api4/system: adjust permissions for applied schema migrations (#19814)

* api4/system: adjust permissions for applied schema migrations

* add a test case

api4/system.go

@@ -937,8 +937,8 @@ func completeOnboarding(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func getAppliedSchemaMigrations(c *Context, w http.ResponseWriter, r *http.Request) {
-	if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionManageSystem) {
-		c.Err = model.NewAppError("getAppliedMigrations", "app.system.applied_migrations.not_authorized", nil, "", http.StatusForbidden)
+	if !c.App.SessionHasPermissionToAny(*c.AppContext.Session(), model.SysconsoleReadPermissions) {
+		c.SetPermissionError(model.SysconsoleReadPermissions...)
 		return
 	}
 

api4/system_test.go

@@ -942,6 +942,16 @@ func TestGetAppliedSchemaMigrations(t *testing.T) {
 		CheckForbiddenStatus(t, resp)
 	})
 
+	t.Run("as a system manager role", func(t *testing.T) {
+		_, appErr := th.App.UpdateUserRoles(th.BasicUser2.Id, model.SystemManagerRoleId, false)
+		require.Nil(t, appErr)
+		th.LoginBasic2()
+
+		_, resp, err := th.Client.GetAppliedSchemaMigrations()
+		require.NoError(t, err)
+		CheckOKStatus(t, resp)
+	})
+
 	th.TestForSystemAdminAndLocal(t, func(t *testing.T, c *model.Client4) {
 		_, resp, err := c.GetAppliedSchemaMigrations()
 		require.NoError(t, err)