[MM-28717] Refactor applyMultiRoleFilters to use sq builder (#15500)

* Refactor apply multi role filters and add role filters to get all profiles

* Add some tests

* Fix tests

* Fix lint

* Trigger CI

* Rename param to make more sense

* Tie get filtered user stats to usermanagement read users

* Dont filter out other system roles when searching for team members or team admins only filter out system admins

* add new permissions

* add migration

* fix test

* remove system roles as default permissions

* implement changes discussed with dennis

* add read only and fix i18n

* use model consts instead of strings

* turn the permissions into pseudo constants

* Update read only default permissions

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>
Co-authored-by: Hossein Ahmadian-Yazdi <hyazdi1997@gmail.com>

api4/role_test.go

@@ -177,6 +177,43 @@ func TestPatchRole(t *testing.T) {
 		Permissions: &[]string{"manage_system", "create_public_channel", "manage_incoming_webhooks", "manage_outgoing_webhooks"},
 	}
 
+	th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
+
+		// Cannot edit a system admin
+		adminRole, err := th.App.Srv().Store.Role().GetByName("system_admin")
+		assert.Nil(t, err)
+		defer th.App.Srv().Store.Job().Delete(adminRole.Id)
+
+		_, resp := client.PatchRole(adminRole.Id, patch)
+		CheckNotImplementedStatus(t, resp)
+
+		// Cannot give other roles read / write to system roles or manage roles because only system admin can do these actions
+		systemManager, err := th.App.Srv().Store.Role().GetByName("system_manager")
+		assert.Nil(t, err)
+		defer th.App.Srv().Store.Job().Delete(systemManager.Id)
+
+		patchWriteSystemRoles := &model.RolePatch{
+			Permissions: &[]string{model.PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_SYSTEM_ROLES.Id},
+		}
+
+		_, resp = client.PatchRole(systemManager.Id, patchWriteSystemRoles)
+		CheckNotImplementedStatus(t, resp)
+
+		patchReadSystemRoles := &model.RolePatch{
+			Permissions: &[]string{model.PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_SYSTEM_ROLES.Id},
+		}
+
+		_, resp = client.PatchRole(systemManager.Id, patchReadSystemRoles)
+		CheckNotImplementedStatus(t, resp)
+
+		patchManageRoles := &model.RolePatch{
+			Permissions: &[]string{model.PERMISSION_MANAGE_ROLES.Id},
+		}
+
+		_, resp = client.PatchRole(systemManager.Id, patchManageRoles)
+		CheckNotImplementedStatus(t, resp)
+	})
+
 	th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
 		received, resp := client.PatchRole(role.Id, patch)
 		CheckNoError(t, resp)