mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

Adding new "VIEW_MEMBERS" permissions restrict the scope of users visibility (#10487)

Просмотр исходного кода 
* MM-14138: Adding new "VIEW_MEMBERS" permissions restrict the scope of users visibility

* Fixing gofmt

* Fixing broken tests

* Addressing PR review comments from Miguel de la Cruz

* Removed hack

* A bit nicer and cleaner code in the UserBelongsToChannels function

* Adding cluster cache invalidation for user team ids

* Checking in the correct order permissions to not leek existency information

* Adding restrictions to TeamMembers and User status requests

* Fixing tests

* Fixing status endpoint permissions checks

* Adding more tests

* Fixing tests

* More tests and making the restrictions query based only on joins

* Adding more tests

* Adding more tests

* fixing merge problems

* Reverting status changes to avoid performance issues

* Adding more tests

* Fixing test

* i18n extract

* Adding extra method for get restrictions for a team

* Add the new elasticsearch functions to search users with restrictions

* Add missing translation string

* Rename restrictedChannelIds to restrictedToChannels

* Remove ToDo

* Adding the permission to the SystemAdmin role during permissions migrations
Этот коммит содержится в:
Jesús Espino
2019-04-29 16:56:56 +02:00
коммит произвёл GitHub
родитель 5b70962f71
Коммит c8920588a0
41 изменённых файлов: 2785 добавлений и 259 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

38
api4/team.go
Просмотреть файл

@@ -295,6 +295,17 @@ func getTeamMember(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
canSee, err := c.App.UserCanSeeOtherUser(c.App.Session.UserId, c.Params.UserId)
if err != nil {
c.Err = err
return
}
if !canSee {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
team, err := c.App.GetTeamMember(c.Params.TeamId, c.Params.UserId)
if err != nil {
c.Err = err
@@ -315,7 +326,13 @@ func getTeamMembers(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
members, err := c.App.GetTeamMembers(c.Params.TeamId, c.Params.Page*c.Params.PerPage, c.Params.PerPage)
restrictions, err := c.App.GetViewUsersRestrictions(c.App.Session.UserId)
if err != nil {
c.Err = err
return
}
members, err := c.App.GetTeamMembers(c.Params.TeamId, c.Params.Page*c.Params.PerPage, c.Params.PerPage, restrictions)
if err != nil {
c.Err = err
return
@@ -335,6 +352,17 @@ func getTeamMembersForUser(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
canSee, err := c.App.UserCanSeeOtherUser(c.App.Session.UserId, c.Params.UserId)
if err != nil {
c.Err = err
return
}
if !canSee {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
members, err := c.App.GetTeamMembersForUser(c.Params.UserId)
if err != nil {
c.Err = err
@@ -362,7 +390,13 @@ func getTeamMembersByIds(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
members, err := c.App.GetTeamMembersByIds(c.Params.TeamId, userIds)
restrictions, err := c.App.GetViewUsersRestrictions(c.App.Session.UserId)
if err != nil {
c.Err = err
return
}
members, err := c.App.GetTeamMembersByIds(c.Params.TeamId, userIds, restrictions)
if err != nil {
c.Err = err
return

178
api4/user.go
Просмотреть файл

@@ -111,7 +111,16 @@ func getUser(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
// No permission check required
canSee, err := c.App.UserCanSeeOtherUser(c.App.Session.UserId, c.Params.UserId)
if err != nil {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
if !canSee {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
user, err := c.App.GetUser(c.Params.UserId)
if err != nil {
@@ -154,14 +163,32 @@ func getUserByUsername(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
// No permission check required
user, err := c.App.GetUserByUsername(c.Params.Username)
if err != nil {
restrictions, err2 := c.App.GetViewUsersRestrictions(c.App.Session.UserId)
if err2 != nil {
c.Err = err2
return
}
if restrictions != nil {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
c.Err = err
return
}
canSee, err := c.App.UserCanSeeOtherUser(c.App.Session.UserId, user.Id)
if err != nil {
c.Err = err
return
}
if !canSee {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
if c.IsSystemAdmin() || c.App.Session.UserId == user.Id {
userTermsOfService, err := c.App.GetUserTermsOfService(user.Id)
if err != nil && err.StatusCode != http.StatusNotFound {
@@ -196,8 +223,6 @@ func getUserByEmail(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
// No permission check required, but still prevent users who can't see another user's email address from using this
sanitizeOptions := c.App.GetSanitizeOptions(c.IsSystemAdmin())
if !sanitizeOptions["email"] {
c.Err = model.NewAppError("getUserByEmail", "api.user.get_user_by_email.permissions.app_error", nil, "userId="+c.App.Session.UserId, http.StatusForbidden)
@@ -206,10 +231,30 @@ func getUserByEmail(c *Context, w http.ResponseWriter, r *http.Request) {
user, err := c.App.GetUserByEmail(c.Params.Email)
if err != nil {
restrictions, err2 := c.App.GetViewUsersRestrictions(c.App.Session.UserId)
if err2 != nil {
c.Err = err2
return
}
if restrictions != nil {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
c.Err = err
return
}
canSee, err := c.App.UserCanSeeOtherUser(c.App.Session.UserId, user.Id)
if err != nil {
c.Err = err
return
}
if !canSee {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
etag := user.Etag(*c.App.Config().PrivacySettings.ShowFullName, *c.App.Config().PrivacySettings.ShowEmailAddress)
if c.HandleEtag(etag, "Get User", w, r) {
@@ -227,18 +272,23 @@ func getDefaultProfileImage(c *Context, w http.ResponseWriter, r *http.Request)
return
}
users, err := c.App.GetUsersByIds([]string{c.Params.UserId}, c.IsSystemAdmin())
canSee, err := c.App.UserCanSeeOtherUser(c.App.Session.UserId, c.Params.UserId)
if err != nil {
c.Err = err
return
}
if len(users) == 0 {
c.Err = model.NewAppError("getProfileImage", "api.user.get_profile_image.not_found.app_error", nil, "", http.StatusNotFound)
if !canSee {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
user, err := c.App.GetUser(c.Params.UserId)
if err != nil {
c.Err = err
return
}
user := users[0]
img, err := c.App.GetDefaultProfileImage(user)
if err != nil {
c.Err = err
@@ -256,18 +306,23 @@ func getProfileImage(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
users, err := c.App.GetUsersByIds([]string{c.Params.UserId}, c.IsSystemAdmin())
canSee, err := c.App.UserCanSeeOtherUser(c.App.Session.UserId, c.Params.UserId)
if err != nil {
c.Err = err
return
}
if len(users) == 0 {
c.Err = model.NewAppError("getProfileImage", "api.user.get_profile_image.not_found.app_error", nil, "", http.StatusNotFound)
if !canSee {
c.SetPermissionError(model.PERMISSION_VIEW_MEMBERS)
return
}
user, err := c.App.GetUser(c.Params.UserId)
if err != nil {
c.Err = err
return
}
user := users[0]
etag := strconv.FormatInt(user.LastPictureUpdate, 10)
if c.HandleEtag(etag, "Get Profile Image", w, r) {
return
@@ -376,7 +431,13 @@ func getTotalUsersStats(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
stats, err := c.App.GetTotalUsersStats()
restrictions, err := c.App.GetViewUsersRestrictions(c.App.Session.UserId)
if err != nil {
c.Err = err
return
}
stats, err := c.App.GetTotalUsersStats(restrictions)
if err != nil {
c.Err = err
return
@@ -419,21 +480,27 @@ func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {
withoutTeamBool, _ := strconv.ParseBool(withoutTeam)
inactiveBool, _ := strconv.ParseBool(inactive)
restrictions, err := c.App.GetViewUsersRestrictions(c.App.Session.UserId)
if err != nil {
c.Err = err
return
}
userGetOptions := &model.UserGetOptions{
InTeamId: inTeamId,
InChannelId: inChannelId,
NotInTeamId: notInTeamId,
NotInChannelId: notInChannelId,
WithoutTeam: withoutTeamBool,
Inactive: inactiveBool,
Role: role,
Sort: sort,
Page: c.Params.Page,
PerPage: c.Params.PerPage,
InTeamId: inTeamId,
InChannelId: inChannelId,
NotInTeamId: notInTeamId,
NotInChannelId: notInChannelId,
WithoutTeam: withoutTeamBool,
Inactive: inactiveBool,
Role: role,
Sort: sort,
Page: c.Params.Page,
PerPage: c.Params.PerPage,
ViewRestrictions: restrictions,
}
var profiles []*model.User
var err *model.AppError
etag := ""
if withoutTeamBool, _ := strconv.ParseBool(withoutTeam); withoutTeamBool {
@@ -443,26 +510,26 @@ func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
profiles, err = c.App.GetUsersWithoutTeamPage(c.Params.Page, c.Params.PerPage, c.IsSystemAdmin())
profiles, err = c.App.GetUsersWithoutTeamPage(c.Params.Page, c.Params.PerPage, c.IsSystemAdmin(), restrictions)
} else if len(notInChannelId) > 0 {
if !c.App.SessionHasPermissionToChannel(c.App.Session, notInChannelId, model.PERMISSION_READ_CHANNEL) {
c.SetPermissionError(model.PERMISSION_READ_CHANNEL)
return
}
profiles, err = c.App.GetUsersNotInChannelPage(inTeamId, notInChannelId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin())
profiles, err = c.App.GetUsersNotInChannelPage(inTeamId, notInChannelId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin(), restrictions)
} else if len(notInTeamId) > 0 {
if !c.App.SessionHasPermissionToTeam(c.App.Session, notInTeamId, model.PERMISSION_VIEW_TEAM) {
c.SetPermissionError(model.PERMISSION_VIEW_TEAM)
return
}
etag = c.App.GetUsersNotInTeamEtag(inTeamId)
etag = c.App.GetUsersNotInTeamEtag(inTeamId, restrictions.Hash())
if c.HandleEtag(etag, "Get Users Not in Team", w, r) {
return
}
profiles, err = c.App.GetUsersNotInTeamPage(notInTeamId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin())
profiles, err = c.App.GetUsersNotInTeamPage(notInTeamId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin(), restrictions)
} else if len(inTeamId) > 0 {
if !c.App.SessionHasPermissionToTeam(c.App.Session, inTeamId, model.PERMISSION_VIEW_TEAM) {
c.SetPermissionError(model.PERMISSION_VIEW_TEAM)
@@ -470,11 +537,11 @@ func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {
}
if sort == "last_activity_at" {
profiles, err = c.App.GetRecentlyActiveUsersForTeamPage(inTeamId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin())
profiles, err = c.App.GetRecentlyActiveUsersForTeamPage(inTeamId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin(), restrictions)
} else if sort == "create_at" {
profiles, err = c.App.GetNewUsersForTeamPage(inTeamId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin())
profiles, err = c.App.GetNewUsersForTeamPage(inTeamId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin(), restrictions)
} else {
etag = c.App.GetUsersInTeamEtag(inTeamId)
etag = c.App.GetUsersInTeamEtag(inTeamId, restrictions.Hash())
if c.HandleEtag(etag, "Get Users in Team", w, r) {
return
}
@@ -491,12 +558,16 @@ func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {
profiles, err = c.App.GetUsersInChannelPage(inChannelId, c.Params.Page, c.Params.PerPage, c.IsSystemAdmin())
}
} else {
// No permission check required
etag = c.App.GetUsersEtag()
etag = c.App.GetUsersEtag(restrictions.Hash())
if c.HandleEtag(etag, "Get Users", w, r) {
return
}
userGetOptions, err = c.App.RestrictUsersGetByPermissions(c.App.Session.UserId, userGetOptions)
if err != nil {
c.Err = err
return
}
profiles, err = c.App.GetUsersPage(userGetOptions, c.IsSystemAdmin())
}
@@ -520,9 +591,13 @@ func getUsersByIds(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
// No permission check required
restrictions, err := c.App.GetViewUsersRestrictions(c.App.Session.UserId)
if err != nil {
c.Err = err
return
}
users, err := c.App.GetUsersByIds(userIds, c.IsSystemAdmin())
users, err := c.App.GetUsersByIds(userIds, c.IsSystemAdmin(), restrictions)
if err != nil {
c.Err = err
return
@@ -539,9 +614,13 @@ func getUsersByNames(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
// No permission check required
restrictions, err := c.App.GetViewUsersRestrictions(c.App.Session.UserId)
if err != nil {
c.Err = err
return
}
users, err := c.App.GetUsersByUsernames(usernames, c.IsSystemAdmin())
users, err := c.App.GetUsersByUsernames(usernames, c.IsSystemAdmin(), restrictions)
if err != nil {
c.Err = err
return
@@ -607,6 +686,12 @@ func searchUsers(c *Context, w http.ResponseWriter, r *http.Request) {
options.AllowFullNames = *c.App.Config().PrivacySettings.ShowFullName
}
options, err := c.App.RestrictUsersSearchByPermissions(c.App.Session.UserId, options)
if err != nil {
c.Err = err
return
}
profiles, err := c.App.SearchUsers(props, options)
if err != nil {
c.Err = err
@@ -670,6 +755,13 @@ func autocompleteUsers(c *Context, w http.ResponseWriter, r *http.Request) {
autocomplete.Users = result.InChannel
autocomplete.OutOfChannel = result.OutOfChannel
} else if len(teamId) > 0 {
var err *model.AppError
options, err = c.App.RestrictUsersSearchByPermissions(c.App.Session.UserId, options)
if err != nil {
c.Err = err
return
}
result, err := c.App.AutocompleteUsersInTeam(teamId, name, options)
if err != nil {
c.Err = err
@@ -678,7 +770,13 @@ func autocompleteUsers(c *Context, w http.ResponseWriter, r *http.Request) {
autocomplete.Users = result.InTeam
} else {
// No permission check required
var err *model.AppError
options, err = c.App.RestrictUsersSearchByPermissions(c.App.Session.UserId, options)
if err != nil {
c.Err = err
return
}
result, err := c.App.SearchUsersInTeam("", name, options)
if err != nil {
c.Err = err

3
api4/user_test.go
Просмотреть файл

@@ -525,7 +525,7 @@ func TestGetBotUser(t *testing.T) {
defer th.RestoreDefaultRolePermissions(th.SaveDefaultRolePermissions())
th.AddPermissionToRole(model.PERMISSION_CREATE_BOT.Id, model.TEAM_USER_ROLE_ID)
th.App.UpdateUserRoles(th.BasicUser.Id, model.TEAM_USER_ROLE_ID, false)
th.App.UpdateUserRoles(th.BasicUser.Id, model.SYSTEM_USER_ROLE_ID+" "+model.TEAM_USER_ROLE_ID, false)
bot := &model.Bot{
Username: GenerateTestUsername(),
@@ -538,6 +538,7 @@ func TestGetBotUser(t *testing.T) {
defer th.App.PermanentDeleteBot(createdBot.UserId)
botUser, resp := th.Client.GetUser(createdBot.UserId, "")
CheckNoError(t, resp)
require.Equal(t, bot.Username, botUser.Username)
require.True(t, botUser.IsBot)
}

471
api4/user_viewmembers_test.go Обычный файл
Просмотреть файл

@@ -0,0 +1,471 @@
package api4
import (
"testing"
"github.com/mattermost/mattermost-server/model"
"github.com/stretchr/testify/require"
)
func TestApiResctrictedViewMembers(t *testing.T) {
th := Setup()
defer th.TearDown()
// Create first account for system admin
_, err := th.App.CreateUser(&model.User{Email: th.GenerateTestEmail(), Nickname: "test user0", Password: "test-password-0", Username: "test-user-0", Roles: model.SYSTEM_USER_ROLE_ID})
require.Nil(t, err)
user1, err := th.App.CreateUser(&model.User{Email: th.GenerateTestEmail(), Nickname: "test user1", Password: "test-password-1", Username: "test-user-1", Roles: model.SYSTEM_USER_ROLE_ID})
require.Nil(t, err)
user2, err := th.App.CreateUser(&model.User{Email: th.GenerateTestEmail(), Nickname: "test user2", Password: "test-password-2", Username: "test-user-2", Roles: model.SYSTEM_USER_ROLE_ID})
require.Nil(t, err)
user3, err := th.App.CreateUser(&model.User{Email: th.GenerateTestEmail(), Nickname: "test user3", Password: "test-password-3", Username: "test-user-3", Roles: model.SYSTEM_USER_ROLE_ID})
require.Nil(t, err)
user4, err := th.App.CreateUser(&model.User{Email: th.GenerateTestEmail(), Nickname: "test user4", Password: "test-password-4", Username: "test-user-4", Roles: model.SYSTEM_USER_ROLE_ID})
require.Nil(t, err)
user5, err := th.App.CreateUser(&model.User{Email: th.GenerateTestEmail(), Nickname: "test user5", Password: "test-password-5", Username: "test-user-5", Roles: model.SYSTEM_USER_ROLE_ID})
require.Nil(t, err)
team1, err := th.App.CreateTeam(&model.Team{DisplayName: "dn_" + model.NewId(), Name: GenerateTestTeamName(), Email: th.GenerateTestEmail(), Type: model.TEAM_OPEN})
require.Nil(t, err)
team2, err := th.App.CreateTeam(&model.Team{DisplayName: "dn_" + model.NewId(), Name: GenerateTestTeamName(), Email: th.GenerateTestEmail(), Type: model.TEAM_OPEN})
require.Nil(t, err)
channel1, err := th.App.CreateChannel(&model.Channel{DisplayName: "dn_" + model.NewId(), Name: "name_" + model.NewId(), Type: model.CHANNEL_OPEN, TeamId: team1.Id, CreatorId: model.NewId()}, false)
require.Nil(t, err)
channel2, err := th.App.CreateChannel(&model.Channel{DisplayName: "dn_" + model.NewId(), Name: "name_" + model.NewId(), Type: model.CHANNEL_OPEN, TeamId: team1.Id, CreatorId: model.NewId()}, false)
require.Nil(t, err)
channel3, err := th.App.CreateChannel(&model.Channel{DisplayName: "dn_" + model.NewId(), Name: "name_" + model.NewId(), Type: model.CHANNEL_OPEN, TeamId: team2.Id, CreatorId: model.NewId()}, false)
require.Nil(t, err)
th.LinkUserToTeam(user1, team1)
th.LinkUserToTeam(user2, team1)
th.LinkUserToTeam(user3, team2)
th.LinkUserToTeam(user4, team1)
th.LinkUserToTeam(user4, team2)
th.AddUserToChannel(user1, channel1)
th.AddUserToChannel(user2, channel2)
th.AddUserToChannel(user3, channel3)
th.AddUserToChannel(user4, channel1)
th.AddUserToChannel(user4, channel3)
th.App.SetStatusOnline(user1.Id, true)
th.App.SetStatusOnline(user2.Id, true)
th.App.SetStatusOnline(user3.Id, true)
th.App.SetStatusOnline(user4.Id, true)
th.App.SetStatusOnline(user5.Id, true)
_, resp := th.Client.Login(user1.Username, "test-password-1")
CheckNoError(t, resp)
t.Run("getUser", func(t *testing.T) {
testCases := []struct {
Name string
RestrictedTo string
UserId string
ExpectedError string
}{
{
"Get visible user without restrictions",
"",
user5.Id,
"",
},
{
"Get not existing user without restrictions",
"",
model.NewId(),
"store.sql_user.missing_account.const",
},
{
"Get not existing user with restrictions to teams",
"teams",
model.NewId(),
"api.context.permissions.app_error",
},
{
"Get visible user with restrictions to teams",
"teams",
user2.Id,
"",
},
{
"Get not visible user with restrictions to teams",
"teams",
user5.Id,
"api.context.permissions.app_error",
},
{
"Get not existing user with restrictions to channels",
"channels",
model.NewId(),
"api.context.permissions.app_error",
},
{
"Get visible user with restrictions to channels",
"channels",
user4.Id,
"",
},
{
"Get not visible user with restrictions to channels",
"channels",
user3.Id,
"api.context.permissions.app_error",
},
}
defer th.RestoreDefaultRolePermissions(th.SaveDefaultRolePermissions())
for _, tc := range testCases {
t.Run(tc.Name, func(t *testing.T) {
if tc.RestrictedTo == "channels" {
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.SYSTEM_USER_ROLE_ID)
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.TEAM_USER_ROLE_ID)
} else if tc.RestrictedTo == "teams" {
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.SYSTEM_USER_ROLE_ID)
th.AddPermissionToRole(model.PERMISSION_VIEW_MEMBERS.Id, model.TEAM_USER_ROLE_ID)
} else {
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.TEAM_USER_ROLE_ID)
th.AddPermissionToRole(model.PERMISSION_VIEW_MEMBERS.Id, model.SYSTEM_USER_ROLE_ID)
}
_, resp := th.Client.GetUser(tc.UserId, "")
require.Nil(t, err)
if tc.ExpectedError != "" {
CheckErrorMessage(t, resp, tc.ExpectedError)
} else {
CheckNoError(t, resp)
}
})
}
})
t.Run("getUserByUsername", func(t *testing.T) {
testCases := []struct {
Name string
RestrictedTo string
Username string
ExpectedError string
}{
{
"Get visible user without restrictions",
"",
user5.Username,
"",
},
{
"Get not existing user without restrictions",
"",
model.NewId(),
"store.sql_user.get_by_username.app_error",
},
{
"Get not existing user with restrictions to teams",
"teams",
model.NewId(),
"api.context.permissions.app_error",
},
{
"Get visible user with restrictions to teams",
"teams",
user2.Username,
"",
},
{
"Get not visible user with restrictions to teams",
"teams",
user5.Username,
"api.context.permissions.app_error",
},
{
"Get not existing user with restrictions to channels",
"channels",
model.NewId(),
"api.context.permissions.app_error",
},
{
"Get visible user with restrictions to channels",
"channels",
user4.Username,
"",
},
{
"Get not visible user with restrictions to channels",
"channels",
user3.Username,
"api.context.permissions.app_error",
},
}
defer th.RestoreDefaultRolePermissions(th.SaveDefaultRolePermissions())
for _, tc := range testCases {
t.Run(tc.Name, func(t *testing.T) {
if tc.RestrictedTo == "channels" {
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.SYSTEM_USER_ROLE_ID)
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.TEAM_USER_ROLE_ID)
} else if tc.RestrictedTo == "teams" {
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.SYSTEM_USER_ROLE_ID)
th.AddPermissionToRole(model.PERMISSION_VIEW_MEMBERS.Id, model.TEAM_USER_ROLE_ID)
} else {
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.TEAM_USER_ROLE_ID)
th.AddPermissionToRole(model.PERMISSION_VIEW_MEMBERS.Id, model.SYSTEM_USER_ROLE_ID)
}
_, resp := th.Client.GetUserByUsername(tc.Username, "")
require.Nil(t, err)
if tc.ExpectedError != "" {
CheckErrorMessage(t, resp, tc.ExpectedError)
} else {
CheckNoError(t, resp)
}
})
}
})
t.Run("getUserByEmail", func(t *testing.T) {
testCases := []struct {
Name string
RestrictedTo string
Email string
ExpectedError string
}{
{
"Get visible user without restrictions",
"",
user5.Email,
"",
},
{
"Get not existing user without restrictions",
"",
th.GenerateTestEmail(),
"store.sql_user.missing_account.const",
},
{
"Get not existing user with restrictions to teams",
"teams",
th.GenerateTestEmail(),
"api.context.permissions.app_error",
},
{
"Get visible user with restrictions to teams",
"teams",
user2.Email,
"",
},
{
"Get not visible user with restrictions to teams",
"teams",
user5.Email,
"api.context.permissions.app_error",
},
{
"Get not existing user with restrictions to channels",
"channels",
th.GenerateTestEmail(),
"api.context.permissions.app_error",
},
{
"Get visible user with restrictions to channels",
"channels",
user4.Email,
"",
},
{
"Get not visible user with restrictions to channels",
"channels",
user3.Email,
"api.context.permissions.app_error",
},
}
defer th.RestoreDefaultRolePermissions(th.SaveDefaultRolePermissions())
for _, tc := range testCases {
t.Run(tc.Name, func(t *testing.T) {
if tc.RestrictedTo == "channels" {
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.SYSTEM_USER_ROLE_ID)
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.TEAM_USER_ROLE_ID)
} else if tc.RestrictedTo == "teams" {
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.SYSTEM_USER_ROLE_ID)
th.AddPermissionToRole(model.PERMISSION_VIEW_MEMBERS.Id, model.TEAM_USER_ROLE_ID)
} else {
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.TEAM_USER_ROLE_ID)
th.AddPermissionToRole(model.PERMISSION_VIEW_MEMBERS.Id, model.SYSTEM_USER_ROLE_ID)
}
_, resp := th.Client.GetUserByEmail(tc.Email, "")
require.Nil(t, err)
if tc.ExpectedError != "" {
CheckErrorMessage(t, resp, tc.ExpectedError)
} else {
CheckNoError(t, resp)
}
})
}
})
t.Run("getDefaultProfileImage", func(t *testing.T) {
testCases := []struct {
Name string
RestrictedTo string
UserId string
ExpectedError string
}{
{
"Get visible user without restrictions",
"",
user5.Id,
"",
},
{
"Get not existing user without restrictions",
"",
model.NewId(),
"store.sql_user.missing_account.const",
},
{
"Get not existing user with restrictions to teams",
"teams",
model.NewId(),
"api.context.permissions.app_error",
},
{
"Get visible user with restrictions to teams",
"teams",
user2.Id,
"",
},
{
"Get not visible user with restrictions to teams",
"teams",
user5.Id,
"api.context.permissions.app_error",
},
{
"Get not existing user with restrictions to channels",
"channels",
model.NewId(),
"api.context.permissions.app_error",
},
{
"Get visible user with restrictions to channels",
"channels",
user4.Id,
"",
},
{
"Get not visible user with restrictions to channels",
"channels",
user3.Id,
"api.context.permissions.app_error",
},
}
defer th.RestoreDefaultRolePermissions(th.SaveDefaultRolePermissions())
for _, tc := range testCases {
t.Run(tc.Name, func(t *testing.T) {
if tc.RestrictedTo == "channels" {
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.SYSTEM_USER_ROLE_ID)
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.TEAM_USER_ROLE_ID)
} else if tc.RestrictedTo == "teams" {
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.SYSTEM_USER_ROLE_ID)
th.AddPermissionToRole(model.PERMISSION_VIEW_MEMBERS.Id, model.TEAM_USER_ROLE_ID)
} else {
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.TEAM_USER_ROLE_ID)
th.AddPermissionToRole(model.PERMISSION_VIEW_MEMBERS.Id, model.SYSTEM_USER_ROLE_ID)
}
_, resp := th.Client.GetDefaultProfileImage(tc.UserId)
require.Nil(t, err)
if tc.ExpectedError != "" {
CheckErrorMessage(t, resp, tc.ExpectedError)
} else {
CheckNoError(t, resp)
}
})
}
})
t.Run("getProfileImage", func(t *testing.T) {
testCases := []struct {
Name string
RestrictedTo string
UserId string
ExpectedError string
}{
{
"Get visible user without restrictions",
"",
user5.Id,
"",
},
{
"Get not existing user without restrictions",
"",
model.NewId(),
"store.sql_user.missing_account.const",
},
{
"Get not existing user with restrictions to teams",
"teams",
model.NewId(),
"api.context.permissions.app_error",
},
{
"Get visible user with restrictions to teams",
"teams",
user2.Id,
"",
},
{
"Get not visible user with restrictions to teams",
"teams",
user5.Id,
"api.context.permissions.app_error",
},
{
"Get not existing user with restrictions to channels",
"channels",
model.NewId(),
"api.context.permissions.app_error",
},
{
"Get visible user with restrictions to channels",
"channels",
user4.Id,
"",
},
{
"Get not visible user with restrictions to channels",
"channels",
user3.Id,
"api.context.permissions.app_error",
},
}
defer th.RestoreDefaultRolePermissions(th.SaveDefaultRolePermissions())
for _, tc := range testCases {
t.Run(tc.Name, func(t *testing.T) {
if tc.RestrictedTo == "channels" {
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.SYSTEM_USER_ROLE_ID)
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.TEAM_USER_ROLE_ID)
} else if tc.RestrictedTo == "teams" {
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.SYSTEM_USER_ROLE_ID)
th.AddPermissionToRole(model.PERMISSION_VIEW_MEMBERS.Id, model.TEAM_USER_ROLE_ID)
} else {
th.RemovePermissionFromRole(model.PERMISSION_VIEW_MEMBERS.Id, model.TEAM_USER_ROLE_ID)
th.AddPermissionToRole(model.PERMISSION_VIEW_MEMBERS.Id, model.SYSTEM_USER_ROLE_ID)
}
_, resp := th.Client.GetProfileImage(tc.UserId, "")
require.Nil(t, err)
if tc.ExpectedError != "" {
CheckErrorMessage(t, resp, tc.ExpectedError)
} else {
CheckNoError(t, resp)
}
})
}
})
}