MM-58548 Remove manage_team permissions from System Console Ancillary permissions (#27395)

* remove manage team permissions from sysconsole_write_user_management_chanels and sysconsole_write_user_management_groups

* update migrations, add unit tests

* run migrations-extract

* make updating ancillary permissions a post

* update file names

* add new api to doc, update body to just be []string

* revert moving ancillary permissions to post

* fix queries after final testing

* Update channel.go

* Update channel.go

* Update 000124_remove_manage_team_permission.up.sql

* Update 000124_remove_manage_team_permission.up.sql

---------

Co-authored-by: Mattermost Build <build@mattermost.com>

server/channels/db/migrations/migrations.list

@@ -244,6 +244,8 @@ channels/db/migrations/mysql/000122_preferences_value_length.down.sql
 channels/db/migrations/mysql/000122_preferences_value_length.up.sql
 channels/db/migrations/mysql/000123_remove_upload_file_permission.down.sql
 channels/db/migrations/mysql/000123_remove_upload_file_permission.up.sql
+channels/db/migrations/mysql/000124_remove_manage_team_permission.down.sql
+channels/db/migrations/mysql/000124_remove_manage_team_permission.up.sql
 channels/db/migrations/postgres/000001_create_teams.down.sql
 channels/db/migrations/postgres/000001_create_teams.up.sql
 channels/db/migrations/postgres/000002_create_team_members.down.sql
@@ -488,3 +490,5 @@ channels/db/migrations/postgres/000122_preferences_value_length.down.sql
 channels/db/migrations/postgres/000122_preferences_value_length.up.sql
 channels/db/migrations/postgres/000123_remove_upload_file_permission.down.sql
 channels/db/migrations/postgres/000123_remove_upload_file_permission.up.sql
+channels/db/migrations/postgres/000124_remove_manage_team_permission.down.sql
+channels/db/migrations/postgres/000124_remove_manage_team_permission.up.sql

server/channels/db/migrations/mysql/000124_remove_manage_team_permission.down.sql

@@ -0,0 +1 @@
+-- Skipping it because the forward migrations are destructive

server/channels/db/migrations/mysql/000124_remove_manage_team_permission.up.sql

@@ -0,0 +1,21 @@
+CREATE PROCEDURE RemoveUploadFilePermission()
+BEGIN
+    updateRoles: LOOP
+        -- update affected rows
+        UPDATE Roles 
+            SET Permissions = REGEXP_REPLACE(Permissions, 'manage_team[[:space:]|?]', '')
+            WHERE Permissions REGEXP 'manage_team[[:space:]|?]'
+                AND Permissions not like '%sysconsole_write_user_management_teams%'
+                AND (Permissions like '%sysconsole_write_user_management_channels%'
+                OR Permissions like '%sysconsole_write_user_management_groups%')
+            LIMIT 100;
+
+          -- check if the loop has completed    
+          IF  ROW_COUNT() < 100 THEN
+              LEAVE updateRoles;
+          END IF;    
+    END LOOP updateRoles;
+END;
+
+CALL RemoveUploadFilePermission();
+DROP PROCEDURE IF EXISTS RemoveUploadFilePermission;

server/channels/db/migrations/postgres/000124_remove_manage_team_permission.down.sql

@@ -0,0 +1 @@
+-- Skipping it because the forward migrations are destructive

server/channels/db/migrations/postgres/000124_remove_manage_team_permission.up.sql

@@ -0,0 +1,21 @@
+DO $$
+<<remove_manage_team_permission>>
+DECLARE
+  rows_updated integer;
+BEGIN
+  LOOP
+    WITH table_holder AS (
+      SELECT id FROM roles
+        WHERE Permissions ~ 'manage_team($|\s)'
+            AND Permissions !~~ '%sysconsole_write_user_management_teams%'
+            AND (Permissions ~~ '%sysconsole_write_user_management_channels%'
+            OR Permissions ~~ '%sysconsole_write_user_management_groups%')
+        ORDER BY id ASC limit 100
+    )
+
+    UPDATE Roles r set permissions = REGEXP_REPLACE(permissions, 'manage_team($|\s)', '') 
+        WHERE r.id in (SELECT id FROM table_holder);
+    GET DIAGNOSTICS rows_updated = ROW_COUNT;
+    EXIT WHEN rows_updated < 100;
+  END LOOP;
+END remove_manage_team_permission $$;