Adding new "VIEW_MEMBERS" permissions restrict the scope of users visibility (#10487)
* MM-14138: Adding new "VIEW_MEMBERS" permissions restrict the scope of users visibility * Fixing gofmt * Fixing broken tests * Addressing PR review comments from Miguel de la Cruz * Removed hack * A bit nicer and cleaner code in the UserBelongsToChannels function * Adding cluster cache invalidation for user team ids * Checking in the correct order permissions to not leek existency information * Adding restrictions to TeamMembers and User status requests * Fixing tests * Fixing status endpoint permissions checks * Adding more tests * Fixing tests * More tests and making the restrictions query based only on joins * Adding more tests * Adding more tests * fixing merge problems * Reverting status changes to avoid performance issues * Adding more tests * Fixing test * i18n extract * Adding extra method for get restrictions for a team * Add the new elasticsearch functions to search users with restrictions * Add missing translation string * Rename restrictedChannelIds to restrictedToChannels * Remove ToDo * Adding the permission to the SystemAdmin role during permissions migrations
Этот коммит содержится в:
Jesús Espino
коммит произвёл
GitHub
GitHub
родитель
5b70962f71
Коммит
c8920588a0
203
app/user_test.go
203
app/user_test.go
@@ -704,3 +704,206 @@ func TestPasswordRecovery(t *testing.T) {
|
||||
err = th.App.ResetPasswordFromToken(token.Token, "abcdefgh")
|
||||
assert.NotNil(t, err)
|
||||
}
|
||||
|
||||
func TestGetViewUsersRestrictions(t *testing.T) {
|
||||
th := Setup(t).InitBasic()
|
||||
defer th.TearDown()
|
||||
|
||||
team1 := th.CreateTeam()
|
||||
team2 := th.CreateTeam()
|
||||
th.CreateTeam() // Another team
|
||||
|
||||
user1 := th.CreateUser()
|
||||
|
||||
th.LinkUserToTeam(user1, team1)
|
||||
th.LinkUserToTeam(user1, team2)
|
||||
|
||||
th.App.UpdateTeamMemberRoles(team1.Id, user1.Id, "team_user team_admin")
|
||||
|
||||
team1channel1 := th.CreateChannel(team1)
|
||||
team1channel2 := th.CreateChannel(team1)
|
||||
th.CreateChannel(team1) // Another channel
|
||||
team1offtopic, err := th.App.GetChannelByName("off-topic", team1.Id, false)
|
||||
require.Nil(t, err)
|
||||
team1townsquare, err := th.App.GetChannelByName("town-square", team1.Id, false)
|
||||
require.Nil(t, err)
|
||||
|
||||
team2channel1 := th.CreateChannel(team2)
|
||||
th.CreateChannel(team2) // Another channel
|
||||
team2offtopic, err := th.App.GetChannelByName("off-topic", team2.Id, false)
|
||||
require.Nil(t, err)
|
||||
team2townsquare, err := th.App.GetChannelByName("town-square", team2.Id, false)
|
||||
require.Nil(t, err)
|
||||
|
||||
th.App.AddUserToChannel(user1, team1channel1)
|
||||
th.App.AddUserToChannel(user1, team1channel2)
|
||||
th.App.AddUserToChannel(user1, team2channel1)
|
||||
|
||||
addPermission := func(role *model.Role, permission string) *model.AppError {
|
||||
newPermissions := append(role.Permissions, permission)
|
||||
_, err := th.App.PatchRole(role, &model.RolePatch{Permissions: &newPermissions})
|
||||
return err
|
||||
}
|
||||
|
||||
removePermission := func(role *model.Role, permission string) *model.AppError {
|
||||
newPermissions := []string{}
|
||||
for _, oldPermission := range role.Permissions {
|
||||
if permission != oldPermission {
|
||||
newPermissions = append(newPermissions, oldPermission)
|
||||
}
|
||||
}
|
||||
_, err := th.App.PatchRole(role, &model.RolePatch{Permissions: &newPermissions})
|
||||
return err
|
||||
}
|
||||
|
||||
t.Run("VIEW_MEMBERS permission granted at system level", func(t *testing.T) {
|
||||
restrictions, err := th.App.GetViewUsersRestrictions(user1.Id)
|
||||
require.Nil(t, err)
|
||||
|
||||
assert.Nil(t, restrictions)
|
||||
})
|
||||
|
||||
t.Run("VIEW_MEMBERS permission granted at team level", func(t *testing.T) {
|
||||
systemUserRole, err := th.App.GetRoleByName(model.SYSTEM_USER_ROLE_ID)
|
||||
require.Nil(t, err)
|
||||
teamUserRole, err := th.App.GetRoleByName(model.TEAM_USER_ROLE_ID)
|
||||
require.Nil(t, err)
|
||||
|
||||
require.Nil(t, removePermission(systemUserRole, model.PERMISSION_VIEW_MEMBERS.Id))
|
||||
defer addPermission(systemUserRole, model.PERMISSION_VIEW_MEMBERS.Id)
|
||||
require.Nil(t, addPermission(teamUserRole, model.PERMISSION_VIEW_MEMBERS.Id))
|
||||
defer removePermission(teamUserRole, model.PERMISSION_VIEW_MEMBERS.Id)
|
||||
|
||||
restrictions, err := th.App.GetViewUsersRestrictions(user1.Id)
|
||||
require.Nil(t, err)
|
||||
|
||||
assert.NotNil(t, restrictions)
|
||||
assert.NotNil(t, restrictions.Teams)
|
||||
assert.Len(t, restrictions.Channels, 0)
|
||||
assert.ElementsMatch(t, []string{team1.Id, team2.Id}, restrictions.Teams)
|
||||
})
|
||||
|
||||
t.Run("VIEW_MEMBERS permission not granted at any level", func(t *testing.T) {
|
||||
systemUserRole, err := th.App.GetRoleByName(model.SYSTEM_USER_ROLE_ID)
|
||||
require.Nil(t, err)
|
||||
require.Nil(t, removePermission(systemUserRole, model.PERMISSION_VIEW_MEMBERS.Id))
|
||||
defer addPermission(systemUserRole, model.PERMISSION_VIEW_MEMBERS.Id)
|
||||
|
||||
restrictions, err := th.App.GetViewUsersRestrictions(user1.Id)
|
||||
require.Nil(t, err)
|
||||
|
||||
assert.NotNil(t, restrictions)
|
||||
assert.Len(t, restrictions.Teams, 0)
|
||||
assert.NotNil(t, restrictions.Channels)
|
||||
assert.ElementsMatch(t, []string{team1townsquare.Id, team1offtopic.Id, team1channel1.Id, team1channel2.Id, team2townsquare.Id, team2offtopic.Id, team2channel1.Id}, restrictions.Channels)
|
||||
})
|
||||
|
||||
t.Run("VIEW_MEMBERS permission for some teams but not for others", func(t *testing.T) {
|
||||
systemUserRole, err := th.App.GetRoleByName(model.SYSTEM_USER_ROLE_ID)
|
||||
require.Nil(t, err)
|
||||
teamAdminRole, err := th.App.GetRoleByName(model.TEAM_ADMIN_ROLE_ID)
|
||||
require.Nil(t, err)
|
||||
|
||||
require.Nil(t, removePermission(systemUserRole, model.PERMISSION_VIEW_MEMBERS.Id))
|
||||
defer addPermission(systemUserRole, model.PERMISSION_VIEW_MEMBERS.Id)
|
||||
require.Nil(t, addPermission(teamAdminRole, model.PERMISSION_VIEW_MEMBERS.Id))
|
||||
defer removePermission(teamAdminRole, model.PERMISSION_VIEW_MEMBERS.Id)
|
||||
|
||||
restrictions, err := th.App.GetViewUsersRestrictions(user1.Id)
|
||||
require.Nil(t, err)
|
||||
|
||||
assert.NotNil(t, restrictions)
|
||||
assert.NotNil(t, restrictions.Teams)
|
||||
assert.NotNil(t, restrictions.Channels)
|
||||
assert.ElementsMatch(t, restrictions.Teams, []string{team1.Id})
|
||||
assert.ElementsMatch(t, []string{team1townsquare.Id, team1offtopic.Id, team1channel1.Id, team1channel2.Id, team2townsquare.Id, team2offtopic.Id, team2channel1.Id}, restrictions.Channels)
|
||||
})
|
||||
}
|
||||
|
||||
func TestGetViewUsersRestrictionsForTeam(t *testing.T) {
|
||||
th := Setup(t).InitBasic()
|
||||
defer th.TearDown()
|
||||
|
||||
team1 := th.CreateTeam()
|
||||
team2 := th.CreateTeam()
|
||||
th.CreateTeam() // Another team
|
||||
|
||||
user1 := th.CreateUser()
|
||||
|
||||
th.LinkUserToTeam(user1, team1)
|
||||
th.LinkUserToTeam(user1, team2)
|
||||
|
||||
th.App.UpdateTeamMemberRoles(team1.Id, user1.Id, "team_user team_admin")
|
||||
|
||||
team1channel1 := th.CreateChannel(team1)
|
||||
team1channel2 := th.CreateChannel(team1)
|
||||
th.CreateChannel(team1) // Another channel
|
||||
team1offtopic, err := th.App.GetChannelByName("off-topic", team1.Id, false)
|
||||
require.Nil(t, err)
|
||||
team1townsquare, err := th.App.GetChannelByName("town-square", team1.Id, false)
|
||||
require.Nil(t, err)
|
||||
|
||||
team2channel1 := th.CreateChannel(team2)
|
||||
th.CreateChannel(team2) // Another channel
|
||||
team2offtopic, err := th.App.GetChannelByName("off-topic", team2.Id, false)
|
||||
require.Nil(t, err)
|
||||
team2townsquare, err := th.App.GetChannelByName("town-square", team2.Id, false)
|
||||
require.Nil(t, err)
|
||||
|
||||
th.App.AddUserToChannel(user1, team1channel1)
|
||||
th.App.AddUserToChannel(user1, team1channel2)
|
||||
th.App.AddUserToChannel(user1, team2channel1)
|
||||
|
||||
addPermission := func(role *model.Role, permission string) *model.AppError {
|
||||
newPermissions := append(role.Permissions, permission)
|
||||
_, err := th.App.PatchRole(role, &model.RolePatch{Permissions: &newPermissions})
|
||||
return err
|
||||
}
|
||||
|
||||
removePermission := func(role *model.Role, permission string) *model.AppError {
|
||||
newPermissions := []string{}
|
||||
for _, oldPermission := range role.Permissions {
|
||||
if permission != oldPermission {
|
||||
newPermissions = append(newPermissions, oldPermission)
|
||||
}
|
||||
}
|
||||
_, err := th.App.PatchRole(role, &model.RolePatch{Permissions: &newPermissions})
|
||||
return err
|
||||
}
|
||||
|
||||
t.Run("VIEW_MEMBERS permission granted at system level", func(t *testing.T) {
|
||||
restrictions, err := th.App.GetViewUsersRestrictionsForTeam(user1.Id, team1.Id)
|
||||
require.Nil(t, err)
|
||||
|
||||
assert.Nil(t, restrictions)
|
||||
})
|
||||
|
||||
t.Run("VIEW_MEMBERS permission granted at team level", func(t *testing.T) {
|
||||
systemUserRole, err := th.App.GetRoleByName(model.SYSTEM_USER_ROLE_ID)
|
||||
require.Nil(t, err)
|
||||
teamUserRole, err := th.App.GetRoleByName(model.TEAM_USER_ROLE_ID)
|
||||
require.Nil(t, err)
|
||||
|
||||
require.Nil(t, removePermission(systemUserRole, model.PERMISSION_VIEW_MEMBERS.Id))
|
||||
defer addPermission(systemUserRole, model.PERMISSION_VIEW_MEMBERS.Id)
|
||||
require.Nil(t, addPermission(teamUserRole, model.PERMISSION_VIEW_MEMBERS.Id))
|
||||
defer removePermission(teamUserRole, model.PERMISSION_VIEW_MEMBERS.Id)
|
||||
|
||||
restrictions, err := th.App.GetViewUsersRestrictionsForTeam(user1.Id, team1.Id)
|
||||
require.Nil(t, err)
|
||||
assert.Nil(t, restrictions)
|
||||
})
|
||||
|
||||
t.Run("VIEW_MEMBERS permission not granted at any level", func(t *testing.T) {
|
||||
systemUserRole, err := th.App.GetRoleByName(model.SYSTEM_USER_ROLE_ID)
|
||||
require.Nil(t, err)
|
||||
require.Nil(t, removePermission(systemUserRole, model.PERMISSION_VIEW_MEMBERS.Id))
|
||||
defer addPermission(systemUserRole, model.PERMISSION_VIEW_MEMBERS.Id)
|
||||
|
||||
restrictions, err := th.App.GetViewUsersRestrictionsForTeam(user1.Id, team1.Id)
|
||||
require.Nil(t, err)
|
||||
|
||||
assert.NotNil(t, restrictions)
|
||||
assert.ElementsMatch(t, []string{team1townsquare.Id, team1offtopic.Id, team1channel1.Id, team1channel2.Id, team2townsquare.Id, team2offtopic.Id, team2channel1.Id}, restrictions)
|
||||
})
|
||||
}
|
||||
|
||||
Ссылка в новой задаче
Block a user