diff --git a/.github/workflows/server-ci.yml b/.github/workflows/server-ci.yml index c7537dad254..38be90e8cd1 100644 --- a/.github/workflows/server-ci.yml +++ b/.github/workflows/server-ci.yml @@ -195,6 +195,38 @@ jobs: run: make store-layers - name: Check generated code run: if [[ -n $(git status --porcelain) ]]; then echo "Please update the store layers using make store-layers"; exit 1; fi + check-default-roles-permissions: + name: Check default roles permissions + needs: go + runs-on: ubuntu-22.04 + container: mattermost/mattermost-build-server:${{ needs.go.outputs.version }} + permissions: + contents: read + services: + postgres: + image: postgres:14 + env: + POSTGRES_USER: mmuser + POSTGRES_PASSWORD: mostest + options: >- + --health-cmd pg_isready + --health-interval 5s + --health-timeout 5s + --health-retries 5 + defaults: + run: + working-directory: server + steps: + - name: Checkout mattermost project + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Run setup-go-work + run: make setup-go-work + - name: Generate default roles permissions + env: + IS_CI: "true" + run: make default-roles-permissions + - name: Check generated code + run: if [[ -n $(git status --porcelain) ]]; then echo "Please update the default roles permissions using make default-roles-permissions"; exit 1; fi check-mmctl-docs: name: Check mmctl docs needs: go diff --git a/e2e-tests/cypress/tests/support/api/default_roles_permissions.js b/e2e-tests/cypress/tests/support/api/default_roles_permissions.js new file mode 100644 index 00000000000..dd8158c1e93 --- /dev/null +++ b/e2e-tests/cypress/tests/support/api/default_roles_permissions.js @@ -0,0 +1,31 @@ +// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved. +// See LICENSE.txt for license information. + +// Code generated by generate_default_roles_permissions.go. DO NOT EDIT. + +export const defaultRolesPermissions = { + channel_admin: 'add_bookmark_private_channel add_bookmark_public_channel add_reaction create_post delete_bookmark_private_channel delete_bookmark_public_channel edit_bookmark_private_channel edit_bookmark_public_channel manage_channel_access_rules manage_channel_join_requests manage_channel_roles manage_private_channel_auto_translation manage_private_channel_banner manage_private_channel_discoverability manage_private_channel_members manage_public_channel_auto_translation manage_public_channel_banner manage_public_channel_members order_bookmark_private_channel order_bookmark_public_channel read_private_channel_groups read_public_channel_groups remove_reaction upload_file use_channel_mentions use_group_mentions', + channel_guest: 'add_reaction create_post edit_file_attachment edit_post read_channel read_channel_content remove_reaction upload_file use_channel_mentions', + channel_user: 'add_bookmark_private_channel add_bookmark_public_channel add_reaction create_post delete_bookmark_private_channel delete_bookmark_public_channel delete_post delete_private_channel delete_public_channel edit_bookmark_private_channel edit_bookmark_public_channel edit_file_attachment edit_post get_public_link manage_private_channel_members manage_private_channel_properties manage_public_channel_members manage_public_channel_properties order_bookmark_private_channel order_bookmark_public_channel read_channel read_channel_content read_private_channel_groups read_public_channel_groups remove_reaction upload_file use_channel_mentions use_group_mentions', + custom_group_user: '', + playbook_admin: 'playbook_private_manage_members playbook_private_manage_properties playbook_private_manage_roles playbook_public_make_private playbook_public_manage_members playbook_public_manage_properties playbook_public_manage_roles', + playbook_member: 'playbook_private_manage_members playbook_private_manage_properties playbook_private_view playbook_public_manage_members playbook_public_manage_properties playbook_public_view run_create', + run_admin: 'run_manage_members run_manage_properties', + run_member: 'run_view', + system_admin: 'add_bookmark_private_channel add_bookmark_public_channel add_ldap_private_cert add_ldap_public_cert add_reaction add_saml_idp_cert add_saml_private_cert add_saml_public_cert add_user_to_team assign_bot assign_system_admin_role bypass_incoming_webhook_channel_lock convert_private_channel_to_public convert_public_channel_to_private create_bot create_compliance_export_job create_custom_group create_data_retention_job create_direct_channel create_elasticsearch_post_aggregation_job create_elasticsearch_post_indexing_job create_emojis create_group_channel create_ldap_sync_job create_post create_post_ephemeral create_post_public create_private_channel create_public_channel create_team create_user_access_token delete_bookmark_private_channel delete_bookmark_public_channel delete_custom_group delete_emojis delete_others_emojis delete_others_posts delete_post delete_private_channel delete_public_channel demote_to_guest download_compliance_export_result edit_bookmark_private_channel edit_bookmark_public_channel edit_brand edit_custom_group edit_file_attachment edit_other_users edit_others_posts edit_post get_analytics get_logs get_public_link get_saml_cert_status get_saml_metadata_from_idp import_team invalidate_caches invalidate_email_invite invite_guest invite_user join_private_teams join_public_channels join_public_teams list_private_teams list_public_teams list_team_channels list_users_without_team manage_bots manage_channel_access_rules manage_channel_join_requests manage_channel_roles manage_compliance_export_job manage_custom_group_members manage_data_retention_job manage_elasticsearch_post_aggregation_job manage_elasticsearch_post_indexing_job manage_jobs manage_ldap_sync_job manage_license_information manage_oauth manage_others_agent manage_others_bots manage_others_incoming_webhooks manage_others_outgoing_webhooks manage_others_slash_commands manage_outgoing_oauth_connections manage_own_agent manage_own_incoming_webhooks manage_own_outgoing_webhooks manage_own_slash_commands manage_private_channel_auto_translation manage_private_channel_banner manage_private_channel_discoverability manage_private_channel_members manage_private_channel_properties manage_public_channel_auto_translation manage_public_channel_banner manage_public_channel_members manage_public_channel_properties manage_roles manage_secure_connections manage_shared_channels manage_system manage_system_wide_oauth manage_team manage_team_access_rules manage_team_roles order_bookmark_private_channel order_bookmark_public_channel playbook_private_create playbook_private_make_public playbook_private_manage_members playbook_private_manage_properties playbook_private_manage_roles playbook_private_view playbook_public_create playbook_public_make_private playbook_public_manage_members playbook_public_manage_properties playbook_public_manage_roles playbook_public_view promote_guest purge_elasticsearch_indexes read_audits read_bots read_channel read_channel_content read_compliance_export_job read_data_retention_job read_deleted_posts read_elasticsearch_post_aggregation_job read_elasticsearch_post_indexing_job read_jobs read_ldap_sync_job read_license_information read_other_users_teams read_others_bots read_private_channel_groups read_public_channel read_public_channel_groups read_user_access_token recycle_database_connections reload_config remove_ldap_private_cert remove_ldap_public_cert remove_others_reactions remove_reaction remove_saml_idp_cert remove_saml_private_cert remove_saml_public_cert remove_user_from_team restore_custom_group revoke_user_access_token run_create run_manage_members run_manage_properties run_view sysconsole_read_about_edition_and_license sysconsole_read_authentication_email sysconsole_read_authentication_guest_access sysconsole_read_authentication_ldap sysconsole_read_authentication_mfa sysconsole_read_authentication_openid sysconsole_read_authentication_password sysconsole_read_authentication_saml sysconsole_read_authentication_signup sysconsole_read_billing sysconsole_read_compliance_compliance_export sysconsole_read_compliance_compliance_monitoring sysconsole_read_compliance_custom_terms_of_service sysconsole_read_compliance_data_retention_policy sysconsole_read_environment_database sysconsole_read_environment_developer sysconsole_read_environment_elasticsearch sysconsole_read_environment_file_storage sysconsole_read_environment_high_availability sysconsole_read_environment_image_proxy sysconsole_read_environment_logging sysconsole_read_environment_mobile_security sysconsole_read_environment_performance_monitoring sysconsole_read_environment_push_notification_server sysconsole_read_environment_rate_limiting sysconsole_read_environment_session_lengths sysconsole_read_environment_smtp sysconsole_read_environment_web_server sysconsole_read_experimental_feature_flags sysconsole_read_experimental_features sysconsole_read_integrations_bot_accounts sysconsole_read_integrations_cors sysconsole_read_integrations_gif sysconsole_read_integrations_integration_management sysconsole_read_plugins sysconsole_read_products_boards sysconsole_read_reporting_server_logs sysconsole_read_reporting_site_statistics sysconsole_read_reporting_team_statistics sysconsole_read_site_announcement_banner sysconsole_read_site_customization sysconsole_read_site_emoji sysconsole_read_site_file_sharing_and_downloads sysconsole_read_site_ip_filters sysconsole_read_site_localization sysconsole_read_site_notices sysconsole_read_site_notifications sysconsole_read_site_posts sysconsole_read_site_public_links sysconsole_read_site_users_and_teams sysconsole_read_user_management_channels sysconsole_read_user_management_groups sysconsole_read_user_management_permissions sysconsole_read_user_management_system_roles sysconsole_read_user_management_teams sysconsole_read_user_management_users sysconsole_write_about_edition_and_license sysconsole_write_authentication_email sysconsole_write_authentication_guest_access sysconsole_write_authentication_ldap sysconsole_write_authentication_mfa sysconsole_write_authentication_openid sysconsole_write_authentication_password sysconsole_write_authentication_saml sysconsole_write_authentication_signup sysconsole_write_billing sysconsole_write_compliance_compliance_export sysconsole_write_compliance_compliance_monitoring sysconsole_write_compliance_custom_terms_of_service sysconsole_write_compliance_data_retention_policy sysconsole_write_environment_database sysconsole_write_environment_developer sysconsole_write_environment_elasticsearch sysconsole_write_environment_file_storage sysconsole_write_environment_high_availability sysconsole_write_environment_image_proxy sysconsole_write_environment_logging sysconsole_write_environment_mobile_security sysconsole_write_environment_performance_monitoring sysconsole_write_environment_push_notification_server sysconsole_write_environment_rate_limiting sysconsole_write_environment_session_lengths sysconsole_write_environment_smtp sysconsole_write_environment_web_server sysconsole_write_experimental_feature_flags sysconsole_write_experimental_features sysconsole_write_integrations_bot_accounts sysconsole_write_integrations_cors sysconsole_write_integrations_gif sysconsole_write_integrations_integration_management sysconsole_write_plugins sysconsole_write_products_boards sysconsole_write_reporting_server_logs sysconsole_write_reporting_site_statistics sysconsole_write_reporting_team_statistics sysconsole_write_site_announcement_banner sysconsole_write_site_customization sysconsole_write_site_emoji sysconsole_write_site_file_sharing_and_downloads sysconsole_write_site_ip_filters sysconsole_write_site_localization sysconsole_write_site_notices sysconsole_write_site_notifications sysconsole_write_site_posts sysconsole_write_site_public_links sysconsole_write_site_users_and_teams sysconsole_write_user_management_channels sysconsole_write_user_management_groups sysconsole_write_user_management_permissions sysconsole_write_user_management_system_roles sysconsole_write_user_management_teams sysconsole_write_user_management_users test_elasticsearch test_email test_ldap test_s3 test_site_url upload_file use_channel_mentions use_group_mentions use_slash_commands view_members view_team', + system_custom_group_admin: 'create_custom_group delete_custom_group edit_custom_group manage_custom_group_members restore_custom_group', + system_guest: 'create_direct_channel create_group_channel', + system_manager: 'add_user_to_team convert_private_channel_to_public convert_public_channel_to_private create_elasticsearch_post_aggregation_job create_elasticsearch_post_indexing_job delete_private_channel delete_public_channel edit_brand get_analytics get_logs invalidate_caches join_private_teams join_public_teams list_private_teams list_public_teams manage_channel_roles manage_elasticsearch_post_aggregation_job manage_elasticsearch_post_indexing_job manage_outgoing_oauth_connections manage_private_channel_auto_translation manage_private_channel_members manage_private_channel_properties manage_public_channel_auto_translation manage_public_channel_members manage_public_channel_properties manage_team manage_team_roles purge_elasticsearch_indexes read_channel read_elasticsearch_post_aggregation_job read_elasticsearch_post_indexing_job read_ldap_sync_job read_license_information read_private_channel_groups read_public_channel read_public_channel_groups recycle_database_connections reload_config remove_user_from_team sysconsole_read_about_edition_and_license sysconsole_read_authentication_email sysconsole_read_authentication_guest_access sysconsole_read_authentication_ldap sysconsole_read_authentication_mfa sysconsole_read_authentication_openid sysconsole_read_authentication_password sysconsole_read_authentication_saml sysconsole_read_authentication_signup sysconsole_read_environment_database sysconsole_read_environment_developer sysconsole_read_environment_elasticsearch sysconsole_read_environment_file_storage sysconsole_read_environment_high_availability sysconsole_read_environment_image_proxy sysconsole_read_environment_logging sysconsole_read_environment_performance_monitoring sysconsole_read_environment_push_notification_server sysconsole_read_environment_rate_limiting sysconsole_read_environment_session_lengths sysconsole_read_environment_smtp sysconsole_read_environment_web_server sysconsole_read_integrations_bot_accounts sysconsole_read_integrations_cors sysconsole_read_integrations_gif sysconsole_read_integrations_integration_management sysconsole_read_plugins sysconsole_read_products_boards sysconsole_read_reporting_server_logs sysconsole_read_reporting_site_statistics sysconsole_read_reporting_team_statistics sysconsole_read_site_announcement_banner sysconsole_read_site_customization sysconsole_read_site_emoji sysconsole_read_site_file_sharing_and_downloads sysconsole_read_site_localization sysconsole_read_site_notices sysconsole_read_site_notifications sysconsole_read_site_posts sysconsole_read_site_public_links sysconsole_read_site_users_and_teams sysconsole_read_user_management_channels sysconsole_read_user_management_groups sysconsole_read_user_management_permissions sysconsole_read_user_management_teams sysconsole_write_environment_database sysconsole_write_environment_developer sysconsole_write_environment_elasticsearch sysconsole_write_environment_file_storage sysconsole_write_environment_high_availability sysconsole_write_environment_image_proxy sysconsole_write_environment_logging sysconsole_write_environment_performance_monitoring sysconsole_write_environment_push_notification_server sysconsole_write_environment_rate_limiting sysconsole_write_environment_session_lengths sysconsole_write_environment_smtp sysconsole_write_environment_web_server sysconsole_write_integrations_bot_accounts sysconsole_write_integrations_cors sysconsole_write_integrations_gif sysconsole_write_integrations_integration_management sysconsole_write_products_boards sysconsole_write_site_announcement_banner sysconsole_write_site_customization sysconsole_write_site_emoji sysconsole_write_site_file_sharing_and_downloads sysconsole_write_site_localization sysconsole_write_site_notices sysconsole_write_site_notifications sysconsole_write_site_posts sysconsole_write_site_public_links sysconsole_write_site_users_and_teams sysconsole_write_user_management_channels sysconsole_write_user_management_groups sysconsole_write_user_management_permissions sysconsole_write_user_management_teams test_elasticsearch test_email test_ldap test_s3 test_site_url view_team', + system_post_all: 'create_post upload_file use_channel_mentions use_group_mentions', + system_post_all_public: 'create_post_public use_channel_mentions use_group_mentions', + system_read_only_admin: 'download_compliance_export_result get_analytics get_logs list_private_teams list_public_teams read_audits read_channel read_compliance_export_job read_data_retention_job read_elasticsearch_post_aggregation_job read_elasticsearch_post_indexing_job read_ldap_sync_job read_license_information read_other_users_teams read_private_channel_groups read_public_channel read_public_channel_groups sysconsole_read_about_edition_and_license sysconsole_read_authentication_email sysconsole_read_authentication_guest_access sysconsole_read_authentication_ldap sysconsole_read_authentication_mfa sysconsole_read_authentication_openid sysconsole_read_authentication_password sysconsole_read_authentication_saml sysconsole_read_authentication_signup sysconsole_read_compliance_compliance_export sysconsole_read_compliance_compliance_monitoring sysconsole_read_compliance_custom_terms_of_service sysconsole_read_compliance_data_retention_policy sysconsole_read_environment_database sysconsole_read_environment_developer sysconsole_read_environment_elasticsearch sysconsole_read_environment_file_storage sysconsole_read_environment_high_availability sysconsole_read_environment_image_proxy sysconsole_read_environment_logging sysconsole_read_environment_mobile_security sysconsole_read_environment_performance_monitoring sysconsole_read_environment_push_notification_server sysconsole_read_environment_rate_limiting sysconsole_read_environment_session_lengths sysconsole_read_environment_smtp sysconsole_read_environment_web_server sysconsole_read_experimental_feature_flags sysconsole_read_experimental_features sysconsole_read_integrations_bot_accounts sysconsole_read_integrations_cors sysconsole_read_integrations_gif sysconsole_read_integrations_integration_management sysconsole_read_plugins sysconsole_read_products_boards sysconsole_read_reporting_server_logs sysconsole_read_reporting_site_statistics sysconsole_read_reporting_team_statistics sysconsole_read_site_announcement_banner sysconsole_read_site_customization sysconsole_read_site_emoji sysconsole_read_site_file_sharing_and_downloads sysconsole_read_site_localization sysconsole_read_site_notices sysconsole_read_site_notifications sysconsole_read_site_posts sysconsole_read_site_public_links sysconsole_read_site_users_and_teams sysconsole_read_user_management_channels sysconsole_read_user_management_groups sysconsole_read_user_management_permissions sysconsole_read_user_management_teams sysconsole_read_user_management_users test_ldap view_team', + system_shared_channel_manager: 'manage_shared_channels', + system_user: 'create_custom_group create_direct_channel create_emojis create_group_channel create_team delete_custom_group delete_emojis edit_custom_group join_public_teams list_public_teams manage_custom_group_members manage_own_agent restore_custom_group view_members', + system_user_access_token: 'create_user_access_token read_user_access_token revoke_user_access_token', + system_user_manager: 'add_user_to_team convert_private_channel_to_public convert_public_channel_to_private delete_private_channel delete_public_channel join_private_teams join_public_teams list_private_teams list_public_teams manage_channel_roles manage_private_channel_auto_translation manage_private_channel_members manage_private_channel_properties manage_public_channel_auto_translation manage_public_channel_members manage_public_channel_properties manage_team manage_team_roles read_channel read_ldap_sync_job read_private_channel_groups read_public_channel read_public_channel_groups remove_user_from_team sysconsole_read_authentication_email sysconsole_read_authentication_guest_access sysconsole_read_authentication_ldap sysconsole_read_authentication_mfa sysconsole_read_authentication_openid sysconsole_read_authentication_password sysconsole_read_authentication_saml sysconsole_read_authentication_signup sysconsole_read_user_management_channels sysconsole_read_user_management_groups sysconsole_read_user_management_permissions sysconsole_read_user_management_teams sysconsole_write_user_management_channels sysconsole_write_user_management_groups sysconsole_write_user_management_teams test_ldap view_team', + team_admin: 'add_bookmark_private_channel add_bookmark_public_channel add_reaction bypass_incoming_webhook_channel_lock convert_private_channel_to_public convert_public_channel_to_private create_post delete_bookmark_private_channel delete_bookmark_public_channel delete_others_posts delete_post edit_bookmark_private_channel edit_bookmark_public_channel import_team manage_channel_access_rules manage_channel_join_requests manage_channel_roles manage_others_incoming_webhooks manage_others_outgoing_webhooks manage_others_slash_commands manage_own_incoming_webhooks manage_own_outgoing_webhooks manage_own_slash_commands manage_private_channel_auto_translation manage_private_channel_banner manage_private_channel_discoverability manage_private_channel_members manage_public_channel_auto_translation manage_public_channel_banner manage_public_channel_members manage_team manage_team_access_rules manage_team_roles order_bookmark_private_channel order_bookmark_public_channel playbook_private_manage_roles playbook_public_manage_roles read_private_channel_groups read_public_channel_groups remove_reaction remove_user_from_team upload_file use_channel_mentions use_group_mentions', + team_guest: 'view_team', + team_post_all: 'create_post upload_file use_channel_mentions use_group_mentions', + team_post_all_public: 'create_post_public use_channel_mentions use_group_mentions', + team_user: 'add_user_to_team create_private_channel create_public_channel invite_user join_public_channels list_team_channels playbook_private_create playbook_public_create read_public_channel view_team', +}; diff --git a/e2e-tests/cypress/tests/support/api/role.js b/e2e-tests/cypress/tests/support/api/role.js index 53469692d1c..b7d9c6fc003 100644 --- a/e2e-tests/cypress/tests/support/api/role.js +++ b/e2e-tests/cypress/tests/support/api/role.js @@ -3,36 +3,14 @@ import xor from 'lodash.xor'; +import {defaultRolesPermissions} from './default_roles_permissions'; + // ***************************************************************************** // Preferences // https://api.mattermost.com/#tag/roles // ***************************************************************************** -export const defaultRolesPermissions = { - channel_admin: 'use_channel_mentions remove_reaction manage_public_channel_members use_group_mentions manage_channel_roles manage_private_channel_members add_reaction read_public_channel_groups create_post read_private_channel_groups add_bookmark_public_channel edit_bookmark_public_channel delete_bookmark_public_channel order_bookmark_public_channel add_bookmark_private_channel edit_bookmark_private_channel delete_bookmark_private_channel order_bookmark_private_channel manage_public_channel_auto_translation manage_private_channel_auto_translation', - channel_guest: 'upload_file edit_post create_post use_channel_mentions read_channel read_channel_content add_reaction remove_reaction edit_file_attachment', - channel_user: 'manage_private_channel_members read_public_channel_groups delete_post read_private_channel_groups use_group_mentions manage_private_channel_properties delete_public_channel add_reaction manage_public_channel_properties edit_post upload_file use_channel_mentions get_public_link read_channel read_channel_content delete_private_channel manage_public_channel_members create_post remove_reaction add_bookmark_public_channel edit_bookmark_public_channel delete_bookmark_public_channel order_bookmark_public_channel add_bookmark_private_channel edit_bookmark_private_channel delete_bookmark_private_channel order_bookmark_private_channel edit_file_attachment', - custom_group_user: '', - playbook_admin: 'playbook_private_manage_properties playbook_public_make_private playbook_public_manage_members playbook_public_manage_roles playbook_public_manage_properties playbook_private_manage_members playbook_private_manage_roles', - playbook_member: 'playbook_public_view playbook_public_manage_members playbook_public_manage_properties playbook_private_view playbook_private_manage_members playbook_private_manage_properties run_create', - run_admin: 'run_manage_properties run_manage_members', - run_member: 'run_view', - system_admin: 'sysconsole_write_environment_elasticsearch playbook_public_manage_properties sysconsole_write_authentication_ldap run_view manage_jobs manage_roles playbook_public_create manage_public_channel_properties manage_public_channel_auto_translation manage_private_channel_auto_translation sysconsole_read_plugins delete_post purge_elasticsearch_indexes sysconsole_read_integrations_bot_accounts read_data_retention_job manage_private_channel_members create_elasticsearch_post_indexing_job manage_elasticsearch_post_indexing_job sysconsole_read_authentication_guest_access create_elasticsearch_post_aggregation_job manage_elasticsearch_post_aggregation_job join_public_teams sysconsole_read_site_public_links add_saml_idp_cert sysconsole_write_site_announcement_banner sysconsole_write_site_notices sysconsole_read_experimental_feature_flags sysconsole_read_site_users_and_teams manage_own_slash_commands manage_others_slash_commands sysconsole_read_authentication_ldap read_channel read_channel_content sysconsole_write_authentication_password list_users_without_team sysconsole_read_authentication_email add_saml_public_cert playbook_private_create promote_guest sysconsole_read_user_management_system_roles manage_public_channel_members create_data_retention_job manage_data_retention_job add_saml_private_cert sysconsole_write_user_management_users sysconsole_read_compliance_compliance_monitoring playbook_public_manage_members sysconsole_write_environment_database sysconsole_write_user_management_teams playbook_private_manage_roles read_public_channel sysconsole_write_plugins sysconsole_read_authentication_openid sysconsole_write_user_management_groups sysconsole_write_site_file_sharing_and_downloads playbook_private_manage_properties sysconsole_read_site_customization join_public_channels add_user_to_team restore_custom_group download_compliance_export_result sysconsole_write_user_management_system_roles sysconsole_write_environment_session_lengths create_custom_group manage_private_channel_properties create_post_public remove_ldap_private_cert sysconsole_write_site_public_links import_team sysconsole_read_environment_developer sysconsole_read_environment_database sysconsole_read_environment_web_server sysconsole_read_environment_mobile_security sysconsole_write_environment_mobile_security use_channel_mentions view_team remove_others_reactions sysconsole_read_environment_session_lengths sysconsole_write_integrations_bot_accounts playbook_public_view use_group_mentions sysconsole_write_environment_web_server add_ldap_private_cert read_public_channel_groups invite_guest sysconsole_read_environment_smtp create_post sysconsole_read_about_edition_and_license sysconsole_read_authentication_signup sysconsole_read_authentication_saml sysconsole_read_environment_file_storage sysconsole_write_experimental_feature_flags sysconsole_write_site_localization sysconsole_write_environment_rate_limiting sysconsole_read_environment_rate_limiting sysconsole_read_products_boards get_saml_cert_status sysconsole_read_environment_high_availability manage_secure_connections read_compliance_export_job sysconsole_write_compliance_custom_terms_of_service read_user_access_token edit_post sysconsole_write_environment_logging sysconsole_read_environment_push_notification_server sysconsole_write_site_customization read_other_users_teams read_elasticsearch_post_aggregation_job sysconsole_write_compliance_data_retention_policy sysconsole_read_user_management_permissions sysconsole_read_site_emoji sysconsole_read_compliance_data_retention_policy read_license_information sysconsole_read_experimental_features read_deleted_posts sysconsole_read_environment_logging sysconsole_read_reporting_site_statistics test_elasticsearch sysconsole_read_site_posts add_reaction sysconsole_write_authentication_signup manage_own_outgoing_webhooks manage_others_outgoing_webhooks create_post_ephemeral sysconsole_read_environment_image_proxy invite_user create_user_access_token sysconsole_write_environment_image_proxy sysconsole_write_products_boards read_elasticsearch_post_indexing_job sysconsole_write_environment_performance_monitoring sysconsole_write_authentication_guest_access sysconsole_read_compliance_custom_terms_of_service edit_others_posts sysconsole_write_billing get_saml_metadata_from_idp sysconsole_write_authentication_saml invalidate_caches view_members manage_others_bots run_create join_private_teams convert_private_channel_to_public read_audits assign_bot read_jobs remove_user_from_team revoke_user_access_token manage_team sysconsole_read_reporting_server_logs get_public_link manage_system delete_public_channel read_private_channel_groups sysconsole_read_authentication_mfa delete_emojis list_private_teams create_emojis sysconsole_read_billing sysconsole_write_site_emoji invalidate_email_invite sysconsole_write_environment_file_storage sysconsole_write_compliance_compliance_monitoring remove_saml_public_cert sysconsole_read_compliance_compliance_export sysconsole_read_site_localization manage_team_roles list_public_teams get_logs sysconsole_write_integrations_integration_management sysconsole_read_integrations_cors manage_oauth manage_outgoing_oauth_connections delete_others_emojis sysconsole_write_integrations_gif manage_own_incoming_webhooks manage_others_incoming_webhooks bypass_incoming_webhook_channel_lock sysconsole_write_authentication_email create_private_channel playbook_private_make_public manage_bots add_ldap_public_cert remove_ldap_public_cert sysconsole_write_site_notifications sysconsole_write_environment_developer playbook_private_manage_members sysconsole_read_user_management_teams edit_custom_group remove_reaction playbook_public_manage_roles sysconsole_write_reporting_server_logs read_others_bots sysconsole_write_site_posts sysconsole_read_site_notifications sysconsole_read_authentication_password playbook_private_view manage_system_wide_oauth get_analytics list_team_channels sysconsole_write_user_management_channels delete_private_channel manage_custom_group_members test_s3 create_ldap_sync_job manage_ldap_sync_job sysconsole_read_integrations_integration_management test_site_url recycle_database_connections sysconsole_read_site_announcement_banner test_email manage_shared_channels read_bots sysconsole_write_environment_smtp sysconsole_write_environment_push_notification_server sysconsole_write_user_management_permissions sysconsole_read_environment_elasticsearch sysconsole_write_reporting_site_statistics sysconsole_write_site_users_and_teams demote_to_guest create_team test_ldap remove_saml_idp_cert delete_others_posts edit_other_users sysconsole_write_reporting_team_statistics sysconsole_read_integrations_gif sysconsole_read_site_notices sysconsole_write_about_edition_and_license run_manage_members create_bot sysconsole_write_authentication_mfa sysconsole_read_user_management_users assign_system_admin_role sysconsole_write_experimental_features edit_brand create_group_channel sysconsole_write_authentication_openid create_direct_channel manage_license_information reload_config manage_channel_roles sysconsole_read_user_management_groups create_compliance_export_job manage_compliance_export_job read_ldap_sync_job upload_file sysconsole_read_site_file_sharing_and_downloads delete_custom_group sysconsole_read_user_management_channels sysconsole_write_compliance_compliance_export remove_saml_private_cert sysconsole_read_environment_performance_monitoring create_public_channel sysconsole_write_integrations_cors sysconsole_write_environment_high_availability playbook_public_make_private run_manage_properties sysconsole_read_reporting_team_statistics convert_public_channel_to_private add_bookmark_public_channel edit_bookmark_public_channel delete_bookmark_public_channel order_bookmark_public_channel add_bookmark_private_channel edit_bookmark_private_channel delete_bookmark_private_channel order_bookmark_private_channel', - system_custom_group_admin: 'create_custom_group edit_custom_group delete_custom_group restore_custom_group manage_custom_group_members', - system_guest: 'create_group_channel create_direct_channel', - system_manager: 'sysconsole_read_site_announcement_banner manage_private_channel_properties edit_brand read_private_channel_groups manage_private_channel_members manage_team_roles sysconsole_write_environment_session_lengths sysconsole_read_site_emoji sysconsole_write_environment_developer sysconsole_read_user_management_groups sysconsole_write_user_management_groups sysconsole_write_environment_rate_limiting delete_private_channel sysconsole_read_environment_performance_monitoring sysconsole_read_environment_rate_limiting sysconsole_write_user_management_teams sysconsole_write_integrations_integration_management sysconsole_write_site_public_links sysconsole_read_authentication_ldap sysconsole_write_integrations_cors reload_config sysconsole_write_user_management_channels sysconsole_read_environment_high_availability sysconsole_read_site_users_and_teams sysconsole_read_user_management_teams sysconsole_write_site_users_and_teams sysconsole_read_site_customization sysconsole_write_environment_high_availability sysconsole_read_integrations_bot_accounts sysconsole_read_authentication_guest_access sysconsole_read_site_public_links read_elasticsearch_post_indexing_job sysconsole_read_user_management_channels sysconsole_read_reporting_team_statistics invalidate_caches sysconsole_read_authentication_signup read_elasticsearch_post_aggregation_job sysconsole_write_environment_smtp manage_public_channel_members list_public_teams add_user_to_team sysconsole_read_environment_web_server sysconsole_read_site_localization get_logs sysconsole_write_site_posts sysconsole_write_integrations_bot_accounts sysconsole_write_user_management_permissions sysconsole_read_environment_elasticsearch sysconsole_read_environment_smtp list_private_teams read_public_channel_groups sysconsole_write_environment_file_storage sysconsole_write_integrations_gif manage_public_channel_properties sysconsole_write_environment_performance_monitoring sysconsole_write_site_notifications sysconsole_read_site_notifications sysconsole_read_environment_image_proxy sysconsole_write_site_announcement_banner sysconsole_write_site_emoji test_site_url sysconsole_read_integrations_gif sysconsole_write_environment_logging convert_public_channel_to_private get_analytics sysconsole_read_user_management_permissions sysconsole_write_environment_image_proxy test_elasticsearch recycle_database_connections sysconsole_write_site_localization sysconsole_read_reporting_server_logs create_elasticsearch_post_indexing_job manage_elasticsearch_post_indexing_job sysconsole_read_reporting_site_statistics test_ldap delete_public_channel sysconsole_write_environment_push_notification_server read_license_information sysconsole_write_products_boards sysconsole_read_about_edition_and_license convert_private_channel_to_public sysconsole_read_integrations_integration_management create_elasticsearch_post_aggregation_job manage_elasticsearch_post_aggregation_job purge_elasticsearch_indexes sysconsole_read_environment_database join_public_teams sysconsole_read_authentication_email sysconsole_read_environment_push_notification_server view_team read_channel sysconsole_read_authentication_password read_ldap_sync_job sysconsole_read_integrations_cors sysconsole_read_environment_logging manage_team sysconsole_read_authentication_openid read_public_channel sysconsole_write_environment_elasticsearch sysconsole_read_plugins manage_channel_roles remove_user_from_team test_email sysconsole_write_site_file_sharing_and_downloads test_s3 sysconsole_read_site_file_sharing_and_downloads sysconsole_read_site_notices sysconsole_read_environment_file_storage join_private_teams sysconsole_read_products_boards sysconsole_read_environment_session_lengths sysconsole_write_environment_database sysconsole_read_authentication_saml sysconsole_read_authentication_mfa sysconsole_write_site_notices sysconsole_write_environment_web_server sysconsole_read_site_posts sysconsole_read_environment_developer sysconsole_write_site_customization sysconsole_read_environment_mobile_security sysconsole_write_environment_mobile_security manage_outgoing_oauth_connections', - system_post_all: 'use_group_mentions use_channel_mentions create_post', - system_post_all_public: 'use_group_mentions use_channel_mentions create_post_public', - system_read_only_admin: 'sysconsole_read_authentication_guest_access download_compliance_export_result sysconsole_read_compliance_data_retention_policy get_logs sysconsole_read_environment_file_storage read_channel sysconsole_read_integrations_integration_management sysconsole_read_compliance_custom_terms_of_service sysconsole_read_site_notices sysconsole_read_environment_rate_limiting sysconsole_read_about_edition_and_license read_public_channel sysconsole_read_experimental_features test_ldap sysconsole_read_user_management_permissions read_elasticsearch_post_aggregation_job sysconsole_read_environment_image_proxy sysconsole_read_compliance_compliance_export sysconsole_read_integrations_bot_accounts sysconsole_read_authentication_openid sysconsole_read_site_posts sysconsole_read_user_management_users sysconsole_read_experimental_feature_flags sysconsole_read_reporting_team_statistics sysconsole_read_site_localization read_private_channel_groups sysconsole_read_site_file_sharing_and_downloads sysconsole_read_user_management_channels sysconsole_read_authentication_email read_data_retention_job read_audits sysconsole_read_plugins view_team get_analytics sysconsole_read_user_management_groups sysconsole_read_products_boards read_compliance_export_job sysconsole_read_environment_logging sysconsole_read_authentication_signup sysconsole_read_environment_smtp sysconsole_read_environment_session_lengths sysconsole_read_environment_developer sysconsole_read_environment_high_availability sysconsole_read_environment_mobile_security read_ldap_sync_job sysconsole_read_environment_performance_monitoring sysconsole_read_authentication_saml read_public_channel_groups sysconsole_read_integrations_gif sysconsole_read_authentication_mfa list_public_teams sysconsole_read_environment_database list_private_teams sysconsole_read_authentication_ldap sysconsole_read_compliance_compliance_monitoring sysconsole_read_site_notifications sysconsole_read_site_announcement_banner read_other_users_teams sysconsole_read_authentication_password sysconsole_read_environment_push_notification_server sysconsole_read_site_users_and_teams sysconsole_read_site_public_links sysconsole_read_site_emoji sysconsole_read_environment_elasticsearch read_license_information sysconsole_read_integrations_cors sysconsole_read_user_management_teams sysconsole_read_reporting_server_logs sysconsole_read_site_customization sysconsole_read_reporting_site_statistics sysconsole_read_environment_web_server read_elasticsearch_post_indexing_job', - system_user: 'delete_custom_group create_emojis edit_custom_group create_direct_channel view_members join_public_teams restore_custom_group create_custom_group manage_custom_group_members delete_emojis list_public_teams create_team create_group_channel', - system_user_access_token: 'create_user_access_token read_user_access_token revoke_user_access_token', - system_user_manager: 'sysconsole_read_authentication_password sysconsole_read_authentication_openid sysconsole_write_user_management_groups list_private_teams sysconsole_read_user_management_groups sysconsole_read_authentication_email manage_public_channel_properties delete_private_channel sysconsole_read_authentication_signup read_private_channel_groups sysconsole_read_user_management_teams test_ldap read_channel view_team manage_team sysconsole_write_user_management_teams manage_channel_roles sysconsole_read_authentication_saml sysconsole_read_authentication_guest_access convert_private_channel_to_public sysconsole_read_user_management_permissions join_public_teams sysconsole_write_user_management_channels read_public_channel_groups sysconsole_read_user_management_channels list_public_teams manage_team_roles join_private_teams manage_public_channel_members convert_public_channel_to_private remove_user_from_team sysconsole_read_authentication_ldap manage_private_channel_properties delete_public_channel manage_private_channel_members read_public_channel add_user_to_team sysconsole_read_authentication_mfa read_ldap_sync_job', - team_admin: 'manage_own_slash_commands manage_others_slash_commands manage_channel_roles manage_own_outgoing_webhooks manage_others_outgoing_webhooks manage_team_roles use_channel_mentions manage_own_incoming_webhooks manage_others_incoming_webhooks bypass_incoming_webhook_channel_lock manage_public_channel_members convert_private_channel_to_public manage_private_channel_members manage_team convert_public_channel_to_private use_group_mentions delete_post read_public_channel_groups delete_others_posts playbook_private_manage_roles add_reaction remove_reaction remove_user_from_team read_private_channel_groups create_post playbook_public_manage_roles import_team add_bookmark_public_channel edit_bookmark_public_channel delete_bookmark_public_channel order_bookmark_public_channel add_bookmark_private_channel edit_bookmark_private_channel delete_bookmark_private_channel order_bookmark_private_channel', - team_guest: 'view_team', - team_post_all: 'create_post use_channel_mentions use_group_mentions', - team_post_all_public: 'create_post_public use_channel_mentions use_group_mentions', - team_user: 'add_user_to_team view_team playbook_private_create playbook_public_create invite_user join_public_channels list_team_channels read_public_channel create_private_channel create_public_channel', -}; +export {defaultRolesPermissions}; Cypress.Commands.add('getRoleByName', (name) => { return cy.request({ diff --git a/server/Makefile b/server/Makefile index 3ec286eaa70..fb72d838ec9 100644 --- a/server/Makefile +++ b/server/Makefile @@ -1,4 +1,4 @@ -.PHONY: build package run stop run-client run-server run-node run-haserver stop-haserver stop-client stop-server restart restart-server restart-client restart-haserver start-docker update-docker clean-dist clean nuke check-style check-client-style check-server-style check-unit-tests test dist run-client-tests setup-run-client-tests cleanup-run-client-tests test-client build-linux build-osx build-freebsd build-windows package-prep package-linux package-osx package-windows internal-test-web-client vet run-server-for-web-client-tests diff-config prepackaged-plugins prepackaged-binaries test-server test-server-ee test-server-elasticsearch test-server-opensearch test-server-quick test-server-race test-mmctl-unit test-mmctl-e2e test-mmctl test-mmctl-coverage mmctl-build mmctl-docs new-migration migrations-extract test-public mocks-public run-server-faketime +.PHONY: build package run stop run-client run-server run-node run-haserver stop-haserver stop-client stop-server restart restart-server restart-client restart-haserver start-docker update-docker clean-dist clean nuke check-style check-client-style check-server-style check-unit-tests test dist run-client-tests setup-run-client-tests cleanup-run-client-tests test-client build-linux build-osx build-freebsd build-windows package-prep package-linux package-osx package-windows internal-test-web-client vet run-server-for-web-client-tests diff-config prepackaged-plugins prepackaged-binaries test-server test-server-ee test-server-elasticsearch test-server-opensearch test-server-quick test-server-race test-mmctl-unit test-mmctl-e2e test-mmctl test-mmctl-coverage mmctl-build mmctl-docs new-migration migrations-extract test-public mocks-public run-server-faketime default-roles-permissions generated ROOT := $(dir $(abspath $(lastword $(MAKEFILE_LIST)))) @@ -404,11 +404,15 @@ mmctl-mocks: setup-go-work ## Creates mocks for mmctl pluginapi: setup-go-work ## Generates api and hooks glue code for plugins cd ./public && $(GO) generate $(GOFLAGS) ./plugin +default-roles-permissions: start-docker ## Generates default_roles_permissions.js by snapshotting a live database. + $(GO) run $(GOFLAGS) ./scripts/default_permissions_generator \ + -out ../e2e-tests/cypress/tests/support/api/default_roles_permissions.js + mocks: store-mocks filestore-mocks ldap-mocks plugin-mocks einterfaces-mocks searchengine-mocks sharedchannel-mocks misc-mocks email-mocks platform-mocks mmctl-mocks mocks-public cache-mocks layers: store-layers pluginapi -generated: mocks layers +generated: mocks layers default-roles-permissions check-prereqs-enterprise: setup-go-work ## Checks prerequisite software status for enterprise. ifeq ($(BUILD_ENTERPRISE_READY),true) diff --git a/server/scripts/default_permissions_generator/main.go b/server/scripts/default_permissions_generator/main.go new file mode 100644 index 00000000000..e4a36c1ef4b --- /dev/null +++ b/server/scripts/default_permissions_generator/main.go @@ -0,0 +1,125 @@ +// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved. +// See LICENSE.txt for license information. + +package main + +import ( + "flag" + "fmt" + "os" + "slices" + "strings" + "text/template" + + "github.com/mattermost/mattermost/server/public/model" + "github.com/mattermost/mattermost/server/v8/channels/app" + "github.com/mattermost/mattermost/server/v8/channels/store/storetest" + "github.com/mattermost/mattermost/server/v8/channels/utils" + "github.com/mattermost/mattermost/server/v8/config" +) + +type roleEntry struct { + Name string + Permissions string +} + +var tmpl = template.Must(template.New("").Parse(`// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved. +// See LICENSE.txt for license information. + +// Code generated by generate_default_roles_permissions.go. DO NOT EDIT. + +export const defaultRolesPermissions = { +{{- range .}} + {{.Name}}: '{{.Permissions}}', +{{- end}} +}; +`)) + +func main() { + outPath := flag.String("out", "", "output file path") + flag.Parse() + + if *outPath == "" { + fmt.Fprintln(os.Stderr, "usage: generate_default_roles_permissions -out ") + os.Exit(1) + } + + if err := utils.TranslationsPreInit(); err != nil { + fmt.Fprintf(os.Stderr, "warning: could not load translations: %v\n", err) + } + + sqlSettings := storetest.MakeSqlSettings(model.DatabaseDriverPostgres) + defer storetest.CleanupSqlSettings(sqlSettings) + + cfg := model.Config{} + cfg.SetDefaults() + cfg.SqlSettings = *sqlSettings + + memStore, err := config.NewMemoryStoreWithOptions(&config.MemoryStoreOptions{ + InitialConfig: &cfg, + }) + if err != nil { + fmt.Fprintf(os.Stderr, "error creating config store: %v\n", err) + os.Exit(1) + } + cfgStore, err := config.NewStoreFromBacking(memStore, nil, false) + if err != nil { + fmt.Fprintf(os.Stderr, "error creating config store: %v\n", err) + os.Exit(1) + } + + // NewServer runs both schema migrations (via sqlstore.New) and all + // app-level migrations (doAppMigrations) as part of its initialization. + server, err := app.NewServer(app.ConfigStore(cfgStore)) + if err != nil { + fmt.Fprintf(os.Stderr, "error creating server: %v\n", err) + os.Exit(1) + } + defer server.Shutdown() + + roles, err := server.Store().Role().GetAll() + if err != nil { + fmt.Fprintf(os.Stderr, "error reading roles: %v\n", err) + os.Exit(1) + } + + defaultNames := make(map[string]bool, len(model.MakeDefaultRoles())) + for name := range model.MakeDefaultRoles() { + defaultNames[name] = true + } + + var roleNames []string + roleByName := make(map[string]*model.Role, len(roles)) + for _, r := range roles { + if defaultNames[r.Name] { + roleNames = append(roleNames, r.Name) + roleByName[r.Name] = r + } + } + slices.Sort(roleNames) + + entries := make([]roleEntry, 0, len(roleNames)) + for _, name := range roleNames { + perms := make([]string, len(roleByName[name].Permissions)) + copy(perms, roleByName[name].Permissions) + slices.Sort(perms) + perms = slices.Compact(perms) + entries = append(entries, roleEntry{ + Name: name, + Permissions: strings.Join(perms, " "), + }) + } + + var b strings.Builder + if err := tmpl.Execute(&b, entries); err != nil { + fmt.Fprintf(os.Stderr, "error executing template: %v\n", err) + os.Exit(1) + } + + if err := os.WriteFile(*outPath, []byte(b.String()), 0644); err != nil { + fmt.Fprintf(os.Stderr, "error writing %s: %v\n", *outPath, err) + os.Exit(1) + } + + fmt.Printf("Generated %s\n", *outPath) +}