[MM-28717] Refactor applyMultiRoleFilters to use sq builder (#15500)
* Refactor apply multi role filters and add role filters to get all profiles * Add some tests * Fix tests * Fix lint * Trigger CI * Rename param to make more sense * Tie get filtered user stats to usermanagement read users * Dont filter out other system roles when searching for team members or team admins only filter out system admins * add new permissions * add migration * fix test * remove system roles as default permissions * implement changes discussed with dennis * add read only and fix i18n * use model consts instead of strings * turn the permissions into pseudo constants * Update read only default permissions Co-authored-by: Mattermod <mattermod@users.noreply.github.com> Co-authored-by: Hossein Ahmadian-Yazdi <hyazdi1997@gmail.com>
Этот коммит содержится в:
Farhan Munshi
коммит произвёл
GitHub
GitHub
родитель
1d15900f84
Коммит
c9a4a475d3
@@ -412,6 +412,7 @@ func (us SqlUserStore) GetAllProfiles(options *model.UserGetOptions) ([]*model.U
|
||||
query = applyViewRestrictionsFilter(query, options.ViewRestrictions, true)
|
||||
|
||||
query = applyRoleFilter(query, options.Role, isPostgreSQL)
|
||||
query = applyMultiRoleFilters(query, options.Roles, []string{}, []string{}, isPostgreSQL)
|
||||
|
||||
if options.Inactive {
|
||||
query = query.Where("u.DeleteAt != 0")
|
||||
@@ -451,119 +452,75 @@ func applyRoleFilter(query sq.SelectBuilder, role string, isPostgreSQL bool) sq.
|
||||
return query.Where("u.Roles LIKE ? ESCAPE '*'", roleParam)
|
||||
}
|
||||
|
||||
func applyMultiRoleFilters(query sq.SelectBuilder, roles []string, teamRoles []string, channelRoles []string) sq.SelectBuilder {
|
||||
queryString := ""
|
||||
if len(roles) > 0 && roles[0] != "" {
|
||||
schemeGuest := false
|
||||
schemeAdmin := false
|
||||
schemeUser := false
|
||||
func applyMultiRoleFilters(query sq.SelectBuilder, systemRoles []string, teamRoles []string, channelRoles []string, isPostgreSQL bool) sq.SelectBuilder {
|
||||
sqOr := sq.Or{}
|
||||
|
||||
for _, role := range roles {
|
||||
if len(systemRoles) > 0 && systemRoles[0] != "" {
|
||||
for _, role := range systemRoles {
|
||||
queryRole := wildcardSearchTerm(role)
|
||||
switch role {
|
||||
case model.SYSTEM_ADMIN_ROLE_ID:
|
||||
schemeAdmin = true
|
||||
case model.SYSTEM_USER_ROLE_ID:
|
||||
schemeUser = true
|
||||
case model.SYSTEM_GUEST_ROLE_ID:
|
||||
schemeGuest = true
|
||||
}
|
||||
}
|
||||
|
||||
if schemeAdmin || schemeUser || schemeGuest {
|
||||
if schemeAdmin && schemeUser {
|
||||
queryString += `(u.Roles LIKE '%system_user%' OR u.Roles LIKE '%system_admin%') `
|
||||
} else if schemeAdmin {
|
||||
queryString += `(u.Roles LIKE '%system_admin%') `
|
||||
} else if schemeUser {
|
||||
queryString += `(u.Roles LIKE '%system_user%' AND u.Roles NOT LIKE '%system_admin%') `
|
||||
}
|
||||
|
||||
if schemeGuest {
|
||||
if queryString != "" {
|
||||
queryString += "OR "
|
||||
// If querying for a `system_user` ensure that the user is only a system_user.
|
||||
sqOr = append(sqOr, sq.Eq{"u.Roles": role})
|
||||
case model.SYSTEM_GUEST_ROLE_ID, model.SYSTEM_ADMIN_ROLE_ID, model.SYSTEM_USER_MANAGER_ROLE_ID, model.SYSTEM_READ_ONLY_ADMIN_ROLE_ID, model.SYSTEM_MANAGER_ROLE_ID:
|
||||
// If querying for any other roles search using a wildcard.
|
||||
if isPostgreSQL {
|
||||
sqOr = append(sqOr, sq.ILike{"u.Roles": queryRole})
|
||||
} else {
|
||||
sqOr = append(sqOr, sq.Like{"u.Roles": queryRole})
|
||||
}
|
||||
queryString += `(u.Roles LIKE '%system_guest%') `
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
if len(channelRoles) > 0 && channelRoles[0] != "" {
|
||||
schemeGuest := false
|
||||
schemeAdmin := false
|
||||
schemeUser := false
|
||||
for _, channelRole := range channelRoles {
|
||||
switch channelRole {
|
||||
case model.CHANNEL_ADMIN_ROLE_ID:
|
||||
schemeAdmin = true
|
||||
case model.CHANNEL_USER_ROLE_ID:
|
||||
schemeUser = true
|
||||
case model.CHANNEL_GUEST_ROLE_ID:
|
||||
schemeGuest = true
|
||||
}
|
||||
}
|
||||
|
||||
if schemeAdmin || schemeUser || schemeGuest {
|
||||
if queryString != "" {
|
||||
queryString += "OR "
|
||||
}
|
||||
if schemeAdmin && schemeUser {
|
||||
queryString += `(cm.SchemeUser = true AND u.Roles = 'system_user')`
|
||||
} else if schemeAdmin {
|
||||
queryString += `(cm.SchemeAdmin = true AND u.Roles = 'system_user')`
|
||||
} else if schemeUser {
|
||||
queryString += `(cm.SchemeUser = true AND cm.SchemeAdmin = false AND u.Roles = 'system_user')`
|
||||
}
|
||||
|
||||
if schemeGuest {
|
||||
if queryString != "" && queryString[len(queryString)-3:] != "OR " {
|
||||
queryString += "OR "
|
||||
if isPostgreSQL {
|
||||
sqOr = append(sqOr, sq.And{sq.Eq{"cm.SchemeAdmin": true}, sq.NotILike{"u.Roles": wildcardSearchTerm(model.SYSTEM_ADMIN_ROLE_ID)}})
|
||||
} else {
|
||||
sqOr = append(sqOr, sq.And{sq.Eq{"cm.SchemeAdmin": true}, sq.NotLike{"u.Roles": wildcardSearchTerm(model.SYSTEM_ADMIN_ROLE_ID)}})
|
||||
}
|
||||
queryString += `(cm.SchemeGuest = true AND u.Roles = 'system_guest')`
|
||||
case model.CHANNEL_USER_ROLE_ID:
|
||||
if isPostgreSQL {
|
||||
sqOr = append(sqOr, sq.And{sq.Eq{"cm.SchemeUser": true}, sq.Eq{"cm.SchemeAdmin": false}, sq.NotILike{"u.Roles": wildcardSearchTerm(model.SYSTEM_ADMIN_ROLE_ID)}})
|
||||
} else {
|
||||
sqOr = append(sqOr, sq.And{sq.Eq{"cm.SchemeUser": true}, sq.Eq{"cm.SchemeAdmin": false}, sq.NotLike{"u.Roles": wildcardSearchTerm(model.SYSTEM_ADMIN_ROLE_ID)}})
|
||||
}
|
||||
case model.CHANNEL_GUEST_ROLE_ID:
|
||||
sqOr = append(sqOr, sq.Eq{"cm.SchemeGuest": true})
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if len(teamRoles) > 0 && teamRoles[0] != "" {
|
||||
schemeAdmin := false
|
||||
schemeUser := false
|
||||
schemeGuest := false
|
||||
for _, teamRole := range teamRoles {
|
||||
switch teamRole {
|
||||
case model.TEAM_ADMIN_ROLE_ID:
|
||||
schemeAdmin = true
|
||||
case model.TEAM_USER_ROLE_ID:
|
||||
schemeUser = true
|
||||
case model.TEAM_GUEST_ROLE_ID:
|
||||
schemeGuest = true
|
||||
}
|
||||
}
|
||||
|
||||
if schemeAdmin || schemeUser || schemeGuest {
|
||||
if queryString != "" {
|
||||
queryString += "OR "
|
||||
}
|
||||
if schemeAdmin && schemeUser {
|
||||
queryString += `(tm.SchemeUser = true AND u.Roles = 'system_user')`
|
||||
} else if schemeAdmin {
|
||||
queryString += `(tm.SchemeAdmin = true AND u.Roles = 'system_user')`
|
||||
} else if schemeUser {
|
||||
queryString += `(tm.SchemeUser = true AND tm.SchemeAdmin = false AND u.Roles = 'system_user')`
|
||||
}
|
||||
|
||||
if schemeGuest {
|
||||
if queryString != "" && queryString[len(queryString)-3:] != "OR " {
|
||||
queryString += "OR "
|
||||
if isPostgreSQL {
|
||||
sqOr = append(sqOr, sq.And{sq.Eq{"tm.SchemeAdmin": true}, sq.NotILike{"u.Roles": wildcardSearchTerm(model.SYSTEM_ADMIN_ROLE_ID)}})
|
||||
} else {
|
||||
sqOr = append(sqOr, sq.And{sq.Eq{"tm.SchemeAdmin": true}, sq.NotLike{"u.Roles": wildcardSearchTerm(model.SYSTEM_ADMIN_ROLE_ID)}})
|
||||
}
|
||||
queryString += `(tm.SchemeGuest = true AND u.Roles = 'system_guest')`
|
||||
case model.TEAM_USER_ROLE_ID:
|
||||
if isPostgreSQL {
|
||||
sqOr = append(sqOr, sq.And{sq.Eq{"tm.SchemeUser": true}, sq.Eq{"tm.SchemeAdmin": false}, sq.NotILike{"u.Roles": wildcardSearchTerm(model.SYSTEM_ADMIN_ROLE_ID)}})
|
||||
} else {
|
||||
sqOr = append(sqOr, sq.And{sq.Eq{"tm.SchemeUser": true}, sq.Eq{"tm.SchemeAdmin": false}, sq.NotLike{"u.Roles": wildcardSearchTerm(model.SYSTEM_ADMIN_ROLE_ID)}})
|
||||
}
|
||||
case model.TEAM_GUEST_ROLE_ID:
|
||||
sqOr = append(sqOr, sq.Eq{"tm.SchemeGuest": true})
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if queryString != "" {
|
||||
query = query.Where("(" + queryString + ")")
|
||||
if len(sqOr) > 0 {
|
||||
return query.Where(sqOr)
|
||||
} else {
|
||||
return query
|
||||
}
|
||||
|
||||
return query
|
||||
}
|
||||
|
||||
func applyChannelGroupConstrainedFilter(query sq.SelectBuilder, channelId string) sq.SelectBuilder {
|
||||
@@ -633,7 +590,7 @@ func (us SqlUserStore) GetProfiles(options *model.UserGetOptions) ([]*model.User
|
||||
query = applyViewRestrictionsFilter(query, options.ViewRestrictions, true)
|
||||
|
||||
query = applyRoleFilter(query, options.Role, isPostgreSQL)
|
||||
query = applyMultiRoleFilters(query, options.Roles, options.TeamRoles, options.ChannelRoles)
|
||||
query = applyMultiRoleFilters(query, options.Roles, options.TeamRoles, options.ChannelRoles, isPostgreSQL)
|
||||
|
||||
if options.Inactive {
|
||||
query = query.Where("u.DeleteAt != 0")
|
||||
@@ -1228,7 +1185,7 @@ func (us SqlUserStore) Count(options model.UserCountOptions) (int64, error) {
|
||||
query = query.LeftJoin("ChannelMembers AS cm ON u.Id = cm.UserId").Where("cm.ChannelId = ?", options.ChannelId)
|
||||
}
|
||||
query = applyViewRestrictionsFilter(query, options.ViewRestrictions, false)
|
||||
query = applyMultiRoleFilters(query, options.Roles, options.TeamRoles, options.ChannelRoles)
|
||||
query = applyMultiRoleFilters(query, options.Roles, options.TeamRoles, options.ChannelRoles, isPostgreSQL)
|
||||
|
||||
if isPostgreSQL {
|
||||
query = query.PlaceholderFormat(sq.Dollar)
|
||||
@@ -1461,7 +1418,7 @@ func (us SqlUserStore) performSearch(query sq.SelectBuilder, term string, option
|
||||
isPostgreSQL := us.DriverName() == model.DATABASE_DRIVER_POSTGRES
|
||||
|
||||
query = applyRoleFilter(query, options.Role, isPostgreSQL)
|
||||
query = applyMultiRoleFilters(query, options.Roles, options.TeamRoles, options.ChannelRoles)
|
||||
query = applyMultiRoleFilters(query, options.Roles, options.TeamRoles, options.ChannelRoles, isPostgreSQL)
|
||||
|
||||
if !options.AllowInactive {
|
||||
query = query.Where("u.DeleteAt = 0")
|
||||
|
||||
Ссылка в новой задаче
Block a user