mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

All Sections to SubSections (#16917)

Просмотр исходного кода 
* initial

* Revert "initial"

This reverts commit 3d631aeecdc2324cd5d17c0ecdc431a8ccc15060.

* [MM-32352] Add Experimental Subsections BACKEND (#16887)

Automatic Merge

* update appiface

* Fix app layers

* Ancillary Permissions on backend (#17061)

Automatic Merge

* [MM-32799] Add About Section (#17015)

* Add About Section

* add mock key

* Update role.go

* Update role.go

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

* [MM-33437] Fix config access tags for experimental settings (#17111)

Automatic Merge

* [MM-32794] Reporting Sub Section (#17035)

* test

* revert

* add permissions

* add new permission stuff

* add store mock

* fix bad merge

* gofmt fix

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

* [MM-32343] Environment SubSection (#17054)

* pre-checkout commit

* fix permission for testSiteURL

* pre-merge commit

* increase size of Permissions column in Roles table

* add entry for ENVIRONMENT to testlib/store.go

* use TEXT for Permissions column in Roles table

* use environment subsection permissions for API endpoints

* use subsections permissions for /config/environment

* add suggestions from hahmadia

* update tests to use subsection permissions

* add permissions column back in

* comment out code in upgradeDatabaseToVersion534

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>
Co-authored-by: Scott Bishel <scott.bishel@mattermost.com>

* MM-32351: Add Compliance Subsections (#17023)

* add subsections for compliance sectin

* add to mock functions

* updates for read job

* fixes

* fix test

* update tests

* update tests

* another test fix

* some cleanup

* update mlog

* fix linting

* Fix bad merges

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>
Co-authored-by: Hossein <hahmadia@users.noreply.github.com>
Co-authored-by: Hossein Ahmadian-Yazdi <hyazdi1997@gmail.com>

* MM-32347 Site Subsections (#17095)

* Init

* Added migration key in testlib store

* Fix syntax error

* fix bad merge

* fix lint

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>
Co-authored-by: Scott Bishel <scott.bishel@mattermost.com>

* MM-32350 Integrations (#17097)

* implement server subsections

* fix tests

* update test

* go fmt

Co-authored-by: Hossein Ahmadian-Yazdi <hyazdi1997@gmail.com>

* patch forgotten endpoints

* Adding subsection permissions for Authentication (#17087)

* adding new permissions, migrations to do

* permission migrations and ancilary permissions

* running make app-layers

* fixing tests and lint

* adding permissions to saml

* ldap write permissions

* running make app-layers

* fixing conflict

* making app layers

* clean up and fix tests

* change job type

* fix js error, if site url not returned

Co-authored-by: Benjamin Cooke <benjamincooke@Benjamins-MacBook-Pro.local>
Co-authored-by: Hossein Ahmadian-Yazdi <hyazdi1997@gmail.com>
Co-authored-by: Mattermod <mattermod@users.noreply.github.com>
Co-authored-by: Scott Bishel <scott.bishel@mattermost.com>

* Update permissions_migrations.go

* gofmt

* upgrade to 535

* gofmt

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>
Co-authored-by: Max Erenberg <max.erenberg@mattermost.com>
Co-authored-by: Scott Bishel <scott.bishel@mattermost.com>
Co-authored-by: Anurag Shivarathri <anurag6713@gmail.com>
Co-authored-by: Ben Cooke <benkcooke@gmail.com>
Co-authored-by: Benjamin Cooke <benjamincooke@Benjamins-MacBook-Pro.local>
Этот коммит содержится в:
Hossein
2021-04-06 10:39:48 -04:00
коммит произвёл GitHub
родитель 2cb82965b0
Коммит daec0b3201
44 изменённых файлов: 2938 добавлений и 626 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

4
api4/bleve.go
Просмотреть файл

@@ -18,8 +18,8 @@ func purgeBleveIndexes(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("purgeBleveIndexes", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_EXPERIMENTAL) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_EXPERIMENTAL)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_PURGE_BLEVE_INDEXES) {
c.SetPermissionError(model.PERMISSION_PURGE_BLEVE_INDEXES)
return
}

2
api4/bleve_test.go
Просмотреть файл

@@ -19,7 +19,7 @@ func TestBlevePurgeIndexes(t *testing.T) {
})
t.Run("as system user with write experimental permission", func(t *testing.T) {
th.AddPermissionToRole(model.PERMISSION_SYSCONSOLE_WRITE_EXPERIMENTAL.Id, model.SYSTEM_USER_ROLE_ID)
th.AddPermissionToRole(model.PERMISSION_PURGE_BLEVE_INDEXES.Id, model.SYSTEM_USER_ROLE_ID)
defer th.RemovePermissionFromRole(model.PERMISSION_SYSCONSOLE_WRITE_EXPERIMENTAL.Id, model.SYSTEM_USER_ROLE_ID)
_, resp := th.Client.PurgeBleveIndexes()
CheckOKStatus(t, resp)

4
api4/cluster.go
Просмотреть файл

@@ -14,8 +14,8 @@ func (api *API) InitCluster() {
}
func getClusterStatus(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_HIGH_AVAILABILITY) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_HIGH_AVAILABILITY)
return
}

16
api4/compliance.go
Просмотреть файл

@@ -30,8 +30,8 @@ func createComplianceReport(c *Context, w http.ResponseWriter, r *http.Request)
auditRec := c.MakeAuditRecord("createComplianceReport", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_COMPLIANCE) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_COMPLIANCE)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_CREATE_COMPLIANCE_EXPORT_JOB) {
c.SetPermissionError(model.PERMISSION_CREATE_COMPLIANCE_EXPORT_JOB)
return
}
@@ -53,8 +53,8 @@ func createComplianceReport(c *Context, w http.ResponseWriter, r *http.Request)
}
func getComplianceReports(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_READ_COMPLIANCE) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_READ_COMPLIANCE)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_READ_COMPLIANCE_EXPORT_JOB) {
c.SetPermissionError(model.PERMISSION_READ_COMPLIANCE_EXPORT_JOB)
return
}
@@ -80,8 +80,8 @@ func getComplianceReport(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("getComplianceReport", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_READ_COMPLIANCE) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_READ_COMPLIANCE)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_READ_COMPLIANCE_EXPORT_JOB) {
c.SetPermissionError(model.PERMISSION_READ_COMPLIANCE_EXPORT_JOB)
return
}
@@ -108,8 +108,8 @@ func downloadComplianceReport(c *Context, w http.ResponseWriter, r *http.Request
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("compliance_id", c.Params.ReportId)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_READ_COMPLIANCE) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_READ_COMPLIANCE)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_DOWNLOAD_COMPLIANCE_EXPORT_RESULT) {
c.SetPermissionError(model.PERMISSION_DOWNLOAD_COMPLIANCE_EXPORT_RESULT)
return
}

15
api4/config.go
Просмотреть файл

@@ -78,8 +78,8 @@ func configReload(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("configReload", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionToAny(*c.App.Session(), model.SysconsoleReadPermissions) {
c.SetPermissionError(model.SysconsoleReadPermissions...)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_RELOAD_CONFIG) {
c.SetPermissionError(model.PERMISSION_RELOAD_CONFIG)
return
}
@@ -193,12 +193,11 @@ func getClientConfig(c *Context, w http.ResponseWriter, r *http.Request) {
}
func getEnvironmentConfig(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT)
return
}
envConfig := c.App.GetEnvironmentConfig()
// Only return the environment variables for the subsections which the client is
// allowed to see
envConfig := c.App.GetEnvironmentConfig(func(structField reflect.StructField) bool {
return readFilter(c, structField)
})
w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
w.Write([]byte(model.StringInterfaceToJson(envConfig)))

30
api4/config_test.go
Просмотреть файл

@@ -77,8 +77,8 @@ func TestGetConfigWithAccessTag(t *testing.T) {
th.Client.Login(th.BasicUser.Username, th.BasicUser.Password)
// add read sysconsole environment config
th.AddPermissionToRole(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT.Id, model.SYSTEM_USER_ROLE_ID)
defer th.RemovePermissionFromRole(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT.Id, model.SYSTEM_USER_ROLE_ID)
th.AddPermissionToRole(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_RATE_LIMITING.Id, model.SYSTEM_USER_ROLE_ID)
defer th.RemovePermissionFromRole(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_RATE_LIMITING.Id, model.SYSTEM_USER_ROLE_ID)
cfg, resp := th.Client.GetConfig()
CheckNoError(t, resp)
@@ -268,8 +268,8 @@ func TestUpdateConfigWithoutManageSystemPermission(t *testing.T) {
th.Client.Login(th.BasicUser.Username, th.BasicUser.Password)
// add read sysconsole integrations config
th.AddPermissionToRole(model.PERMISSION_SYSCONSOLE_READ_INTEGRATIONS.Id, model.SYSTEM_USER_ROLE_ID)
defer th.RemovePermissionFromRole(model.PERMISSION_SYSCONSOLE_READ_INTEGRATIONS.Id, model.SYSTEM_USER_ROLE_ID)
th.AddPermissionToRole(model.PERMISSION_SYSCONSOLE_READ_INTEGRATIONS_INTEGRATION_MANAGEMENT.Id, model.SYSTEM_USER_ROLE_ID)
defer th.RemovePermissionFromRole(model.PERMISSION_SYSCONSOLE_READ_INTEGRATIONS_INTEGRATION_MANAGEMENT.Id, model.SYSTEM_USER_ROLE_ID)
t.Run("sysconsole read permission does not provides config write access", func(t *testing.T) {
// should be readable because has a sysconsole read permission
@@ -289,8 +289,8 @@ func TestUpdateConfigWithoutManageSystemPermission(t *testing.T) {
originalValue := *cfg.ServiceSettings.AllowCorsFrom
// add the wrong write permission
th.AddPermissionToRole(model.PERMISSION_SYSCONSOLE_WRITE_ABOUT.Id, model.SYSTEM_USER_ROLE_ID)
defer th.RemovePermissionFromRole(model.PERMISSION_SYSCONSOLE_WRITE_ABOUT.Id, model.SYSTEM_USER_ROLE_ID)
th.AddPermissionToRole(model.PERMISSION_SYSCONSOLE_WRITE_ABOUT_EDITION_AND_LICENSE.Id, model.SYSTEM_USER_ROLE_ID)
defer th.RemovePermissionFromRole(model.PERMISSION_SYSCONSOLE_WRITE_ABOUT_EDITION_AND_LICENSE.Id, model.SYSTEM_USER_ROLE_ID)
// try update a config value allowed by sysconsole WRITE integrations
mockVal := model.NewId()
@@ -299,7 +299,7 @@ func TestUpdateConfigWithoutManageSystemPermission(t *testing.T) {
CheckNoError(t, resp)
// ensure the config setting was not updated
cfg, resp = th.Client.GetConfig()
cfg, resp = th.SystemAdminClient.GetConfig()
CheckNoError(t, resp)
assert.Equal(t, *cfg.ServiceSettings.AllowCorsFrom, originalValue)
})
@@ -309,8 +309,10 @@ func TestUpdateConfigWithoutManageSystemPermission(t *testing.T) {
cfg, resp := th.SystemAdminClient.GetConfig()
CheckNoError(t, resp)
th.AddPermissionToRole(model.PERMISSION_SYSCONSOLE_WRITE_INTEGRATIONS.Id, model.SYSTEM_USER_ROLE_ID)
defer th.RemovePermissionFromRole(model.PERMISSION_SYSCONSOLE_WRITE_INTEGRATIONS.Id, model.SYSTEM_USER_ROLE_ID)
th.AddPermissionToRole(model.PERMISSION_SYSCONSOLE_WRITE_INTEGRATIONS_CORS.Id, model.SYSTEM_USER_ROLE_ID)
defer th.RemovePermissionFromRole(model.PERMISSION_SYSCONSOLE_WRITE_INTEGRATIONS_CORS.Id, model.SYSTEM_USER_ROLE_ID)
th.AddPermissionToRole(model.PERMISSION_SYSCONSOLE_READ_INTEGRATIONS_CORS.Id, model.SYSTEM_USER_ROLE_ID)
defer th.RemovePermissionFromRole(model.PERMISSION_SYSCONSOLE_READ_INTEGRATIONS_CORS.Id, model.SYSTEM_USER_ROLE_ID)
// try update a config value allowed by sysconsole WRITE integrations
mockVal := model.NewId()
@@ -477,15 +479,17 @@ func TestGetEnvironmentConfig(t *testing.T) {
TeamAdminClient := th.CreateClient()
th.LoginTeamAdminWithClient(TeamAdminClient)
_, resp := TeamAdminClient.GetEnvironmentConfig()
CheckForbiddenStatus(t, resp)
envConfig, resp := TeamAdminClient.GetEnvironmentConfig()
CheckNoError(t, resp)
require.Empty(t, envConfig)
})
t.Run("as regular user", func(t *testing.T) {
Client := th.Client
_, resp := Client.GetEnvironmentConfig()
CheckForbiddenStatus(t, resp)
envConfig, resp := Client.GetEnvironmentConfig()
CheckNoError(t, resp)
require.Empty(t, envConfig)
})
t.Run("as not-regular user", func(t *testing.T) {

18
api4/elasticsearch.go
Просмотреть файл

@@ -21,8 +21,10 @@ func testElasticsearch(c *Context, w http.ResponseWriter, r *http.Request) {
cfg = c.App.Config()
}
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT)
// PERMISSION_TEST_ELASTICSEARCH is an ancillary permission of PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_ELASTICSEARCH,
// which should prevent read-only managers from password sniffing
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_TEST_ELASTICSEARCH) {
c.SetPermissionError(model.PERMISSION_TEST_ELASTICSEARCH)
return
}
@@ -31,14 +33,6 @@ func testElasticsearch(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
// no sniffing for ports or passwords
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT) {
if (*cfg.ElasticsearchSettings.ConnectionUrl != *c.App.Config().ElasticsearchSettings.ConnectionUrl) || (*cfg.ElasticsearchSettings.Password != model.FAKE_SETTING) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT)
return
}
}
if err := c.App.TestElasticsearch(cfg); err != nil {
c.Err = err
return
@@ -51,8 +45,8 @@ func purgeElasticsearchIndexes(c *Context, w http.ResponseWriter, r *http.Reques
auditRec := c.MakeAuditRecord("purgeElasticsearchIndexes", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_PURGE_ELASTICSEARCH_INDEXES) {
c.SetPermissionError(model.PERMISSION_PURGE_ELASTICSEARCH_INDEXES)
return
}

69
api4/job.go
Просмотреть файл

@@ -11,6 +11,7 @@ import (
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
"github.com/mattermost/mattermost-server/v5/shared/mlog"
)
func (api *API) InitJob() {
@@ -28,17 +29,22 @@ func getJob(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_READ_JOBS) {
c.SetPermissionError(model.PERMISSION_READ_JOBS)
return
}
job, err := c.App.GetJob(c.Params.JobId)
if err != nil {
c.Err = err
return
}
hasPermission, permissionRequired := c.App.SessionHasPermissionToReadJob(*c.App.Session(), job.Type)
if permissionRequired == nil {
c.Err = model.NewAppError("getJob", "api.job.retrieve.nopermissions", nil, "", http.StatusBadRequest)
return
}
if !hasPermission {
c.SetPermissionError(permissionRequired)
return
}
w.Write([]byte(job.ToJson()))
}
@@ -105,8 +111,14 @@ func createJob(c *Context, w http.ResponseWriter, r *http.Request) {
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("job", job)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_JOBS) {
c.SetPermissionError(model.PERMISSION_MANAGE_JOBS)
hasPermission, permissionRequired := c.App.SessionHasPermissionToCreateJob(*c.App.Session(), job)
if permissionRequired == nil {
c.Err = model.NewAppError("unableToCreateJob", "api.job.unable_to_create_job.incorrect_job_type", nil, "", http.StatusBadRequest)
return
}
if !hasPermission {
c.SetPermissionError(permissionRequired)
return
}
@@ -128,12 +140,23 @@ func getJobs(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_READ_JOBS) {
c.SetPermissionError(model.PERMISSION_READ_JOBS)
var validJobTypes []string
for _, jobType := range model.ALL_JOB_TYPES {
hasPermission, permissionRequired := c.App.SessionHasPermissionToReadJob(*c.App.Session(), jobType)
if permissionRequired == nil {
mlog.Warn("The job types of a job you are trying to retrieve does not contain permissions", mlog.String("jobType", jobType))
continue
}
if hasPermission {
validJobTypes = append(validJobTypes, jobType)
}
}
if len(validJobTypes) == 0 {
c.SetPermissionError()
return
}
jobs, err := c.App.GetJobsPage(c.Params.Page, c.Params.PerPage)
jobs, err := c.App.GetJobsByTypesPage(validJobTypes, c.Params.Page, c.Params.PerPage)
if err != nil {
c.Err = err
return
@@ -148,8 +171,13 @@ func getJobsByType(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_READ_JOBS) {
c.SetPermissionError(model.PERMISSION_READ_JOBS)
hasPermission, permissionRequired := c.App.SessionHasPermissionToReadJob(*c.App.Session(), c.Params.JobType)
if permissionRequired == nil {
c.Err = model.NewAppError("getJobsByType", "api.job.retrieve.nopermissions", nil, "", http.StatusBadRequest)
return
}
if !hasPermission {
c.SetPermissionError(permissionRequired)
return
}
@@ -172,8 +200,21 @@ func cancelJob(c *Context, w http.ResponseWriter, r *http.Request) {
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("job_id", c.Params.JobId)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_JOBS) {
c.SetPermissionError(model.PERMISSION_MANAGE_JOBS)
job, err := c.App.GetJob(c.Params.JobId)
if err != nil {
c.Err = err
return
}
// if permission to create, permission to cancel, same permission
hasPermission, permissionRequired := c.App.SessionHasPermissionToCreateJob(*c.App.Session(), job)
if permissionRequired == nil {
c.Err = model.NewAppError("unableToCancelJob", "api.job.unable_to_create_job.incorrect_job_type", nil, "", http.StatusBadRequest)
return
}
if !hasPermission {
c.SetPermissionError(permissionRequired)
return
}

19
api4/job_test.go
Просмотреть файл

@@ -26,7 +26,7 @@ func TestCreateJob(t *testing.T) {
}
_, resp := th.SystemManagerClient.CreateJob(job)
require.Nil(t, resp.Error)
CheckForbiddenStatus(t, resp)
received, resp := th.SystemAdminClient.CreateJob(job)
require.Nil(t, resp.Error)
@@ -40,6 +40,7 @@ func TestCreateJob(t *testing.T) {
_, resp = th.SystemAdminClient.CreateJob(job)
CheckBadRequestStatus(t, resp)
job.Type = model.JOB_TYPE_ELASTICSEARCH_POST_INDEXING
_, resp = th.Client.CreateJob(job)
CheckForbiddenStatus(t, resp)
}
@@ -51,6 +52,7 @@ func TestGetJob(t *testing.T) {
job := &model.Job{
Id: model.NewId(),
Status: model.JOB_STATUS_PENDING,
Type: model.JOB_TYPE_MESSAGE_EXPORT,
}
_, err := th.App.Srv().Store.Job().Save(job)
require.NoError(t, err)
@@ -77,7 +79,7 @@ func TestGetJobs(t *testing.T) {
th := Setup(t)
defer th.TearDown()
jobType := model.NewId()
jobType := model.JOB_TYPE_DATA_RETENTION
t0 := model.GetMillis()
jobs := []*model.Job{
@@ -124,7 +126,7 @@ func TestGetJobsByType(t *testing.T) {
th := Setup(t)
defer th.TearDown()
jobType := model.NewId()
jobType := model.JOB_TYPE_DATA_RETENTION
jobs := []*model.Job{
{
@@ -177,7 +179,7 @@ func TestGetJobsByType(t *testing.T) {
_, resp = th.Client.GetJobsByType(jobType, 0, 60)
CheckForbiddenStatus(t, resp)
_, resp = th.SystemManagerClient.GetJobsByType(model.JOB_TYPE_MESSAGE_EXPORT, 0, 60)
_, resp = th.SystemManagerClient.GetJobsByType(model.JOB_TYPE_ELASTICSEARCH_POST_INDEXING, 0, 60)
require.Nil(t, resp.Error)
}
@@ -273,20 +275,21 @@ func TestCancelJob(t *testing.T) {
th := Setup(t)
defer th.TearDown()
jobType := model.JOB_TYPE_MESSAGE_EXPORT
jobs := []*model.Job{
{
Id: model.NewId(),
Type: model.NewId(),
Type: jobType,
Status: model.JOB_STATUS_PENDING,
},
{
Id: model.NewId(),
Type: model.NewId(),
Type: jobType,
Status: model.JOB_STATUS_IN_PROGRESS,
},
{
Id: model.NewId(),
Type: model.NewId(),
Type: jobType,
Status: model.JOB_STATUS_SUCCESS,
},
}
@@ -310,5 +313,5 @@ func TestCancelJob(t *testing.T) {
CheckInternalErrorStatus(t, resp)
_, resp = th.SystemAdminClient.CancelJob(model.NewId())
CheckInternalErrorStatus(t, resp)
CheckNotFoundStatus(t, resp)
}

24
api4/ldap.go
Просмотреть файл

@@ -50,8 +50,8 @@ func syncLdap(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("syncLdap", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_CREATE_LDAP_SYNC_JOB) {
c.SetPermissionError(model.PERMISSION_CREATE_LDAP_SYNC_JOB)
return
}
@@ -67,8 +67,8 @@ func testLdap(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_READ_AUTHENTICATION) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_READ_AUTHENTICATION)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_TEST_LDAP) {
c.SetPermissionError(model.PERMISSION_TEST_LDAP)
return
}
@@ -319,8 +319,8 @@ func parseLdapCertificateRequest(r *http.Request, maxFileSize int64) (*multipart
}
func addLdapPublicCertificate(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_ADD_LDAP_PUBLIC_CERT) {
c.SetPermissionError(model.PERMISSION_ADD_LDAP_PUBLIC_CERT)
return
}
@@ -343,8 +343,8 @@ func addLdapPublicCertificate(c *Context, w http.ResponseWriter, r *http.Request
}
func addLdapPrivateCertificate(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_ADD_LDAP_PRIVATE_CERT) {
c.SetPermissionError(model.PERMISSION_ADD_LDAP_PRIVATE_CERT)
return
}
@@ -367,8 +367,8 @@ func addLdapPrivateCertificate(c *Context, w http.ResponseWriter, r *http.Reques
}
func removeLdapPublicCertificate(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_REMOVE_LDAP_PUBLIC_CERT) {
c.SetPermissionError(model.PERMISSION_REMOVE_LDAP_PUBLIC_CERT)
return
}
@@ -385,8 +385,8 @@ func removeLdapPublicCertificate(c *Context, w http.ResponseWriter, r *http.Requ
}
func removeLdapPrivateCertificate(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_REMOVE_LDAP_PRIVATE_CERT) {
c.SetPermissionError(model.PERMISSION_REMOVE_LDAP_PRIVATE_CERT)
return
}

18
api4/license.go
Просмотреть файл

@@ -38,7 +38,7 @@ func getClientLicense(c *Context, w http.ResponseWriter, r *http.Request) {
var clientLicense map[string]string
if c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_READ_ABOUT) {
if c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_READ_LICENSE_INFORMATION) {
clientLicense = c.App.Srv().ClientLicense()
} else {
clientLicense = c.App.Srv().GetSanitizedClientLicense()
@@ -52,8 +52,8 @@ func addLicense(c *Context, w http.ResponseWriter, r *http.Request) {
defer c.LogAuditRec(auditRec)
c.LogAudit("attempt")
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_ABOUT) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_ABOUT)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_LICENSE_INFORMATION) {
c.SetPermissionError(model.PERMISSION_MANAGE_LICENSE_INFORMATION)
return
}
@@ -118,8 +118,8 @@ func removeLicense(c *Context, w http.ResponseWriter, r *http.Request) {
defer c.LogAuditRec(auditRec)
c.LogAudit("attempt")
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_ABOUT) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_ABOUT)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_LICENSE_INFORMATION) {
c.SetPermissionError(model.PERMISSION_MANAGE_LICENSE_INFORMATION)
return
}
@@ -144,8 +144,8 @@ func requestTrialLicense(c *Context, w http.ResponseWriter, r *http.Request) {
defer c.LogAuditRec(auditRec)
c.LogAudit("attempt")
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_ABOUT) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_ABOUT)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_LICENSE_INFORMATION) {
c.SetPermissionError(model.PERMISSION_MANAGE_LICENSE_INFORMATION)
return
}
@@ -213,8 +213,8 @@ func requestRenewalLink(c *Context, w http.ResponseWriter, r *http.Request) {
defer c.LogAuditRec(auditRec)
c.LogAudit("attempt")
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_ABOUT) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_ABOUT)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_LICENSE_INFORMATION) {
c.SetPermissionError(model.PERMISSION_MANAGE_LICENSE_INFORMATION)
return
}

5
api4/role.go
Просмотреть файл

@@ -162,6 +162,11 @@ func patchRole(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
}
ancillaryPermissions := model.AddAncillaryPermissions(*patch.Permissions)
*patch.Permissions = append(*patch.Permissions, ancillaryPermissions...)
*patch.Permissions = model.UniqueStrings(*patch.Permissions)
}
if c.App.Srv().License() != nil && isGuest && !*c.App.Srv().License().Features.GuestAccountsPermissions {

32
api4/saml.go
Просмотреть файл

@@ -62,8 +62,8 @@ func parseSamlCertificateRequest(r *http.Request, maxFileSize int64) (*multipart
}
func addSamlPublicCertificate(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_ADD_SAML_PUBLIC_CERT) {
c.SetPermissionError(model.PERMISSION_ADD_SAML_PUBLIC_CERT)
return
}
@@ -86,8 +86,8 @@ func addSamlPublicCertificate(c *Context, w http.ResponseWriter, r *http.Request
}
func addSamlPrivateCertificate(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_ADD_SAML_PRIVATE_CERT) {
c.SetPermissionError(model.PERMISSION_ADD_SAML_PRIVATE_CERT)
return
}
@@ -110,8 +110,8 @@ func addSamlPrivateCertificate(c *Context, w http.ResponseWriter, r *http.Reques
}
func addSamlIdpCertificate(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_ADD_SAML_IDP_CERT) {
c.SetPermissionError(model.PERMISSION_ADD_SAML_IDP_CERT)
return
}
@@ -163,8 +163,8 @@ func addSamlIdpCertificate(c *Context, w http.ResponseWriter, r *http.Request) {
}
func removeSamlPublicCertificate(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_REMOVE_SAML_PUBLIC_CERT) {
c.SetPermissionError(model.PERMISSION_REMOVE_SAML_PUBLIC_CERT)
return
}
@@ -181,8 +181,8 @@ func removeSamlPublicCertificate(c *Context, w http.ResponseWriter, r *http.Requ
}
func removeSamlPrivateCertificate(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_REMOVE_SAML_PRIVATE_CERT) {
c.SetPermissionError(model.PERMISSION_REMOVE_SAML_PRIVATE_CERT)
return
}
@@ -199,8 +199,8 @@ func removeSamlPrivateCertificate(c *Context, w http.ResponseWriter, r *http.Req
}
func removeSamlIdpCertificate(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_REMOVE_SAML_IDP_CERT) {
c.SetPermissionError(model.PERMISSION_REMOVE_SAML_IDP_CERT)
return
}
@@ -217,8 +217,8 @@ func removeSamlIdpCertificate(c *Context, w http.ResponseWriter, r *http.Request
}
func getSamlCertificateStatus(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_GET_SAML_CERT_STATUS) {
c.SetPermissionError(model.PERMISSION_GET_SAML_CERT_STATUS)
return
}
@@ -227,8 +227,8 @@ func getSamlCertificateStatus(c *Context, w http.ResponseWriter, r *http.Request
}
func getSamlMetadataFromIdp(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_GET_SAML_METADATA_FROM_IDP) {
c.SetPermissionError(model.PERMISSION_GET_SAML_METADATA_FROM_IDP)
return
}

41
api4/system.go
Просмотреть файл

@@ -195,8 +195,8 @@ func testEmail(c *Context, w http.ResponseWriter, r *http.Request) {
cfg = c.App.Config()
}
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_TEST_EMAIL) {
c.SetPermissionError(model.PERMISSION_TEST_EMAIL)
return
}
@@ -215,8 +215,8 @@ func testEmail(c *Context, w http.ResponseWriter, r *http.Request) {
}
func testSiteURL(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_TEST_SITE_URL) {
c.SetPermissionError(model.PERMISSION_TEST_SITE_URL)
return
}
@@ -232,11 +232,6 @@ func testSiteURL(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT) && siteURL != *c.App.Config().ServiceSettings.SiteURL {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT)
return
}
err := c.App.TestSiteURL(siteURL)
if err != nil {
c.Err = err
@@ -250,8 +245,8 @@ func getAudits(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("getAudits", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_READ_COMPLIANCE) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_READ_COMPLIANCE)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_READ_AUDITS) {
c.SetPermissionError(model.PERMISSION_READ_AUDITS)
return
}
@@ -269,8 +264,8 @@ func getAudits(c *Context, w http.ResponseWriter, r *http.Request) {
}
func databaseRecycle(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_RECYCLE_DATABASE_CONNECTIONS) {
c.SetPermissionError(model.PERMISSION_RECYCLE_DATABASE_CONNECTIONS)
return
}
@@ -289,8 +284,8 @@ func databaseRecycle(c *Context, w http.ResponseWriter, r *http.Request) {
}
func invalidateCaches(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_INVALIDATE_CACHES) {
c.SetPermissionError(model.PERMISSION_INVALIDATE_CACHES)
return
}
@@ -323,8 +318,8 @@ func getLogs(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_READ_REPORTING) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_READ_REPORTING)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_GET_LOGS) {
c.SetPermissionError(model.PERMISSION_GET_LOGS)
return
}
@@ -386,12 +381,8 @@ func getAnalytics(c *Context, w http.ResponseWriter, r *http.Request) {
name = "standard"
}
permissions := []*model.Permission{
model.PERMISSION_SYSCONSOLE_READ_REPORTING,
model.PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_USERS,
}
if !c.App.SessionHasPermissionToAny(*c.App.Session(), permissions) {
c.SetPermissionError(permissions...)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_GET_ANALYTICS) {
c.SetPermissionError(model.PERMISSION_GET_ANALYTICS)
return
}
@@ -430,8 +421,8 @@ func testS3(c *Context, w http.ResponseWriter, r *http.Request) {
cfg = c.App.Config()
}
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_TEST_S3) {
c.SetPermissionError(model.PERMISSION_TEST_S3)
return
}

4
api4/team.go
Просмотреть файл

@@ -1396,8 +1396,8 @@ func getInviteInfo(c *Context, w http.ResponseWriter, r *http.Request) {
}
func invalidateAllEmailInvites(c *Context, w http.ResponseWriter, r *http.Request) {
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) {
c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_INVALIDATE_EMAIL_INVITE) {
c.SetPermissionError(model.PERMISSION_INVALIDATE_EMAIL_INVITE)
return
}

4
api4/team_test.go
Просмотреть файл

@@ -3321,8 +3321,8 @@ func TestInvalidateAllEmailInvites(t *testing.T) {
})
t.Run("OK when request performed by system user with requisite system permission", func(t *testing.T) {
th.AddPermissionToRole(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION.Id, model.SYSTEM_USER_ROLE_ID)
defer th.RemovePermissionFromRole(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION.Id, model.SYSTEM_USER_ROLE_ID)
th.AddPermissionToRole(model.PERMISSION_INVALIDATE_EMAIL_INVITE.Id, model.SYSTEM_USER_ROLE_ID)
defer th.RemovePermissionFromRole(model.PERMISSION_INVALIDATE_EMAIL_INVITE.Id, model.SYSTEM_USER_ROLE_ID)
ok, res := th.Client.InvalidateEmailInvites()
require.Equal(t, true, ok)
CheckOKStatus(t, res)