION_MANAGE_TEAM,
|
||||
PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS,
|
||||
PERMISSION_MANAGE_PUBLIC_CHANNEL_MEMBERS,
|
||||
},
|
||||
PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT.Id: {
|
||||
PERMISSION_MANAGE_JOBS,
|
||||
},
|
||||
PERMISSION_SYSCONSOLE_WRITE_SITE.Id: {
|
||||
PERMISSION_EDIT_BRAND,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
@@ -42,6 +105,9 @@ const (
|
||||
SYSTEM_POST_ALL_ROLE_ID = "system_post_all"
|
||||
SYSTEM_POST_ALL_PUBLIC_ROLE_ID = "system_post_all_public"
|
||||
SYSTEM_USER_ACCESS_TOKEN_ROLE_ID = "system_user_access_token"
|
||||
SYSTEM_USER_MANAGER_ROLE_ID = "system_user_manager"
|
||||
SYSTEM_READ_ONLY_ADMIN_ROLE_ID = "system_read_only_admin"
|
||||
SYSTEM_MANAGER_ROLE_ID = "system_manager"
|
||||
|
||||
TEAM_GUEST_ROLE_ID = "team_guest"
|
||||
TEAM_USER_ROLE_ID = "team_user"
|
||||
@@ -135,8 +201,8 @@ func (r *Role) MergeChannelHigherScopedPermissions(higherScopedPermissions *Role
|
||||
higherScopedPermissionsMap := AsStringBoolMap(higherScopedPermissions.Permissions)
|
||||
rolePermissionsMap := AsStringBoolMap(r.Permissions)
|
||||
|
||||
for _, cp := range ALL_PERMISSIONS {
|
||||
if cp.Scope != PERMISSION_SCOPE_CHANNEL {
|
||||
for _, cp := range AllPermissions {
|
||||
if cp.Scope != PermissionScopeChannel {
|
||||
continue
|
||||
}
|
||||
|
||||
@@ -150,7 +216,7 @@ func (r *Role) MergeChannelHigherScopedPermissions(higherScopedPermissions *Role
|
||||
continue
|
||||
}
|
||||
|
||||
_, permissionIsModerated := CHANNEL_MODERATED_PERMISSIONS_MAP[cp.Id]
|
||||
_, permissionIsModerated := ChannelModeratedPermissionsMap[cp.Id]
|
||||
if permissionIsModerated {
|
||||
_, presentOnRole := rolePermissionsMap[cp.Id]
|
||||
if presentOnRole && presentOnHigherScope {
|
||||
@@ -216,13 +282,13 @@ func ChannelModeratedPermissionsChangedByPatch(role *Role, patch *RolePatch) []s
|
||||
patchMap := make(map[string]bool)
|
||||
|
||||
for _, permission := range role.Permissions {
|
||||
if channelModeratedPermissionName, found := CHANNEL_MODERATED_PERMISSIONS_MAP[permission]; found {
|
||||
if channelModeratedPermissionName, found := ChannelModeratedPermissionsMap[permission]; found {
|
||||
roleMap[channelModeratedPermissionName] = true
|
||||
}
|
||||
}
|
||||
|
||||
for _, permission := range *patch.Permissions {
|
||||
if channelModeratedPermissionName, found := CHANNEL_MODERATED_PERMISSIONS_MAP[permission]; found {
|
||||
if channelModeratedPermissionName, found := ChannelModeratedPermissionsMap[permission]; found {
|
||||
patchMap[channelModeratedPermissionName] = true
|
||||
}
|
||||
}
|
||||
@@ -246,11 +312,11 @@ func ChannelModeratedPermissionsChangedByPatch(role *Role, patch *RolePatch) []s
|
||||
func (r *Role) GetChannelModeratedPermissions(channelType string) map[string]bool {
|
||||
moderatedPermissions := make(map[string]bool)
|
||||
for _, permission := range r.Permissions {
|
||||
if _, found := CHANNEL_MODERATED_PERMISSIONS_MAP[permission]; !found {
|
||||
if _, found := ChannelModeratedPermissionsMap[permission]; !found {
|
||||
continue
|
||||
}
|
||||
|
||||
for moderated, moderatedPermissionValue := range CHANNEL_MODERATED_PERMISSIONS_MAP {
|
||||
for moderated, moderatedPermissionValue := range ChannelModeratedPermissionsMap {
|
||||
// the moderated permission has already been found to be true so skip this iteration
|
||||
if moderatedPermissions[moderatedPermissionValue] {
|
||||
continue
|
||||
@@ -279,14 +345,14 @@ func (r *Role) RolePatchFromChannelModerationsPatch(channelModerationsPatch []*C
|
||||
// Iterate through the list of existing permissions on the role and append permissions that we want to keep.
|
||||
for _, permission := range r.Permissions {
|
||||
// Permission is not moderated so dont add it to the patch and skip the channelModerationsPatch
|
||||
if _, isModerated := CHANNEL_MODERATED_PERMISSIONS_MAP[permission]; !isModerated {
|
||||
if _, isModerated := ChannelModeratedPermissionsMap[permission]; !isModerated {
|
||||
continue
|
||||
}
|
||||
|
||||
permissionEnabled := true
|
||||
// Check if permission has a matching moderated permission name inside the channel moderation patch
|
||||
for _, channelModerationPatch := range channelModerationsPatch {
|
||||
if *channelModerationPatch.Name == CHANNEL_MODERATED_PERMISSIONS_MAP[permission] {
|
||||
if *channelModerationPatch.Name == ChannelModeratedPermissionsMap[permission] {
|
||||
// Permission key exists in patch with a value of false so skip over it
|
||||
if roleName == "members" {
|
||||
if channelModerationPatch.Roles.Members != nil && !*channelModerationPatch.Roles.Members {
|
||||
@@ -307,7 +373,7 @@ func (r *Role) RolePatchFromChannelModerationsPatch(channelModerationsPatch []*C
|
||||
|
||||
// Iterate through the patch and add any permissions that dont already exist on the role
|
||||
for _, channelModerationPatch := range channelModerationsPatch {
|
||||
for permission, moderatedPermissionName := range CHANNEL_MODERATED_PERMISSIONS_MAP {
|
||||
for permission, moderatedPermissionName := range ChannelModeratedPermissionsMap {
|
||||
if roleName == "members" && channelModerationPatch.Roles.Members != nil && *channelModerationPatch.Roles.Members && *channelModerationPatch.Name == moderatedPermissionName {
|
||||
permissionsToAddToPatch[permission] = true
|
||||
}
|
||||
@@ -349,7 +415,7 @@ func (r *Role) IsValidWithoutId() bool {
|
||||
|
||||
for _, permission := range r.Permissions {
|
||||
permissionValidated := false
|
||||
for _, p := range ALL_PERMISSIONS {
|
||||
for _, p := range append(AllPermissions, DeprecatedPermissions...) {
|
||||
if permission == p.Id {
|
||||
permissionValidated = true
|
||||
break
|
||||
@@ -579,6 +645,91 @@ func MakeDefaultRoles() map[string]*Role {
|
||||
BuiltIn: true,
|
||||
}
|
||||
|
||||
roles[SYSTEM_USER_MANAGER_ROLE_ID] = &Role{
|
||||
Name: "system_user_manager",
|
||||
DisplayName: "authentication.roles.system_user_manager.name",
|
||||
Description: "authentication.roles.system_user_manager.description",
|
||||
Permissions: []string{
|
||||
PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_GROUPS.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_TEAMS.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_CHANNELS.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_PERMISSIONS.Id,
|
||||
PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_GROUPS.Id,
|
||||
PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_TEAMS.Id,
|
||||
PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_CHANNELS.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_AUTHENTICATION.Id,
|
||||
},
|
||||
SchemeManaged: false,
|
||||
BuiltIn: true,
|
||||
}
|
||||
|
||||
roles[SYSTEM_READ_ONLY_ADMIN_ROLE_ID] = &Role{
|
||||
Name: "system_read_only_admin",
|
||||
DisplayName: "authentication.roles.system_read_only_admin.name",
|
||||
Description: "authentication.roles.system_read_only_admin.description",
|
||||
Permissions: []string{
|
||||
PERMISSION_SYSCONSOLE_READ_ABOUT.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_REPORTING.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_USERS.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_GROUPS.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_TEAMS.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_CHANNELS.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_PERMISSIONS.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_ENVIRONMENT.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_SITE.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_AUTHENTICATION.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_PLUGINS.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_INTEGRATIONS.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_EXPERIMENTAL.Id,
|
||||
},
|
||||
SchemeManaged: false,
|
||||
BuiltIn: true,
|
||||
}
|
||||
|
||||
roles[SYSTEM_MANAGER_ROLE_ID] = &Role{
|
||||
Name: "system_manager",
|
||||
DisplayName: "authentication.roles.system_manager.name",
|
||||
Description: "authentication.roles.system_manager.description",
|
||||
Permissions: []string{
|
||||
PERMISSION_SYSCONSOLE_READ_ABOUT.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_REPORTING.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_GROUPS.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_TEAMS.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_CHANNELS.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_PERMISSIONS.Id,
|
||||
PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_GROUPS.Id,
|
||||
PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_TEAMS.Id,
|
||||
PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_CHANNELS.Id,
|
||||
PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_PERMISSIONS.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_ENVIRONMENT.Id,
|
||||
PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_SITE.Id,
|
||||
PERMISSION_SYSCONSOLE_WRITE_SITE.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_AUTHENTICATION.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_PLUGINS.Id,
|
||||
PERMISSION_SYSCONSOLE_READ_INTEGRATIONS.Id,
|
||||
PERMISSION_SYSCONSOLE_WRITE_INTEGRATIONS.Id,
|
||||
},
|
||||
SchemeManaged: false,
|
||||
BuiltIn: true,
|
||||
}
|
||||
|
||||
// Add the ancillary permissions to each new system role
|
||||
for _, role := range []*Role{roles[SYSTEM_USER_MANAGER_ROLE_ID], roles[SYSTEM_READ_ONLY_ADMIN_ROLE_ID], roles[SYSTEM_MANAGER_ROLE_ID]} {
|
||||
for _, rolePermission := range role.Permissions {
|
||||
if ancillaryPermissions, ok := SysconsoleAncillaryPermissions[rolePermission]; ok {
|
||||
for _, ancillaryPermission := range ancillaryPermissions {
|
||||
role.Permissions = append(role.Permissions, ancillaryPermission.Id)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
allPermissionIDs := []string{}
|
||||
for _, permission := range AllPermissions {
|
||||
allPermissionIDs = append(allPermissionIDs, permission.Id)
|
||||
}
|
||||
|
||||
roles[SYSTEM_ADMIN_ROLE_ID] = &Role{
|
||||
Name: "system_admin",
|
||||
DisplayName: "authentication.roles.global_admin.name",
|
||||
@@ -586,61 +737,7 @@ func MakeDefaultRoles() map[string]*Role {
|
||||
// System admins can do anything channel and team admins can do
|
||||
// plus everything members of teams and channels can do to all teams
|
||||
// and channels on the system
|
||||
Permissions: append(
|
||||
append(
|
||||
append(
|
||||
append(
|
||||
[]string{
|
||||
PERMISSION_ASSIGN_SYSTEM_ADMIN_ROLE.Id,
|
||||
PERMISSION_MANAGE_SYSTEM.Id,
|
||||
PERMISSION_MANAGE_ROLES.Id,
|
||||
PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id,
|
||||
PERMISSION_MANAGE_PUBLIC_CHANNEL_MEMBERS.Id,
|
||||
PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS.Id,
|
||||
PERMISSION_DELETE_PUBLIC_CHANNEL.Id,
|
||||
PERMISSION_CREATE_PUBLIC_CHANNEL.Id,
|
||||
PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id,
|
||||
PERMISSION_DELETE_PRIVATE_CHANNEL.Id,
|
||||
PERMISSION_CREATE_PRIVATE_CHANNEL.Id,
|
||||
PERMISSION_MANAGE_SYSTEM_WIDE_OAUTH.Id,
|
||||
PERMISSION_MANAGE_OTHERS_INCOMING_WEBHOOKS.Id,
|
||||
PERMISSION_MANAGE_OTHERS_OUTGOING_WEBHOOKS.Id,
|
||||
PERMISSION_EDIT_OTHER_USERS.Id,
|
||||
PERMISSION_EDIT_OTHERS_POSTS.Id,
|
||||
PERMISSION_MANAGE_OAUTH.Id,
|
||||
PERMISSION_INVITE_USER.Id,
|
||||
PERMISSION_INVITE_GUEST.Id,
|
||||
PERMISSION_PROMOTE_GUEST.Id,
|
||||
PERMISSION_DEMOTE_TO_GUEST.Id,
|
||||
PERMISSION_DELETE_POST.Id,
|
||||
PERMISSION_DELETE_OTHERS_POSTS.Id,
|
||||
PERMISSION_CREATE_TEAM.Id,
|
||||
PERMISSION_ADD_USER_TO_TEAM.Id,
|
||||
PERMISSION_LIST_USERS_WITHOUT_TEAM.Id,
|
||||
PERMISSION_MANAGE_JOBS.Id,
|
||||
PERMISSION_CREATE_POST_PUBLIC.Id,
|
||||
PERMISSION_CREATE_POST_EPHEMERAL.Id,
|
||||
PERMISSION_CREATE_USER_ACCESS_TOKEN.Id,
|
||||
PERMISSION_READ_USER_ACCESS_TOKEN.Id,
|
||||
PERMISSION_REVOKE_USER_ACCESS_TOKEN.Id,
|
||||
PERMISSION_CREATE_BOT.Id,
|
||||
PERMISSION_READ_BOTS.Id,
|
||||
PERMISSION_READ_OTHERS_BOTS.Id,
|
||||
PERMISSION_MANAGE_BOTS.Id,
|
||||
PERMISSION_MANAGE_OTHERS_BOTS.Id,
|
||||
PERMISSION_REMOVE_OTHERS_REACTIONS.Id,
|
||||
PERMISSION_LIST_PRIVATE_TEAMS.Id,
|
||||
PERMISSION_JOIN_PRIVATE_TEAMS.Id,
|
||||
PERMISSION_VIEW_MEMBERS.Id,
|
||||
},
|
||||
roles[TEAM_USER_ROLE_ID].Permissions...,
|
||||
),
|
||||
roles[CHANNEL_USER_ROLE_ID].Permissions...,
|
||||
),
|
||||
roles[TEAM_ADMIN_ROLE_ID].Permissions...,
|
||||
),
|
||||
roles[CHANNEL_ADMIN_ROLE_ID].Permissions...,
|
||||
),
|
||||
Permissions: allPermissionIDs,
|
||||
SchemeManaged: true,
|
||||
BuiltIn: true,
|
||||
}
|
||||
|
||||
@@ -26,13 +26,13 @@ func TestChannelModeratedPermissionsChangedByPatch(t *testing.T) {
|
||||
"Adds permissions to empty initial permissions list",
|
||||
[]string{},
|
||||
[]string{PERMISSION_CREATE_POST.Id, PERMISSION_ADD_REACTION.Id},
|
||||
[]string{CHANNEL_MODERATED_PERMISSIONS[0], CHANNEL_MODERATED_PERMISSIONS[1]},
|
||||
[]string{ChannelModeratedPermissions[0], ChannelModeratedPermissions[1]},
|
||||
},
|
||||
{
|
||||
"Ignores non moderated permissions in initial permissions list",
|
||||
[]string{PERMISSION_ASSIGN_BOT.Id},
|
||||
[]string{PERMISSION_CREATE_POST.Id, PERMISSION_REMOVE_REACTION.Id},
|
||||
[]string{CHANNEL_MODERATED_PERMISSIONS[0], CHANNEL_MODERATED_PERMISSIONS[1]},
|
||||
[]string{ChannelModeratedPermissions[0], ChannelModeratedPermissions[1]},
|
||||
},
|
||||
{
|
||||
"Adds removed moderated permissions from initial permissions list",
|
||||
@@ -58,10 +58,10 @@ func TestChannelModeratedPermissionsChangedByPatch(t *testing.T) {
|
||||
}
|
||||
|
||||
func TestRolePatchFromChannelModerationsPatch(t *testing.T) {
|
||||
createPosts := CHANNEL_MODERATED_PERMISSIONS[0]
|
||||
createReactions := CHANNEL_MODERATED_PERMISSIONS[1]
|
||||
manageMembers := CHANNEL_MODERATED_PERMISSIONS[2]
|
||||
channelMentions := CHANNEL_MODERATED_PERMISSIONS[3]
|
||||
createPosts := ChannelModeratedPermissions[0]
|
||||
createReactions := ChannelModeratedPermissions[1]
|
||||
manageMembers := ChannelModeratedPermissions[2]
|
||||
channelMentions := ChannelModeratedPermissions[3]
|
||||
|
||||
basePermissions := []string{
|
||||
PERMISSION_ADD_REACTION.Id,
|
||||
@@ -245,10 +245,10 @@ func TestGetChannelModeratedPermissions(t *testing.T) {
|
||||
[]string{PERMISSION_CREATE_POST.Id, PERMISSION_ADD_REACTION.Id, PERMISSION_REMOVE_REACTION.Id, PERMISSION_MANAGE_PUBLIC_CHANNEL_MEMBERS.Id, PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS.Id, PERMISSION_USE_CHANNEL_MENTIONS.Id},
|
||||
CHANNEL_OPEN,
|
||||
map[string]bool{
|
||||
CHANNEL_MODERATED_PERMISSIONS[0]: true,
|
||||
CHANNEL_MODERATED_PERMISSIONS[1]: true,
|
||||
CHANNEL_MODERATED_PERMISSIONS[2]: true,
|
||||
CHANNEL_MODERATED_PERMISSIONS[3]: true,
|
||||
ChannelModeratedPermissions[0]: true,
|
||||
ChannelModeratedPermissions[1]: true,
|
||||
ChannelModeratedPermissions[2]: true,
|
||||
ChannelModeratedPermissions[3]: true,
|
||||
},
|
||||
},
|
||||
{
|
||||
@@ -256,7 +256,7 @@ func TestGetChannelModeratedPermissions(t *testing.T) {
|
||||
[]string{PERMISSION_CREATE_POST.Id, PERMISSION_CREATE_DIRECT_CHANNEL.Id},
|
||||
CHANNEL_OPEN,
|
||||
map[string]bool{
|
||||
CHANNEL_MODERATED_PERMISSIONS[0]: true,
|
||||
ChannelModeratedPermissions[0]: true,
|
||||
},
|
||||
},
|
||||
{
|
||||
|
||||
Ссылка в новой задаче
Block a user