[MM-28717] Refactor applyMultiRoleFilters to use sq builder (#15500)

* Refactor apply multi role filters and add role filters to get all profiles

* Add some tests

* Fix tests

* Fix lint

* Trigger CI

* Rename param to make more sense

* Tie get filtered user stats to usermanagement read users

* Dont filter out other system roles when searching for team members or team admins only filter out system admins

* add new permissions

* add migration

* fix test

* remove system roles as default permissions

* implement changes discussed with dennis

* add read only and fix i18n

* use model consts instead of strings

* turn the permissions into pseudo constants

* Update read only default permissions

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>
Co-authored-by: Hossein Ahmadian-Yazdi <hyazdi1997@gmail.com>

model/migration.go

@@ -21,5 +21,6 @@ const (
 	MIGRATION_KEY_ADD_SYSTEM_CONSOLE_PERMISSIONS              = "add_system_console_permissions"
 	MIGRATION_KEY_SIDEBAR_CATEGORIES_PHASE_2                  = "migration_sidebar_categories_phase_2"
 	MIGRATION_KEY_ADD_CONVERT_CHANNEL_PERMISSIONS             = "add_convert_channel_permissions"
+	MIGRATION_KEY_ADD_SYSTEM_ROLES_PERMISSIONS                = "add_system_roles_permissions"
 	MIGRATION_KEY_ADD_MANAGE_SHARED_CHANNEL_PERMISSIONS       = "manage_shared_channel_permissions"
 )

model/permission.go

@@ -122,6 +122,9 @@ var PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_CHANNELS *Permission
 var PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_PERMISSIONS *Permission
 var PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_PERMISSIONS *Permission
 
+var PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_SYSTEM_ROLES *Permission
+var PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_SYSTEM_ROLES *Permission
+
 var PERMISSION_SYSCONSOLE_READ_ENVIRONMENT *Permission
 var PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT *Permission
 
@@ -757,6 +760,18 @@ func initializePermissions() {
 		"authentication.permissions.use_group_mentions.description",
 		PermissionScopeSystem,
 	}
+	PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_SYSTEM_ROLES = &Permission{
+		"sysconsole_read_user_management_system_roles",
+		"authentication.permissions.use_group_mentions.name",
+		"authentication.permissions.use_group_mentions.description",
+		PermissionScopeSystem,
+	}
+	PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_SYSTEM_ROLES = &Permission{
+		"sysconsole_write_user_management_system_roles",
+		"authentication.permissions.use_group_mentions.name",
+		"authentication.permissions.use_group_mentions.description",
+		PermissionScopeSystem,
+	}
 	PERMISSION_SYSCONSOLE_READ_ENVIRONMENT = &Permission{
 		"sysconsole_read_environment",
 		"authentication.permissions.use_group_mentions.name",
@@ -862,6 +877,7 @@ func initializePermissions() {
 		PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_TEAMS,
 		PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_CHANNELS,
 		PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_PERMISSIONS,
+		PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_SYSTEM_ROLES,
 		PERMISSION_SYSCONSOLE_READ_ENVIRONMENT,
 		PERMISSION_SYSCONSOLE_READ_SITE,
 		PERMISSION_SYSCONSOLE_READ_AUTHENTICATION,
@@ -879,6 +895,7 @@ func initializePermissions() {
 		PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_TEAMS,
 		PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_CHANNELS,
 		PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_PERMISSIONS,
+		PERMISSION_SYSCONSOLE_WRITE_USERMANAGEMENT_SYSTEM_ROLES,
 		PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT,
 		PERMISSION_SYSCONSOLE_WRITE_SITE,
 		PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION,

model/role.go

@@ -133,6 +133,7 @@ func init() {
 		PERMISSION_SYSCONSOLE_READ_SITE.Id,
 		PERMISSION_SYSCONSOLE_READ_AUTHENTICATION.Id,
 		PERMISSION_SYSCONSOLE_READ_PLUGINS.Id,
+		PERMISSION_SYSCONSOLE_READ_COMPLIANCE.Id,
 		PERMISSION_SYSCONSOLE_READ_INTEGRATIONS.Id,
 		PERMISSION_SYSCONSOLE_READ_EXPERIMENTAL.Id,
 	}