MM-14845 Fix for 5.9 (#10611)

* MM-14845: Update default channel modify/delete permissions.

* Fix tests and permission IDs.

* Add policyroleadaptor changes.

* Update out-of-the-box migration.

* Fix another test.

* Fix another test.

* Fix more tests.

api4/apitestlib.go

@@ -115,6 +115,7 @@ func setupTestHelper(enterprise bool, updateConfig func(*model.Config)) *TestHel
 	th.App.Srv.Store.MarkSystemRanUnitTests()
 	th.App.DoAdvancedPermissionsMigration()
 	th.App.DoEmojisPermissionsMigration()
+	th.App.DoPermissionsMigrations()
 
 	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.EnableOpenServer = true })
 

api4/channel_test.go

@@ -990,8 +990,8 @@ func TestDeleteChannel2(t *testing.T) {
 		th.RestoreDefaultRolePermissions(defaultRolePermissions)
 	}()
 
-	th.AddPermissionToRole(model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id, model.TEAM_USER_ROLE_ID)
-	th.AddPermissionToRole(model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id, model.TEAM_USER_ROLE_ID)
+	th.AddPermissionToRole(model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id, model.CHANNEL_USER_ROLE_ID)
+	th.AddPermissionToRole(model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id, model.CHANNEL_USER_ROLE_ID)
 
 	// channels created by SystemAdmin
 	publicChannel6 := th.CreateChannelWithClient(th.SystemAdminClient, model.CHANNEL_OPEN)
@@ -1008,8 +1008,8 @@ func TestDeleteChannel2(t *testing.T) {
 	CheckNoError(t, resp)
 
 	// Restrict permissions to Channel Admins
-	th.RemovePermissionFromRole(model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id, model.TEAM_USER_ROLE_ID)
-	th.RemovePermissionFromRole(model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id, model.TEAM_USER_ROLE_ID)
+	th.RemovePermissionFromRole(model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id, model.CHANNEL_USER_ROLE_ID)
+	th.RemovePermissionFromRole(model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id, model.CHANNEL_USER_ROLE_ID)
 	th.AddPermissionToRole(model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id, model.CHANNEL_ADMIN_ROLE_ID)
 	th.AddPermissionToRole(model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id, model.CHANNEL_ADMIN_ROLE_ID)
 

app/app_test.go

@@ -5,6 +5,7 @@ package app
 
 import (
 	"fmt"
+	"sort"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -81,6 +82,10 @@ func TestDoAdvancedPermissionsMigration(t *testing.T) {
 			model.PERMISSION_GET_PUBLIC_LINK.Id,
 			model.PERMISSION_CREATE_POST.Id,
 			model.PERMISSION_USE_SLASH_COMMANDS.Id,
+			model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id,
+			model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id,
+			model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id,
+			model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id,
 			model.PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS.Id,
 			model.PERMISSION_DELETE_POST.Id,
 			model.PERMISSION_EDIT_POST.Id,
@@ -94,11 +99,7 @@ func TestDoAdvancedPermissionsMigration(t *testing.T) {
 			model.PERMISSION_READ_PUBLIC_CHANNEL.Id,
 			model.PERMISSION_VIEW_TEAM.Id,
 			model.PERMISSION_CREATE_PUBLIC_CHANNEL.Id,
-			model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id,
-			model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id,
 			model.PERMISSION_CREATE_PRIVATE_CHANNEL.Id,
-			model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id,
-			model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id,
 			model.PERMISSION_INVITE_USER.Id,
 			model.PERMISSION_ADD_USER_TO_TEAM.Id,
 		},
@@ -249,6 +250,8 @@ func TestDoAdvancedPermissionsMigration(t *testing.T) {
 			model.PERMISSION_GET_PUBLIC_LINK.Id,
 			model.PERMISSION_CREATE_POST.Id,
 			model.PERMISSION_USE_SLASH_COMMANDS.Id,
+			model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id,
+			model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id,
 			model.PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS.Id,
 			model.PERMISSION_DELETE_POST.Id,
 			model.PERMISSION_EDIT_POST.Id,
@@ -262,9 +265,7 @@ func TestDoAdvancedPermissionsMigration(t *testing.T) {
 			model.PERMISSION_READ_PUBLIC_CHANNEL.Id,
 			model.PERMISSION_VIEW_TEAM.Id,
 			model.PERMISSION_CREATE_PUBLIC_CHANNEL.Id,
-			model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id,
 			model.PERMISSION_CREATE_PRIVATE_CHANNEL.Id,
-			model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id,
 			model.PERMISSION_INVITE_USER.Id,
 			model.PERMISSION_ADD_USER_TO_TEAM.Id,
 		},
@@ -497,9 +498,11 @@ func TestDoEmojisPermissionsMigration(t *testing.T) {
 		model.PERMISSION_MANAGE_EMOJIS.Id,
 		model.PERMISSION_MANAGE_OTHERS_EMOJIS.Id,
 	}
+	sort.Strings(expectedSystemAdmin)
 
 	role1, err1 := th.App.GetRoleByName(model.SYSTEM_ADMIN_ROLE_ID)
 	assert.Nil(t, err1)
+	sort.Strings(role1.Permissions)
 	assert.Equal(t, expectedSystemAdmin, role1.Permissions, fmt.Sprintf("'%v' did not have expected permissions", model.SYSTEM_ADMIN_ROLE_ID))
 
 	th.App.UpdateConfig(func(cfg *model.Config) {
@@ -525,6 +528,8 @@ func TestDoEmojisPermissionsMigration(t *testing.T) {
 		model.PERMISSION_DELETE_OTHERS_POSTS.Id,
 		model.PERMISSION_MANAGE_EMOJIS.Id,
 	}
+	sort.Strings(expected2)
+	sort.Strings(role2.Permissions)
 	assert.Equal(t, expected2, role2.Permissions, fmt.Sprintf("'%v' did not have expected permissions", model.TEAM_ADMIN_ROLE_ID))
 
 	systemAdmin1, systemAdminErr1 := th.App.GetRoleByName(model.SYSTEM_ADMIN_ROLE_ID)
@@ -547,6 +552,8 @@ func TestDoEmojisPermissionsMigration(t *testing.T) {
 		model.PERMISSION_CREATE_TEAM.Id,
 		model.PERMISSION_MANAGE_EMOJIS.Id,
 	}
+	sort.Strings(expected3)
+	sort.Strings(role3.Permissions)
 	assert.Equal(t, expected3, role3.Permissions, fmt.Sprintf("'%v' did not have expected permissions", model.SYSTEM_USER_ROLE_ID))
 
 	systemAdmin2, systemAdminErr2 := th.App.GetRoleByName(model.SYSTEM_ADMIN_ROLE_ID)

app/command_channel_header_test.go

@@ -17,6 +17,8 @@ func TestHeaderProviderDoCommand(t *testing.T) {
 
 	hp := HeaderProvider{}
 
+	th.AddPermissionToRole(model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id, model.CHANNEL_USER_ROLE_ID)
+
 	// Try a public channel *with* permission.
 	args := &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
@@ -32,16 +34,20 @@ func TestHeaderProviderDoCommand(t *testing.T) {
 		assert.Equal(t, expected, actual)
 	}
 
+	th.RemovePermissionFromRole(model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id, model.CHANNEL_USER_ROLE_ID)
+
 	// Try a public channel *without* permission.
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: th.BasicChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual := hp.DoCommand(th.App, args, "hello").Text
 	assert.Equal(t, "api.command_channel_header.permission.app_error", actual)
 
+	th.AddPermissionToRole(model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id, model.CHANNEL_USER_ROLE_ID)
+
 	// Try a private channel *with* permission.
 	privateChannel := th.CreatePrivateChannel(th.BasicTeam)
 
@@ -54,11 +60,13 @@ func TestHeaderProviderDoCommand(t *testing.T) {
 	actual = hp.DoCommand(th.App, args, "hello").Text
 	assert.Equal(t, "", actual)
 
+	th.RemovePermissionFromRole(model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id, model.CHANNEL_USER_ROLE_ID)
+
 	// Try a private channel *without* permission.
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: privateChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual = hp.DoCommand(th.App, args, "hello").Text
@@ -74,7 +82,7 @@ func TestHeaderProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: groupChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual = hp.DoCommand(th.App, args, "hello").Text
@@ -84,7 +92,7 @@ func TestHeaderProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: groupChannel.Id,
-		Session:   model.Session{UserId: user3.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		Session:   model.Session{UserId: user3.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual = hp.DoCommand(th.App, args, "hello").Text
@@ -96,7 +104,7 @@ func TestHeaderProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: directChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual = hp.DoCommand(th.App, args, "hello").Text
@@ -106,7 +114,7 @@ func TestHeaderProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: directChannel.Id,
-		Session:   model.Session{UserId: user2.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		Session:   model.Session{UserId: user2.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual = hp.DoCommand(th.App, args, "hello").Text

app/command_channel_purpose_test.go

@@ -18,6 +18,8 @@ func TestPurposeProviderDoCommand(t *testing.T) {
 	pp := PurposeProvider{}
 
 	// Try a public channel *with* permission.
+	th.AddPermissionToRole(model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id, model.CHANNEL_USER_ROLE_ID)
+
 	args := &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: th.BasicChannel.Id,
@@ -33,10 +35,12 @@ func TestPurposeProviderDoCommand(t *testing.T) {
 	}
 
 	// Try a public channel *without* permission.
+	th.RemovePermissionFromRole(model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id, model.CHANNEL_USER_ROLE_ID)
+
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: th.BasicChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual := pp.DoCommand(th.App, args, "hello").Text
@@ -45,6 +49,8 @@ func TestPurposeProviderDoCommand(t *testing.T) {
 	// Try a private channel *with* permission.
 	privateChannel := th.CreatePrivateChannel(th.BasicTeam)
 
+	th.AddPermissionToRole(model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id, model.CHANNEL_USER_ROLE_ID)
+
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: privateChannel.Id,
@@ -55,10 +61,12 @@ func TestPurposeProviderDoCommand(t *testing.T) {
 	assert.Equal(t, "", actual)
 
 	// Try a private channel *without* permission.
+	th.RemovePermissionFromRole(model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id, model.CHANNEL_USER_ROLE_ID)
+
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: privateChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual = pp.DoCommand(th.App, args, "hello").Text
@@ -73,7 +81,7 @@ func TestPurposeProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: groupChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual = pp.DoCommand(th.App, args, "hello").Text
@@ -85,7 +93,7 @@ func TestPurposeProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: directChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual = pp.DoCommand(th.App, args, "hello").Text

app/command_channel_rename_test.go

@@ -15,6 +15,8 @@ func TestRenameProviderDoCommand(t *testing.T) {
 	th := Setup().InitBasic()
 	defer th.TearDown()
 
+	th.AddPermissionToRole(model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id, model.CHANNEL_USER_ROLE_ID)
+
 	rp := RenameProvider{}
 	args := &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
@@ -35,10 +37,12 @@ func TestRenameProviderDoCommand(t *testing.T) {
 	}
 
 	// Try a public channel *without* permission.
+	th.RemovePermissionFromRole(model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id, model.CHANNEL_USER_ROLE_ID)
+
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: th.BasicChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual := rp.DoCommand(th.App, args, "hello").Text
@@ -47,6 +51,8 @@ func TestRenameProviderDoCommand(t *testing.T) {
 	// Try a private channel *with* permission.
 	privateChannel := th.CreatePrivateChannel(th.BasicTeam)
 
+	th.AddPermissionToRole(model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id, model.CHANNEL_USER_ROLE_ID)
+
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: privateChannel.Id,
@@ -57,10 +63,12 @@ func TestRenameProviderDoCommand(t *testing.T) {
 	assert.Equal(t, "", actual)
 
 	// Try a private channel *without* permission.
+	th.RemovePermissionFromRole(model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id, model.CHANNEL_USER_ROLE_ID)
+
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: privateChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual = rp.DoCommand(th.App, args, "hello").Text
@@ -75,7 +83,7 @@ func TestRenameProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: groupChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual = rp.DoCommand(th.App, args, "hello").Text
@@ -87,7 +95,7 @@ func TestRenameProviderDoCommand(t *testing.T) {
 	args = &model.CommandArgs{
 		T:         func(s string, args ...interface{}) string { return s },
 		ChannelId: directChannel.Id,
-		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: model.TEAM_USER_ROLE_ID}}},
 	}
 
 	actual = rp.DoCommand(th.App, args, "hello").Text

app/helper_test.go

@@ -8,6 +8,7 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"strings"
 	"time"
 
 	"testing"
@@ -504,3 +505,62 @@ func (me *TestHelper) SetupPluginAPI() *PluginAPI {
 
 	return NewPluginAPI(me.App, manifest)
 }
+
+func (me *TestHelper) RemovePermissionFromRole(permission string, roleName string) {
+	utils.DisableDebugLogForTest()
+
+	role, err1 := me.App.GetRoleByName(roleName)
+	if err1 != nil {
+		utils.EnableDebugLogForTest()
+		panic(err1)
+	}
+
+	var newPermissions []string
+	for _, p := range role.Permissions {
+		if p != permission {
+			newPermissions = append(newPermissions, p)
+		}
+	}
+
+	if strings.Join(role.Permissions, " ") == strings.Join(newPermissions, " ") {
+		utils.EnableDebugLogForTest()
+		return
+	}
+
+	role.Permissions = newPermissions
+
+	_, err2 := me.App.UpdateRole(role)
+	if err2 != nil {
+		utils.EnableDebugLogForTest()
+		panic(err2)
+	}
+
+	utils.EnableDebugLogForTest()
+}
+
+func (me *TestHelper) AddPermissionToRole(permission string, roleName string) {
+	utils.DisableDebugLogForTest()
+
+	role, err1 := me.App.GetRoleByName(roleName)
+	if err1 != nil {
+		utils.EnableDebugLogForTest()
+		panic(err1)
+	}
+
+	for _, existingPermission := range role.Permissions {
+		if existingPermission == permission {
+			utils.EnableDebugLogForTest()
+			return
+		}
+	}
+
+	role.Permissions = append(role.Permissions, permission)
+
+	_, err2 := me.App.UpdateRole(role)
+	if err2 != nil {
+		utils.EnableDebugLogForTest()
+		panic(err2)
+	}
+
+	utils.EnableDebugLogForTest()
+}

app/permissions.go

@@ -60,6 +60,7 @@ func (a *App) ResetPermissionsSystem() *model.AppError {
 	// Now that the permissions system has been reset, re-run the migration to reinitialise it.
 	a.DoAdvancedPermissionsMigration()
 	a.DoEmojisPermissionsMigration()
+	a.DoPermissionsMigrations()
 
 	return nil
 }

app/permissions_migrations.go

@@ -0,0 +1,186 @@
+// Copyright (c) 2018-present Mattermost, Inc. All Rights Reserved.
+// See License.txt for license information.
+
+package app
+
+import (
+	"github.com/mattermost/mattermost-server/model"
+)
+
+type permissionTransformation struct {
+	On     func(string, map[string]map[string]bool) bool
+	Add    []string
+	Remove []string
+}
+type permissionsMap []permissionTransformation
+
+const (
+	MIGRATION_KEY_APPLY_CHANNEL_MANAGE_DELETE_TO_CHANNEL_USER = "apply_channel_manage_delete_to_channel_user"
+	MIGRATION_KEY_REMOVE_CHANNEL_MANAGE_DELETE_FROM_TEAM_USER = "remove_channel_manage_delete_from_team_user"
+
+	PERMISSION_DELETE_PUBLIC_CHANNEL             = "delete_public_channel"
+	PERMISSION_DELETE_PRIVATE_CHANNEL            = "delete_private_channel"
+	PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES  = "manage_public_channel_properties"
+	PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES = "manage_private_channel_properties"
+)
+
+func isRole(role string) func(string, map[string]map[string]bool) bool {
+	return func(roleName string, permissionsMap map[string]map[string]bool) bool {
+		return roleName == role
+	}
+}
+
+func permissionExists(permission string) func(string, map[string]map[string]bool) bool {
+	return func(roleName string, permissionsMap map[string]map[string]bool) bool {
+		val, ok := permissionsMap[roleName][permission]
+		return ok && val
+	}
+}
+
+func permissionNotExists(permission string) func(string, map[string]map[string]bool) bool {
+	return func(roleName string, permissionsMap map[string]map[string]bool) bool {
+		val, ok := permissionsMap[roleName][permission]
+		return !(ok && val)
+	}
+}
+
+func onOtherRole(otherRole string, function func(string, map[string]map[string]bool) bool) func(string, map[string]map[string]bool) bool {
+	return func(roleName string, permissionsMap map[string]map[string]bool) bool {
+		return function(otherRole, permissionsMap)
+	}
+}
+
+func permissionOr(funcs ...func(string, map[string]map[string]bool) bool) func(string, map[string]map[string]bool) bool {
+	return func(roleName string, permissionsMap map[string]map[string]bool) bool {
+		for _, f := range funcs {
+			if f(roleName, permissionsMap) {
+				return true
+			}
+		}
+		return false
+	}
+}
+
+func permissionAnd(funcs ...func(string, map[string]map[string]bool) bool) func(string, map[string]map[string]bool) bool {
+	return func(roleName string, permissionsMap map[string]map[string]bool) bool {
+		for _, f := range funcs {
+			if !f(roleName, permissionsMap) {
+				return false
+			}
+		}
+		return true
+	}
+}
+
+func applyPermissionsMap(roleName string, roleMap map[string]map[string]bool, migrationMap permissionsMap) []string {
+	var result []string
+
+	for _, transformation := range migrationMap {
+		if transformation.On(roleName, roleMap) {
+			for _, permission := range transformation.Add {
+				roleMap[roleName][permission] = true
+			}
+			for _, permission := range transformation.Remove {
+				roleMap[roleName][permission] = false
+			}
+		}
+	}
+
+	for key, active := range roleMap[roleName] {
+		if active {
+			result = append(result, key)
+		}
+	}
+	return result
+}
+
+func (a *App) doPermissionsMigration(key string, migrationMap permissionsMap) *model.AppError {
+	if result := <-a.Srv.Store.System().GetByName(key); result.Err == nil {
+		return nil
+	}
+
+	roles, err := a.GetAllRoles()
+	if err != nil {
+		return err
+	}
+
+	roleMap := make(map[string]map[string]bool)
+	for _, role := range roles {
+		roleMap[role.Name] = make(map[string]bool)
+		for _, permission := range role.Permissions {
+			roleMap[role.Name][permission] = true
+		}
+	}
+
+	for _, role := range roles {
+		role.Permissions = applyPermissionsMap(role.Name, roleMap, migrationMap)
+		if result := <-a.Srv.Store.Role().Save(role); result.Err != nil {
+			return result.Err
+		}
+	}
+
+	if result := <-a.Srv.Store.System().Save(&model.System{Name: key, Value: "true"}); result.Err != nil {
+		return result.Err
+	}
+	return nil
+}
+
+func applyChannelManageDeleteToChannelUser() permissionsMap {
+	return permissionsMap{
+		permissionTransformation{
+			On:  permissionAnd(isRole(model.CHANNEL_USER_ROLE_ID), onOtherRole(model.TEAM_USER_ROLE_ID, permissionExists(PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES))),
+			Add: []string{PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES},
+		},
+		permissionTransformation{
+			On:  permissionAnd(isRole(model.CHANNEL_USER_ROLE_ID), onOtherRole(model.TEAM_USER_ROLE_ID, permissionExists(PERMISSION_DELETE_PRIVATE_CHANNEL))),
+			Add: []string{PERMISSION_DELETE_PRIVATE_CHANNEL},
+		},
+		permissionTransformation{
+			On:  permissionAnd(isRole(model.CHANNEL_USER_ROLE_ID), onOtherRole(model.TEAM_USER_ROLE_ID, permissionExists(PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES))),
+			Add: []string{PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES},
+		},
+		permissionTransformation{
+			On:  permissionAnd(isRole(model.CHANNEL_USER_ROLE_ID), onOtherRole(model.TEAM_USER_ROLE_ID, permissionExists(PERMISSION_DELETE_PUBLIC_CHANNEL))),
+			Add: []string{PERMISSION_DELETE_PUBLIC_CHANNEL},
+		},
+	}
+}
+
+func removeChannelManageDeleteFromTeamUser() permissionsMap {
+	return permissionsMap{
+		permissionTransformation{
+			On:     permissionAnd(isRole(model.TEAM_USER_ROLE_ID), permissionExists(PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES)),
+			Remove: []string{PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES},
+		},
+		permissionTransformation{
+			On:     permissionAnd(isRole(model.TEAM_USER_ROLE_ID), permissionExists(PERMISSION_DELETE_PRIVATE_CHANNEL)),
+			Remove: []string{model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id},
+		},
+		permissionTransformation{
+			On:     permissionAnd(isRole(model.TEAM_USER_ROLE_ID), permissionExists(PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES)),
+			Remove: []string{PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES},
+		},
+		permissionTransformation{
+			On:     permissionAnd(isRole(model.TEAM_USER_ROLE_ID), permissionExists(PERMISSION_DELETE_PUBLIC_CHANNEL)),
+			Remove: []string{PERMISSION_DELETE_PUBLIC_CHANNEL},
+		},
+	}
+}
+
+// DoPermissionsMigrations execute all the permissions migrations need by the current version.
+func (a *App) DoPermissionsMigrations() *model.AppError {
+	PermissionsMigrations := []struct {
+		Key       string
+		Migration func() permissionsMap
+	}{
+		{Key: MIGRATION_KEY_APPLY_CHANNEL_MANAGE_DELETE_TO_CHANNEL_USER, Migration: applyChannelManageDeleteToChannelUser},
+		{Key: MIGRATION_KEY_REMOVE_CHANNEL_MANAGE_DELETE_FROM_TEAM_USER, Migration: removeChannelManageDeleteFromTeamUser},
+	}
+
+	for _, migration := range PermissionsMigrations {
+		if err := a.doPermissionsMigration(migration.Key, migration.Migration()); err != nil {
+			return err
+		}
+	}
+	return nil
+}

app/permissions_migrations_test.go

@@ -0,0 +1,203 @@
+// Copyright (c) 2018-present Mattermost, Inc. All Rights Reserved.
+// See License.txt for license information.
+
+package app
+
+import (
+	"sort"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestApplyPermissionsMap(t *testing.T) {
+	tt := []struct {
+		Name           string
+		RoleMap        map[string]map[string]bool
+		TranslationMap permissionsMap
+		ExpectedResult []string
+	}{
+		{
+			"Split existing",
+			map[string]map[string]bool{
+				"system_admin": {
+					"test1": true,
+					"test2": true,
+					"test3": true,
+				},
+			},
+			permissionsMap{permissionTransformation{On: permissionExists("test2"), Add: []string{"test4", "test5"}}},
+			[]string{"test1", "test2", "test3", "test4", "test5"},
+		},
+		{
+			"Remove existing",
+			map[string]map[string]bool{
+				"system_admin": {
+					"test1": true,
+					"test2": true,
+					"test3": true,
+				},
+			},
+			permissionsMap{permissionTransformation{On: permissionExists("test2"), Remove: []string{"test2"}}},
+			[]string{"test1", "test3"},
+		},
+		{
+			"Rename existing",
+			map[string]map[string]bool{
+				"system_admin": {
+					"test1": true,
+					"test2": true,
+					"test3": true,
+				},
+			},
+			permissionsMap{permissionTransformation{On: permissionExists("test2"), Add: []string{"test5"}, Remove: []string{"test2"}}},
+			[]string{"test1", "test3", "test5"},
+		},
+		{
+			"Remove when other not exists",
+			map[string]map[string]bool{
+				"system_admin": {
+					"test1": true,
+					"test2": true,
+					"test3": true,
+				},
+			},
+			permissionsMap{permissionTransformation{On: permissionNotExists("test5"), Remove: []string{"test2"}}},
+			[]string{"test1", "test3"},
+		},
+		{
+			"Add when at least one exists",
+			map[string]map[string]bool{
+				"system_admin": {
+					"test1": true,
+					"test2": true,
+					"test3": true,
+				},
+			},
+			permissionsMap{permissionTransformation{
+				On:  permissionOr(permissionExists("test5"), permissionExists("test3")),
+				Add: []string{"test4"},
+			}},
+			[]string{"test1", "test2", "test3", "test4"},
+		},
+		{
+			"Add when all exists",
+			map[string]map[string]bool{
+				"system_admin": {
+					"test1": true,
+					"test2": true,
+					"test3": true,
+				},
+			},
+			permissionsMap{permissionTransformation{
+				On:  permissionAnd(permissionExists("test1"), permissionExists("test2")),
+				Add: []string{"test4"},
+			}},
+			[]string{"test1", "test2", "test3", "test4"},
+		},
+		{
+			"Not add when one in the and not exists",
+			map[string]map[string]bool{
+				"system_admin": {
+					"test1": true,
+					"test2": true,
+					"test3": true,
+				},
+			},
+			permissionsMap{permissionTransformation{
+				On:  permissionAnd(permissionExists("test1"), permissionExists("test5")),
+				Add: []string{"test4"},
+			}},
+			[]string{"test1", "test2", "test3"},
+		},
+		{
+			"Not Add when none on the or exists",
+			map[string]map[string]bool{
+				"system_admin": {
+					"test1": true,
+					"test2": true,
+					"test3": true,
+				},
+			},
+			permissionsMap{permissionTransformation{
+				On:  permissionOr(permissionExists("test7"), permissionExists("test9")),
+				Add: []string{"test4"},
+			}},
+			[]string{"test1", "test2", "test3"},
+		},
+		{
+			"When the role matches",
+			map[string]map[string]bool{
+				"system_admin": {
+					"test1": true,
+					"test2": true,
+					"test3": true,
+				},
+			},
+			permissionsMap{permissionTransformation{
+				On:  isRole("system_admin"),
+				Add: []string{"test4"},
+			}},
+			[]string{"test1", "test2", "test3", "test4"},
+		},
+		{
+			"When the role doesn't match",
+			map[string]map[string]bool{
+				"system_admin": {
+					"test1": true,
+					"test2": true,
+					"test3": true,
+				},
+			},
+			permissionsMap{permissionTransformation{
+				On:  isRole("system_user"),
+				Add: []string{"test4"},
+			}},
+			[]string{"test1", "test2", "test3"},
+		},
+		{
+			"Remove a permission conditional on another role having it, success case",
+			map[string]map[string]bool{
+				"system_admin": {
+					"test1": true,
+					"test2": true,
+					"test3": true,
+				},
+				"other_role": {
+					"test4": true,
+				},
+			},
+			permissionsMap{permissionTransformation{
+				On:     onOtherRole("other_role", permissionExists("test4")),
+				Remove: []string{"test1"},
+			}},
+			[]string{"test2", "test3"},
+		},
+		{
+			"Remove a permission conditional on another role having it, failure case",
+			map[string]map[string]bool{
+				"system_admin": {
+					"test1": true,
+					"test2": true,
+					"test4": true,
+				},
+				"other_role": {
+					"test1": true,
+				},
+			},
+			permissionsMap{permissionTransformation{
+				On:     onOtherRole("other_role", permissionExists("test4")),
+				Remove: []string{"test1"},
+			}},
+			[]string{"test1", "test2", "test4"},
+		},
+	}
+
+	for _, tc := range tt {
+		t.Run(tc.Name, func(t *testing.T) {
+			result := applyPermissionsMap("system_admin", tc.RoleMap, tc.TranslationMap)
+			sort.Strings(result)
+			assert.Equal(t, tc.ExpectedResult, result)
+		})
+	}
+}

app/role.go

@@ -36,6 +36,14 @@ func (a *App) GetRolesByNames(names []string) ([]*model.Role, *model.AppError) {
 	return result.Data.([]*model.Role), nil
 }
 
+func (a *App) GetAllRoles() ([]*model.Role, *model.AppError) {
+	result := <-a.Srv.Store.Role().GetAll()
+	if result.Err != nil {
+		return nil, result.Err
+	}
+	return result.Data.([]*model.Role), nil
+}
+
 func (a *App) PatchRole(role *model.Role, patch *model.RolePatch) (*model.Role, *model.AppError) {
 	// If patch is a no-op then short-circuit the store.
 	if patch.Permissions != nil && reflect.DeepEqual(*patch.Permissions, role.Permissions) {

app/server_app_adapters.go

@@ -133,6 +133,7 @@ func (s *Server) RunOldAppInitalization() error {
 
 	s.FakeApp().DoAdvancedPermissionsMigration()
 	s.FakeApp().DoEmojisPermissionsMigration()
+	s.FakeApp().DoPermissionsMigrations()
 
 	s.FakeApp().InitPostMetadata()
 

cmd/mattermost/commands/init.go

@@ -26,6 +26,7 @@ func InitDBCommandContextCobra(command *cobra.Command) (*app.App, error) {
 	a.InitPlugins(*a.Config().PluginSettings.Directory, *a.Config().PluginSettings.ClientDirectory)
 	a.DoAdvancedPermissionsMigration()
 	a.DoEmojisPermissionsMigration()
+	a.DoPermissionsMigrations()
 
 	return a, nil
 }

migrations/helper_test.go

@@ -77,6 +77,7 @@ func setupTestHelper(enterprise bool) *TestHelper {
 
 	th.App.DoAdvancedPermissionsMigration()
 	th.App.DoEmojisPermissionsMigration()
+	th.App.DoPermissionsMigrations()
 
 	th.App.Srv.Store.MarkSystemRanUnitTests()
 

store/layered_store.go

@@ -298,6 +298,12 @@ func (s *LayeredRoleStore) Delete(roldId string) StoreChannel {
 	})
 }
 
+func (s *LayeredRoleStore) GetAll() StoreChannel {
+	return s.RunQuery(func(supplier LayeredStoreSupplier) *LayeredStoreSupplierResult {
+		return supplier.RoleGetAll(s.TmpContext)
+	})
+}
+
 func (s *LayeredRoleStore) PermanentDeleteAll() StoreChannel {
 	return s.RunQuery(func(supplier LayeredStoreSupplier) *LayeredStoreSupplierResult {
 		return supplier.RolePermanentDeleteAll(s.TmpContext)

store/layered_store_supplier.go

@@ -37,6 +37,7 @@ type LayeredStoreSupplier interface {
 	RoleGetByName(ctx context.Context, name string, hints ...LayeredStoreHint) *LayeredStoreSupplierResult
 	RoleGetByNames(ctx context.Context, names []string, hints ...LayeredStoreHint) *LayeredStoreSupplierResult
 	RoleDelete(ctx context.Context, roldId string, hints ...LayeredStoreHint) *LayeredStoreSupplierResult
+	RoleGetAll(ctx context.Context, hints ...LayeredStoreHint) *LayeredStoreSupplierResult
 	RolePermanentDeleteAll(ctx context.Context, hints ...LayeredStoreHint) *LayeredStoreSupplierResult
 
 	// Schemes

store/local_cache_supplier_roles.go

@@ -80,6 +80,12 @@ func (s *LocalCacheSupplier) RoleDelete(ctx context.Context, roleId string, hint
 	return result
 }
 
+func (s *LocalCacheSupplier) RoleGetAll(ctx context.Context, hints ...LayeredStoreHint) *LayeredStoreSupplierResult {
+	// Roles are cached by name, as that is most commonly how they are looked up.
+	// This means that no caching is supported on roles being listed.
+	return s.Next().RoleGetAll(ctx, hints...)
+}
+
 func (s *LocalCacheSupplier) RolePermanentDeleteAll(ctx context.Context, hints ...LayeredStoreHint) *LayeredStoreSupplierResult {
 	defer s.roleCache.Purge()
 	defer s.doClearCacheCluster(s.roleCache)

store/redis_supplier_roles.go

@@ -102,6 +102,12 @@ func (s *RedisSupplier) RoleDelete(ctx context.Context, roleId string, hints ...
 	return s.Next().RoleDelete(ctx, roleId, hints...)
 }
 
+func (s *RedisSupplier) RoleGetAll(ctx context.Context, hints ...LayeredStoreHint) *LayeredStoreSupplierResult {
+	// Roles are cached by name, as that is most commonly how they are looked up.
+	// This means that no caching is supported on roles being listed.
+	return s.Next().RoleGetAll(ctx, hints...)
+}
+
 func (s *RedisSupplier) RolePermanentDeleteAll(ctx context.Context, hints ...LayeredStoreHint) *LayeredStoreSupplierResult {
 	defer func() {
 		if keys, err := s.client.Keys("roles:*").Result(); err != nil {

store/sqlstore/role_supplier.go

@@ -241,6 +241,27 @@ func (s *SqlSupplier) RoleDelete(ctx context.Context, roleId string, hints ...st
 	return result
 }
 
+func (s *SqlSupplier) RoleGetAll(ctx context.Context, hints ...store.LayeredStoreHint) *store.LayeredStoreSupplierResult {
+	result := store.NewSupplierResult()
+
+	var dbRoles []Role
+	if _, err := s.GetReplica().Select(&dbRoles, "SELECT * from Roles", map[string]interface{}{}); err != nil {
+		if err == sql.ErrNoRows {
+			result.Err = model.NewAppError("SqlRoleStore.GetAll", "store.sql_role.get_all.app_error", nil, err.Error(), http.StatusNotFound)
+		} else {
+			result.Err = model.NewAppError("SqlRoleStore.GetAll", "store.sql_role.get_all.app_error", nil, err.Error(), http.StatusInternalServerError)
+		}
+	}
+
+	var roles []*model.Role
+	for _, dbRole := range dbRoles {
+		roles = append(roles, dbRole.ToModel())
+	}
+	result.Data = roles
+
+	return result
+}
+
 func (s *SqlSupplier) RolePermanentDeleteAll(ctx context.Context, hints ...store.LayeredStoreHint) *store.LayeredStoreSupplierResult {
 	result := store.NewSupplierResult()
 

store/store.go

@@ -515,6 +515,7 @@ type RoleStore interface {
 	Get(roleId string) StoreChannel
 	GetByName(name string) StoreChannel
 	GetByNames(names []string) StoreChannel
+	GetAll() StoreChannel
 	Delete(roldId string) StoreChannel
 	PermanentDeleteAll() StoreChannel
 }

store/storetest/mocks/LayeredStoreDatabaseLayer.go

@@ -952,6 +952,29 @@ func (_m *LayeredStoreDatabaseLayer) RoleGet(ctx context.Context, roleId string,
 	return r0
 }
 
+// RoleGetAll provides a mock function with given fields: ctx, hints
+func (_m *LayeredStoreDatabaseLayer) RoleGetAll(ctx context.Context, hints ...store.LayeredStoreHint) *store.LayeredStoreSupplierResult {
+	_va := make([]interface{}, len(hints))
+	for _i := range hints {
+		_va[_i] = hints[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, ctx)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	var r0 *store.LayeredStoreSupplierResult
+	if rf, ok := ret.Get(0).(func(context.Context, ...store.LayeredStoreHint) *store.LayeredStoreSupplierResult); ok {
+		r0 = rf(ctx, hints...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*store.LayeredStoreSupplierResult)
+		}
+	}
+
+	return r0
+}
+
 // RoleGetByName provides a mock function with given fields: ctx, name, hints
 func (_m *LayeredStoreDatabaseLayer) RoleGetByName(ctx context.Context, name string, hints ...store.LayeredStoreHint) *store.LayeredStoreSupplierResult {
 	_va := make([]interface{}, len(hints))

store/storetest/mocks/LayeredStoreSupplier.go

@@ -628,6 +628,29 @@ func (_m *LayeredStoreSupplier) RoleGet(ctx context.Context, roleId string, hint
 	return r0
 }
 
+// RoleGetAll provides a mock function with given fields: ctx, hints
+func (_m *LayeredStoreSupplier) RoleGetAll(ctx context.Context, hints ...store.LayeredStoreHint) *store.LayeredStoreSupplierResult {
+	_va := make([]interface{}, len(hints))
+	for _i := range hints {
+		_va[_i] = hints[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, ctx)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	var r0 *store.LayeredStoreSupplierResult
+	if rf, ok := ret.Get(0).(func(context.Context, ...store.LayeredStoreHint) *store.LayeredStoreSupplierResult); ok {
+		r0 = rf(ctx, hints...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*store.LayeredStoreSupplierResult)
+		}
+	}
+
+	return r0
+}
+
 // RoleGetByName provides a mock function with given fields: ctx, name, hints
 func (_m *LayeredStoreSupplier) RoleGetByName(ctx context.Context, name string, hints ...store.LayeredStoreHint) *store.LayeredStoreSupplierResult {
 	_va := make([]interface{}, len(hints))

store/storetest/mocks/RoleStore.go

@@ -45,6 +45,22 @@ func (_m *RoleStore) Get(roleId string) store.StoreChannel {
 	return r0
 }
 
+// GetAll provides a mock function with given fields:
+func (_m *RoleStore) GetAll() store.StoreChannel {
+	ret := _m.Called()
+
+	var r0 store.StoreChannel
+	if rf, ok := ret.Get(0).(func() store.StoreChannel); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(store.StoreChannel)
+		}
+	}
+
+	return r0
+}
+
 // GetByName provides a mock function with given fields: name
 func (_m *RoleStore) GetByName(name string) store.StoreChannel {
 	ret := _m.Called(name)

store/storetest/role_store.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/mattermost/mattermost-server/model"
 	"github.com/mattermost/mattermost-server/store"
@@ -18,6 +19,7 @@ func TestRoleStore(t *testing.T, ss store.Store) {
 	t.Run("GetByName", func(t *testing.T) { testRoleStoreGetByName(t, ss) })
 	t.Run("GetNames", func(t *testing.T) { testRoleStoreGetByNames(t, ss) })
 	t.Run("Delete", func(t *testing.T) { testRoleStoreDelete(t, ss) })
+	t.Run("GetAll", func(t *testing.T) { testRoleStoreGetAll(t, ss) })
 	t.Run("PermanentDeleteAll", func(t *testing.T) { testRoleStorePermanentDeleteAll(t, ss) })
 }
 
@@ -288,6 +290,48 @@ func testRoleStoreDelete(t *testing.T, ss store.Store) {
 	assert.NotNil(t, res6.Err)
 }
 
+func testRoleStoreGetAll(t *testing.T, ss store.Store) {
+	prev := <-ss.Role().GetAll()
+	require.Nil(t, prev.Err)
+	prevCount := len(prev.Data.([]*model.Role))
+
+	// Save a role to test with.
+	r1 := &model.Role{
+		Name:        model.NewId(),
+		DisplayName: model.NewId(),
+		Description: model.NewId(),
+		Permissions: []string{
+			"invite_user",
+			"create_public_channel",
+			"add_user_to_team",
+		},
+		SchemeManaged: false,
+	}
+
+	res1 := <-ss.Role().Save(r1)
+
+	require.Nil(t, res1.Err)
+
+	r2 := &model.Role{
+		Name:        model.NewId(),
+		DisplayName: model.NewId(),
+		Description: model.NewId(),
+		Permissions: []string{
+			"invite_user",
+			"create_public_channel",
+			"add_user_to_team",
+		},
+		SchemeManaged: false,
+	}
+	res2 := <-ss.Role().Save(r2)
+	require.Nil(t, res2.Err)
+
+	res3 := <-ss.Role().GetAll()
+	require.Nil(t, res3.Err)
+	data := res3.Data.([]*model.Role)
+	assert.Len(t, data, prevCount+2)
+}
+
 func testRoleStorePermanentDeleteAll(t *testing.T, ss store.Store) {
 	r1 := &model.Role{
 		Name:        model.NewId(),

utils/authorization.go

@@ -31,8 +31,8 @@ func SetRolePermissionsFromConfig(roles map[string]*model.Role, cfg *model.Confi
 	if isLicensed {
 		switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement {
 		case model.PERMISSIONS_ALL:
-			roles[model.TEAM_USER_ROLE_ID].Permissions = append(
-				roles[model.TEAM_USER_ROLE_ID].Permissions,
+			roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+				roles[model.CHANNEL_USER_ROLE_ID].Permissions,
 				model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id,
 			)
 		case model.PERMISSIONS_CHANNEL_ADMIN:
@@ -51,8 +51,8 @@ func SetRolePermissionsFromConfig(roles map[string]*model.Role, cfg *model.Confi
 			)
 		}
 	} else {
-		roles[model.TEAM_USER_ROLE_ID].Permissions = append(
-			roles[model.TEAM_USER_ROLE_ID].Permissions,
+		roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+			roles[model.CHANNEL_USER_ROLE_ID].Permissions,
 			model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id,
 		)
 	}
@@ -60,8 +60,8 @@ func SetRolePermissionsFromConfig(roles map[string]*model.Role, cfg *model.Confi
 	if isLicensed {
 		switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelDeletion {
 		case model.PERMISSIONS_ALL:
-			roles[model.TEAM_USER_ROLE_ID].Permissions = append(
-				roles[model.TEAM_USER_ROLE_ID].Permissions,
+			roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+				roles[model.CHANNEL_USER_ROLE_ID].Permissions,
 				model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id,
 			)
 		case model.PERMISSIONS_CHANNEL_ADMIN:
@@ -80,8 +80,8 @@ func SetRolePermissionsFromConfig(roles map[string]*model.Role, cfg *model.Confi
 			)
 		}
 	} else {
-		roles[model.TEAM_USER_ROLE_ID].Permissions = append(
-			roles[model.TEAM_USER_ROLE_ID].Permissions,
+		roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+			roles[model.CHANNEL_USER_ROLE_ID].Permissions,
 			model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id,
 		)
 	}
@@ -109,8 +109,8 @@ func SetRolePermissionsFromConfig(roles map[string]*model.Role, cfg *model.Confi
 	if isLicensed {
 		switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement {
 		case model.PERMISSIONS_ALL:
-			roles[model.TEAM_USER_ROLE_ID].Permissions = append(
-				roles[model.TEAM_USER_ROLE_ID].Permissions,
+			roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+				roles[model.CHANNEL_USER_ROLE_ID].Permissions,
 				model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id,
 			)
 		case model.PERMISSIONS_CHANNEL_ADMIN:
@@ -129,8 +129,8 @@ func SetRolePermissionsFromConfig(roles map[string]*model.Role, cfg *model.Confi
 			)
 		}
 	} else {
-		roles[model.TEAM_USER_ROLE_ID].Permissions = append(
-			roles[model.TEAM_USER_ROLE_ID].Permissions,
+		roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+			roles[model.CHANNEL_USER_ROLE_ID].Permissions,
 			model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id,
 		)
 	}
@@ -138,8 +138,8 @@ func SetRolePermissionsFromConfig(roles map[string]*model.Role, cfg *model.Confi
 	if isLicensed {
 		switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelDeletion {
 		case model.PERMISSIONS_ALL:
-			roles[model.TEAM_USER_ROLE_ID].Permissions = append(
-				roles[model.TEAM_USER_ROLE_ID].Permissions,
+			roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+				roles[model.CHANNEL_USER_ROLE_ID].Permissions,
 				model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id,
 			)
 		case model.PERMISSIONS_CHANNEL_ADMIN:
@@ -158,8 +158,8 @@ func SetRolePermissionsFromConfig(roles map[string]*model.Role, cfg *model.Confi
 			)
 		}
 	} else {
-		roles[model.TEAM_USER_ROLE_ID].Permissions = append(
-			roles[model.TEAM_USER_ROLE_ID].Permissions,
+		roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+			roles[model.CHANNEL_USER_ROLE_ID].Permissions,
 			model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id,
 		)
 	}

utils/policies-roles-mapping.json

@@ -101,14 +101,14 @@
     "restrictPublicChannelManagement": {
         "all": [
             {
-                "roleName": "team_user",
+                "roleName": "channel_user",
                 "permission": "manage_public_channel_properties",
                 "shouldHave": true
             }
         ],
         "channel_admin": [
             {
-                "roleName": "team_user",
+                "roleName": "channel_user",
                 "permission": "manage_public_channel_properties",
                 "shouldHave": false
             },
@@ -125,7 +125,7 @@
         ],
         "team_admin": [
             {
-                "roleName": "team_user",
+                "roleName": "channel_user",
                 "permission": "manage_public_channel_properties",
                 "shouldHave": false
             },
@@ -142,7 +142,7 @@
         ],
         "system_admin": [
             {
-                "roleName": "team_user",
+                "roleName": "channel_user",
                 "permission": "manage_public_channel_properties",
                 "shouldHave": false
             },
@@ -161,14 +161,14 @@
     "restrictPublicChannelDeletion": {
         "all": [
             {
-                "roleName": "team_user",
+                "roleName": "channel_user",
                 "permission": "delete_public_channel",
                 "shouldHave": true
             }
         ],
         "channel_admin": [
             {
-                "roleName": "team_user",
+                "roleName": "channel_user",
                 "permission": "delete_public_channel",
                 "shouldHave": false
             },
@@ -185,7 +185,7 @@
         ],
         "team_admin": [
             {
-                "roleName": "team_user",
+                "roleName": "channel_user",
                 "permission": "delete_public_channel",
                 "shouldHave": false
             },
@@ -202,7 +202,7 @@
         ],
         "system_admin": [
             {
-                "roleName": "team_user",
+                "roleName": "channel_user",
                 "permission": "delete_public_channel",
                 "shouldHave": false
             },
@@ -221,14 +221,14 @@
     "restrictPrivateChannelManagement": {
         "all": [
             {
-                "roleName": "team_user",
+                "roleName": "channel_user",
                 "permission": "manage_private_channel_properties",
                 "shouldHave": true
             }
         ],
         "channel_admin": [
             {
-                "roleName": "team_user",
+                "roleName": "channel_user",
                 "permission": "manage_private_channel_properties",
                 "shouldHave": false
             },
@@ -245,7 +245,7 @@
         ],
         "team_admin": [
             {
-                "roleName": "team_user",
+                "roleName": "channel_user",
                 "permission": "manage_private_channel_properties",
                 "shouldHave": false
             },
@@ -262,7 +262,7 @@
         ],
         "system_admin": [
             {
-                "roleName": "team_user",
+                "roleName": "channel_user",
                 "permission": "manage_private_channel_properties",
                 "shouldHave": false
             },
@@ -341,14 +341,14 @@
     "restrictPrivateChannelDeletion": {
         "all": [
             {
-                "roleName": "team_user",
+                "roleName": "channel_user",
                 "permission": "delete_private_channel",
                 "shouldHave": true
             }
         ],
         "channel_admin": [
             {
-                "roleName": "team_user",
+                "roleName": "channel_user",
                 "permission": "delete_private_channel",
                 "shouldHave": false
             },
@@ -365,7 +365,7 @@
         ],
         "team_admin": [
             {
-                "roleName": "team_user",
+                "roleName": "channel_user",
                 "permission": "delete_private_channel",
                 "shouldHave": false
             },
@@ -382,7 +382,7 @@
         ],
         "system_admin": [
             {
-                "roleName": "team_user",
+                "roleName": "channel_user",
                 "permission": "delete_private_channel",
                 "shouldHave": false
             },

web/web_test.go

@@ -47,6 +47,7 @@ func Setup() *TestHelper {
 
 	a.DoAdvancedPermissionsMigration()
 	a.DoEmojisPermissionsMigration()
+	a.DoPermissionsMigrations()
 
 	a.Srv.Store.MarkSystemRanUnitTests()