mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

restrict access to channel converstion to public for non team admin+ (#29819)

Просмотр исходного кода
Этот коммит содержится в:
Julien Tant
2025-01-23 09:42:20 -07:00
коммит произвёл GitHub
родитель 291fe10784
Коммит b41b968eb8
9 изменённых файлов: 75 добавлений и 71 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

18
server/channels/app/permissions_migrations.go
Просмотреть файл

@@ -1124,6 +1124,23 @@ func (a *App) getAddUploadFilePermissionMigration() (permissionsMap, error) {
}, nil
}
// Only sysadmins, team admins, and users with channels and groups managements have access to "convert channel to public"
func (a *App) getRestrictAcessToChannelConversionToPublic() (permissionsMap, error) {
return []permissionTransformation{
{
On: permissionAnd(
isNotRole(model.SystemAdminRoleId),
isNotRole(model.TeamAdminRoleId),
permissionOr(
permissionNotExists(model.PermissionSysconsoleWriteUserManagementChannels.Id),
permissionNotExists(model.PermissionSysconsoleWriteUserManagementGroups.Id),
),
),
Remove: []string{PermissionConvertPrivateChannelToPublic},
},
}, nil
}
// DoPermissionsMigrations execute all the permissions migrations need by the current version.
func (a *App) DoPermissionsMigrations() error {
return a.Srv().doPermissionsMigrations()
@@ -1173,6 +1190,7 @@ func (s *Server) doPermissionsMigrations() error {
{Key: model.MigrationKeyAddChannelBookmarksPermissions, Migration: a.getAddChannelBookmarksPermissionsMigration},
{Key: model.MigrationKeyAddManageJobAncillaryPermissions, Migration: a.getAddManageJobAncillaryPermissionsMigration},
{Key: model.MigrationKeyAddUploadFilePermission, Migration: a.getAddUploadFilePermissionMigration},
{Key: model.RestrictAccessToChannelConversionToPublic, Migration: a.getRestrictAcessToChannelConversionToPublic},
}
roles, err := s.Store().Role().GetAll()

1
server/channels/testlib/store.go
Просмотреть файл

@@ -79,6 +79,7 @@ func GetMockStoreForSetupFunctions() *mocks.Store {
systemStore.On("GetByName", model.MigrationKeyDeleteDmsPreferences).Return(&model.System{Name: model.MigrationKeyDeleteDmsPreferences, Value: "true"}, nil)
systemStore.On("GetByName", model.MigrationKeyAddManageJobAncillaryPermissions).Return(&model.System{Name: model.MigrationKeyAddManageJobAncillaryPermissions, Value: "true"}, nil)
systemStore.On("GetByName", model.MigrationKeyAddUploadFilePermission).Return(&model.System{Name: model.MigrationKeyAddUploadFilePermission, Value: "true"}, nil)
systemStore.On("GetByName", model.RestrictAccessToChannelConversionToPublic).Return(&model.System{Name: model.RestrictAccessToChannelConversionToPublic, Value: "true"}, nil)
systemStore.On("GetByName", "CustomGroupAdminRoleCreationMigrationComplete").Return(&model.System{Name: model.MigrationKeyAddPlayboosksManageRolesPermissions, Value: "true"}, nil)
systemStore.On("GetByName", "products_boards").Return(&model.System{Name: "products_boards", Value: "true"}, nil)
systemStore.On("GetByName", "elasticsearch_fix_channel_index_migration").Return(&model.System{Name: "elasticsearch_fix_channel_index_migration", Value: "true"}, nil)

1
server/public/model/migration.go
Просмотреть файл

@@ -50,4 +50,5 @@ const (
MigrationKeyDeleteDmsPreferences = "delete_dms_preferences_migration"
MigrationKeyAddManageJobAncillaryPermissions = "add_manage_jobs_ancillary_permissions"
MigrationKeyAddUploadFilePermission = "add_upload_file_permission"
RestrictAccessToChannelConversionToPublic = "restrict_access_to_channel_conversion_to_public_permissions"
)

63
webapp/channels/src/components/admin_console/permission_schemes_settings/permissions_tree/__snapshots__/permissions_tree.test.tsx.snap
Просмотреть файл

@@ -73,14 +73,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh
],
},
"delete_public_channel",
Object {
"combined": true,
"id": "convert_public_channel_to_private",
"permissions": Array [
"convert_public_channel_to_private",
"convert_private_channel_to_public",
],
},
"convert_public_channel_to_private",
],
},
Object {
@@ -274,14 +267,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh
],
},
"delete_public_channel",
Object {
"combined": true,
"id": "convert_public_channel_to_private",
"permissions": Array [
"convert_public_channel_to_private",
"convert_private_channel_to_public",
],
},
"convert_public_channel_to_private",
],
},
Object {
@@ -483,14 +469,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh
],
},
"delete_public_channel",
Object {
"combined": true,
"id": "convert_public_channel_to_private",
"permissions": Array [
"convert_public_channel_to_private",
"convert_private_channel_to_public",
],
},
"convert_public_channel_to_private",
],
},
Object {
@@ -681,14 +660,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh
],
},
"delete_public_channel",
Object {
"combined": true,
"id": "convert_public_channel_to_private",
"permissions": Array [
"convert_public_channel_to_private",
"convert_private_channel_to_public",
],
},
"convert_public_channel_to_private",
],
},
Object {
@@ -890,14 +862,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh
],
},
"delete_public_channel",
Object {
"combined": true,
"id": "convert_public_channel_to_private",
"permissions": Array [
"convert_public_channel_to_private",
"convert_private_channel_to_public",
],
},
"convert_public_channel_to_private",
],
},
Object {
@@ -1099,14 +1064,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh
],
},
"delete_public_channel",
Object {
"combined": true,
"id": "convert_public_channel_to_private",
"permissions": Array [
"convert_public_channel_to_private",
"convert_private_channel_to_public",
],
},
"convert_public_channel_to_private",
],
},
Object {
@@ -1315,14 +1273,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh
],
},
"delete_public_channel",
Object {
"combined": true,
"id": "convert_public_channel_to_private",
"permissions": Array [
"convert_public_channel_to_private",
"convert_private_channel_to_public",
],
},
"convert_public_channel_to_private",
],
},
Object {

23
webapp/channels/src/components/admin_console/permission_schemes_settings/permissions_tree/permissions_tree.test.tsx
Просмотреть файл

@@ -4,6 +4,8 @@
import {shallow} from 'enzyme';
import React from 'react';
import GeneralConstants from 'mattermost-redux/constants/general';
import PermissionGroup from 'components/admin_console/permission_schemes_settings/permission_group';
import PermissionsTree from 'components/admin_console/permission_schemes_settings/permissions_tree/permissions_tree';
@@ -107,6 +109,27 @@ describe('components/admin_console/permission_schemes_settings/permission_tree',
expect(onToggle).toBeCalledWith('test', ['test_permission', 'test_permission2']);
});
test.each([
{roleName: GeneralConstants.SYSTEM_ADMIN_ROLE, shouldSeeConvertPrivateToPublic: true},
{roleName: GeneralConstants.TEAM_ADMIN_ROLE, shouldSeeConvertPrivateToPublic: true},
{roleName: GeneralConstants.CHANNEL_ADMIN_ROLE, shouldSeeConvertPrivateToPublic: false},
{roleName: GeneralConstants.SYSTEM_USER_ROLE, shouldSeeConvertPrivateToPublic: false},
{roleName: GeneralConstants.SYSTEM_GUEST_ROLE, shouldSeeConvertPrivateToPublic: false},
])('should show convert private channel to public for $roleName: $shouldSeeConvertPrivateToPublic', ({roleName, shouldSeeConvertPrivateToPublic}) => {
const wrapper = shallow(
<PermissionsTree
{...defaultProps}
role={{name: roleName}}
/>,
);
const groups = wrapper.find(PermissionGroup).first().prop('permissions') as Array<Group | Permission>;
if (shouldSeeConvertPrivateToPublic) {
expect(groups[2].permissions).toContain('convert_private_channel_to_public');
} else {
expect(groups[2].permissions).not.toContain('convert_private_channel_to_public');
}
});
test('should hide disabbled integration options', () => {
const wrapper = shallow(
<PermissionsTree

16
webapp/channels/src/components/admin_console/permission_schemes_settings/permissions_tree/permissions_tree.tsx
Просмотреть файл

@@ -7,6 +7,7 @@ import {FormattedMessage} from 'react-intl';
import type {ClientConfig, ClientLicense} from '@mattermost/types/config';
import type {Role} from '@mattermost/types/roles';
import GeneralConstants from 'mattermost-redux/constants/general';
import Permissions from 'mattermost-redux/constants/permissions';
import {isEnterpriseLicense, isNonEnterpriseLicense} from 'utils/license_utils';
@@ -91,14 +92,7 @@ export default class PermissionsTree extends React.PureComponent<Props, State> {
],
},
Permissions.DELETE_PUBLIC_CHANNEL,
{
id: 'convert_public_channel_to_private',
combined: true,
permissions: [
Permissions.CONVERT_PUBLIC_CHANNEL_TO_PRIVATE,
Permissions.CONVERT_PRIVATE_CHANNEL_TO_PUBLIC,
],
},
Permissions.CONVERT_PUBLIC_CHANNEL_TO_PRIVATE,
],
},
{
@@ -205,7 +199,7 @@ export default class PermissionsTree extends React.PureComponent<Props, State> {
}
updateGroups = () => {
const {config, scope, license} = this.props;
const {config, scope, license, role} = this.props;
const teamsGroup = this.groups[0];
const publicChannelsGroup = this.groups[1];
@@ -265,6 +259,10 @@ export default class PermissionsTree extends React.PureComponent<Props, State> {
customGroupsGroup?.permissions.pop();
}
if ([GeneralConstants.TEAM_ADMIN_ROLE, GeneralConstants.SYSTEM_ADMIN_ROLE].includes(role.name || '')) {
privateChannelsGroup.permissions.push(Permissions.CONVERT_PRIVATE_CHANNEL_TO_PUBLIC);
}
if (license?.IsLicensed === 'true') {
publicChannelsGroup.permissions.push({
id: 'manage_public_channel_bookmarks',

12
webapp/channels/src/components/admin_console/permission_schemes_settings/strings/groups.tsx
Просмотреть файл

@@ -208,13 +208,23 @@ export const groupRolesStrings: Record<string, Record<string, MessageDescriptor>
convert_public_channel_to_private: defineMessages({
name: {
id: 'admin.permissions.group.convert_public_channel_to_private.name',
defaultMessage: 'Convert Channels',
defaultMessage: 'Convert to private',
},
description: {
id: 'admin.permissions.group.convert_public_channel_to_private.description',
defaultMessage: 'Convert public channels to private',
},
}),
convert_private_channel_to_public: defineMessages({
name: {
id: 'admin.permissions.group.convert_private_channel_to_public.name',
defaultMessage: 'Convert to public',
},
description: {
id: 'admin.permissions.group.convert_private_channel_to_public.description',
defaultMessage: 'Convert private channels to public',
},
}),
manage_shared_channels: defineMessages({
name: {
id: 'admin.permissions.group.manage_shared_channels.name',

4
webapp/channels/src/components/admin_console/permission_schemes_settings/strings/permissions.tsx
Просмотреть файл

@@ -18,7 +18,7 @@ export const permissionRolesStrings: Record<string, Record<string, MessageDescri
convert_public_channel_to_private: defineMessages({
name: {
id: 'admin.permissions.permission.convert_public_channel_to_private.name',
defaultMessage: 'Convert Channels',
defaultMessage: 'Convert to private',
},
description: {
id: 'admin.permissions.permission.convert_public_channel_to_private.description',
@@ -28,7 +28,7 @@ export const permissionRolesStrings: Record<string, Record<string, MessageDescri
convert_private_channel_to_public: defineMessages({
name: {
id: 'admin.permissions.permission.convert_private_channel_to_public.name',
defaultMessage: 'Convert Channels',
defaultMessage: 'Convert to public',
},
description: {
id: 'admin.permissions.permission.convert_private_channel_to_public.description',

8
webapp/channels/src/i18n/en.json
Просмотреть файл

@@ -1589,8 +1589,10 @@
"admin.password.preview": "Error message preview",
"admin.password.symbol": "At least one symbol (e.g. \"~!@#$%^&*()\")",
"admin.password.uppercase": "At least one uppercase letter",
"admin.permissions.group.convert_private_channel_to_public.description": "Convert private channels to public",
"admin.permissions.group.convert_private_channel_to_public.name": "Convert to public",
"admin.permissions.group.convert_public_channel_to_private.description": "Convert public channels to private",
"admin.permissions.group.convert_public_channel_to_private.name": "Convert Channels",
"admin.permissions.group.convert_public_channel_to_private.name": "Convert to private",
"admin.permissions.group.custom_groups.description": "Create, edit, delete and manage the members of custom groups.",
"admin.permissions.group.custom_groups.name": "Custom Groups",
"admin.permissions.group.delete_posts.description": "Delete own and others' posts.",
@@ -1650,9 +1652,9 @@
"admin.permissions.permission.assign_system_admin_role.description": "Assign system admin role",
"admin.permissions.permission.assign_system_admin_role.name": "Assign system admin role",
"admin.permissions.permission.convert_private_channel_to_public.description": "Convert private channels to public",
"admin.permissions.permission.convert_private_channel_to_public.name": "Convert Channels",
"admin.permissions.permission.convert_private_channel_to_public.name": "Convert to public",
"admin.permissions.permission.convert_public_channel_to_private.description": "Convert public channels to private",
"admin.permissions.permission.convert_public_channel_to_private.name": "Convert Channels",
"admin.permissions.permission.convert_public_channel_to_private.name": "Convert to private",
"admin.permissions.permission.create_custom_group.description": "Create custom groups.",
"admin.permissions.permission.create_custom_group.name": "Create",
"admin.permissions.permission.create_direct_channel.description": "Create direct channel",