api4/system: adjust permissions for applied schema migrations (#19814)

* api4/system: adjust permissions for applied schema migrations

* add a test case

api4/system.go

@@ -937,8 +937,8 @@ func completeOnboarding(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func getAppliedSchemaMigrations(c *Context, w http.ResponseWriter, r *http.Request) {
-	if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionManageSystem) {
-		c.Err = model.NewAppError("getAppliedMigrations", "app.system.applied_migrations.not_authorized", nil, "", http.StatusForbidden)
+	if !c.App.SessionHasPermissionToAny(*c.AppContext.Session(), model.SysconsoleReadPermissions) {
+		c.SetPermissionError(model.SysconsoleReadPermissions...)
 		return
 	}
 

api4/system_test.go

@@ -942,6 +942,16 @@ func TestGetAppliedSchemaMigrations(t *testing.T) {
 		CheckForbiddenStatus(t, resp)
 	})
 
+	t.Run("as a system manager role", func(t *testing.T) {
+		_, appErr := th.App.UpdateUserRoles(th.BasicUser2.Id, model.SystemManagerRoleId, false)
+		require.Nil(t, appErr)
+		th.LoginBasic2()
+
+		_, resp, err := th.Client.GetAppliedSchemaMigrations()
+		require.NoError(t, err)
+		CheckOKStatus(t, resp)
+	})
+
 	th.TestForSystemAdminAndLocal(t, func(t *testing.T, c *model.Client4) {
 		_, resp, err := c.GetAppliedSchemaMigrations()
 		require.NoError(t, err)

i18n/de.json

@@ -9398,10 +9398,6 @@
     "id": "app.group.get_by_username_failure",
     "translation": " "
   },
-  {
-    "id": "app.system.applied_migrations.not_authorized",
-    "translation": "Dir fehlen die notwendigen Berechtigungen."
-  },
   {
     "id": "model.oauth.is_valid.mattermost_app_id.app_error",
     "translation": "Die maximale Länge der MattermostAppID ist 32 Zeichen."

i18n/en.json

@@ -6155,10 +6155,6 @@
     "id": "app.submit_interactive_dialog.json_error",
     "translation": "Encountered an error encoding JSON for the interactive dialog."
   },
-  {
-    "id": "app.system.applied_migrations.not_authorized",
-    "translation": "You don't have the appropriate permissions."
-  },
   {
     "id": "app.system.complete_onboarding_request.app_error",
     "translation": "Failed to decode the complete onboarding request."

i18n/hu.json

@@ -9382,9 +9382,5 @@
   {
     "id": "model.oauth.is_valid.mattermost_app_id.app_error",
     "translation": "A MattermostAppID maximális hossza 32 karakter."
-  },
-  {
-    "id": "app.system.applied_migrations.not_authorized",
-    "translation": "Ön nem rendelkezik a megfelelő jogosultságokkal."
   }
 ]

i18n/nl.json

@@ -9385,9 +9385,5 @@
   {
     "id": "model.oauth.is_valid.mattermost_app_id.app_error",
     "translation": "De maximale lengte van MattermostAppID is 32 tekens."
-  },
-  {
-    "id": "app.system.applied_migrations.not_authorized",
-    "translation": "Je hebt niet de juiste rechten."
   }
 ]

i18n/ru.json

@@ -9402,9 +9402,5 @@
   {
     "id": "model.oauth.is_valid.mattermost_app_id.app_error",
     "translation": "Максимальная длина MattermostAppID — 32 символа."
-  },
-  {
-    "id": "app.system.applied_migrations.not_authorized",
-    "translation": "У Вас нет соответствующих разрешений."
   }
 ]

i18n/tr.json

@@ -9401,9 +9401,5 @@
   {
     "id": "model.oauth.is_valid.mattermost_app_id.app_error",
     "translation": "MattermostAppID en fazla 32 karakter uzunluğunda olabilir."
-  },
-  {
-    "id": "app.system.applied_migrations.not_authorized",
-    "translation": "Yeterli izinleriniz yok."
   }
 ]