All Sections to SubSections (#16917)

* initial * Revert "initial" This reverts commit 3d631aeecdc2324cd5d17c0ecdc431a8ccc15060. * [MM-32352] Add Experimental Subsections BACKEND (#16887) Automatic Merge * update appiface * Fix app layers * Ancillary Permissions on backend (#17061) Automatic Merge * [MM-32799] Add About Section (#17015) * Add About Section * add mock key * Update role.go * Update role.go Co-authored-by: Mattermod <mattermod@users.noreply.github.com> * [MM-33437] Fix config access tags for experimental settings (#17111) Automatic Merge * [MM-32794] Reporting Sub Section (#17035) * test * revert * add permissions * add new permission stuff * add store mock * fix bad merge * gofmt fix Co-authored-by: Mattermod <mattermod@users.noreply.github.com> * [MM-32343] Environment SubSection (#17054) * pre-checkout commit * fix permission for testSiteURL * pre-merge commit * increase size of Permissions column in Roles table * add entry for ENVIRONMENT to testlib/store.go * use TEXT for Permissions column in Roles table * use environment subsection permissions for API endpoints * use subsections permissions for /config/environment * add suggestions from hahmadia * update tests to use subsection permissions * add permissions column back in * comment out code in upgradeDatabaseToVersion534 Co-authored-by: Mattermod <mattermod@users.noreply.github.com> Co-authored-by: Scott Bishel <scott.bishel@mattermost.com> * MM-32351: Add Compliance Subsections (#17023) * add subsections for compliance sectin * add to mock functions * updates for read job * fixes * fix test * update tests * update tests * another test fix * some cleanup * update mlog * fix linting * Fix bad merges Co-authored-by: Mattermod <mattermod@users.noreply.github.com> Co-authored-by: Hossein <hahmadia@users.noreply.github.com> Co-authored-by: Hossein Ahmadian-Yazdi <hyazdi1997@gmail.com> * MM-32347 Site Subsections (#17095) * Init * Added migration key in testlib store * Fix syntax error * fix bad merge * fix lint Co-authored-by: Mattermod <mattermod@users.noreply.github.com> Co-authored-by: Scott Bishel <scott.bishel@mattermost.com> * MM-32350 Integrations (#17097) * implement server subsections * fix tests * update test * go fmt Co-authored-by: Hossein Ahmadian-Yazdi <hyazdi1997@gmail.com> * patch forgotten endpoints * Adding subsection permissions for Authentication (#17087) * adding new permissions, migrations to do * permission migrations and ancilary permissions * running make app-layers * fixing tests and lint * adding permissions to saml * ldap write permissions * running make app-layers * fixing conflict * making app layers * clean up and fix tests * change job type * fix js error, if site url not returned Co-authored-by: Benjamin Cooke <benjamincooke@Benjamins-MacBook-Pro.local> Co-authored-by: Hossein Ahmadian-Yazdi <hyazdi1997@gmail.com> Co-authored-by: Mattermod <mattermod@users.noreply.github.com> Co-authored-by: Scott Bishel <scott.bishel@mattermost.com> * Update permissions_migrations.go * gofmt * upgrade to 535 * gofmt Co-authored-by: Mattermod <mattermod@users.noreply.github.com> Co-authored-by: Max Erenberg <max.erenberg@mattermost.com> Co-authored-by: Scott Bishel <scott.bishel@mattermost.com> Co-authored-by: Anurag Shivarathri <anurag6713@gmail.com> Co-authored-by: Ben Cooke <benkcooke@gmail.com> Co-authored-by: Benjamin Cooke <benjamincooke@Benjamins-MacBook-Pro.local>
2021-04-06 10:39:48 -04:00
--- a/app/app_iface.go
+++ b/app/app_iface.go
@@ -14,6 +14,7 @@ import (
 	"mime/multipart"
 	"net/http"
 	"net/url"
+	"reflect"
 	"time"

 	"github.com/dyatlov/go-opengraph/opengraph"
@@ -159,7 +160,8 @@ type AppIface interface {
 	// and the API route for custom ones. Errors if not found or if custom and deleted.
 	GetEmojiStaticUrl(emojiName string) (string, *model.AppError)
 	// GetEnvironmentConfig returns a map of configuration keys whose values have been overridden by an environment variable.
-	GetEnvironmentConfig() map[string]interface{}
+	// If filter is not nil and returns false for a struct field, that field will be omitted.
+	GetEnvironmentConfig(filter func(reflect.StructField) bool) map[string]interface{}
 	// GetFilteredUsersStats is used to get a count of users based on the set of filters supported by UserCountOptions.
 	GetFilteredUsersStats(options *model.UserCountOptions) (*model.UsersStats, *model.AppError)
 	// GetGroupsByTeam returns the paged list and the total count of group associated to the given team.
@@ -511,7 +513,7 @@ type AppIface interface {
 	DoUploadFileExpectModification(now time.Time, rawTeamId string, rawChannelId string, rawUserId string, rawFilename string, data []byte) (*model.FileInfo, []byte, *model.AppError)
 	DownloadFromURL(downloadURL string) ([]byte, error)
 	EnableUserAccessToken(token *model.UserAccessToken) *model.AppError
-	EnvironmentConfig() map[string]interface{}
+	EnvironmentConfig(filter func(reflect.StructField) bool) map[string]interface{}
 	ExportPermissions(w io.Writer) error
 	FetchSamlMetadataFromIdp(url string) ([]byte, *model.AppError)
 	FileBackend() (filestore.FileBackend, *model.AppError)
@@ -615,6 +617,8 @@ type AppIface interface {
 	GetJobs(offset int, limit int) ([]*model.Job, *model.AppError)
 	GetJobsByType(jobType string, offset int, limit int) ([]*model.Job, *model.AppError)
 	GetJobsByTypePage(jobType string, page int, perPage int) ([]*model.Job, *model.AppError)
+	GetJobsByTypes(jobTypes []string, offset int, limit int) ([]*model.Job, *model.AppError)
+	GetJobsByTypesPage(jobType []string, page int, perPage int) ([]*model.Job, *model.AppError)
 	GetJobsPage(page int, perPage int) ([]*model.Job, *model.AppError)
 	GetLatestTermsOfService() (*model.TermsOfService, *model.AppError)
 	GetLogs(page, perPage int) ([]string, *model.AppError)
@@ -948,6 +952,8 @@ type AppIface interface {
 	SessionHasPermissionToCategory(session model.Session, userID, teamID, categoryId string) bool
 	SessionHasPermissionToChannel(session model.Session, channelID string, permission *model.Permission) bool
 	SessionHasPermissionToChannelByPost(session model.Session, postID string, permission *model.Permission) bool
+	SessionHasPermissionToCreateJob(session model.Session, job *model.Job) (bool, *model.Permission)
+	SessionHasPermissionToReadJob(session model.Session, jobType string) (bool, *model.Permission)
 	SessionHasPermissionToTeam(session model.Session, teamID string, permission *model.Permission) bool
 	SessionHasPermissionToUser(session model.Session, userID string) bool
 	SessionHasPermissionToUserOrBot(session model.Session, userID string) bool
--- a/app/config.go
+++ b/app/config.go
@@ -14,6 +14,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"reflect"
 	"strconv"
 	"time"

@@ -38,12 +39,12 @@ func (a *App) Config() *model.Config {
 	return a.Srv().Config()
 }

-func (s *Server) EnvironmentConfig() map[string]interface{} {
-	return s.configStore.GetEnvironmentOverrides()
+func (s *Server) EnvironmentConfig(filter func(reflect.StructField) bool) map[string]interface{} {
+	return s.configStore.GetEnvironmentOverridesWithFilter(filter)
 }

-func (a *App) EnvironmentConfig() map[string]interface{} {
-	return a.Srv().EnvironmentConfig()
+func (a *App) EnvironmentConfig(filter func(reflect.StructField) bool) map[string]interface{} {
+	return a.Srv().EnvironmentConfig(filter)
 }

 func (s *Server) UpdateConfig(f func(*model.Config)) {
@@ -398,8 +399,9 @@ func (a *App) GetSanitizedConfig() *model.Config {
 }

 // GetEnvironmentConfig returns a map of configuration keys whose values have been overridden by an environment variable.
-func (a *App) GetEnvironmentConfig() map[string]interface{} {
-	return a.EnvironmentConfig()
+// If filter is not nil and returns false for a struct field, that field will be omitted.
+func (a *App) GetEnvironmentConfig(filter func(reflect.StructField) bool) map[string]interface{} {
+	return a.EnvironmentConfig(filter)
 }

 // SaveConfig replaces the active configuration, optionally notifying cluster peers.
--- a/app/job.go
+++ b/app/job.go
@@ -52,6 +52,18 @@ func (a *App) GetJobsByType(jobType string, offset int, limit int) ([]*model.Job
 	return jobs, nil
 }

+func (a *App) GetJobsByTypesPage(jobType []string, page int, perPage int) ([]*model.Job, *model.AppError) {
+	return a.GetJobsByTypes(jobType, page*perPage, perPage)
+}
+
+func (a *App) GetJobsByTypes(jobTypes []string, offset int, limit int) ([]*model.Job, *model.AppError) {
+	jobs, err := a.Srv().Store.Job().GetAllByTypesPage(jobTypes, offset, limit)
+	if err != nil {
+		return nil, model.NewAppError("GetJobsByType", "app.job.get_all.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+	return jobs, nil
+}
+
 func (a *App) CreateJob(job *model.Job) (*model.Job, *model.AppError) {
 	return a.Srv().Jobs.CreateJob(job.Type, job.Data)
 }
@@ -59,3 +71,64 @@ func (a *App) CreateJob(job *model.Job) (*model.Job, *model.AppError) {
 func (a *App) CancelJob(jobId string) *model.AppError {
 	return a.Srv().Jobs.RequestCancellation(jobId)
 }
+
+func (a *App) SessionHasPermissionToCreateJob(session model.Session, job *model.Job) (bool, *model.Permission) {
+	switch job.Type {
+	case model.JOB_TYPE_BLEVE_POST_INDEXING:
+		return a.SessionHasPermissionTo(session, model.PERMISSION_CREATE_POST_BLEVE_INDEXES_JOB), model.PERMISSION_CREATE_POST_BLEVE_INDEXES_JOB
+	case model.JOB_TYPE_DATA_RETENTION:
+		return a.SessionHasPermissionTo(session, model.PERMISSION_CREATE_DATA_RETENTION_JOB), model.PERMISSION_CREATE_DATA_RETENTION_JOB
+	case model.JOB_TYPE_MESSAGE_EXPORT:
+		return a.SessionHasPermissionTo(session, model.PERMISSION_CREATE_COMPLIANCE_EXPORT_JOB), model.PERMISSION_CREATE_COMPLIANCE_EXPORT_JOB
+	case model.JOB_TYPE_ELASTICSEARCH_POST_INDEXING:
+		return a.SessionHasPermissionTo(session, model.PERMISSION_CREATE_ELASTICSEARCH_POST_INDEXING_JOB), model.PERMISSION_CREATE_ELASTICSEARCH_POST_INDEXING_JOB
+	case model.JOB_TYPE_ELASTICSEARCH_POST_AGGREGATION:
+		return a.SessionHasPermissionTo(session, model.PERMISSION_CREATE_ELASTICSEARCH_POST_AGGREGATION_JOB), model.PERMISSION_CREATE_ELASTICSEARCH_POST_AGGREGATION_JOB
+	case model.JOB_TYPE_LDAP_SYNC:
+		return a.SessionHasPermissionTo(session, model.PERMISSION_CREATE_LDAP_SYNC_JOB), model.PERMISSION_CREATE_LDAP_SYNC_JOB
+	case
+		model.JOB_TYPE_MIGRATIONS,
+		model.JOB_TYPE_PLUGINS,
+		model.JOB_TYPE_PRODUCT_NOTICES,
+		model.JOB_TYPE_EXPIRY_NOTIFY,
+		model.JOB_TYPE_ACTIVE_USERS,
+		model.JOB_TYPE_IMPORT_PROCESS,
+		model.JOB_TYPE_IMPORT_DELETE,
+		model.JOB_TYPE_EXPORT_PROCESS,
+		model.JOB_TYPE_EXPORT_DELETE,
+		model.JOB_TYPE_CLOUD:
+		return a.SessionHasPermissionTo(session, model.PERMISSION_MANAGE_JOBS), model.PERMISSION_MANAGE_JOBS
+	}
+
+	return false, nil
+}
+
+func (a *App) SessionHasPermissionToReadJob(session model.Session, jobType string) (bool, *model.Permission) {
+	switch jobType {
+	case model.JOB_TYPE_DATA_RETENTION:
+		return a.SessionHasPermissionTo(session, model.PERMISSION_READ_DATA_RETENTION_JOB), model.PERMISSION_READ_DATA_RETENTION_JOB
+	case model.JOB_TYPE_MESSAGE_EXPORT:
+		return a.SessionHasPermissionTo(session, model.PERMISSION_READ_COMPLIANCE_EXPORT_JOB), model.PERMISSION_READ_COMPLIANCE_EXPORT_JOB
+	case model.JOB_TYPE_ELASTICSEARCH_POST_INDEXING:
+		return a.SessionHasPermissionTo(session, model.PERMISSION_READ_ELASTICSEARCH_POST_INDEXING_JOB), model.PERMISSION_READ_ELASTICSEARCH_POST_INDEXING_JOB
+	case model.JOB_TYPE_ELASTICSEARCH_POST_AGGREGATION:
+		return a.SessionHasPermissionTo(session, model.PERMISSION_READ_ELASTICSEARCH_POST_AGGREGATION_JOB), model.PERMISSION_READ_ELASTICSEARCH_POST_AGGREGATION_JOB
+	case model.JOB_TYPE_LDAP_SYNC:
+		return a.SessionHasPermissionTo(session, model.PERMISSION_READ_LDAP_SYNC_JOB), model.PERMISSION_READ_LDAP_SYNC_JOB
+	case
+		model.JOB_TYPE_BLEVE_POST_INDEXING,
+		model.JOB_TYPE_MIGRATIONS,
+		model.JOB_TYPE_PLUGINS,
+		model.JOB_TYPE_PRODUCT_NOTICES,
+		model.JOB_TYPE_EXPIRY_NOTIFY,
+		model.JOB_TYPE_ACTIVE_USERS,
+		model.JOB_TYPE_IMPORT_PROCESS,
+		model.JOB_TYPE_IMPORT_DELETE,
+		model.JOB_TYPE_EXPORT_PROCESS,
+		model.JOB_TYPE_EXPORT_DELETE,
+		model.JOB_TYPE_CLOUD:
+		return a.SessionHasPermissionTo(session, model.PERMISSION_READ_JOBS), model.PERMISSION_READ_JOBS
+	}
+
+	return false, nil
+}
--- a/app/job_test.go
+++ b/app/job_test.go
@@ -6,6 +6,7 @@ package app
 import (
 	"testing"

+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

 	"github.com/mattermost/mattermost-server/v5/model"
@@ -29,6 +30,185 @@ func TestGetJob(t *testing.T) {
 	require.Equal(t, status, received, "incorrect job status received")
 }

+func TestSessionHasPermissionToCreateJob(t *testing.T) {
+	th := Setup(t)
+	defer th.TearDown()
+
+	jobs := []model.Job{
+		{
+			Id:       model.NewId(),
+			Type:     model.JOB_TYPE_BLEVE_POST_INDEXING,
+			CreateAt: 1000,
+		},
+		{
+			Id:       model.NewId(),
+			Type:     model.JOB_TYPE_DATA_RETENTION,
+			CreateAt: 999,
+		},
+		{
+			Id:       model.NewId(),
+			Type:     model.JOB_TYPE_MESSAGE_EXPORT,
+			CreateAt: 1001,
+		},
+	}
+
+	testCases := []struct {
+		Job                model.Job
+		PermissionRequired *model.Permission
+	}{
+		{
+			Job:                jobs[0],
+			PermissionRequired: model.PERMISSION_CREATE_POST_BLEVE_INDEXES_JOB,
+		},
+		{
+			Job:                jobs[1],
+			PermissionRequired: model.PERMISSION_CREATE_DATA_RETENTION_JOB,
+		},
+		{
+			Job:                jobs[2],
+			PermissionRequired: model.PERMISSION_CREATE_COMPLIANCE_EXPORT_JOB,
+		},
+	}
+
+	session := model.Session{
+		Roles: model.SYSTEM_USER_ROLE_ID + " " + model.SYSTEM_ADMIN_ROLE_ID,
+	}
+
+	// Check to see if admin has permission to all the jobs
+	for _, testCase := range testCases {
+		hasPermission, permissionRequired := th.App.SessionHasPermissionToCreateJob(session, &testCase.Job)
+		assert.Equal(t, true, hasPermission)
+		require.NotNil(t, permissionRequired)
+		assert.Equal(t, testCase.PermissionRequired.Id, permissionRequired.Id)
+	}
+
+	session = model.Session{
+		Roles: model.SYSTEM_USER_ROLE_ID + " " + model.SYSTEM_READ_ONLY_ADMIN_ROLE_ID,
+	}
+
+	// Initially the system read only admin should not have access to create these jobs
+	for _, testCase := range testCases {
+		hasPermission, permissionRequired := th.App.SessionHasPermissionToCreateJob(session, &testCase.Job)
+		assert.Equal(t, false, hasPermission)
+		require.NotNil(t, permissionRequired)
+		assert.Equal(t, testCase.PermissionRequired.Id, permissionRequired.Id)
+	}
+
+	role, _ := th.App.GetRoleByName(model.SYSTEM_READ_ONLY_ADMIN_ROLE_ID)
+
+	role.Permissions = append(role.Permissions, model.PERMISSION_CREATE_POST_BLEVE_INDEXES_JOB.Id)
+
+	_, err := th.App.UpdateRole(role)
+	require.Nil(t, err)
+
+	// Now system read only admin should have ability to create a Belve Post Index job but not the others
+	for _, testCase := range testCases {
+		hasPermission, permissionRequired := th.App.SessionHasPermissionToCreateJob(session, &testCase.Job)
+		expectedHasPermission := testCase.Job.Type == model.JOB_TYPE_BLEVE_POST_INDEXING
+		assert.Equal(t, expectedHasPermission, hasPermission)
+		require.NotNil(t, permissionRequired)
+		assert.Equal(t, testCase.PermissionRequired.Id, permissionRequired.Id)
+	}
+
+	role.Permissions = append(role.Permissions, model.PERMISSION_CREATE_DATA_RETENTION_JOB.Id)
+	role.Permissions = append(role.Permissions, model.PERMISSION_CREATE_COMPLIANCE_EXPORT_JOB.Id)
+
+	_, err = th.App.UpdateRole(role)
+	require.Nil(t, err)
+
+	// Now system read only admin should have ability to create all jobs
+	for _, testCase := range testCases {
+		hasPermission, permissionRequired := th.App.SessionHasPermissionToCreateJob(session, &testCase.Job)
+		assert.Equal(t, true, hasPermission)
+		require.NotNil(t, permissionRequired)
+		assert.Equal(t, testCase.PermissionRequired.Id, permissionRequired.Id)
+	}
+}
+
+func TestSessionHasPermissionToReadJob(t *testing.T) {
+	th := Setup(t)
+	defer th.TearDown()
+
+	jobs := []model.Job{
+		{
+			Id:       model.NewId(),
+			Type:     model.JOB_TYPE_DATA_RETENTION,
+			CreateAt: 999,
+		},
+		{
+			Id:       model.NewId(),
+			Type:     model.JOB_TYPE_MESSAGE_EXPORT,
+			CreateAt: 1001,
+		},
+	}
+	testCases := []struct {
+		Job                model.Job
+		PermissionRequired *model.Permission
+	}{
+		{
+			Job:                jobs[0],
+			PermissionRequired: model.PERMISSION_READ_DATA_RETENTION_JOB,
+		},
+		{
+			Job:                jobs[1],
+			PermissionRequired: model.PERMISSION_READ_COMPLIANCE_EXPORT_JOB,
+		},
+	}
+
+	session := model.Session{
+		Roles: model.SYSTEM_USER_ROLE_ID + " " + model.SYSTEM_ADMIN_ROLE_ID,
+	}
+
+	// Check to see if admin has permission to all the jobs
+	for _, testCase := range testCases {
+		hasPermission, permissionRequired := th.App.SessionHasPermissionToReadJob(session, testCase.Job.Type)
+		assert.Equal(t, true, hasPermission)
+		require.NotNil(t, permissionRequired)
+		assert.Equal(t, testCase.PermissionRequired.Id, permissionRequired.Id)
+	}
+
+	session = model.Session{
+		Roles: model.SYSTEM_USER_ROLE_ID + " " + model.SYSTEM_MANAGER_ROLE_ID,
+	}
+
+	// Initially the system manager should not have access to read these jobs
+	for _, testCase := range testCases {
+		hasPermission, permissionRequired := th.App.SessionHasPermissionToReadJob(session, testCase.Job.Type)
+		assert.Equal(t, false, hasPermission)
+		require.NotNil(t, permissionRequired)
+		assert.Equal(t, testCase.PermissionRequired.Id, permissionRequired.Id)
+	}
+
+	role, _ := th.App.GetRoleByName(model.SYSTEM_MANAGER_ROLE_ID)
+
+	role.Permissions = append(role.Permissions, model.PERMISSION_READ_DATA_RETENTION_JOB.Id)
+
+	_, err := th.App.UpdateRole(role)
+	require.Nil(t, err)
+
+	// Now system manager should have ability to read data retention jobs
+	for _, testCase := range testCases {
+		hasPermission, permissionRequired := th.App.SessionHasPermissionToReadJob(session, testCase.Job.Type)
+		expectedHasPermission := testCase.Job.Type == model.JOB_TYPE_DATA_RETENTION
+		assert.Equal(t, expectedHasPermission, hasPermission)
+		require.NotNil(t, permissionRequired)
+		assert.Equal(t, testCase.PermissionRequired.Id, permissionRequired.Id)
+	}
+
+	role.Permissions = append(role.Permissions, model.PERMISSION_READ_COMPLIANCE_EXPORT_JOB.Id)
+
+	_, err = th.App.UpdateRole(role)
+	require.Nil(t, err)
+
+	// Now system read only admin should have ability to create all jobs
+	for _, testCase := range testCases {
+		hasPermission, permissionRequired := th.App.SessionHasPermissionToReadJob(session, testCase.Job.Type)
+		assert.Equal(t, true, hasPermission)
+		require.NotNil(t, permissionRequired)
+		assert.Equal(t, testCase.PermissionRequired.Id, permissionRequired.Id)
+	}
+}
+
 func TestGetJobByType(t *testing.T) {
 	th := Setup(t)
 	defer th.TearDown()
@@ -70,3 +250,55 @@ func TestGetJobByType(t *testing.T) {
 	require.Len(t, received, 1, "received wrong number of statuses")
 	require.Equal(t, statuses[1], received[0], "should've received oldest job last")
 }
+
+func TestGetJobsByTypes(t *testing.T) {
+	th := Setup(t)
+	defer th.TearDown()
+
+	jobType := model.NewId()
+	jobType1 := model.NewId()
+	jobType2 := model.NewId()
+
+	statuses := []*model.Job{
+		{
+			Id:       model.NewId(),
+			Type:     jobType,
+			CreateAt: 1000,
+		},
+		{
+			Id:       model.NewId(),
+			Type:     jobType1,
+			CreateAt: 999,
+		},
+		{
+			Id:       model.NewId(),
+			Type:     jobType2,
+			CreateAt: 1001,
+		},
+	}
+
+	for _, status := range statuses {
+		_, err := th.App.Srv().Store.Job().Save(status)
+		require.NoError(t, err)
+		defer th.App.Srv().Store.Job().Delete(status.Id)
+	}
+
+	jobTypes := []string{jobType, jobType1, jobType2}
+	received, err := th.App.GetJobsByTypes(jobTypes, 0, 2)
+	require.Nil(t, err)
+	require.Len(t, received, 2, "received wrong number of jobs")
+	require.Equal(t, statuses[2], received[0], "should've received newest job first")
+	require.Equal(t, statuses[0], received[1], "should've received second newest job second")
+
+	received, err = th.App.GetJobsByTypes(jobTypes, 2, 2)
+	require.Nil(t, err)
+	require.Len(t, received, 1, "received wrong number of jobs")
+	require.Equal(t, statuses[1], received[0], "should've received oldest job last")
+
+	jobTypes = []string{jobType1, jobType2}
+	received, err = th.App.GetJobsByTypes(jobTypes, 0, 3)
+	require.Nil(t, err)
+	require.Len(t, received, 2, "received wrong number of jobs")
+	require.Equal(t, statuses[2], received[0], "received wrong job type")
+	require.Equal(t, statuses[1], received[1], "received wrong job type")
+}
--- a/app/opentracing/opentracing_layer.go
+++ b/app/opentracing/opentracing_layer.go
@@ -14,6 +14,7 @@ import (
 	"mime/multipart"
 	"net/http"
 	"net/url"
+	"reflect"
 	"time"

 	"github.com/dyatlov/go-opengraph/opengraph"
@@ -3714,7 +3715,7 @@ func (a *OpenTracingAppLayer) EnableUserAccessToken(token *model.UserAccessToken
 	return resultVar0
 }

-func (a *OpenTracingAppLayer) EnvironmentConfig() map[string]interface{} {
+func (a *OpenTracingAppLayer) EnvironmentConfig(filter func(reflect.StructField) bool) map[string]interface{} {
 	origCtx := a.ctx
 	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.EnvironmentConfig")

@@ -3726,7 +3727,7 @@ func (a *OpenTracingAppLayer) EnvironmentConfig() map[string]interface{} {
 	}()

 	defer span.Finish()
-	resultVar0 := a.app.EnvironmentConfig()
+	resultVar0 := a.app.EnvironmentConfig(filter)

 	return resultVar0
 }
@@ -5541,7 +5542,7 @@ func (a *OpenTracingAppLayer) GetEmojiStaticUrl(emojiName string) (string, *mode
 	return resultVar0, resultVar1
 }

-func (a *OpenTracingAppLayer) GetEnvironmentConfig() map[string]interface{} {
+func (a *OpenTracingAppLayer) GetEnvironmentConfig(filter func(reflect.StructField) bool) map[string]interface{} {
 	origCtx := a.ctx
 	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.GetEnvironmentConfig")

@@ -5553,7 +5554,7 @@ func (a *OpenTracingAppLayer) GetEnvironmentConfig() map[string]interface{} {
 	}()

 	defer span.Finish()
-	resultVar0 := a.app.GetEnvironmentConfig()
+	resultVar0 := a.app.GetEnvironmentConfig(filter)

 	return resultVar0
 }
@@ -6345,6 +6346,50 @@ func (a *OpenTracingAppLayer) GetJobsByTypePage(jobType string, page int, perPag
 	return resultVar0, resultVar1
 }

+func (a *OpenTracingAppLayer) GetJobsByTypes(jobTypes []string, offset int, limit int) ([]*model.Job, *model.AppError) {
+	origCtx := a.ctx
+	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.GetJobsByTypes")
+
+	a.ctx = newCtx
+	a.app.Srv().Store.SetContext(newCtx)
+	defer func() {
+		a.app.Srv().Store.SetContext(origCtx)
+		a.ctx = origCtx
+	}()
+
+	defer span.Finish()
+	resultVar0, resultVar1 := a.app.GetJobsByTypes(jobTypes, offset, limit)
+
+	if resultVar1 != nil {
+		span.LogFields(spanlog.Error(resultVar1))
+		ext.Error.Set(span, true)
+	}
+
+	return resultVar0, resultVar1
+}
+
+func (a *OpenTracingAppLayer) GetJobsByTypesPage(jobType []string, page int, perPage int) ([]*model.Job, *model.AppError) {
+	origCtx := a.ctx
+	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.GetJobsByTypesPage")
+
+	a.ctx = newCtx
+	a.app.Srv().Store.SetContext(newCtx)
+	defer func() {
+		a.app.Srv().Store.SetContext(origCtx)
+		a.ctx = origCtx
+	}()
+
+	defer span.Finish()
+	resultVar0, resultVar1 := a.app.GetJobsByTypesPage(jobType, page, perPage)
+
+	if resultVar1 != nil {
+		span.LogFields(spanlog.Error(resultVar1))
+		ext.Error.Set(span, true)
+	}
+
+	return resultVar0, resultVar1
+}
+
 func (a *OpenTracingAppLayer) GetJobsPage(page int, perPage int) ([]*model.Job, *model.AppError) {
 	origCtx := a.ctx
 	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.GetJobsPage")
@@ -14053,6 +14098,23 @@ func (a *OpenTracingAppLayer) SessionHasPermissionToChannelByPost(session model.
 	return resultVar0
 }

+func (a *OpenTracingAppLayer) SessionHasPermissionToCreateJob(session model.Session, job *model.Job) (bool, *model.Permission) {
+	origCtx := a.ctx
+	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.SessionHasPermissionToCreateJob")
+
+	a.ctx = newCtx
+	a.app.Srv().Store.SetContext(newCtx)
+	defer func() {
+		a.app.Srv().Store.SetContext(origCtx)
+		a.ctx = origCtx
+	}()
+
+	defer span.Finish()
+	resultVar0, resultVar1 := a.app.SessionHasPermissionToCreateJob(session, job)
+
+	return resultVar0, resultVar1
+}
+
 func (a *OpenTracingAppLayer) SessionHasPermissionToManageBot(session model.Session, botUserId string) *model.AppError {
 	origCtx := a.ctx
 	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.SessionHasPermissionToManageBot")
@@ -14075,6 +14137,23 @@ func (a *OpenTracingAppLayer) SessionHasPermissionToManageBot(session model.Sess
 	return resultVar0
 }

+func (a *OpenTracingAppLayer) SessionHasPermissionToReadJob(session model.Session, jobType string) (bool, *model.Permission) {
+	origCtx := a.ctx
+	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.SessionHasPermissionToReadJob")
+
+	a.ctx = newCtx
+	a.app.Srv().Store.SetContext(newCtx)
+	defer func() {
+		a.app.Srv().Store.SetContext(origCtx)
+		a.ctx = origCtx
+	}()
+
+	defer span.Finish()
+	resultVar0, resultVar1 := a.app.SessionHasPermissionToReadJob(session, jobType)
+
+	return resultVar0, resultVar1
+}
+
 func (a *OpenTracingAppLayer) SessionHasPermissionToTeam(session model.Session, teamID string, permission *model.Permission) bool {
 	origCtx := a.ctx
 	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.SessionHasPermissionToTeam")
--- a/app/permissions_migrations.go
+++ b/app/permissions_migrations.go
@@ -537,7 +537,7 @@ func (a *App) getAddManageRemoteClustersPermissionsMigration() (permissionsMap,
 func (a *App) getAddDownloadComplianceExportResult() (permissionsMap, error) {
 	transformations := []permissionTransformation{}

-	permissionsToAddComplianceRead := []string{model.PERMISSION_DOWNLOAD_COMPLIANCE_EXPORT_RESULT.Id, model.PERMISSION_READ_JOBS.Id}
+	permissionsToAddComplianceRead := []string{model.PERMISSION_DOWNLOAD_COMPLIANCE_EXPORT_RESULT.Id, model.PERMISSION_READ_DATA_RETENTION_JOB.Id}
 	permissionsToAddComplianceWrite := []string{model.PERMISSION_MANAGE_JOBS.Id}

 	// add the new permissions to system admin
@@ -562,6 +562,350 @@ func (a *App) getAddDownloadComplianceExportResult() (permissionsMap, error) {
 	return transformations, nil
 }

+func (a *App) getAddExperimentalSubsectionPermissions() (permissionsMap, error) {
+	transformations := []permissionTransformation{}
+
+	permissionsExperimentalRead := []string{model.PERMISSION_SYSCONSOLE_READ_EXPERIMENTAL_BLEVE.Id, model.PERMISSION_SYSCONSOLE_READ_EXPERIMENTAL_FEATURES.Id, model.PERMISSION_SYSCONSOLE_READ_EXPERIMENTAL_FEATURE_FLAGS.Id}
+	permissionsExperimentalWrite := []string{model.PERMISSION_SYSCONSOLE_WRITE_EXPERIMENTAL_BLEVE.Id, model.PERMISSION_SYSCONSOLE_WRITE_EXPERIMENTAL_FEATURES.Id, model.PERMISSION_SYSCONSOLE_WRITE_EXPERIMENTAL_FEATURE_FLAGS.Id}
+
+	// Give the new subsection READ permissions to any user with READ_EXPERIMENTAL
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PERMISSION_SYSCONSOLE_READ_EXPERIMENTAL.Id),
+		Add:    permissionsExperimentalRead,
+		Remove: []string{model.PERMISSION_SYSCONSOLE_READ_EXPERIMENTAL.Id},
+	})
+
+	// Give the new subsection WRITE permissions to any user with WRITE_EXPERIMENTAL
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_EXPERIMENTAL.Id),
+		Add:    permissionsExperimentalWrite,
+		Remove: []string{model.PERMISSION_SYSCONSOLE_WRITE_EXPERIMENTAL.Id},
+	})
+
+	// Give the ancillary permissions MANAGE_JOBS and PURGE_BLEVE_INDEXES to anyone with WRITE_EXPERIMENTAL_BLEVE
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_EXPERIMENTAL_BLEVE.Id),
+		Add: []string{model.PERMISSION_CREATE_POST_BLEVE_INDEXES_JOB.Id, model.PERMISSION_PURGE_BLEVE_INDEXES.Id},
+	})
+
+	return transformations, nil
+}
+
+func (a *App) getAddIntegrationsSubsectionPermissions() (permissionsMap, error) {
+	transformations := []permissionTransformation{}
+
+	permissionsIntegrationsRead := []string{model.PERMISSION_SYSCONSOLE_READ_INTEGRATIONS_INTEGRATION_MANAGEMENT.Id, model.PERMISSION_SYSCONSOLE_READ_INTEGRATIONS_BOT_ACCOUNTS.Id, model.PERMISSION_SYSCONSOLE_READ_INTEGRATIONS_GIF.Id, model.PERMISSION_SYSCONSOLE_READ_INTEGRATIONS_CORS.Id}
+	permissionsIntegrationsWrite := []string{model.PERMISSION_SYSCONSOLE_WRITE_INTEGRATIONS_INTEGRATION_MANAGEMENT.Id, model.PERMISSION_SYSCONSOLE_WRITE_INTEGRATIONS_BOT_ACCOUNTS.Id, model.PERMISSION_SYSCONSOLE_WRITE_INTEGRATIONS_GIF.Id, model.PERMISSION_SYSCONSOLE_WRITE_INTEGRATIONS_CORS.Id}
+
+	// Give the new subsection READ permissions to any user with READ_INTEGRATIONS
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PERMISSION_SYSCONSOLE_READ_INTEGRATIONS.Id),
+		Add:    permissionsIntegrationsRead,
+		Remove: []string{model.PERMISSION_SYSCONSOLE_READ_INTEGRATIONS.Id},
+	})
+
+	// Give the new subsection WRITE permissions to any user with WRITE_EXPERIMENTAL
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_INTEGRATIONS.Id),
+		Add:    permissionsIntegrationsWrite,
+		Remove: []string{model.PERMISSION_SYSCONSOLE_WRITE_INTEGRATIONS.Id},
+	})
+
+	return transformations, nil
+}
+
+func (a *App) getAddSiteSubsectionPermissions() (permissionsMap, error) {
+	transformations := []permissionTransformation{}
+
+	permissionsSiteRead := []string{model.PERMISSION_SYSCONSOLE_READ_SITE_CUSTOMIZATION.Id, model.PERMISSION_SYSCONSOLE_READ_SITE_LOCALIZATION.Id, model.PERMISSION_SYSCONSOLE_READ_SITE_USERS_AND_TEAMS.Id, model.PERMISSION_SYSCONSOLE_READ_SITE_NOTIFICATIONS.Id, model.PERMISSION_SYSCONSOLE_READ_SITE_ANNOUNCEMENT_BANNER.Id, model.PERMISSION_SYSCONSOLE_READ_SITE_EMOJI.Id, model.PERMISSION_SYSCONSOLE_READ_SITE_POSTS.Id, model.PERMISSION_SYSCONSOLE_READ_SITE_FILE_SHARING_AND_DOWNLOADS.Id, model.PERMISSION_SYSCONSOLE_READ_SITE_PUBLIC_LINKS.Id, model.PERMISSION_SYSCONSOLE_READ_SITE_NOTICES.Id}
+	permissionsSiteWrite := []string{model.PERMISSION_SYSCONSOLE_WRITE_SITE_CUSTOMIZATION.Id, model.PERMISSION_SYSCONSOLE_WRITE_SITE_LOCALIZATION.Id, model.PERMISSION_SYSCONSOLE_WRITE_SITE_USERS_AND_TEAMS.Id, model.PERMISSION_SYSCONSOLE_WRITE_SITE_NOTIFICATIONS.Id, model.PERMISSION_SYSCONSOLE_WRITE_SITE_ANNOUNCEMENT_BANNER.Id, model.PERMISSION_SYSCONSOLE_WRITE_SITE_EMOJI.Id, model.PERMISSION_SYSCONSOLE_WRITE_SITE_POSTS.Id, model.PERMISSION_SYSCONSOLE_WRITE_SITE_FILE_SHARING_AND_DOWNLOADS.Id, model.PERMISSION_SYSCONSOLE_WRITE_SITE_PUBLIC_LINKS.Id, model.PERMISSION_SYSCONSOLE_WRITE_SITE_NOTICES.Id}
+
+	// Give the new subsection READ permissions to any user with READ_SITE
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PERMISSION_SYSCONSOLE_READ_SITE.Id),
+		Add:    permissionsSiteRead,
+		Remove: []string{model.PERMISSION_SYSCONSOLE_READ_SITE.Id},
+	})
+
+	// Give the new subsection WRITE permissions to any user with WRITE_SITE
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_SITE.Id),
+		Add:    permissionsSiteWrite,
+		Remove: []string{model.PERMISSION_SYSCONSOLE_WRITE_SITE.Id},
+	})
+
+	// Give the ancillary permissions EDIT_BRAND to anyone with WRITE_SITE_CUSTOMIZATION
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_SITE_CUSTOMIZATION.Id),
+		Add: []string{model.PERMISSION_EDIT_BRAND.Id},
+	})
+
+	return transformations, nil
+}
+
+func (a *App) getAddComplianceSubsectionPermissions() (permissionsMap, error) {
+	transformations := []permissionTransformation{}
+
+	permissionsComplianceRead := []string{model.PERMISSION_SYSCONSOLE_READ_COMPLIANCE_DATA_RETENTION_POLICY.Id, model.PERMISSION_SYSCONSOLE_READ_COMPLIANCE_COMPLIANCE_EXPORT.Id, model.PERMISSION_SYSCONSOLE_READ_COMPLIANCE_COMPLIANCE_MONITORING.Id, model.PERMISSION_SYSCONSOLE_READ_COMPLIANCE_CUSTOM_TERMS_OF_SERVICE.Id}
+	permissionsComplianceWrite := []string{model.PERMISSION_SYSCONSOLE_WRITE_COMPLIANCE_DATA_RETENTION_POLICY.Id, model.PERMISSION_SYSCONSOLE_WRITE_COMPLIANCE_COMPLIANCE_EXPORT.Id, model.PERMISSION_SYSCONSOLE_WRITE_COMPLIANCE_COMPLIANCE_MONITORING.Id, model.PERMISSION_SYSCONSOLE_WRITE_COMPLIANCE_CUSTOM_TERMS_OF_SERVICE.Id}
+
+	// Give the new subsection READ permissions to any user with READ_COMPLIANCE
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PERMISSION_SYSCONSOLE_READ_COMPLIANCE.Id),
+		Add:    permissionsComplianceRead,
+		Remove: []string{model.PERMISSION_SYSCONSOLE_READ_COMPLIANCE.Id},
+	})
+
+	// Give the new subsection WRITE permissions to any user with WRITE_COMPLIANCE
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_COMPLIANCE.Id),
+		Add:    permissionsComplianceWrite,
+		Remove: []string{model.PERMISSION_SYSCONSOLE_WRITE_COMPLIANCE.Id},
+	})
+
+	// Ancilary permissions
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_COMPLIANCE_DATA_RETENTION_POLICY.Id),
+		Add: []string{model.PERMISSION_CREATE_DATA_RETENTION_JOB.Id},
+	})
+
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PERMISSION_SYSCONSOLE_READ_COMPLIANCE_DATA_RETENTION_POLICY.Id),
+		Add: []string{model.PERMISSION_READ_DATA_RETENTION_JOB.Id},
+	})
+
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_COMPLIANCE_COMPLIANCE_EXPORT.Id),
+		Add: []string{model.PERMISSION_CREATE_COMPLIANCE_EXPORT_JOB.Id, model.PERMISSION_DOWNLOAD_COMPLIANCE_EXPORT_RESULT.Id},
+	})
+
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PERMISSION_SYSCONSOLE_READ_COMPLIANCE_COMPLIANCE_EXPORT.Id),
+		Add: []string{model.PERMISSION_READ_COMPLIANCE_EXPORT_JOB.Id, model.PERMISSION_DOWNLOAD_COMPLIANCE_EXPORT_RESULT.Id},
+	})
+
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PERMISSION_SYSCONSOLE_READ_COMPLIANCE_CUSTOM_TERMS_OF_SERVICE.Id),
+		Add: []string{model.PERMISSION_READ_AUDITS.Id},
+	})
+
+	return transformations, nil
+}
+
+func (a *App) getAddEnvironmentSubsectionPermissions() (permissionsMap, error) {
+	transformations := []permissionTransformation{}
+
+	permissionsEnvironmentRead := []string{
+		model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_WEB_SERVER.Id,
+		model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_DATABASE.Id,
+		model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_ELASTICSEARCH.Id,
+		model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_FILE_STORAGE.Id,
+		model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_IMAGE_PROXY.Id,
+		model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_SMTP.Id,
+		model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_PUSH_NOTIFICATION_SERVER.Id,
+		model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_HIGH_AVAILABILITY.Id,
+		model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_RATE_LIMITING.Id,
+		model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_LOGGING.Id,
+		model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_SESSION_LENGTHS.Id,
+		model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_PERFORMANCE_MONITORING.Id,
+		model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_DEVELOPER.Id,
+	}
+	permissionsEnvironmentWrite := []string{
+		model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_WEB_SERVER.Id,
+		model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_DATABASE.Id,
+		model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_ELASTICSEARCH.Id,
+		model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_FILE_STORAGE.Id,
+		model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_IMAGE_PROXY.Id,
+		model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_SMTP.Id,
+		model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_PUSH_NOTIFICATION_SERVER.Id,
+		model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_HIGH_AVAILABILITY.Id,
+		model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_RATE_LIMITING.Id,
+		model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_LOGGING.Id,
+		model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_SESSION_LENGTHS.Id,
+		model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_PERFORMANCE_MONITORING.Id,
+		model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_DEVELOPER.Id,
+	}
+
+	// Give the new subsection READ permissions to any user with READ_ENVIRONMENT
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT.Id),
+		Add:    permissionsEnvironmentRead,
+		Remove: []string{model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT.Id},
+	})
+
+	// Give the new subsection WRITE permissions to any user with WRITE_ENVIRONMENT
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT.Id),
+		Add:    permissionsEnvironmentWrite,
+		Remove: []string{model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT.Id},
+	})
+
+	// Give these ancillary permissions to anyone with READ_ENVIRONMENT_ELASTICSEARCH
+	transformations = append(transformations, permissionTransformation{
+		On: permissionExists(model.PERMISSION_SYSCONSOLE_READ_ENVIRONMENT_ELASTICSEARCH.Id),
+		Add: []string{
+			model.PERMISSION_READ_ELASTICSEARCH_POST_INDEXING_JOB.Id,
+			model.PERMISSION_READ_ELASTICSEARCH_POST_AGGREGATION_JOB.Id,
+		},
+	})
+
+	// Give these ancillary permissions to anyone with WRITE_ENVIRONMENT_WEB_SERVER
+	transformations = append(transformations, permissionTransformation{
+		On: permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_WEB_SERVER.Id),
+		Add: []string{
+			model.PERMISSION_TEST_SITE_URL.Id,
+			model.PERMISSION_RELOAD_CONFIG.Id,
+			model.PERMISSION_INVALIDATE_CACHES.Id,
+		},
+	})
+
+	// Give these ancillary permissions to anyone with WRITE_ENVIRONMENT_DATABASE
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_DATABASE.Id),
+		Add: []string{model.PERMISSION_RECYCLE_DATABASE_CONNECTIONS.Id},
+	})
+
+	// Give these ancillary permissions to anyone with WRITE_ENVIRONMENT_ELASTICSEARCH
+	transformations = append(transformations, permissionTransformation{
+		On: permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_ELASTICSEARCH.Id),
+		Add: []string{
+			model.PERMISSION_TEST_ELASTICSEARCH.Id,
+			model.PERMISSION_CREATE_ELASTICSEARCH_POST_INDEXING_JOB.Id,
+			model.PERMISSION_CREATE_ELASTICSEARCH_POST_AGGREGATION_JOB.Id,
+			model.PERMISSION_PURGE_ELASTICSEARCH_INDEXES.Id,
+		},
+	})
+
+	// Give these ancillary permissions to anyone with WRITE_ENVIRONMENT_FILE_STORAGE
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_ENVIRONMENT_FILE_STORAGE.Id),
+		Add: []string{model.PERMISSION_TEST_S3.Id},
+	})
+
+	return transformations, nil
+}
+
+func (a *App) getAddAboutSubsectionPermissions() (permissionsMap, error) {
+	transformations := []permissionTransformation{}
+
+	permissionsAboutRead := []string{model.PERMISSION_SYSCONSOLE_READ_ABOUT_EDITION_AND_LICENSE.Id}
+	permissionsAboutWrite := []string{model.PERMISSION_SYSCONSOLE_WRITE_ABOUT_EDITION_AND_LICENSE.Id}
+
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PERMISSION_SYSCONSOLE_READ_ABOUT.Id),
+		Add:    permissionsAboutRead,
+		Remove: []string{model.PERMISSION_SYSCONSOLE_READ_ABOUT.Id},
+	})
+
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_ABOUT.Id),
+		Add:    permissionsAboutWrite,
+		Remove: []string{model.PERMISSION_SYSCONSOLE_WRITE_ABOUT.Id},
+	})
+
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PERMISSION_SYSCONSOLE_READ_ABOUT_EDITION_AND_LICENSE.Id),
+		Add: []string{model.PERMISSION_READ_LICENSE_INFORMATION.Id},
+	})
+
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_ABOUT_EDITION_AND_LICENSE.Id),
+		Add: []string{model.PERMISSION_MANAGE_LICENSE_INFORMATION.Id},
+	})
+
+	return transformations, nil
+}
+
+func (a *App) getAddReportingSubsectionPermissions() (permissionsMap, error) {
+	transformations := []permissionTransformation{}
+
+	permissionsReportingRead := []string{
+		model.PERMISSION_SYSCONSOLE_READ_REPORTING_SITE_STATISTICS.Id,
+		model.PERMISSION_SYSCONSOLE_READ_REPORTING_TEAM_STATISTICS.Id,
+		model.PERMISSION_SYSCONSOLE_READ_REPORTING_SERVER_LOGS.Id,
+	}
+	permissionsReportingWrite := []string{
+		model.PERMISSION_SYSCONSOLE_WRITE_REPORTING_SITE_STATISTICS.Id,
+		model.PERMISSION_SYSCONSOLE_WRITE_REPORTING_TEAM_STATISTICS.Id,
+		model.PERMISSION_SYSCONSOLE_WRITE_REPORTING_SERVER_LOGS.Id,
+	}
+
+	// Give the new subsection READ permissions to any user with READ_REPORTING
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PERMISSION_SYSCONSOLE_READ_REPORTING.Id),
+		Add:    permissionsReportingRead,
+		Remove: []string{model.PERMISSION_SYSCONSOLE_READ_REPORTING.Id},
+	})
+
+	// Give the new subsection WRITE permissions to any user with WRITE_REPORTING
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_REPORTING.Id),
+		Add:    permissionsReportingWrite,
+		Remove: []string{model.PERMISSION_SYSCONSOLE_WRITE_REPORTING.Id},
+	})
+
+	// Give the ancillary permissions PERMISSION_GET_ANALYTICS to anyone with PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_USERS or PERMISSION_SYSCONSOLE_READ_REPORTING_SITE_STATISTICS
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionOr(permissionExists(model.PERMISSION_SYSCONSOLE_READ_USERMANAGEMENT_USERS.Id), permissionExists(model.PERMISSION_SYSCONSOLE_READ_REPORTING_SITE_STATISTICS.Id)),
+		Add: []string{model.PERMISSION_GET_ANALYTICS.Id},
+	})
+
+	// Give the ancillary permissions PERMISSION_GET_LOGS to anyone with PERMISSION_SYSCONSOLE_READ_REPORTING_SERVER_LOGS
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PERMISSION_SYSCONSOLE_READ_REPORTING_SERVER_LOGS.Id),
+		Add: []string{model.PERMISSION_GET_LOGS.Id},
+	})
+
+	return transformations, nil
+}
+
+func (a *App) getAddAuthenticationSubsectionPermissions() (permissionsMap, error) {
+	transformations := []permissionTransformation{}
+
+	permissionsAuthenticationRead := []string{model.PERMISSION_SYSCONSOLE_READ_AUTHENTICATION_SIGNUP.Id, model.PERMISSION_SYSCONSOLE_READ_AUTHENTICATION_EMAIL.Id, model.PERMISSION_SYSCONSOLE_READ_AUTHENTICATION_PASSWORD.Id, model.PERMISSION_SYSCONSOLE_READ_AUTHENTICATION_MFA.Id, model.PERMISSION_SYSCONSOLE_READ_AUTHENTICATION_LDAP.Id, model.PERMISSION_SYSCONSOLE_READ_AUTHENTICATION_SAML.Id, model.PERMISSION_SYSCONSOLE_READ_AUTHENTICATION_OPENID.Id, model.PERMISSION_SYSCONSOLE_READ_AUTHENTICATION_GUEST_ACCESS.Id}
+	permissionsAuthenticationWrite := []string{model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION_SIGNUP.Id, model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION_EMAIL.Id, model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION_PASSWORD.Id, model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION_MFA.Id, model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION_LDAP.Id, model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION_SAML.Id, model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION_OPENID.Id, model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION_GUEST_ACCESS.Id}
+
+	// Give the new subsection READ permissions to any user with READ_AUTHENTICATION
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PERMISSION_SYSCONSOLE_READ_AUTHENTICATION.Id),
+		Add:    permissionsAuthenticationRead,
+		Remove: []string{model.PERMISSION_SYSCONSOLE_READ_AUTHENTICATION.Id},
+	})
+
+	// Give the new subsection WRITE permissions to any user with WRITE_AUTHENTICATION
+	transformations = append(transformations, permissionTransformation{
+		On:     permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION.Id),
+		Add:    permissionsAuthenticationWrite,
+		Remove: []string{model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION.Id},
+	})
+
+	// Give the ancillary permissions for LDAP to anyone with WRITE_AUTHENTICATION_LDAP
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION_LDAP.Id),
+		Add: []string{model.PERMISSION_CREATE_LDAP_SYNC_JOB.Id, model.PERMISSION_TEST_LDAP.Id, model.PERMISSION_ADD_LDAP_PUBLIC_CERT.Id, model.PERMISSION_ADD_LDAP_PRIVATE_CERT.Id, model.PERMISSION_REMOVE_LDAP_PUBLIC_CERT.Id, model.PERMISSION_REMOVE_LDAP_PRIVATE_CERT.Id},
+	})
+
+	// Give the ancillary permissions PERMISSION_TEST_LDAP to anyone with READ_AUTHENTICATION_LDAP
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PERMISSION_SYSCONSOLE_READ_AUTHENTICATION_LDAP.Id),
+		Add: []string{model.PERMISSION_READ_LDAP_SYNC_JOB.Id},
+	})
+
+	// Give the ancillary permissions PERMISSION_INVALIDATE_EMAIL_INVITE to anyone with WRITE_AUTHENTICATION_EMAIL
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION_EMAIL.Id),
+		Add: []string{model.PERMISSION_INVALIDATE_EMAIL_INVITE.Id},
+	})
+
+	// Give the ancillary permissions for SAML to anyone with WRITE_AUTHENTICATION_SAML
+	transformations = append(transformations, permissionTransformation{
+		On:  permissionExists(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION_SAML.Id),
+		Add: []string{model.PERMISSION_GET_SAML_METADATA_FROM_IDP.Id, model.PERMISSION_ADD_SAML_PUBLIC_CERT.Id, model.PERMISSION_ADD_SAML_PRIVATE_CERT.Id, model.PERMISSION_ADD_SAML_IDP_CERT.Id, model.PERMISSION_REMOVE_SAML_PUBLIC_CERT.Id, model.PERMISSION_REMOVE_SAML_PRIVATE_CERT.Id, model.PERMISSION_REMOVE_SAML_IDP_CERT.Id, model.PERMISSION_GET_SAML_CERT_STATUS.Id},
+	})
+
+	return transformations, nil
+}
+
 // DoPermissionsMigrations execute all the permissions migrations need by the current version.
 func (a *App) DoPermissionsMigrations() error {
 	PermissionsMigrations := []struct {
@@ -586,6 +930,14 @@ func (a *App) DoPermissionsMigrations() error {
 		{Key: model.MIGRATION_KEY_ADD_SYSTEM_ROLES_PERMISSIONS, Migration: a.getSystemRolesPermissionsMigration},
 		{Key: model.MIGRATION_KEY_ADD_BILLING_PERMISSIONS, Migration: a.getBillingPermissionsMigration},
 		{Key: model.MIGRATION_KEY_ADD_DOWNLOAD_COMPLIANCE_EXPORT_RESULTS, Migration: a.getAddDownloadComplianceExportResult},
+		{Key: model.MIGRATION_KEY_ADD_EXPERIMENTAL_SUBSECTION_PERMISSIONS, Migration: a.getAddExperimentalSubsectionPermissions},
+		{Key: model.MIGRATION_KEY_ADD_AUTHENTICATION_SUBSECTION_PERMISSIONS, Migration: a.getAddAuthenticationSubsectionPermissions},
+		{Key: model.MIGRATION_KEY_ADD_INTEGRATIONS_SUBSECTION_PERMISSIONS, Migration: a.getAddIntegrationsSubsectionPermissions},
+		{Key: model.MIGRATION_KEY_ADD_SITE_SUBSECTION_PERMISSIONS, Migration: a.getAddSiteSubsectionPermissions},
+		{Key: model.MIGRATION_KEY_ADD_COMPLIANCE_SUBSECTION_PERMISSIONS, Migration: a.getAddComplianceSubsectionPermissions},
+		{Key: model.MIGRATION_KEY_ADD_ENVIRONMENT_SUBSECTION_PERMISSIONS, Migration: a.getAddEnvironmentSubsectionPermissions},
+		{Key: model.MIGRATION_KEY_ADD_ABOUT_SUBSECTION_PERMISSIONS, Migration: a.getAddAboutSubsectionPermissions},
+		{Key: model.MIGRATION_KEY_ADD_REPORTING_SUBSECTION_PERMISSIONS, Migration: a.getAddReportingSubsectionPermissions},
 	}

 	roles, err := a.GetAllRoles()