github.com/fretkak/mattermost-mattermost-server@v5.11.1+incompatible/utils/authorization.go (about) 1 // Copyright (c) 2016-present Mattermost, Inc. All Rights Reserved. 2 // See License.txt for license information. 3 4 package utils 5 6 import ( 7 "github.com/mattermost/mattermost-server/model" 8 ) 9 10 func SetRolePermissionsFromConfig(roles map[string]*model.Role, cfg *model.Config, isLicensed bool) map[string]*model.Role { 11 if isLicensed { 12 switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelCreation { 13 case model.PERMISSIONS_ALL: 14 roles[model.TEAM_USER_ROLE_ID].Permissions = append( 15 roles[model.TEAM_USER_ROLE_ID].Permissions, 16 model.PERMISSION_CREATE_PUBLIC_CHANNEL.Id, 17 ) 18 case model.PERMISSIONS_TEAM_ADMIN: 19 roles[model.TEAM_ADMIN_ROLE_ID].Permissions = append( 20 roles[model.TEAM_ADMIN_ROLE_ID].Permissions, 21 model.PERMISSION_CREATE_PUBLIC_CHANNEL.Id, 22 ) 23 } 24 } else { 25 roles[model.TEAM_USER_ROLE_ID].Permissions = append( 26 roles[model.TEAM_USER_ROLE_ID].Permissions, 27 model.PERMISSION_CREATE_PUBLIC_CHANNEL.Id, 28 ) 29 } 30 31 if isLicensed { 32 switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelManagement { 33 case model.PERMISSIONS_ALL: 34 roles[model.CHANNEL_USER_ROLE_ID].Permissions = append( 35 roles[model.CHANNEL_USER_ROLE_ID].Permissions, 36 model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id, 37 ) 38 case model.PERMISSIONS_CHANNEL_ADMIN: 39 roles[model.TEAM_ADMIN_ROLE_ID].Permissions = append( 40 roles[model.TEAM_ADMIN_ROLE_ID].Permissions, 41 model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id, 42 ) 43 roles[model.CHANNEL_ADMIN_ROLE_ID].Permissions = append( 44 roles[model.CHANNEL_ADMIN_ROLE_ID].Permissions, 45 model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id, 46 ) 47 case model.PERMISSIONS_TEAM_ADMIN: 48 roles[model.TEAM_ADMIN_ROLE_ID].Permissions = append( 49 roles[model.TEAM_ADMIN_ROLE_ID].Permissions, 50 model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id, 51 ) 52 } 53 } else { 54 roles[model.CHANNEL_USER_ROLE_ID].Permissions = append( 55 roles[model.CHANNEL_USER_ROLE_ID].Permissions, 56 model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id, 57 ) 58 } 59 60 if isLicensed { 61 switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPublicChannelDeletion { 62 case model.PERMISSIONS_ALL: 63 roles[model.CHANNEL_USER_ROLE_ID].Permissions = append( 64 roles[model.CHANNEL_USER_ROLE_ID].Permissions, 65 model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id, 66 ) 67 case model.PERMISSIONS_CHANNEL_ADMIN: 68 roles[model.TEAM_ADMIN_ROLE_ID].Permissions = append( 69 roles[model.TEAM_ADMIN_ROLE_ID].Permissions, 70 model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id, 71 ) 72 roles[model.CHANNEL_ADMIN_ROLE_ID].Permissions = append( 73 roles[model.CHANNEL_ADMIN_ROLE_ID].Permissions, 74 model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id, 75 ) 76 case model.PERMISSIONS_TEAM_ADMIN: 77 roles[model.TEAM_ADMIN_ROLE_ID].Permissions = append( 78 roles[model.TEAM_ADMIN_ROLE_ID].Permissions, 79 model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id, 80 ) 81 } 82 } else { 83 roles[model.CHANNEL_USER_ROLE_ID].Permissions = append( 84 roles[model.CHANNEL_USER_ROLE_ID].Permissions, 85 model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id, 86 ) 87 } 88 89 if isLicensed { 90 switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelCreation { 91 case model.PERMISSIONS_ALL: 92 roles[model.TEAM_USER_ROLE_ID].Permissions = append( 93 roles[model.TEAM_USER_ROLE_ID].Permissions, 94 model.PERMISSION_CREATE_PRIVATE_CHANNEL.Id, 95 ) 96 case model.PERMISSIONS_TEAM_ADMIN: 97 roles[model.TEAM_ADMIN_ROLE_ID].Permissions = append( 98 roles[model.TEAM_ADMIN_ROLE_ID].Permissions, 99 model.PERMISSION_CREATE_PRIVATE_CHANNEL.Id, 100 ) 101 } 102 } else { 103 roles[model.TEAM_USER_ROLE_ID].Permissions = append( 104 roles[model.TEAM_USER_ROLE_ID].Permissions, 105 model.PERMISSION_CREATE_PRIVATE_CHANNEL.Id, 106 ) 107 } 108 109 if isLicensed { 110 switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManagement { 111 case model.PERMISSIONS_ALL: 112 roles[model.CHANNEL_USER_ROLE_ID].Permissions = append( 113 roles[model.CHANNEL_USER_ROLE_ID].Permissions, 114 model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id, 115 ) 116 case model.PERMISSIONS_CHANNEL_ADMIN: 117 roles[model.TEAM_ADMIN_ROLE_ID].Permissions = append( 118 roles[model.TEAM_ADMIN_ROLE_ID].Permissions, 119 model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id, 120 ) 121 roles[model.CHANNEL_ADMIN_ROLE_ID].Permissions = append( 122 roles[model.CHANNEL_ADMIN_ROLE_ID].Permissions, 123 model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id, 124 ) 125 case model.PERMISSIONS_TEAM_ADMIN: 126 roles[model.TEAM_ADMIN_ROLE_ID].Permissions = append( 127 roles[model.TEAM_ADMIN_ROLE_ID].Permissions, 128 model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id, 129 ) 130 } 131 } else { 132 roles[model.CHANNEL_USER_ROLE_ID].Permissions = append( 133 roles[model.CHANNEL_USER_ROLE_ID].Permissions, 134 model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id, 135 ) 136 } 137 138 if isLicensed { 139 switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelDeletion { 140 case model.PERMISSIONS_ALL: 141 roles[model.CHANNEL_USER_ROLE_ID].Permissions = append( 142 roles[model.CHANNEL_USER_ROLE_ID].Permissions, 143 model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id, 144 ) 145 case model.PERMISSIONS_CHANNEL_ADMIN: 146 roles[model.TEAM_ADMIN_ROLE_ID].Permissions = append( 147 roles[model.TEAM_ADMIN_ROLE_ID].Permissions, 148 model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id, 149 ) 150 roles[model.CHANNEL_ADMIN_ROLE_ID].Permissions = append( 151 roles[model.CHANNEL_ADMIN_ROLE_ID].Permissions, 152 model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id, 153 ) 154 case model.PERMISSIONS_TEAM_ADMIN: 155 roles[model.TEAM_ADMIN_ROLE_ID].Permissions = append( 156 roles[model.TEAM_ADMIN_ROLE_ID].Permissions, 157 model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id, 158 ) 159 } 160 } else { 161 roles[model.CHANNEL_USER_ROLE_ID].Permissions = append( 162 roles[model.CHANNEL_USER_ROLE_ID].Permissions, 163 model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id, 164 ) 165 } 166 167 // Restrict permissions for Private Channel Manage Members 168 if isLicensed { 169 switch *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictPrivateChannelManageMembers { 170 case model.PERMISSIONS_ALL: 171 roles[model.CHANNEL_USER_ROLE_ID].Permissions = append( 172 roles[model.CHANNEL_USER_ROLE_ID].Permissions, 173 model.PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS.Id, 174 ) 175 case model.PERMISSIONS_CHANNEL_ADMIN: 176 roles[model.TEAM_ADMIN_ROLE_ID].Permissions = append( 177 roles[model.TEAM_ADMIN_ROLE_ID].Permissions, 178 model.PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS.Id, 179 ) 180 roles[model.CHANNEL_ADMIN_ROLE_ID].Permissions = append( 181 roles[model.CHANNEL_ADMIN_ROLE_ID].Permissions, 182 model.PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS.Id, 183 ) 184 case model.PERMISSIONS_TEAM_ADMIN: 185 roles[model.TEAM_ADMIN_ROLE_ID].Permissions = append( 186 roles[model.TEAM_ADMIN_ROLE_ID].Permissions, 187 model.PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS.Id, 188 ) 189 } 190 } else { 191 roles[model.CHANNEL_USER_ROLE_ID].Permissions = append( 192 roles[model.CHANNEL_USER_ROLE_ID].Permissions, 193 model.PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS.Id, 194 ) 195 } 196 197 if !*cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_EnableOnlyAdminIntegrations { 198 roles[model.TEAM_USER_ROLE_ID].Permissions = append( 199 roles[model.TEAM_USER_ROLE_ID].Permissions, 200 model.PERMISSION_MANAGE_INCOMING_WEBHOOKS.Id, 201 model.PERMISSION_MANAGE_OUTGOING_WEBHOOKS.Id, 202 model.PERMISSION_MANAGE_SLASH_COMMANDS.Id, 203 ) 204 roles[model.SYSTEM_USER_ROLE_ID].Permissions = append( 205 roles[model.SYSTEM_USER_ROLE_ID].Permissions, 206 model.PERMISSION_MANAGE_OAUTH.Id, 207 ) 208 } 209 210 // Grant permissions for inviting and adding users to a team. 211 if isLicensed { 212 if *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictTeamInvite == model.PERMISSIONS_TEAM_ADMIN { 213 roles[model.TEAM_ADMIN_ROLE_ID].Permissions = append( 214 roles[model.TEAM_ADMIN_ROLE_ID].Permissions, 215 model.PERMISSION_INVITE_USER.Id, 216 model.PERMISSION_ADD_USER_TO_TEAM.Id, 217 ) 218 } else if *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_RestrictTeamInvite == model.PERMISSIONS_ALL { 219 roles[model.TEAM_USER_ROLE_ID].Permissions = append( 220 roles[model.TEAM_USER_ROLE_ID].Permissions, 221 model.PERMISSION_INVITE_USER.Id, 222 model.PERMISSION_ADD_USER_TO_TEAM.Id, 223 ) 224 } 225 } else { 226 roles[model.TEAM_USER_ROLE_ID].Permissions = append( 227 roles[model.TEAM_USER_ROLE_ID].Permissions, 228 model.PERMISSION_INVITE_USER.Id, 229 model.PERMISSION_ADD_USER_TO_TEAM.Id, 230 ) 231 } 232 233 if isLicensed { 234 switch *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_RestrictPostDelete { 235 case model.PERMISSIONS_DELETE_POST_ALL: 236 roles[model.CHANNEL_USER_ROLE_ID].Permissions = append( 237 roles[model.CHANNEL_USER_ROLE_ID].Permissions, 238 model.PERMISSION_DELETE_POST.Id, 239 ) 240 roles[model.TEAM_ADMIN_ROLE_ID].Permissions = append( 241 roles[model.TEAM_ADMIN_ROLE_ID].Permissions, 242 model.PERMISSION_DELETE_POST.Id, 243 model.PERMISSION_DELETE_OTHERS_POSTS.Id, 244 ) 245 case model.PERMISSIONS_DELETE_POST_TEAM_ADMIN: 246 roles[model.TEAM_ADMIN_ROLE_ID].Permissions = append( 247 roles[model.TEAM_ADMIN_ROLE_ID].Permissions, 248 model.PERMISSION_DELETE_POST.Id, 249 model.PERMISSION_DELETE_OTHERS_POSTS.Id, 250 ) 251 } 252 } else { 253 roles[model.CHANNEL_USER_ROLE_ID].Permissions = append( 254 roles[model.CHANNEL_USER_ROLE_ID].Permissions, 255 model.PERMISSION_DELETE_POST.Id, 256 ) 257 roles[model.TEAM_ADMIN_ROLE_ID].Permissions = append( 258 roles[model.TEAM_ADMIN_ROLE_ID].Permissions, 259 model.PERMISSION_DELETE_POST.Id, 260 model.PERMISSION_DELETE_OTHERS_POSTS.Id, 261 ) 262 } 263 264 if *cfg.TeamSettings.DEPRECATED_DO_NOT_USE_EnableTeamCreation { 265 roles[model.SYSTEM_USER_ROLE_ID].Permissions = append( 266 roles[model.SYSTEM_USER_ROLE_ID].Permissions, 267 model.PERMISSION_CREATE_TEAM.Id, 268 ) 269 } 270 271 if isLicensed { 272 switch *cfg.ServiceSettings.DEPRECATED_DO_NOT_USE_AllowEditPost { 273 case model.ALLOW_EDIT_POST_ALWAYS, model.ALLOW_EDIT_POST_TIME_LIMIT: 274 roles[model.CHANNEL_USER_ROLE_ID].Permissions = append( 275 roles[model.CHANNEL_USER_ROLE_ID].Permissions, 276 model.PERMISSION_EDIT_POST.Id, 277 ) 278 roles[model.SYSTEM_ADMIN_ROLE_ID].Permissions = append( 279 roles[model.SYSTEM_ADMIN_ROLE_ID].Permissions, 280 model.PERMISSION_EDIT_POST.Id, 281 ) 282 } 283 } else { 284 roles[model.CHANNEL_USER_ROLE_ID].Permissions = append( 285 roles[model.CHANNEL_USER_ROLE_ID].Permissions, 286 model.PERMISSION_EDIT_POST.Id, 287 ) 288 roles[model.SYSTEM_ADMIN_ROLE_ID].Permissions = append( 289 roles[model.SYSTEM_ADMIN_ROLE_ID].Permissions, 290 model.PERMISSION_EDIT_POST.Id, 291 ) 292 } 293 294 return roles 295 }