diff --git a/server/channels/app/permissions_migrations.go b/server/channels/app/permissions_migrations.go index 9075e49b10..3e9787d131 100644 --- a/server/channels/app/permissions_migrations.go +++ b/server/channels/app/permissions_migrations.go @@ -1124,6 +1124,23 @@ func (a *App) getAddUploadFilePermissionMigration() (permissionsMap, error) { }, nil } +// Only sysadmins, team admins, and users with channels and groups managements have access to "convert channel to public" +func (a *App) getRestrictAcessToChannelConversionToPublic() (permissionsMap, error) { + return []permissionTransformation{ + { + On: permissionAnd( + isNotRole(model.SystemAdminRoleId), + isNotRole(model.TeamAdminRoleId), + permissionOr( + permissionNotExists(model.PermissionSysconsoleWriteUserManagementChannels.Id), + permissionNotExists(model.PermissionSysconsoleWriteUserManagementGroups.Id), + ), + ), + Remove: []string{PermissionConvertPrivateChannelToPublic}, + }, + }, nil +} + // DoPermissionsMigrations execute all the permissions migrations need by the current version. func (a *App) DoPermissionsMigrations() error { return a.Srv().doPermissionsMigrations() @@ -1173,6 +1190,7 @@ func (s *Server) doPermissionsMigrations() error { {Key: model.MigrationKeyAddChannelBookmarksPermissions, Migration: a.getAddChannelBookmarksPermissionsMigration}, {Key: model.MigrationKeyAddManageJobAncillaryPermissions, Migration: a.getAddManageJobAncillaryPermissionsMigration}, {Key: model.MigrationKeyAddUploadFilePermission, Migration: a.getAddUploadFilePermissionMigration}, + {Key: model.RestrictAccessToChannelConversionToPublic, Migration: a.getRestrictAcessToChannelConversionToPublic}, } roles, err := s.Store().Role().GetAll() diff --git a/server/channels/testlib/store.go b/server/channels/testlib/store.go index 10ee04e69d..2291db483f 100644 --- a/server/channels/testlib/store.go +++ b/server/channels/testlib/store.go @@ -79,6 +79,7 @@ func GetMockStoreForSetupFunctions() *mocks.Store { systemStore.On("GetByName", model.MigrationKeyDeleteDmsPreferences).Return(&model.System{Name: model.MigrationKeyDeleteDmsPreferences, Value: "true"}, nil) systemStore.On("GetByName", model.MigrationKeyAddManageJobAncillaryPermissions).Return(&model.System{Name: model.MigrationKeyAddManageJobAncillaryPermissions, Value: "true"}, nil) systemStore.On("GetByName", model.MigrationKeyAddUploadFilePermission).Return(&model.System{Name: model.MigrationKeyAddUploadFilePermission, Value: "true"}, nil) + systemStore.On("GetByName", model.RestrictAccessToChannelConversionToPublic).Return(&model.System{Name: model.RestrictAccessToChannelConversionToPublic, Value: "true"}, nil) systemStore.On("GetByName", "CustomGroupAdminRoleCreationMigrationComplete").Return(&model.System{Name: model.MigrationKeyAddPlayboosksManageRolesPermissions, Value: "true"}, nil) systemStore.On("GetByName", "products_boards").Return(&model.System{Name: "products_boards", Value: "true"}, nil) systemStore.On("GetByName", "elasticsearch_fix_channel_index_migration").Return(&model.System{Name: "elasticsearch_fix_channel_index_migration", Value: "true"}, nil) diff --git a/server/public/model/migration.go b/server/public/model/migration.go index 3653b10221..adcf354fe3 100644 --- a/server/public/model/migration.go +++ b/server/public/model/migration.go @@ -50,4 +50,5 @@ const ( MigrationKeyDeleteDmsPreferences = "delete_dms_preferences_migration" MigrationKeyAddManageJobAncillaryPermissions = "add_manage_jobs_ancillary_permissions" MigrationKeyAddUploadFilePermission = "add_upload_file_permission" + RestrictAccessToChannelConversionToPublic = "restrict_access_to_channel_conversion_to_public_permissions" ) diff --git a/webapp/channels/src/components/admin_console/permission_schemes_settings/permissions_tree/__snapshots__/permissions_tree.test.tsx.snap b/webapp/channels/src/components/admin_console/permission_schemes_settings/permissions_tree/__snapshots__/permissions_tree.test.tsx.snap index 26a48952fd..8f50adbcef 100644 --- a/webapp/channels/src/components/admin_console/permission_schemes_settings/permissions_tree/__snapshots__/permissions_tree.test.tsx.snap +++ b/webapp/channels/src/components/admin_console/permission_schemes_settings/permissions_tree/__snapshots__/permissions_tree.test.tsx.snap @@ -73,14 +73,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh ], }, "delete_public_channel", - Object { - "combined": true, - "id": "convert_public_channel_to_private", - "permissions": Array [ - "convert_public_channel_to_private", - "convert_private_channel_to_public", - ], - }, + "convert_public_channel_to_private", ], }, Object { @@ -274,14 +267,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh ], }, "delete_public_channel", - Object { - "combined": true, - "id": "convert_public_channel_to_private", - "permissions": Array [ - "convert_public_channel_to_private", - "convert_private_channel_to_public", - ], - }, + "convert_public_channel_to_private", ], }, Object { @@ -483,14 +469,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh ], }, "delete_public_channel", - Object { - "combined": true, - "id": "convert_public_channel_to_private", - "permissions": Array [ - "convert_public_channel_to_private", - "convert_private_channel_to_public", - ], - }, + "convert_public_channel_to_private", ], }, Object { @@ -681,14 +660,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh ], }, "delete_public_channel", - Object { - "combined": true, - "id": "convert_public_channel_to_private", - "permissions": Array [ - "convert_public_channel_to_private", - "convert_private_channel_to_public", - ], - }, + "convert_public_channel_to_private", ], }, Object { @@ -890,14 +862,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh ], }, "delete_public_channel", - Object { - "combined": true, - "id": "convert_public_channel_to_private", - "permissions": Array [ - "convert_public_channel_to_private", - "convert_private_channel_to_public", - ], - }, + "convert_public_channel_to_private", ], }, Object { @@ -1099,14 +1064,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh ], }, "delete_public_channel", - Object { - "combined": true, - "id": "convert_public_channel_to_private", - "permissions": Array [ - "convert_public_channel_to_private", - "convert_private_channel_to_public", - ], - }, + "convert_public_channel_to_private", ], }, Object { @@ -1315,14 +1273,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh ], }, "delete_public_channel", - Object { - "combined": true, - "id": "convert_public_channel_to_private", - "permissions": Array [ - "convert_public_channel_to_private", - "convert_private_channel_to_public", - ], - }, + "convert_public_channel_to_private", ], }, Object { diff --git a/webapp/channels/src/components/admin_console/permission_schemes_settings/permissions_tree/permissions_tree.test.tsx b/webapp/channels/src/components/admin_console/permission_schemes_settings/permissions_tree/permissions_tree.test.tsx index 600b1b2bca..f13b22de91 100644 --- a/webapp/channels/src/components/admin_console/permission_schemes_settings/permissions_tree/permissions_tree.test.tsx +++ b/webapp/channels/src/components/admin_console/permission_schemes_settings/permissions_tree/permissions_tree.test.tsx @@ -4,6 +4,8 @@ import {shallow} from 'enzyme'; import React from 'react'; +import GeneralConstants from 'mattermost-redux/constants/general'; + import PermissionGroup from 'components/admin_console/permission_schemes_settings/permission_group'; import PermissionsTree from 'components/admin_console/permission_schemes_settings/permissions_tree/permissions_tree'; @@ -107,6 +109,27 @@ describe('components/admin_console/permission_schemes_settings/permission_tree', expect(onToggle).toBeCalledWith('test', ['test_permission', 'test_permission2']); }); + test.each([ + {roleName: GeneralConstants.SYSTEM_ADMIN_ROLE, shouldSeeConvertPrivateToPublic: true}, + {roleName: GeneralConstants.TEAM_ADMIN_ROLE, shouldSeeConvertPrivateToPublic: true}, + {roleName: GeneralConstants.CHANNEL_ADMIN_ROLE, shouldSeeConvertPrivateToPublic: false}, + {roleName: GeneralConstants.SYSTEM_USER_ROLE, shouldSeeConvertPrivateToPublic: false}, + {roleName: GeneralConstants.SYSTEM_GUEST_ROLE, shouldSeeConvertPrivateToPublic: false}, + ])('should show convert private channel to public for $roleName: $shouldSeeConvertPrivateToPublic', ({roleName, shouldSeeConvertPrivateToPublic}) => { + const wrapper = shallow( + , + ); + const groups = wrapper.find(PermissionGroup).first().prop('permissions') as Array; + if (shouldSeeConvertPrivateToPublic) { + expect(groups[2].permissions).toContain('convert_private_channel_to_public'); + } else { + expect(groups[2].permissions).not.toContain('convert_private_channel_to_public'); + } + }); + test('should hide disabbled integration options', () => { const wrapper = shallow( { ], }, Permissions.DELETE_PUBLIC_CHANNEL, - { - id: 'convert_public_channel_to_private', - combined: true, - permissions: [ - Permissions.CONVERT_PUBLIC_CHANNEL_TO_PRIVATE, - Permissions.CONVERT_PRIVATE_CHANNEL_TO_PUBLIC, - ], - }, + Permissions.CONVERT_PUBLIC_CHANNEL_TO_PRIVATE, ], }, { @@ -205,7 +199,7 @@ export default class PermissionsTree extends React.PureComponent { } updateGroups = () => { - const {config, scope, license} = this.props; + const {config, scope, license, role} = this.props; const teamsGroup = this.groups[0]; const publicChannelsGroup = this.groups[1]; @@ -265,6 +259,10 @@ export default class PermissionsTree extends React.PureComponent { customGroupsGroup?.permissions.pop(); } + if ([GeneralConstants.TEAM_ADMIN_ROLE, GeneralConstants.SYSTEM_ADMIN_ROLE].includes(role.name || '')) { + privateChannelsGroup.permissions.push(Permissions.CONVERT_PRIVATE_CHANNEL_TO_PUBLIC); + } + if (license?.IsLicensed === 'true') { publicChannelsGroup.permissions.push({ id: 'manage_public_channel_bookmarks', diff --git a/webapp/channels/src/components/admin_console/permission_schemes_settings/strings/groups.tsx b/webapp/channels/src/components/admin_console/permission_schemes_settings/strings/groups.tsx index 67aa4a7f95..ea77708329 100644 --- a/webapp/channels/src/components/admin_console/permission_schemes_settings/strings/groups.tsx +++ b/webapp/channels/src/components/admin_console/permission_schemes_settings/strings/groups.tsx @@ -208,13 +208,23 @@ export const groupRolesStrings: Record convert_public_channel_to_private: defineMessages({ name: { id: 'admin.permissions.group.convert_public_channel_to_private.name', - defaultMessage: 'Convert Channels', + defaultMessage: 'Convert to private', }, description: { id: 'admin.permissions.group.convert_public_channel_to_private.description', defaultMessage: 'Convert public channels to private', }, }), + convert_private_channel_to_public: defineMessages({ + name: { + id: 'admin.permissions.group.convert_private_channel_to_public.name', + defaultMessage: 'Convert to public', + }, + description: { + id: 'admin.permissions.group.convert_private_channel_to_public.description', + defaultMessage: 'Convert private channels to public', + }, + }), manage_shared_channels: defineMessages({ name: { id: 'admin.permissions.group.manage_shared_channels.name', diff --git a/webapp/channels/src/components/admin_console/permission_schemes_settings/strings/permissions.tsx b/webapp/channels/src/components/admin_console/permission_schemes_settings/strings/permissions.tsx index 745b2d8b9d..0a3d13317b 100644 --- a/webapp/channels/src/components/admin_console/permission_schemes_settings/strings/permissions.tsx +++ b/webapp/channels/src/components/admin_console/permission_schemes_settings/strings/permissions.tsx @@ -18,7 +18,7 @@ export const permissionRolesStrings: Record