Permission changes (#29570)

* update permission mistakes

* add getAnalytics to TeamStatistics

* add PermissionGetAnalytics to ReadTeamStatistics

* add mocks for migrations

---------

Co-authored-by: Mattermost Build <build@mattermost.com>

server/channels/app/permissions_migrations.go

@@ -1124,6 +1124,36 @@ func (a *App) getAddUploadFilePermissionMigration() (permissionsMap, error) {
 	}, nil
 }
 
+func (a *App) getFixReadAuditsPermissionMigration() (permissionsMap, error) {
+	transformations := []permissionTransformation{}
+
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PermissionSysconsoleReadComplianceCustomTermsOfService.Id),
+		Remove: []string{model.PermissionReadAudits.Id},
+	})
+
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PermissionSysconsoleReadComplianceComplianceMonitoring.Id),
+		Add: []string{model.PermissionReadAudits.Id},
+	})
+	return transformations, nil
+}
+
+func (a *App) removeGetAnalyticsPermissionMigration() (permissionsMap, error) {
+	transformations := []permissionTransformation{}
+
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PermissionSysconsoleReadUserManagementUsers.Id),
+		Remove: []string{model.PermissionGetAnalytics.Id},
+	})
+
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PermissionSysconsoleReadReportingTeamStatistics.Id),
+		Add: []string{model.PermissionGetAnalytics.Id},
+	})
+	return transformations, nil
+}
+
 // Only sysadmins, team admins, and users with channels and groups managements have access to "convert channel to public"
 func (a *App) getRestrictAcessToChannelConversionToPublic() (permissionsMap, error) {
 	return []permissionTransformation{
@@ -1191,6 +1221,8 @@ func (s *Server) doPermissionsMigrations() error {
 		{Key: model.MigrationKeyAddManageJobAncillaryPermissions, Migration: a.getAddManageJobAncillaryPermissionsMigration},
 		{Key: model.MigrationKeyAddUploadFilePermission, Migration: a.getAddUploadFilePermissionMigration},
 		{Key: model.RestrictAccessToChannelConversionToPublic, Migration: a.getRestrictAcessToChannelConversionToPublic},
+		{Key: model.MigrationKeyFixReadAuditsPermission, Migration: a.getFixReadAuditsPermissionMigration},
+		{Key: model.MigrationRemoveGetAnalyticsPermission, Migration: a.removeGetAnalyticsPermissionMigration},
 	}
 
 	roles, err := s.Store().Role().GetAll()

server/channels/testlib/store.go

@@ -80,6 +80,8 @@ func GetMockStoreForSetupFunctions() *mocks.Store {
 	systemStore.On("GetByName", model.MigrationKeyAddManageJobAncillaryPermissions).Return(&model.System{Name: model.MigrationKeyAddManageJobAncillaryPermissions, Value: "true"}, nil)
 	systemStore.On("GetByName", model.MigrationKeyAddUploadFilePermission).Return(&model.System{Name: model.MigrationKeyAddUploadFilePermission, Value: "true"}, nil)
 	systemStore.On("GetByName", model.RestrictAccessToChannelConversionToPublic).Return(&model.System{Name: model.RestrictAccessToChannelConversionToPublic, Value: "true"}, nil)
+	systemStore.On("GetByName", model.MigrationKeyFixReadAuditsPermission).Return(&model.System{Name: model.MigrationKeyFixReadAuditsPermission, Value: "true"}, nil)
+	systemStore.On("GetByName", model.MigrationRemoveGetAnalyticsPermission).Return(&model.System{Name: model.MigrationRemoveGetAnalyticsPermission, Value: "true"}, nil)
 	systemStore.On("GetByName", "CustomGroupAdminRoleCreationMigrationComplete").Return(&model.System{Name: model.MigrationKeyAddPlayboosksManageRolesPermissions, Value: "true"}, nil)
 	systemStore.On("GetByName", "products_boards").Return(&model.System{Name: "products_boards", Value: "true"}, nil)
 	systemStore.On("GetByName", "elasticsearch_fix_channel_index_migration").Return(&model.System{Name: "elasticsearch_fix_channel_index_migration", Value: "true"}, nil)

server/public/model/migration.go

@@ -51,4 +51,6 @@ const (
 	MigrationKeyAddManageJobAncillaryPermissions       = "add_manage_jobs_ancillary_permissions"
 	MigrationKeyAddUploadFilePermission                = "add_upload_file_permission"
 	RestrictAccessToChannelConversionToPublic          = "restrict_access_to_channel_conversion_to_public_permissions"
+	MigrationKeyFixReadAuditsPermission                = "fix_read_audits_permission"
+	MigrationRemoveGetAnalyticsPermission              = "remove_get_analytics_permission"
 )

server/public/model/role.go

@@ -70,7 +70,6 @@ func init() {
 		},
 		PermissionSysconsoleReadUserManagementUsers.Id: {
 			PermissionReadOtherUsersTeams,
-			PermissionGetAnalytics,
 		},
 		PermissionSysconsoleReadUserManagementTeams.Id: {
 			PermissionListPrivateTeams,
@@ -111,6 +110,7 @@ func init() {
 		},
 		PermissionSysconsoleReadReportingTeamStatistics.Id: {
 			PermissionViewTeam,
+			PermissionGetAnalytics,
 		},
 		PermissionSysconsoleWriteUserManagementUsers.Id: {
 			PermissionEditOtherUsers,
@@ -161,7 +161,7 @@ func init() {
 			PermissionReadComplianceExportJob,
 			PermissionDownloadComplianceExportResult,
 		},
-		PermissionSysconsoleReadComplianceCustomTermsOfService.Id: {
+		PermissionSysconsoleReadComplianceComplianceMonitoring.Id: {
 			PermissionReadAudits,
 		},
 		PermissionSysconsoleWriteExperimentalBleve.Id: {

server/public/model/role_test.go

@@ -275,3 +275,33 @@ func TestGetChannelModeratedPermissions(t *testing.T) {
 		})
 	}
 }
+
+func TestAddAncillaryPermissions(t *testing.T) {
+	tests := []struct {
+		Name        string
+		Permissions []string
+		Expected    []string
+	}{
+		{
+			"Add For ReadUserManagementUsers",
+			[]string{PermissionSysconsoleReadUserManagementUsers.Id},
+			[]string{PermissionSysconsoleReadUserManagementUsers.Id, PermissionReadOtherUsersTeams.Id},
+		},
+		{
+			"Add For ReadCompliance",
+			[]string{PermissionSysconsoleReadComplianceComplianceMonitoring.Id},
+			[]string{PermissionSysconsoleReadComplianceComplianceMonitoring.Id, PermissionReadAudits.Id},
+		},
+		{
+			"Add None",
+			[]string{PermissionSysconsoleReadComplianceCustomTermsOfService.Id},
+			[]string{PermissionSysconsoleReadComplianceCustomTermsOfService.Id},
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.Name, func(t *testing.T) {
+			permissions := AddAncillaryPermissions(tc.Permissions)
+			assert.Equal(t, permissions, tc.Expected)
+		})
+	}
+}