restrict access to channel converstion to public for non team admin+ (#29819)

server/channels/app/permissions_migrations.go

@@ -1124,6 +1124,23 @@ func (a *App) getAddUploadFilePermissionMigration() (permissionsMap, error) {
 	}, nil
 }
 
+// Only sysadmins, team admins, and users with channels and groups managements have access to "convert channel to public"
+func (a *App) getRestrictAcessToChannelConversionToPublic() (permissionsMap, error) {
+	return []permissionTransformation{
+		{
+			On: permissionAnd(
+				isNotRole(model.SystemAdminRoleId),
+				isNotRole(model.TeamAdminRoleId),
+				permissionOr(
+					permissionNotExists(model.PermissionSysconsoleWriteUserManagementChannels.Id),
+					permissionNotExists(model.PermissionSysconsoleWriteUserManagementGroups.Id),
+				),
+			),
+			Remove: []string{PermissionConvertPrivateChannelToPublic},
+		},
+	}, nil
+}
+
 // DoPermissionsMigrations execute all the permissions migrations need by the current version.
 func (a *App) DoPermissionsMigrations() error {
 	return a.Srv().doPermissionsMigrations()
@@ -1173,6 +1190,7 @@ func (s *Server) doPermissionsMigrations() error {
 		{Key: model.MigrationKeyAddChannelBookmarksPermissions, Migration: a.getAddChannelBookmarksPermissionsMigration},
 		{Key: model.MigrationKeyAddManageJobAncillaryPermissions, Migration: a.getAddManageJobAncillaryPermissionsMigration},
 		{Key: model.MigrationKeyAddUploadFilePermission, Migration: a.getAddUploadFilePermissionMigration},
+		{Key: model.RestrictAccessToChannelConversionToPublic, Migration: a.getRestrictAcessToChannelConversionToPublic},
 	}
 
 	roles, err := s.Store().Role().GetAll()

server/channels/testlib/store.go

@@ -79,6 +79,7 @@ func GetMockStoreForSetupFunctions() *mocks.Store {
 	systemStore.On("GetByName", model.MigrationKeyDeleteDmsPreferences).Return(&model.System{Name: model.MigrationKeyDeleteDmsPreferences, Value: "true"}, nil)
 	systemStore.On("GetByName", model.MigrationKeyAddManageJobAncillaryPermissions).Return(&model.System{Name: model.MigrationKeyAddManageJobAncillaryPermissions, Value: "true"}, nil)
 	systemStore.On("GetByName", model.MigrationKeyAddUploadFilePermission).Return(&model.System{Name: model.MigrationKeyAddUploadFilePermission, Value: "true"}, nil)
+	systemStore.On("GetByName", model.RestrictAccessToChannelConversionToPublic).Return(&model.System{Name: model.RestrictAccessToChannelConversionToPublic, Value: "true"}, nil)
 	systemStore.On("GetByName", "CustomGroupAdminRoleCreationMigrationComplete").Return(&model.System{Name: model.MigrationKeyAddPlayboosksManageRolesPermissions, Value: "true"}, nil)
 	systemStore.On("GetByName", "products_boards").Return(&model.System{Name: "products_boards", Value: "true"}, nil)
 	systemStore.On("GetByName", "elasticsearch_fix_channel_index_migration").Return(&model.System{Name: "elasticsearch_fix_channel_index_migration", Value: "true"}, nil)

server/public/model/migration.go

@@ -50,4 +50,5 @@ const (
 	MigrationKeyDeleteDmsPreferences                   = "delete_dms_preferences_migration"
 	MigrationKeyAddManageJobAncillaryPermissions       = "add_manage_jobs_ancillary_permissions"
 	MigrationKeyAddUploadFilePermission                = "add_upload_file_permission"
+	RestrictAccessToChannelConversionToPublic          = "restrict_access_to_channel_conversion_to_public_permissions"
 )

webapp/channels/src/components/admin_console/permission_schemes_settings/permissions_tree/__snapshots__/permissions_tree.test.tsx.snap

@@ -73,14 +73,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh
                 ],
               },
               "delete_public_channel",
-              Object {
+              "convert_public_channel_to_private",
-                "combined": true,
-                "id": "convert_public_channel_to_private",
-                "permissions": Array [
-                  "convert_public_channel_to_private",
-                  "convert_private_channel_to_public",
-                ],
-              },
             ],
           },
           Object {
@@ -274,14 +267,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh
                 ],
               },
               "delete_public_channel",
-              Object {
+              "convert_public_channel_to_private",
-                "combined": true,
-                "id": "convert_public_channel_to_private",
-                "permissions": Array [
-                  "convert_public_channel_to_private",
-                  "convert_private_channel_to_public",
-                ],
-              },
             ],
           },
           Object {
@@ -483,14 +469,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh
                 ],
               },
               "delete_public_channel",
-              Object {
+              "convert_public_channel_to_private",
-                "combined": true,
-                "id": "convert_public_channel_to_private",
-                "permissions": Array [
-                  "convert_public_channel_to_private",
-                  "convert_private_channel_to_public",
-                ],
-              },
             ],
           },
           Object {
@@ -681,14 +660,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh
                 ],
               },
               "delete_public_channel",
-              Object {
+              "convert_public_channel_to_private",
-                "combined": true,
-                "id": "convert_public_channel_to_private",
-                "permissions": Array [
-                  "convert_public_channel_to_private",
-                  "convert_private_channel_to_public",
-                ],
-              },
             ],
           },
           Object {
@@ -890,14 +862,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh
                 ],
               },
               "delete_public_channel",
-              Object {
+              "convert_public_channel_to_private",
-                "combined": true,
-                "id": "convert_public_channel_to_private",
-                "permissions": Array [
-                  "convert_public_channel_to_private",
-                  "convert_private_channel_to_public",
-                ],
-              },
             ],
           },
           Object {
@@ -1099,14 +1064,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh
                 ],
               },
               "delete_public_channel",
-              Object {
+              "convert_public_channel_to_private",
-                "combined": true,
-                "id": "convert_public_channel_to_private",
-                "permissions": Array [
-                  "convert_public_channel_to_private",
-                  "convert_private_channel_to_public",
-                ],
-              },
             ],
           },
           Object {
@@ -1315,14 +1273,7 @@ exports[`components/admin_console/permission_schemes_settings/permission_tree sh
                 ],
               },
               "delete_public_channel",
-              Object {
+              "convert_public_channel_to_private",
-                "combined": true,
-                "id": "convert_public_channel_to_private",
-                "permissions": Array [
-                  "convert_public_channel_to_private",
-                  "convert_private_channel_to_public",
-                ],
-              },
             ],
           },
           Object {

webapp/channels/src/components/admin_console/permission_schemes_settings/permissions_tree/permissions_tree.test.tsx

@@ -4,6 +4,8 @@
 import {shallow} from 'enzyme';
 import React from 'react';
 
+import GeneralConstants from 'mattermost-redux/constants/general';
+
 import PermissionGroup from 'components/admin_console/permission_schemes_settings/permission_group';
 import PermissionsTree from 'components/admin_console/permission_schemes_settings/permissions_tree/permissions_tree';
 
@@ -107,6 +109,27 @@ describe('components/admin_console/permission_schemes_settings/permission_tree',
         expect(onToggle).toBeCalledWith('test', ['test_permission', 'test_permission2']);
     });
 
+    test.each([
+        {roleName: GeneralConstants.SYSTEM_ADMIN_ROLE, shouldSeeConvertPrivateToPublic: true},
+        {roleName: GeneralConstants.TEAM_ADMIN_ROLE, shouldSeeConvertPrivateToPublic: true},
+        {roleName: GeneralConstants.CHANNEL_ADMIN_ROLE, shouldSeeConvertPrivateToPublic: false},
+        {roleName: GeneralConstants.SYSTEM_USER_ROLE, shouldSeeConvertPrivateToPublic: false},
+        {roleName: GeneralConstants.SYSTEM_GUEST_ROLE, shouldSeeConvertPrivateToPublic: false},
+    ])('should show convert private channel to public for $roleName: $shouldSeeConvertPrivateToPublic', ({roleName, shouldSeeConvertPrivateToPublic}) => {
+        const wrapper = shallow(
+            <PermissionsTree
+                {...defaultProps}
+                role={{name: roleName}}
+            />,
+        );
+        const groups = wrapper.find(PermissionGroup).first().prop('permissions') as Array<Group | Permission>;
+        if (shouldSeeConvertPrivateToPublic) {
+            expect(groups[2].permissions).toContain('convert_private_channel_to_public');
+        } else {
+            expect(groups[2].permissions).not.toContain('convert_private_channel_to_public');
+        }
+    });
+
     test('should hide disabbled integration options', () => {
         const wrapper = shallow(
             <PermissionsTree

webapp/channels/src/components/admin_console/permission_schemes_settings/permissions_tree/permissions_tree.tsx

@@ -7,6 +7,7 @@ import {FormattedMessage} from 'react-intl';
 import type {ClientConfig, ClientLicense} from '@mattermost/types/config';
 import type {Role} from '@mattermost/types/roles';
 
+import GeneralConstants from 'mattermost-redux/constants/general';
 import Permissions from 'mattermost-redux/constants/permissions';
 
 import {isEnterpriseLicense, isNonEnterpriseLicense} from 'utils/license_utils';
@@ -91,14 +92,7 @@ export default class PermissionsTree extends React.PureComponent<Props, State> {
                         ],
                     },
                     Permissions.DELETE_PUBLIC_CHANNEL,
-                    {
+                    Permissions.CONVERT_PUBLIC_CHANNEL_TO_PRIVATE,
-                        id: 'convert_public_channel_to_private',
-                        combined: true,
-                        permissions: [
-                            Permissions.CONVERT_PUBLIC_CHANNEL_TO_PRIVATE,
-                            Permissions.CONVERT_PRIVATE_CHANNEL_TO_PUBLIC,
-                        ],
-                    },
                 ],
             },
             {
@@ -205,7 +199,7 @@ export default class PermissionsTree extends React.PureComponent<Props, State> {
     }
 
     updateGroups = () => {
-        const {config, scope, license} = this.props;
+        const {config, scope, license, role} = this.props;
 
         const teamsGroup = this.groups[0];
         const publicChannelsGroup = this.groups[1];
@@ -265,6 +259,10 @@ export default class PermissionsTree extends React.PureComponent<Props, State> {
             customGroupsGroup?.permissions.pop();
         }
 
+        if ([GeneralConstants.TEAM_ADMIN_ROLE, GeneralConstants.SYSTEM_ADMIN_ROLE].includes(role.name || '')) {
+            privateChannelsGroup.permissions.push(Permissions.CONVERT_PRIVATE_CHANNEL_TO_PUBLIC);
+        }
+
         if (license?.IsLicensed === 'true') {
             publicChannelsGroup.permissions.push({
                 id: 'manage_public_channel_bookmarks',

webapp/channels/src/components/admin_console/permission_schemes_settings/strings/groups.tsx

@@ -208,13 +208,23 @@ export const groupRolesStrings: Record<string, Record<string, MessageDescriptor>
     convert_public_channel_to_private: defineMessages({
         name: {
             id: 'admin.permissions.group.convert_public_channel_to_private.name',
-            defaultMessage: 'Convert Channels',
+            defaultMessage: 'Convert to private',
         },
         description: {
             id: 'admin.permissions.group.convert_public_channel_to_private.description',
             defaultMessage: 'Convert public channels to private',
         },
     }),
+    convert_private_channel_to_public: defineMessages({
+        name: {
+            id: 'admin.permissions.group.convert_private_channel_to_public.name',
+            defaultMessage: 'Convert to public',
+        },
+        description: {
+            id: 'admin.permissions.group.convert_private_channel_to_public.description',
+            defaultMessage: 'Convert private channels to public',
+        },
+    }),
     manage_shared_channels: defineMessages({
         name: {
             id: 'admin.permissions.group.manage_shared_channels.name',

webapp/channels/src/components/admin_console/permission_schemes_settings/strings/permissions.tsx

@@ -18,7 +18,7 @@ export const permissionRolesStrings: Record<string, Record<string, MessageDescri
     convert_public_channel_to_private: defineMessages({
         name: {
             id: 'admin.permissions.permission.convert_public_channel_to_private.name',
-            defaultMessage: 'Convert Channels',
+            defaultMessage: 'Convert to private',
         },
         description: {
             id: 'admin.permissions.permission.convert_public_channel_to_private.description',
@@ -28,7 +28,7 @@ export const permissionRolesStrings: Record<string, Record<string, MessageDescri
     convert_private_channel_to_public: defineMessages({
         name: {
             id: 'admin.permissions.permission.convert_private_channel_to_public.name',
-            defaultMessage: 'Convert Channels',
+            defaultMessage: 'Convert to public',
         },
         description: {
             id: 'admin.permissions.permission.convert_private_channel_to_public.description',

webapp/channels/src/i18n/en.json

@@ -1589,8 +1589,10 @@
   "admin.password.preview": "Error message preview",
   "admin.password.symbol": "At least one symbol (e.g. \"~!@#$%^&*()\")",
   "admin.password.uppercase": "At least one uppercase letter",
+  "admin.permissions.group.convert_private_channel_to_public.description": "Convert private channels to public",
+  "admin.permissions.group.convert_private_channel_to_public.name": "Convert to public",
   "admin.permissions.group.convert_public_channel_to_private.description": "Convert public channels to private",
-  "admin.permissions.group.convert_public_channel_to_private.name": "Convert Channels",
+  "admin.permissions.group.convert_public_channel_to_private.name": "Convert to private",
   "admin.permissions.group.custom_groups.description": "Create, edit, delete and manage the members of custom groups.",
   "admin.permissions.group.custom_groups.name": "Custom Groups",
   "admin.permissions.group.delete_posts.description": "Delete own and others' posts.",
@@ -1650,9 +1652,9 @@
   "admin.permissions.permission.assign_system_admin_role.description": "Assign system admin role",
   "admin.permissions.permission.assign_system_admin_role.name": "Assign system admin role",
   "admin.permissions.permission.convert_private_channel_to_public.description": "Convert private channels to public",
-  "admin.permissions.permission.convert_private_channel_to_public.name": "Convert Channels",
+  "admin.permissions.permission.convert_private_channel_to_public.name": "Convert to public",
   "admin.permissions.permission.convert_public_channel_to_private.description": "Convert public channels to private",
-  "admin.permissions.permission.convert_public_channel_to_private.name": "Convert Channels",
+  "admin.permissions.permission.convert_public_channel_to_private.name": "Convert to private",
   "admin.permissions.permission.create_custom_group.description": "Create custom groups.",
   "admin.permissions.permission.create_custom_group.name": "Create",
   "admin.permissions.permission.create_direct_channel.description": "Create direct channel",