Adding new "VIEW_MEMBERS" permissions restrict the scope of users visibility (#10487)

* MM-14138: Adding new "VIEW_MEMBERS" permissions restrict the scope of users visibility

* Fixing gofmt

* Fixing broken tests

* Addressing PR review comments from Miguel de la Cruz

* Removed hack

* A bit nicer and cleaner code in the UserBelongsToChannels function

* Adding cluster cache invalidation for user team ids

* Checking in the correct order permissions to not leek existency information

* Adding restrictions to TeamMembers and User status requests

* Fixing tests

* Fixing status endpoint permissions checks

* Adding more tests

* Fixing tests

* More tests and making the restrictions query based only on joins

* Adding more tests

* Adding more tests

* fixing merge problems

* Reverting status changes to avoid performance issues

* Adding more tests

* Fixing test

* i18n extract

* Adding extra method for get restrictions for a team

* Add the new elasticsearch functions to search users with restrictions

* Add missing translation string

* Rename restrictedChannelIds to restrictedToChannels

* Remove ToDo

* Adding the permission to the SystemAdmin role during permissions migrations

model/cluster_message.go

@@ -20,6 +20,7 @@ const (
 	CLUSTER_EVENT_INVALIDATE_CACHE_FOR_CHANNEL_BY_NAME              = "inv_channel_name"
 	CLUSTER_EVENT_INVALIDATE_CACHE_FOR_CHANNEL                      = "inv_channel"
 	CLUSTER_EVENT_INVALIDATE_CACHE_FOR_USER                         = "inv_user"
+	CLUSTER_EVENT_INVALIDATE_CACHE_FOR_USER_TEAMS                   = "inv_user_teams"
 	CLUSTER_EVENT_CLEAR_SESSION_CACHE_FOR_USER                      = "clear_session_user"
 	CLUSTER_EVENT_INVALIDATE_CACHE_FOR_ROLES                        = "inv_roles"
 	CLUSTER_EVENT_INVALIDATE_CACHE_FOR_SCHEMES                      = "inv_schemes"

model/permission.go

@@ -85,6 +85,7 @@ var PERMISSION_READ_BOTS *Permission
 var PERMISSION_READ_OTHERS_BOTS *Permission
 var PERMISSION_MANAGE_BOTS *Permission
 var PERMISSION_MANAGE_OTHERS_BOTS *Permission
+var PERMISSION_VIEW_MEMBERS *Permission
 
 // General permission that encompasses all system admin functions
 // in the future this could be broken up to allow access to some
@@ -519,6 +520,12 @@ func initializePermissions() {
 		"authentication.permisssions.manage_jobs.description",
 		PERMISSION_SCOPE_SYSTEM,
 	}
+	PERMISSION_VIEW_MEMBERS = &Permission{
+		"view_members",
+		"authentication.permisssions.view_members.name",
+		"authentication.permisssions.view_members.description",
+		PERMISSION_SCOPE_TEAM,
+	}
 
 	ALL_PERMISSIONS = []*Permission{
 		PERMISSION_INVITE_USER,
@@ -591,6 +598,7 @@ func initializePermissions() {
 		PERMISSION_MANAGE_BOTS,
 		PERMISSION_MANAGE_OTHERS_BOTS,
 		PERMISSION_MANAGE_SYSTEM,
+		PERMISSION_VIEW_MEMBERS,
 	}
 }
 

model/role.go

@@ -268,6 +268,7 @@ func MakeDefaultRoles() map[string]*Role {
 			PERMISSION_JOIN_PUBLIC_TEAMS.Id,
 			PERMISSION_CREATE_DIRECT_CHANNEL.Id,
 			PERMISSION_CREATE_GROUP_CHANNEL.Id,
+			PERMISSION_VIEW_MEMBERS.Id,
 		},
 		SchemeManaged: true,
 		BuiltIn:       true,
@@ -357,6 +358,7 @@ func MakeDefaultRoles() map[string]*Role {
 							PERMISSION_REMOVE_OTHERS_REACTIONS.Id,
 							PERMISSION_LIST_PRIVATE_TEAMS.Id,
 							PERMISSION_JOIN_PRIVATE_TEAMS.Id,
+							PERMISSION_VIEW_MEMBERS.Id,
 						},
 						roles[TEAM_USER_ROLE_ID].Permissions...,
 					),

model/user.go

@@ -4,6 +4,7 @@
 package model
 
 import (
+	"crypto/sha256"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -118,6 +119,22 @@ type UserForIndexing struct {
 	ChannelsIds []string `json:"channel_id"`
 }
 
+type ViewUsersRestrictions struct {
+	Teams    []string
+	Channels []string
+}
+
+func (r *ViewUsersRestrictions) Hash() string {
+	if r == nil {
+		return ""
+	}
+	ids := append(r.Teams, r.Channels...)
+	sort.Strings(ids)
+	hash := sha256.New()
+	hash.Write([]byte(strings.Join(ids, "")))
+	return fmt.Sprintf("%x", hash.Sum(nil))
+}
+
 type UserSlice []*User
 
 func (u UserSlice) Usernames() []string {

model/user_count.go

@@ -13,4 +13,6 @@ type UserCountOptions struct {
 	ExcludeRegularUsers bool
 	// Only include users on a specific team. "" for any team.
 	TeamId string
+	// Restrict to search in a list of teams and channels
+	ViewRestrictions *ViewUsersRestrictions
 }

model/user_get.go

@@ -20,6 +20,8 @@ type UserGetOptions struct {
 	Role string
 	// Sorting option
 	Sort string
+	// Restrict to search in a list of teams and channels
+	ViewRestrictions *ViewUsersRestrictions
 	// Page
 	Page int
 	// Page size

model/user_search.go

@@ -57,4 +57,6 @@ type UserSearchOptions struct {
 	Limit int
 	// Filters for the given role
 	Role string
+	// Restrict to search in a list of teams and channels
+	ViewRestrictions *ViewUsersRestrictions
 }