New isrole replacement (#21688)

* Adds new function to use in place of isRole that includes team and channel schemes.

* Adds tests. Fixes code.

* Adds warning to isRole.

* Fixes phrasing.

* Added more docs.

* Moved from strings to constants.

* Added some spacing and improved some comments.

* Renames some functions.

* Rename isNotRole to isNotExactRole. Add a new isNotRole function.

* Switch to only checking prefix.

* Ignores unused function warning.

* Lint fix.

* Switch from unused to deadcode.

* Adds test for isNotRole.

app/permissions_migrations.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/mattermost/mattermost-server/v6/model"
 	"github.com/mattermost/mattermost-server/v6/store"
+	"github.com/mattermost/mattermost-server/v6/store/sqlstore"
 )
 
 type permissionTransformation struct {
@@ -74,18 +75,73 @@ const (
 	PermissionManageRemoteClusters           = "manage_remote_clusters" // deprecated; use `manage_secure_connections`
 )
 
-func isRole(roleName string) func(*model.Role, map[string]map[string]bool) bool {
+// Deprecated: This function should only be used if a case arises where team and/or channel scheme roles do not need to be migrated.
+// Otherwise, use isRole.
+func isExactRole(roleName string) func(*model.Role, map[string]map[string]bool) bool {
 	return func(role *model.Role, permissionsMap map[string]map[string]bool) bool {
 		return role.Name == roleName
 	}
 }
 
-func isNotRole(roleName string) func(*model.Role, map[string]map[string]bool) bool {
+// isRole returns true if roleName matches a role's name field or if the a team
+// or channel scheme role matches a "common name". A common name is one of the following role
+// that is common among the system scheme and the team and/or channel schemes:
+//
+// TeamAdmin,
+// TeamUser,
+// TeamGuest,
+// ChannelAdmin,
+// ChannelUser,
+// ChannelGuest,
+// PlaybookAdmin,
+// PlaybookMember,
+// RunAdmin,
+// RunMember
+func isRole(roleName string) func(*model.Role, map[string]map[string]bool) bool {
+	return func(role *model.Role, permissionsMap map[string]map[string]bool) bool {
+		if role.Name == roleName {
+			return true
+		}
+		return isSchemeRoleAssociatedToCommonName(roleName, role)
+	}
+}
+
+// Deprecated: use isNotRole instead.
+func isNotExactRole(roleName string) func(*model.Role, map[string]map[string]bool) bool {
 	return func(role *model.Role, permissionsMap map[string]map[string]bool) bool {
 		return role.Name != roleName
 	}
 }
 
+func isNotRole(roleName string) func(*model.Role, map[string]map[string]bool) bool {
+	return func(role *model.Role, permissionsMap map[string]map[string]bool) bool {
+		return role.Name != roleName && !isSchemeRoleAssociatedToCommonName(roleName, role)
+	}
+}
+
+func isSchemeRoleAssociatedToCommonName(roleName string, role *model.Role) bool {
+	roleIDToSchemeRoleDisplayName := map[string]string{
+		model.TeamAdminRoleId: sqlstore.SchemeRoleDisplayNameTeamAdmin,
+		model.TeamUserRoleId:  sqlstore.SchemeRoleDisplayNameTeamUser,
+		model.TeamGuestRoleId: sqlstore.SchemeRoleDisplayNameTeamGuest,
+
+		model.ChannelAdminRoleId: sqlstore.SchemeRoleDisplayNameChannelAdmin,
+		model.ChannelUserRoleId:  sqlstore.SchemeRoleDisplayNameChannelUser,
+		model.ChannelGuestRoleId: sqlstore.SchemeRoleDisplayNameChannelGuest,
+
+		model.PlaybookAdminRoleId:  sqlstore.SchemeRoleDisplayNamePlaybookAdmin,
+		model.PlaybookMemberRoleId: sqlstore.SchemeRoleDisplayNamePlaybookMember,
+
+		model.RunAdminRoleId:  sqlstore.SchemeRoleDisplayNameRunAdmin,
+		model.RunMemberRoleId: sqlstore.SchemeRoleDisplayNameRunMember,
+	}
+	displayName, ok := roleIDToSchemeRoleDisplayName[roleName]
+	if !ok {
+		return false
+	}
+	return strings.HasPrefix(role.DisplayName, displayName)
+}
+
 func isNotSchemeRole(roleName string) func(*model.Role, map[string]map[string]bool) bool {
 	return func(role *model.Role, permissionsMap map[string]map[string]bool) bool {
 		return !strings.Contains(role.DisplayName, roleName)
@@ -222,12 +278,12 @@ func (a *App) getWebhooksPermissionsSplitMigration() (permissionsMap, error) {
 func (a *App) getListJoinPublicPrivateTeamsPermissionsMigration() (permissionsMap, error) {
 	return permissionsMap{
 		permissionTransformation{
-			On:     isRole(model.SystemAdminRoleId),
+			On:     isExactRole(model.SystemAdminRoleId),
 			Add:    []string{PermissionListPrivateTeams, PermissionJoinPrivateTeams},
 			Remove: []string{},
 		},
 		permissionTransformation{
-			On:     isRole(model.SystemUserRoleId),
+			On:     isExactRole(model.SystemUserRoleId),
 			Add:    []string{PermissionListPublicTeams, PermissionJoinPublicTeams},
 			Remove: []string{},
 		},
@@ -246,7 +302,7 @@ func (a *App) removePermanentDeleteUserMigration() (permissionsMap, error) {
 func (a *App) getAddBotPermissionsMigration() (permissionsMap, error) {
 	return permissionsMap{
 		permissionTransformation{
-			On:     isRole(model.SystemAdminRoleId),
+			On:     isExactRole(model.SystemAdminRoleId),
 			Add:    []string{PermissionCreateBot, PermissionReadBots, PermissionReadOthersBots, PermissionManageBots, PermissionManageOthersBots},
 			Remove: []string{},
 		},
@@ -256,19 +312,19 @@ func (a *App) getAddBotPermissionsMigration() (permissionsMap, error) {
 func (a *App) applyChannelManageDeleteToChannelUser() (permissionsMap, error) {
 	return permissionsMap{
 		permissionTransformation{
-			On:  permissionAnd(isRole(model.ChannelUserRoleId), onOtherRole(model.TeamUserRoleId, permissionExists(PermissionManagePrivateChannelProperties))),
+			On:  permissionAnd(isExactRole(model.ChannelUserRoleId), onOtherRole(model.TeamUserRoleId, permissionExists(PermissionManagePrivateChannelProperties))),
 			Add: []string{PermissionManagePrivateChannelProperties},
 		},
 		permissionTransformation{
-			On:  permissionAnd(isRole(model.ChannelUserRoleId), onOtherRole(model.TeamUserRoleId, permissionExists(PermissionDeletePrivateChannel))),
+			On:  permissionAnd(isExactRole(model.ChannelUserRoleId), onOtherRole(model.TeamUserRoleId, permissionExists(PermissionDeletePrivateChannel))),
 			Add: []string{PermissionDeletePrivateChannel},
 		},
 		permissionTransformation{
-			On:  permissionAnd(isRole(model.ChannelUserRoleId), onOtherRole(model.TeamUserRoleId, permissionExists(PermissionManagePublicChannelProperties))),
+			On:  permissionAnd(isExactRole(model.ChannelUserRoleId), onOtherRole(model.TeamUserRoleId, permissionExists(PermissionManagePublicChannelProperties))),
 			Add: []string{PermissionManagePublicChannelProperties},
 		},
 		permissionTransformation{
-			On:  permissionAnd(isRole(model.ChannelUserRoleId), onOtherRole(model.TeamUserRoleId, permissionExists(PermissionDeletePublicChannel))),
+			On:  permissionAnd(isExactRole(model.ChannelUserRoleId), onOtherRole(model.TeamUserRoleId, permissionExists(PermissionDeletePublicChannel))),
 			Add: []string{PermissionDeletePublicChannel},
 		},
 	}, nil
@@ -277,19 +333,19 @@ func (a *App) applyChannelManageDeleteToChannelUser() (permissionsMap, error) {
 func (a *App) removeChannelManageDeleteFromTeamUser() (permissionsMap, error) {
 	return permissionsMap{
 		permissionTransformation{
-			On:     permissionAnd(isRole(model.TeamUserRoleId), permissionExists(PermissionManagePrivateChannelProperties)),
+			On:     permissionAnd(isExactRole(model.TeamUserRoleId), permissionExists(PermissionManagePrivateChannelProperties)),
 			Remove: []string{PermissionManagePrivateChannelProperties},
 		},
 		permissionTransformation{
-			On:     permissionAnd(isRole(model.TeamUserRoleId), permissionExists(PermissionDeletePrivateChannel)),
+			On:     permissionAnd(isExactRole(model.TeamUserRoleId), permissionExists(PermissionDeletePrivateChannel)),
 			Remove: []string{model.PermissionDeletePrivateChannel.Id},
 		},
 		permissionTransformation{
-			On:     permissionAnd(isRole(model.TeamUserRoleId), permissionExists(PermissionManagePublicChannelProperties)),
+			On:     permissionAnd(isExactRole(model.TeamUserRoleId), permissionExists(PermissionManagePublicChannelProperties)),
 			Remove: []string{PermissionManagePublicChannelProperties},
 		},
 		permissionTransformation{
-			On:     permissionAnd(isRole(model.TeamUserRoleId), permissionExists(PermissionDeletePublicChannel)),
+			On:     permissionAnd(isExactRole(model.TeamUserRoleId), permissionExists(PermissionDeletePublicChannel)),
 			Remove: []string{PermissionDeletePublicChannel},
 		},
 	}, nil
@@ -298,11 +354,11 @@ func (a *App) removeChannelManageDeleteFromTeamUser() (permissionsMap, error) {
 func (a *App) getViewMembersPermissionMigration() (permissionsMap, error) {
 	return permissionsMap{
 		permissionTransformation{
-			On:  isRole(model.SystemUserRoleId),
+			On:  isExactRole(model.SystemUserRoleId),
 			Add: []string{PermissionViewMembers},
 		},
 		permissionTransformation{
-			On:  isRole(model.SystemAdminRoleId),
+			On:  isExactRole(model.SystemAdminRoleId),
 			Add: []string{PermissionViewMembers},
 		},
 	}, nil
@@ -311,7 +367,7 @@ func (a *App) getViewMembersPermissionMigration() (permissionsMap, error) {
 func (a *App) getAddManageGuestsPermissionsMigration() (permissionsMap, error) {
 	return permissionsMap{
 		permissionTransformation{
-			On:  isRole(model.SystemAdminRoleId),
+			On:  isExactRole(model.SystemAdminRoleId),
 			Add: []string{PermissionPromoteGuest, PermissionDemoteToGuest, PermissionInviteGuest},
 		},
 	}, nil
@@ -342,7 +398,7 @@ func (a *App) channelModerationPermissionsMigration() (permissionsMap, error) {
 			// add each moderated permission to the channel admin if channel user or guest has the permission
 			trans := permissionTransformation{
 				On: permissionAnd(
-					isRole(channelAdminID),
+					isExactRole(channelAdminID),
 					permissionOr(
 						onOtherRole(channelUserID, permissionExists(perm)),
 						onOtherRole(channelGuestID, permissionExists(perm)),
@@ -355,7 +411,7 @@ func (a *App) channelModerationPermissionsMigration() (permissionsMap, error) {
 			// add each moderated permission to the team admin if channel admin, user, or guest has the permission
 			trans = permissionTransformation{
 				On: permissionAnd(
-					isRole(teamAdminID),
+					isExactRole(teamAdminID),
 					permissionOr(
 						onOtherRole(channelAdminID, permissionExists(perm)),
 						onOtherRole(channelUserID, permissionExists(perm)),
@@ -373,14 +429,14 @@ func (a *App) channelModerationPermissionsMigration() (permissionsMap, error) {
 	for _, ts := range allTeamSchemes {
 		// ensure all team scheme channel admins have create_post because it's not exposed via the UI
 		trans := permissionTransformation{
-			On:  isRole(ts.DefaultChannelAdminRole),
+			On:  isExactRole(ts.DefaultChannelAdminRole),
 			Add: []string{PermissionCreatePost},
 		}
 		transformations = append(transformations, trans)
 
 		// ensure all team scheme team admins have create_post because it's not exposed via the UI
 		trans = permissionTransformation{
-			On:  isRole(ts.DefaultTeamAdminRole),
+			On:  isExactRole(ts.DefaultTeamAdminRole),
 			Add: []string{PermissionCreatePost},
 		}
 		transformations = append(transformations, trans)
@@ -396,13 +452,13 @@ func (a *App) channelModerationPermissionsMigration() (permissionsMap, error) {
 
 	// ensure team admins have create_post
 	transformations = append(transformations, permissionTransformation{
-		On:  isRole(model.TeamAdminRoleId),
+		On:  isExactRole(model.TeamAdminRoleId),
 		Add: []string{PermissionCreatePost},
 	})
 
 	// ensure channel admins have create_post
 	transformations = append(transformations, permissionTransformation{
-		On:  isRole(model.ChannelAdminRoleId),
+		On:  isExactRole(model.ChannelAdminRoleId),
 		Add: []string{PermissionCreatePost},
 	})
 
@@ -416,7 +472,7 @@ func (a *App) channelModerationPermissionsMigration() (permissionsMap, error) {
 
 	// ensure system admin has all of the moderated permissions
 	transformations = append(transformations, permissionTransformation{
-		On:  isRole(model.SystemAdminRoleId),
+		On:  isExactRole(model.SystemAdminRoleId),
 		Add: append(moderatedPermissionsMinusCreatePost, PermissionCreatePost),
 	})
 
@@ -433,8 +489,8 @@ func (a *App) getAddUseGroupMentionsPermissionMigration() (permissionsMap, error
 	return permissionsMap{
 		permissionTransformation{
 			On: permissionAnd(
-				isNotRole(model.ChannelGuestRoleId),
+				isNotExactRole(model.ChannelGuestRoleId),
-				isNotSchemeRole("Channel Guest Role for Scheme"),
+				isNotSchemeRole(sqlstore.SchemeRoleDisplayNameChannelGuest),
 				permissionOr(permissionExists(PermissionCreatePost), permissionExists(PermissionCreatePost_PUBLIC)),
 			),
 			Add: []string{PermissionUseGroupMentions},
@@ -453,7 +509,7 @@ func (a *App) getAddSystemConsolePermissionsMigration() (permissionsMap, error)
 	// add the new permissions to system admin
 	transformations = append(transformations,
 		permissionTransformation{
-			On:  isRole(model.SystemAdminRoleId),
+			On:  isExactRole(model.SystemAdminRoleId),
 			Add: permissionsToAdd,
 		})
 
@@ -502,7 +558,7 @@ func (a *App) getAddConvertChannelPermissionsMigration() (permissionsMap, error)
 func (a *App) getSystemRolesPermissionsMigration() (permissionsMap, error) {
 	return permissionsMap{
 		permissionTransformation{
-			On:  isRole(model.SystemAdminRoleId),
+			On:  isExactRole(model.SystemAdminRoleId),
 			Add: []string{model.PermissionSysconsoleReadUserManagementSystemRoles.Id, model.PermissionSysconsoleWriteUserManagementSystemRoles.Id},
 		},
 	}, nil
@@ -511,7 +567,7 @@ func (a *App) getSystemRolesPermissionsMigration() (permissionsMap, error) {
 func (a *App) getAddManageSharedChannelsPermissionsMigration() (permissionsMap, error) {
 	return permissionsMap{
 		permissionTransformation{
-			On:  isRole(model.SystemAdminRoleId),
+			On:  isExactRole(model.SystemAdminRoleId),
 			Add: []string{PermissionManageSharedChannels},
 		},
 	}, nil
@@ -520,7 +576,7 @@ func (a *App) getAddManageSharedChannelsPermissionsMigration() (permissionsMap,
 func (a *App) getBillingPermissionsMigration() (permissionsMap, error) {
 	return permissionsMap{
 		permissionTransformation{
-			On:  isRole(model.SystemAdminRoleId),
+			On:  isExactRole(model.SystemAdminRoleId),
 			Add: []string{model.PermissionSysconsoleReadBilling.Id, model.PermissionSysconsoleWriteBilling.Id},
 		},
 	}, nil
@@ -532,14 +588,14 @@ func (a *App) getAddManageSecureConnectionsPermissionsMigration() (permissionsMa
 	// add the new permission to system admin
 	transformations = append(transformations,
 		permissionTransformation{
-			On:  isRole(model.SystemAdminRoleId),
+			On:  isExactRole(model.SystemAdminRoleId),
 			Add: []string{PermissionManageSecureConnections},
 		})
 
 	// remote the deprecated permission from system admin
 	transformations = append(transformations,
 		permissionTransformation{
-			On:     isRole(model.SystemAdminRoleId),
+			On:     isExactRole(model.SystemAdminRoleId),
 			Remove: []string{PermissionManageRemoteClusters},
 		})
 
@@ -555,7 +611,7 @@ func (a *App) getAddDownloadComplianceExportResult() (permissionsMap, error) {
 	// add the new permissions to system admin
 	transformations = append(transformations,
 		permissionTransformation{
-			On:  isRole(model.SystemAdminRoleId),
+			On:  isExactRole(model.SystemAdminRoleId),
 			Add: []string{model.PermissionDownloadComplianceExportResult.Id},
 		})
 
@@ -926,12 +982,12 @@ func (a *App) getAddCustomUserGroupsPermissions() (permissionsMap, error) {
 	}
 
 	t = append(t, permissionTransformation{
-		On:  isRole(model.SystemUserRoleId),
+		On:  isExactRole(model.SystemUserRoleId),
 		Add: customGroupPermissions,
 	})
 
 	t = append(t, permissionTransformation{
-		On:  isRole(model.SystemAdminRoleId),
+		On:  isExactRole(model.SystemAdminRoleId),
 		Add: customGroupPermissions,
 	})
 
@@ -953,7 +1009,7 @@ func (a *App) getAddPlaybooksPermissions() (permissionsMap, error) {
 	})
 
 	transformations = append(transformations, permissionTransformation{
-		On: isRole(model.SystemAdminRoleId),
+		On: isExactRole(model.SystemAdminRoleId),
 		Add: []string{
 			model.PermissionPublicPlaybookManageProperties.Id,
 			model.PermissionPublicPlaybookManageMembers.Id,
@@ -978,9 +1034,9 @@ func (a *App) getPlaybooksPermissionsAddManageRoles() (permissionsMap, error) {
 
 	transformations = append(transformations, permissionTransformation{
 		On: permissionOr(
-			isRole(model.PlaybookAdminRoleId),
+			isExactRole(model.PlaybookAdminRoleId),
-			isRole(model.TeamAdminRoleId),
+			isExactRole(model.TeamAdminRoleId),
-			isRole(model.SystemAdminRoleId),
+			isExactRole(model.SystemAdminRoleId),
 		),
 		Add: []string{
 			model.PermissionPublicPlaybookManageRoles.Id,
@@ -999,13 +1055,13 @@ func (a *App) getProductsBoardsPermissions() (permissionsMap, error) {
 
 	// Give the new subsection READ permissions to any user with SYSTEM_MANAGER
 	transformations = append(transformations, permissionTransformation{
-		On:  permissionOr(isRole(model.SystemManagerRoleId)),
+		On:  permissionOr(isExactRole(model.SystemManagerRoleId)),
 		Add: permissionsProductsRead,
 	})
 
 	// Give the new subsection WRITE permissions to any user with SYSTEM_ADMIN
 	transformations = append(transformations, permissionTransformation{
-		On:  permissionOr(isRole(model.SystemAdminRoleId)),
+		On:  permissionOr(isExactRole(model.SystemAdminRoleId)),
 		Add: permissionsProductsWrite,
 	})
 

app/permissions_migrations_test.go

@@ -10,6 +10,7 @@ import (
 	"github.com/stretchr/testify/assert"
 
 	"github.com/mattermost/mattermost-server/v6/model"
+	"github.com/mattermost/mattermost-server/v6/store/sqlstore"
 )
 
 func TestApplyPermissionsMap(t *testing.T) {
@@ -137,7 +138,7 @@ func TestApplyPermissionsMap(t *testing.T) {
 				},
 			},
 			permissionsMap{permissionTransformation{
-				On:  isRole("system_admin"),
+				On:  isExactRole("system_admin"),
 				Add: []string{"test4"},
 			}},
 			[]string{"test1", "test2", "test3", "test4"},
@@ -152,7 +153,7 @@ func TestApplyPermissionsMap(t *testing.T) {
 				},
 			},
 			permissionsMap{permissionTransformation{
-				On:  isRole("system_user"),
+				On:  isExactRole("system_user"),
 				Add: []string{"test4"},
 			}},
 			[]string{"test1", "test2", "test3"},
@@ -203,3 +204,74 @@ func TestApplyPermissionsMap(t *testing.T) {
 		})
 	}
 }
+
+func TestApplyPermissionsMapToSchemeRole(t *testing.T) {
+	schemeRoleName := model.NewId()
+	tt := []struct {
+		Name           string
+		RoleMap        map[string]map[string]bool
+		TranslationMap permissionsMap
+		ExpectedResult []string
+	}{
+		{
+			"Adds a permission to a scheme role with a matching common name",
+			map[string]map[string]bool{
+				schemeRoleName: {
+					"test1": true,
+				},
+			},
+			permissionsMap{permissionTransformation{
+				On:  isRole(model.TeamAdminRoleId),
+				Add: []string{"test2"},
+			}},
+			[]string{"test1", "test2"},
+		},
+		{
+			"Doesn't add a permission to a scheme role with a different common name",
+			map[string]map[string]bool{
+				schemeRoleName: {
+					"test1": true,
+				},
+			},
+			permissionsMap{permissionTransformation{
+				On:  isRole(model.ChannelAdminRoleId),
+				Add: []string{"test2"},
+			}},
+			[]string{"test1"},
+		},
+		{
+			"Doesn't add a permission to a role with a the same exact name",
+			map[string]map[string]bool{
+				schemeRoleName: {
+					"test1": true,
+				},
+			},
+			permissionsMap{permissionTransformation{
+				On:  isNotRole(schemeRoleName),
+				Add: []string{"test2"},
+			}},
+			[]string{"test1"},
+		},
+		{
+			"Doesn't add a permission to a role with a different exact name but the same common name",
+			map[string]map[string]bool{
+				schemeRoleName: {
+					"test1": true,
+				},
+			},
+			permissionsMap{permissionTransformation{
+				On:  isNotRole(model.TeamAdminRoleId),
+				Add: []string{"test2"},
+			}},
+			[]string{"test1"},
+		},
+	}
+
+	for _, tc := range tt {
+		t.Run(tc.Name, func(t *testing.T) {
+			result := applyPermissionsMap(&model.Role{Name: schemeRoleName, DisplayName: sqlstore.SchemeRoleDisplayNameTeamAdmin}, tc.RoleMap, tc.TranslationMap)
+			sort.Strings(result)
+			assert.Equal(t, tc.ExpectedResult, result)
+		})
+	}
+}

store/sqlstore/scheme_store.go

@@ -14,6 +14,22 @@ import (
 	"github.com/mattermost/mattermost-server/v6/store"
 )
 
+const (
+	SchemeRoleDisplayNameTeamAdmin = "Team Admin Role for Scheme"
+	SchemeRoleDisplayNameTeamUser  = "Team User Role for Scheme"
+	SchemeRoleDisplayNameTeamGuest = "Team Guest Role for Scheme"
+
+	SchemeRoleDisplayNameChannelAdmin = "Channel Admin Role for Scheme"
+	SchemeRoleDisplayNameChannelUser  = "Channel User Role for Scheme"
+	SchemeRoleDisplayNameChannelGuest = "Channel Guest Role for Scheme"
+
+	SchemeRoleDisplayNamePlaybookAdmin  = "Playbook Admin Role for Scheme"
+	SchemeRoleDisplayNamePlaybookMember = "Playbook Member Role for Scheme"
+
+	SchemeRoleDisplayNameRunAdmin  = "Run Admin Role for Scheme"
+	SchemeRoleDisplayNameRunMember = "Run Member Role for Scheme"
+)
+
 type SqlSchemeStore struct {
 	*SqlStore
 }
@@ -50,7 +66,7 @@ func (s *SqlSchemeStore) Save(scheme *model.Scheme) (_ *model.Scheme, err error)
 		SET UpdateAt=:UpdateAt, CreateAt=:CreateAt, DeleteAt=:DeleteAt, Name=:Name, DisplayName=:DisplayName, Description=:Description, Scope=:Scope,
 		 DefaultTeamAdminRole=:DefaultTeamAdminRole, DefaultTeamUserRole=:DefaultTeamUserRole, DefaultTeamGuestRole=:DefaultTeamGuestRole,
 		 DefaultChannelAdminRole=:DefaultChannelAdminRole, DefaultChannelUserRole=:DefaultChannelUserRole, DefaultChannelGuestRole=:DefaultChannelGuestRole,
-		 DefaultPlaybookMemberRole=:DefaultPlaybookMemberRole, DefaultPlaybookAdminRole=:DefaultPlaybookAdminRole, DefaultRunMemberRole=:DefaultRunMemberRole, DefaultRunAdminRole=:DefaultRunAdminRole 
+		 DefaultPlaybookMemberRole=:DefaultPlaybookMemberRole, DefaultPlaybookAdminRole=:DefaultPlaybookAdminRole, DefaultRunMemberRole=:DefaultRunMemberRole, DefaultRunAdminRole=:DefaultRunAdminRole
 		 WHERE Id=:Id`, scheme)
 
 	if err != nil {
@@ -101,7 +117,7 @@ func (s *SqlSchemeStore) createScheme(scheme *model.Scheme, transaction *sqlxTxW
 		// Team Admin Role
 		teamAdminRole := &model.Role{
 			Name:          model.NewId(),
-			DisplayName:   fmt.Sprintf("Team Admin Role for Scheme %s", scheme.Name),
+			DisplayName:   fmt.Sprintf("%s %s", SchemeRoleDisplayNameTeamAdmin, scheme.Name),
 			Permissions:   defaultRoles[model.TeamAdminRoleId].Permissions,
 			SchemeManaged: true,
 		}
@@ -115,7 +131,7 @@ func (s *SqlSchemeStore) createScheme(scheme *model.Scheme, transaction *sqlxTxW
 		// Team User Role
 		teamUserRole := &model.Role{
 			Name:          model.NewId(),
-			DisplayName:   fmt.Sprintf("Team User Role for Scheme %s", scheme.Name),
+			DisplayName:   fmt.Sprintf("%s %s", SchemeRoleDisplayNameTeamUser, scheme.Name),
 			Permissions:   defaultRoles[model.TeamUserRoleId].Permissions,
 			SchemeManaged: true,
 		}
@@ -129,7 +145,7 @@ func (s *SqlSchemeStore) createScheme(scheme *model.Scheme, transaction *sqlxTxW
 		// Team Guest Role
 		teamGuestRole := &model.Role{
 			Name:          model.NewId(),
-			DisplayName:   fmt.Sprintf("Team Guest Role for Scheme %s", scheme.Name),
+			DisplayName:   fmt.Sprintf("%s %s", SchemeRoleDisplayNameTeamGuest, scheme.Name),
 			Permissions:   defaultRoles[model.TeamGuestRoleId].Permissions,
 			SchemeManaged: true,
 		}
@@ -143,7 +159,7 @@ func (s *SqlSchemeStore) createScheme(scheme *model.Scheme, transaction *sqlxTxW
 		// playbook admin role
 		playbookAdminRole := &model.Role{
 			Name:          model.NewId(),
-			DisplayName:   fmt.Sprintf("Playbook Admin Role for Scheme %s", scheme.Name),
+			DisplayName:   fmt.Sprintf("%s %s", SchemeRoleDisplayNamePlaybookAdmin, scheme.Name),
 			Permissions:   defaultRoles[model.PlaybookAdminRoleId].Permissions,
 			SchemeManaged: true,
 		}
@@ -156,7 +172,7 @@ func (s *SqlSchemeStore) createScheme(scheme *model.Scheme, transaction *sqlxTxW
 		// playbook member role
 		playbookMemberRole := &model.Role{
 			Name:          model.NewId(),
-			DisplayName:   fmt.Sprintf("Playbook Member Role for Scheme %s", scheme.Name),
+			DisplayName:   fmt.Sprintf("%s %s", SchemeRoleDisplayNamePlaybookMember, scheme.Name),
 			Permissions:   defaultRoles[model.PlaybookMemberRoleId].Permissions,
 			SchemeManaged: true,
 		}
@@ -169,7 +185,7 @@ func (s *SqlSchemeStore) createScheme(scheme *model.Scheme, transaction *sqlxTxW
 		// run admin role
 		runAdminRole := &model.Role{
 			Name:          model.NewId(),
-			DisplayName:   fmt.Sprintf("Run Admin Role for Scheme %s", scheme.Name),
+			DisplayName:   fmt.Sprintf("%s %s", SchemeRoleDisplayNameRunAdmin, scheme.Name),
 			Permissions:   defaultRoles[model.RunAdminRoleId].Permissions,
 			SchemeManaged: true,
 		}
@@ -182,7 +198,7 @@ func (s *SqlSchemeStore) createScheme(scheme *model.Scheme, transaction *sqlxTxW
 		// run member role
 		runMemberRole := &model.Role{
 			Name:          model.NewId(),
-			DisplayName:   fmt.Sprintf("Run Member Role for Scheme %s", scheme.Name),
+			DisplayName:   fmt.Sprintf("%s %s", SchemeRoleDisplayNameRunMember, scheme.Name),
 			Permissions:   defaultRoles[model.RunMemberRoleId].Permissions,
 			SchemeManaged: true,
 		}
@@ -369,7 +385,7 @@ func (s *SqlSchemeStore) Delete(schemeId string) (*model.Scheme, error) {
 	res, err := s.GetMasterX().NamedExec(`UPDATE Schemes
 		SET UpdateAt=:UpdateAt, DeleteAt=:DeleteAt, CreateAt=:CreateAt, Name=:Name, DisplayName=:DisplayName, Description=:Description, Scope=:Scope,
 		 DefaultTeamAdminRole=:DefaultTeamAdminRole, DefaultTeamUserRole=:DefaultTeamUserRole, DefaultTeamGuestRole=:DefaultTeamGuestRole,
-		 DefaultChannelAdminRole=:DefaultChannelAdminRole, DefaultChannelUserRole=:DefaultChannelUserRole, DefaultChannelGuestRole=:DefaultChannelGuestRole 
+		 DefaultChannelAdminRole=:DefaultChannelAdminRole, DefaultChannelUserRole=:DefaultChannelUserRole, DefaultChannelGuestRole=:DefaultChannelGuestRole
 		 WHERE Id=:Id`, &scheme)
 
 	if err != nil {