IntenseWebs/mattermost
3
0
Fork 0
mirror of https://github.com/mattermost/mattermost.git synced 2026-08-27 05:37:15 -05:00
Code Issues Packages Projects Releases Wiki Activity

MM-68258 Remove system_secure_connection_manager role (#36009)

Browse Source 
* Remove system_secure_connection_manager role

  The dedicated role for delegating secure connection management is no
  longer needed. The manage_secure_connections permission remains and
  continues to be granted to system admins via AllPermissions.

  Removes the role definition, migration, permissions migration, UI
  components, i18n strings, and all associated tests across server,
  webapp, and e2e-tests.
This commit is contained in:
Doug Lauder
2026-04-10 10:49:04 -04:00
committed by GitHub
parent f3c2e52b76
commit 73c6e6a7cf
21 changed files with 33 additions and 263 deletions
Download Patch File Download Diff File Expand all files Collapse all files
e2e-tests/playwright/lib/src/ui/components/system_console/sections/user_management/delegated_granular_administration.ts
-8
View File
@@ -68,9 +68,6 @@ class AdminRolesPanel {
get sharedChannelManager() {
return this.dataGrid.sharedChannelManager;
}
get secureConnectionManager() {
return this.dataGrid.secureConnectionManager;
}
get viewer() {
return this.dataGrid.viewer;
}
@@ -87,7 +84,6 @@ class DataGrid {
readonly userManager: RoleRow;
readonly customGroupManager: RoleRow;
readonly sharedChannelManager: RoleRow;
readonly secureConnectionManager: RoleRow;
readonly viewer: RoleRow;
constructor(container: Locator) {
@@ -116,10 +112,6 @@ class DataGrid {
this.rows.locator('.DataGrid_row').filter({hasText: 'Shared Channel Manager'}),
'system_shared_channel_manager_edit',
);
this.secureConnectionManager = new RoleRow(
this.rows.locator('.DataGrid_row').filter({hasText: 'Secure Connection Manager'}),
'system_secure_connection_manager_edit',
);
this.viewer = new RoleRow(
this.rows.locator('.DataGrid_row').filter({hasText: 'Viewer'}),
'system_read_only_admin_edit',
e2e-tests/playwright/specs/functional/system_console/permissions/system_role_assignment.spec.ts
+1 -4
View File
@@ -3,10 +3,7 @@
import {expect, test} from '@mattermost/playwright-lib';
const roleCases = [
{accessor: 'sharedChannelManager' as const, roleId: 'system_shared_channel_manager'},
{accessor: 'secureConnectionManager' as const, roleId: 'system_secure_connection_manager'},
];
const roleCases = [{accessor: 'sharedChannelManager' as const, roleId: 'system_shared_channel_manager'}];
for (const {accessor, roleId} of roleCases) {
test(
server/channels/api4/remote_cluster_test.go
-91
View File
@@ -12,44 +12,6 @@ import (
"github.com/stretchr/testify/require"
)
func TestGetRemoteClustersWithSecureConnectionManagerRole(t *testing.T) {
mainHelper.Parallel(t)
th := setupForSharedChannels(t).InitBasic(t)
// Create a remote cluster for testing
newRC := &model.RemoteCluster{
RemoteId: model.NewId(),
Name: "test-remote",
SiteURL: "http://example.com",
CreatorId: th.SystemAdminUser.Id,
Token: model.NewId(),
}
_, appErr := th.App.AddRemoteCluster(newRC)
require.Nil(t, appErr)
// Create a user with only the system_secure_connection_manager role
scmUser := th.CreateUser(t)
_, appErr = th.App.UpdateUserRoles(th.Context, scmUser.Id, model.SystemUserRoleId+" "+model.SecureConnectionManagerRoleId, false)
require.Nil(t, appErr)
scmClient := th.CreateClient()
_, _, err := scmClient.Login(context.Background(), scmUser.Email, scmUser.Password)
require.NoError(t, err)
t.Run("regular user should be denied", func(t *testing.T) {
_, resp, err := th.Client.GetRemoteClusters(context.Background(), 0, 999999, model.RemoteClusterQueryFilter{})
CheckForbiddenStatus(t, resp)
require.Error(t, err)
})
t.Run("system_secure_connection_manager user should have access", func(t *testing.T) {
rcs, resp, err := scmClient.GetRemoteClusters(context.Background(), 0, 999999, model.RemoteClusterQueryFilter{})
CheckOKStatus(t, resp)
require.NoError(t, err)
require.NotEmpty(t, rcs)
})
}
func TestGetRemoteClustersWithSharedChannelManagerRole(t *testing.T) {
mainHelper.Parallel(t)
th := setupForSharedChannels(t).InitBasic(t)
@@ -88,42 +50,6 @@ func TestGetRemoteClustersWithSharedChannelManagerRole(t *testing.T) {
})
}
func TestCreateRemoteClusterWithSecureConnectionManagerRole(t *testing.T) {
mainHelper.Parallel(t)
th := setupForSharedChannels(t).InitBasic(t)
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.SiteURL = "http://localhost:8065" })
// Create a user with only the system_secure_connection_manager role
scmUser := th.CreateUser(t)
_, appErr := th.App.UpdateUserRoles(th.Context, scmUser.Id, model.SystemUserRoleId+" "+model.SecureConnectionManagerRoleId, false)
require.Nil(t, appErr)
scmClient := th.CreateClient()
_, _, err := scmClient.Login(context.Background(), scmUser.Email, scmUser.Password)
require.NoError(t, err)
rcPayload := &model.RemoteClusterWithPassword{
RemoteCluster: &model.RemoteCluster{
Name: "test-from-scm",
DefaultTeamId: th.BasicTeam.Id,
},
Password: model.NewTestPassword(),
}
t.Run("regular user should be denied", func(t *testing.T) {
_, resp, err := th.Client.CreateRemoteCluster(context.Background(), rcPayload)
CheckForbiddenStatus(t, resp)
require.Error(t, err)
})
t.Run("system_secure_connection_manager user should have access", func(t *testing.T) {
rcWithInvite, resp, err := scmClient.CreateRemoteCluster(context.Background(), rcPayload)
CheckCreatedStatus(t, resp)
require.NoError(t, err)
require.NotEmpty(t, rcWithInvite)
})
}
func TestCreateRemoteClusterDeniedForSharedChannelManagerRole(t *testing.T) {
mainHelper.Parallel(t)
th := setupForSharedChannels(t).InitBasic(t)
@@ -698,15 +624,6 @@ func TestGetRemoteClusterWithManagerRoles(t *testing.T) {
_, _, err := sharedChannelClient.Login(context.Background(), sharedChannelUser.Email, sharedChannelUser.Password)
require.NoError(t, err)
// Create a user with only the system_secure_connection_manager role
secureConnUser := th.CreateUser(t)
_, appErr = th.App.UpdateUserRoles(th.Context, secureConnUser.Id, model.SystemUserRoleId+" "+model.SecureConnectionManagerRoleId, false)
require.Nil(t, appErr)
secureConnClient := th.CreateClient()
_, _, err = secureConnClient.Login(context.Background(), secureConnUser.Email, secureConnUser.Password)
require.NoError(t, err)
t.Run("regular user should be denied", func(t *testing.T) {
_, resp, err := th.Client.GetRemoteCluster(context.Background(), newRC.RemoteId)
CheckForbiddenStatus(t, resp)
@@ -720,14 +637,6 @@ func TestGetRemoteClusterWithManagerRoles(t *testing.T) {
require.Equal(t, newRC.RemoteId, fetchedRC.RemoteId)
require.Empty(t, fetchedRC.Token)
})
t.Run("system_secure_connection_manager user should have access", func(t *testing.T) {
fetchedRC, resp, err := secureConnClient.GetRemoteCluster(context.Background(), newRC.RemoteId)
CheckOKStatus(t, resp)
require.NoError(t, err)
require.Equal(t, newRC.RemoteId, fetchedRC.RemoteId)
require.Empty(t, fetchedRC.Token)
})
}
func TestPatchRemoteCluster(t *testing.T) {
server/channels/api4/shared_channel_test.go
-24
View File
@@ -708,27 +708,3 @@ func TestSharedChannelEndpointsWithSharedChannelManagerRole(t *testing.T) {
require.Error(t, err)
})
}
func TestGetSharedChannelRemotesByRemoteClusterWithSecureConnectionManagerRole(t *testing.T) {
mainHelper.Parallel(t)
th := setupForSharedChannels(t).InitBasic(t)
newRC := &model.RemoteCluster{Name: "rc", SiteURL: "http://example.com", CreatorId: th.SystemAdminUser.Id}
rc, appErr := th.App.AddRemoteCluster(newRC)
require.Nil(t, appErr)
// Create a user with only the secure_connection_manager role
scmUser := th.CreateUser(t)
_, appErr = th.App.UpdateUserRoles(th.Context, scmUser.Id, model.SystemUserRoleId+" "+model.SecureConnectionManagerRoleId, false)
require.Nil(t, appErr)
scmClient := th.CreateClient()
_, _, err := scmClient.Login(context.Background(), scmUser.Email, scmUser.Password)
require.NoError(t, err)
t.Run("secure_connection_manager should have access", func(t *testing.T) {
_, resp, err := scmClient.GetSharedChannelRemotesByRemoteCluster(context.Background(), rc.RemoteId, model.SharedChannelRemoteFilterOpts{}, 0, 100)
CheckOKStatus(t, resp)
require.NoError(t, err)
})
}
server/channels/app/export_test.go
+2 -2
View File
@@ -1360,7 +1360,7 @@ func TestExportSchemes(t *testing.T) {
err := th1.App.Srv().Store().System().Save(&model.System{Name: model.MigrationKeyAdvancedPermissionsPhase2, Value: "true"})
require.NoError(t, err)
builtInRoles := 25
builtInRoles := 24
defaultChannelSchemeRoles := 3
// Verify the roles count is expected prior to scheme creation.
@@ -1457,7 +1457,7 @@ func TestExportSchemes(t *testing.T) {
err := th1.App.Srv().Store().System().Save(&model.System{Name: model.MigrationKeyAdvancedPermissionsPhase2, Value: "true"})
require.NoError(t, err)
builtInRoles := 25
builtInRoles := 24
defaultTeamSchemeRoles := 10
// Verify the roles count is expected prior to scheme creation.
server/channels/app/migrations.go
+12 -18
View File
@@ -18,19 +18,18 @@ import (
)
const (
EmojisPermissionsMigrationKey = "EmojisPermissionsMigrationComplete"
GuestRolesCreationMigrationKey = "GuestRolesCreationMigrationComplete"
SystemConsoleRolesCreationMigrationKey = "SystemConsoleRolesCreationMigrationComplete"
CustomGroupAdminRoleCreationMigrationKey = "CustomGroupAdminRoleCreationMigrationComplete"
SharedChannelManagerRoleCreationMigrationKey = "SystemSharedChannelManagerRoleCreationMigrationComplete"
SecureConnectionManagerRoleCreationMigrationKey = "SystemSecureConnectionManagerRoleCreationMigrationComplete"
ContentExtractionConfigDefaultTrueMigrationKey = "ContentExtractionConfigDefaultTrueMigrationComplete"
PlaybookRolesCreationMigrationKey = "PlaybookRolesCreationMigrationComplete"
FirstAdminSetupCompleteKey = model.SystemFirstAdminSetupComplete
remainingSchemaMigrationsKey = "RemainingSchemaMigrations"
postPriorityConfigDefaultTrueMigrationKey = "PostPriorityConfigDefaultTrueMigrationComplete"
contentFlaggingSetupDoneKey = "content_flagging_setup_done"
contentFlaggingMigrationVersion = "v5"
EmojisPermissionsMigrationKey = "EmojisPermissionsMigrationComplete"
GuestRolesCreationMigrationKey = "GuestRolesCreationMigrationComplete"
SystemConsoleRolesCreationMigrationKey = "SystemConsoleRolesCreationMigrationComplete"
CustomGroupAdminRoleCreationMigrationKey = "CustomGroupAdminRoleCreationMigrationComplete"
SharedChannelManagerRoleCreationMigrationKey = "SystemSharedChannelManagerRoleCreationMigrationComplete"
ContentExtractionConfigDefaultTrueMigrationKey = "ContentExtractionConfigDefaultTrueMigrationComplete"
PlaybookRolesCreationMigrationKey = "PlaybookRolesCreationMigrationComplete"
FirstAdminSetupCompleteKey = model.SystemFirstAdminSetupComplete
remainingSchemaMigrationsKey = "RemainingSchemaMigrations"
postPriorityConfigDefaultTrueMigrationKey = "PostPriorityConfigDefaultTrueMigrationComplete"
contentFlaggingSetupDoneKey = "content_flagging_setup_done"
contentFlaggingMigrationVersion = "v5"
contentFlaggingPropertyNameFlaggedPostId = "flagged_post_id"
ContentFlaggingPropertyNameStatus = "status"
@@ -369,10 +368,6 @@ func (s *Server) doSharedChannelManagerRoleCreationMigration() error {
return s.doSingleRoleCreationMigration(SharedChannelManagerRoleCreationMigrationKey, model.SharedChannelManagerRoleId)
}
func (s *Server) doSecureConnectionManagerRoleCreationMigration() error {
return s.doSingleRoleCreationMigration(SecureConnectionManagerRoleCreationMigrationKey, model.SecureConnectionManagerRoleId)
}
func (s *Server) doContentExtractionConfigDefaultTrueMigration() error {
// If the migration is already marked as completed, don't do it again.
var nfErr *store.ErrNotFound
@@ -865,7 +860,6 @@ func (s *Server) doAppMigrations() {
{"System Console Roles Creation Migration", s.doSystemConsoleRolesCreationMigration},
{"Custom Group Admin Role Creation Migration", s.doCustomGroupAdminRoleCreationMigration},
{"Shared Channel Manager Role Creation Migration", s.doSharedChannelManagerRoleCreationMigration},
{"Secure Connection Manager Role Creation Migration", s.doSecureConnectionManagerRoleCreationMigration},
// This migration always run after dependent migrations such as the guest roles migration.
{"Permissions Migrations", s.doPermissionsMigrations},
{"Content Extraction Config Default True Migration", s.doContentExtractionConfigDefaultTrueMigration},
server/channels/app/permissions_migrations.go
-10
View File
@@ -1275,15 +1275,6 @@ func (a *App) getAddSharedChannelManagerPermissionsMigration() (permissionsMap,
}, nil
}
func (a *App) getAddSecureConnectionManagerPermissionsMigration() (permissionsMap, error) {
return permissionsMap{
permissionTransformation{
On: isExactRole(model.SecureConnectionManagerRoleId),
Add: []string{PermissionManageSecureConnections},
},
}, nil
}
func (a *App) getRestoreManageOAuthPermissionMigration() (permissionsMap, error) {
return permissionsMap{
permissionTransformation{
@@ -1351,7 +1342,6 @@ func (s *Server) doPermissionsMigrations() error {
{Key: model.MigrationKeyAddChannelAccessRulesPermission, Migration: a.getAddChannelAccessRulesPermissionMigration},
{Key: model.MigrationKeyAddChannelAutoTranslationPermissions, Migration: a.getAddChannelAutoTranslationPermissionMigration},
{Key: model.MigrationKeyAddSharedChannelManagerPermissions, Migration: a.getAddSharedChannelManagerPermissionsMigration},
{Key: model.MigrationKeyAddSecureConnectionManagerPermissions, Migration: a.getAddSecureConnectionManagerPermissionsMigration},
{Key: model.MigrationKeyRestoreManageOAuthPermission, Migration: a.getRestoreManageOAuthPermissionMigration},
}
server/channels/app/support_packet_test.go
+3 -3
View File
@@ -611,7 +611,7 @@ func TestGetSupportPacketPermissionsInfo(t *testing.T) {
t.Run("No custom permissions", func(t *testing.T) {
permissions := generatePermissionInfo(t)
assert.Len(t, permissions.Roles, 25)
assert.Len(t, permissions.Roles, 24)
assert.Empty(t, permissions.Schemes)
})
@@ -625,7 +625,7 @@ func TestGetSupportPacketPermissionsInfo(t *testing.T) {
t.Run("with custom scheme", func(t *testing.T) {
permissions := generatePermissionInfo(t)
assert.Len(t, permissions.Roles, 35) // 25 default roles + 10 custom roles from the scheme
assert.Len(t, permissions.Roles, 34) // 24 default roles + 10 custom roles from the scheme
require.Len(t, permissions.Schemes, 1)
assert.Equal(t, scheme.Id, permissions.Schemes[0].Id)
assert.Equal(t, model.FakeSetting, permissions.Schemes[0].Name, "Name should be obfuscated")
@@ -647,7 +647,7 @@ func TestGetSupportPacketPermissionsInfo(t *testing.T) {
permissions := generatePermissionInfo(t)
require.Len(t, permissions.Schemes, 1)
require.Len(t, permissions.Roles, 36) // 25 default roles + 10 custom roles from the scheme + 1 custom role
require.Len(t, permissions.Roles, 35) // 24 default roles + 10 custom roles from the scheme + 1 custom role
found := false
for _, r := range permissions.Roles {
// Confirm that sensitive fields are obfuscated
server/channels/store/sqlstore/user_store.go
+1 -1
View File
@@ -697,7 +697,7 @@ func applyMultiRoleFilters(query sq.SelectBuilder, systemRoles []string, teamRol
case model.SystemUserRoleId:
// If querying for a `system_user` ensure that the user is only a system_user.
sqOr = append(sqOr, sq.Eq{"Users.Roles": role})
case model.SystemGuestRoleId, model.SystemAdminRoleId, model.SystemUserManagerRoleId, model.SystemReadOnlyAdminRoleId, model.SystemManagerRoleId, model.SystemCustomGroupAdminRoleId, model.SharedChannelManagerRoleId, model.SecureConnectionManagerRoleId:
case model.SystemGuestRoleId, model.SystemAdminRoleId, model.SystemUserManagerRoleId, model.SystemReadOnlyAdminRoleId, model.SystemManagerRoleId, model.SystemCustomGroupAdminRoleId, model.SharedChannelManagerRoleId:
// If querying for any other roles search using a wildcard.
sqOr = append(sqOr, sq.ILike{"Users.Roles": queryRole})
}
server/channels/testlib/store.go
-2
View File
@@ -86,9 +86,7 @@ func GetMockStoreForSetupFunctions() *mocks.Store {
systemStore.On("GetByName", model.MigrationRemoveGetAnalyticsPermission).Return(&model.System{Name: model.MigrationRemoveGetAnalyticsPermission, Value: "true"}, nil)
systemStore.On("GetByName", "CustomGroupAdminRoleCreationMigrationComplete").Return(&model.System{Name: model.MigrationKeyAddPlayboosksManageRolesPermissions, Value: "true"}, nil)
systemStore.On("GetByName", "SystemSharedChannelManagerRoleCreationMigrationComplete").Return(&model.System{Name: "SystemSharedChannelManagerRoleCreationMigrationComplete", Value: "true"}, nil)
systemStore.On("GetByName", "SystemSecureConnectionManagerRoleCreationMigrationComplete").Return(&model.System{Name: "SystemSecureConnectionManagerRoleCreationMigrationComplete", Value: "true"}, nil)
systemStore.On("GetByName", model.MigrationKeyAddSharedChannelManagerPermissions).Return(&model.System{Name: model.MigrationKeyAddSharedChannelManagerPermissions, Value: "true"}, nil)
systemStore.On("GetByName", model.MigrationKeyAddSecureConnectionManagerPermissions).Return(&model.System{Name: model.MigrationKeyAddSecureConnectionManagerPermissions, Value: "true"}, nil)
systemStore.On("GetByName", "products_boards").Return(&model.System{Name: "products_boards", Value: "true"}, nil)
systemStore.On("GetByName", "elasticsearch_fix_channel_index_migration").Return(&model.System{Name: "elasticsearch_fix_channel_index_migration", Value: "true"}, nil)
systemStore.On("GetByName", model.MigrationAddSysconsoleMobileSecurityPermission).Return(&model.System{Name: model.MigrationAddSysconsoleMobileSecurityPermission, Value: "true"}, nil)
server/public/model/migration.go
-1
View File
@@ -59,6 +59,5 @@ const (
MigrationKeyAddChannelAccessRulesPermission = "add_channel_access_rules_permission"
MigrationKeyAddChannelAutoTranslationPermissions = "add_channel_auto_translation_permissions"
MigrationKeyAddSharedChannelManagerPermissions = "system_shared_channel_manager_permissions"
MigrationKeyAddSecureConnectionManagerPermissions = "system_secure_connection_manager_permissions"
MigrationKeyRestoreManageOAuthPermission = "restore_manage_oauth_permission"
)
server/public/model/role.go
+11 -27
View File
@@ -17,7 +17,6 @@ var SystemUserManagerDefaultPermissions []string
var SystemReadOnlyAdminDefaultPermissions []string
var SystemCustomGroupAdminDefaultPermissions []string
var SharedChannelManagerDefaultPermissions []string
var SecureConnectionManagerDefaultPermissions []string
var BuiltInSchemeManagedRoleIDs []string
@@ -29,7 +28,6 @@ func init() {
SystemReadOnlyAdminRoleId,
SystemManagerRoleId,
SharedChannelManagerRoleId,
SecureConnectionManagerRoleId,
}
BuiltInSchemeManagedRoleIDs = append([]string{
@@ -362,10 +360,6 @@ func init() {
PermissionManageSharedChannels.Id,
}
SecureConnectionManagerDefaultPermissions = []string{
PermissionManageSecureConnections.Id,
}
// Add the ancillary permissions to each system role
SystemUserManagerDefaultPermissions = AddAncillaryPermissions(SystemUserManagerDefaultPermissions)
SystemReadOnlyAdminDefaultPermissions = AddAncillaryPermissions(SystemReadOnlyAdminDefaultPermissions)
@@ -377,18 +371,17 @@ type RoleType string
type RoleScope string
const (
SystemGuestRoleId = "system_guest"
SystemUserRoleId = "system_user"
SystemAdminRoleId = "system_admin"
SystemPostAllRoleId = "system_post_all"
SystemPostAllPublicRoleId = "system_post_all_public"
SystemUserAccessTokenRoleId = "system_user_access_token"
SystemUserManagerRoleId = "system_user_manager"
SystemReadOnlyAdminRoleId = "system_read_only_admin"
SystemManagerRoleId = "system_manager"
SystemCustomGroupAdminRoleId = "system_custom_group_admin"
SharedChannelManagerRoleId = "system_shared_channel_manager"
SecureConnectionManagerRoleId = "system_secure_connection_manager"
SystemGuestRoleId = "system_guest"
SystemUserRoleId = "system_user"
SystemAdminRoleId = "system_admin"
SystemPostAllRoleId = "system_post_all"
SystemPostAllPublicRoleId = "system_post_all_public"
SystemUserAccessTokenRoleId = "system_user_access_token"
SystemUserManagerRoleId = "system_user_manager"
SystemReadOnlyAdminRoleId = "system_read_only_admin"
SystemManagerRoleId = "system_manager"
SystemCustomGroupAdminRoleId = "system_custom_group_admin"
SharedChannelManagerRoleId = "system_shared_channel_manager"
TeamGuestRoleId = "team_guest"
TeamUserRoleId = "team_user"
@@ -1202,15 +1195,6 @@ func MakeDefaultRoles() map[string]*Role {
BuiltIn: true,
}
roles[SecureConnectionManagerRoleId] = &Role{
Name: SecureConnectionManagerRoleId,
DisplayName: "authentication.roles.system_secure_connection_manager.name",
Description: "authentication.roles.system_secure_connection_manager.description",
Permissions: SecureConnectionManagerDefaultPermissions,
SchemeManaged: false,
BuiltIn: true,
}
allPermissionIDs := []string{}
for _, permission := range AllPermissions {
allPermissionIDs = append(allPermissionIDs, permission.Id)
server/public/model/role_test.go
-14
View File
@@ -323,23 +323,9 @@ func TestMakeDefaultRolesContainsNewManagerRoles(t *testing.T) {
"role should NOT have manage_secure_connections permission")
})
t.Run("system_secure_connection_manager role exists with correct permissions", func(t *testing.T) {
role, ok := roles[SecureConnectionManagerRoleId]
require.True(t, ok, "system_secure_connection_manager role should exist in MakeDefaultRoles")
assert.Equal(t, "system_secure_connection_manager", role.Name)
assert.True(t, role.BuiltIn, "role should be built-in")
assert.False(t, role.SchemeManaged, "role should not be scheme-managed")
assert.True(t, slices.Contains(role.Permissions, PermissionManageSecureConnections.Id),
"role should have manage_secure_connections permission")
assert.False(t, slices.Contains(role.Permissions, PermissionManageSharedChannels.Id),
"role should NOT have manage_shared_channels permission")
})
t.Run("roles are included in NewSystemRoleIDs", func(t *testing.T) {
assert.True(t, slices.Contains(NewSystemRoleIDs, SharedChannelManagerRoleId),
"system_shared_channel_manager should be in NewSystemRoleIDs")
assert.True(t, slices.Contains(NewSystemRoleIDs, SecureConnectionManagerRoleId),
"system_secure_connection_manager should be in NewSystemRoleIDs")
})
t.Run("system_admin includes manage_oauth by default", func(t *testing.T) {
webapp/channels/src/components/admin_console/admin_console.tsx
+2 -3
View File
@@ -89,7 +89,7 @@ const AdminConsole = (props: Props) => {
useEffect(() => {
props.actions.getConfig();
props.actions.getEnvironmentConfig();
props.actions.loadRolesIfNeeded(['channel_user', 'team_user', 'system_user', 'channel_admin', 'team_admin', 'system_admin', 'system_user_manager', 'system_custom_group_admin', 'system_read_only_admin', 'system_manager', 'system_shared_channel_manager', 'system_secure_connection_manager']);
props.actions.loadRolesIfNeeded(['channel_user', 'team_user', 'system_user', 'channel_admin', 'team_admin', 'system_admin', 'system_user_manager', 'system_custom_group_admin', 'system_read_only_admin', 'system_manager', 'system_shared_channel_manager']);
props.actions.selectLhsItem(LhsItemType.None);
props.actions.selectTeam('');
document.body.classList.add('console__body');
@@ -121,8 +121,7 @@ const AdminConsole = (props: Props) => {
roles.system_read_only_admin &&
roles.system_custom_group_admin &&
roles.system_manager &&
roles.system_shared_channel_manager &&
roles.system_secure_connection_manager
roles.system_shared_channel_manager
);
};
webapp/channels/src/components/admin_console/system_roles/strings.tsx
-14
View File
@@ -88,18 +88,4 @@ export const rolesStrings: Record<string, Record<string, MessageDescriptor>> = {
defaultMessage: 'System Role',
},
}),
system_secure_connection_manager: defineMessages({
name: {
id: 'admin.permissions.roles.system_secure_connection_manager.name',
defaultMessage: 'Secure Connection Manager',
},
description: {
id: 'admin.permissions.roles.system_secure_connection_manager.description',
defaultMessage: 'Can create, manage, and remove secure connections to remote servers.',
},
type: {
id: 'admin.permissions.roles.system_secure_connection_manager.type',
defaultMessage: 'System Role',
},
}),
};
webapp/channels/src/components/admin_console/system_roles/system_role/system_role_permissions.tsx
-32
View File
@@ -275,38 +275,6 @@ export default class SystemRolePermissions extends React.PureComponent<Props, St
);
}
if (this.props.role.name === Constants.PERMISSIONS_SECURE_CONNECTION_MANAGER) {
return (
<>
<p>
<FormattedMessage
id='admin.permissions.roles.system_secure_connection_manager.introduction'
defaultMessage='The built-in Secure Connection Manager role can be used to delegate the ability to create, manage, and remove <a>secure connections</a> to remote servers to users other than the System Admin.'
values={{
a: (chunks) => (
<ExternalLink
href='https://docs.mattermost.com/administration-guide/onboard/connected-workspaces.html'
location='adminConsoleSystemRoles'
>
{chunks}
</ExternalLink>
),
}}
/>
</p>
<p>
<FormattedMessage
id='admin.permissions.roles.system_secure_connection_manager.permissions_info'
defaultMessage='This role has the <b>manage_secure_connections</b> permission, which allows creating, editing, and deleting secure connections to remote servers.'
values={{
b: (chunks) => <b>{chunks}</b>,
}}
/>
</p>
</>
);
}
if (this.props.role.name === Constants.PERMISSIONS_SYSTEM_USER_MANAGER) {
let permissionsToShow: Record<string, boolean> = {};
Object.keys(permissionsMap).forEach((permission) => {
webapp/channels/src/components/admin_console/system_roles/system_roles.tsx
+1 -1
View File
@@ -45,7 +45,7 @@ const columns: Column[] = [
},
];
const roleNames = ['system_admin', 'system_manager', 'system_user_manager', 'system_custom_group_admin', 'system_shared_channel_manager', 'system_secure_connection_manager', 'system_read_only_admin'];
const roleNames = ['system_admin', 'system_manager', 'system_user_manager', 'system_custom_group_admin', 'system_shared_channel_manager', 'system_read_only_admin'];
const noop = () => {};
webapp/channels/src/i18n/en.json
-5
View File
@@ -2141,11 +2141,6 @@
"admin.permissions.roles.system_read_only_admin.description": "Read only access for oversight.",
"admin.permissions.roles.system_read_only_admin.name": "Viewer",
"admin.permissions.roles.system_read_only_admin.type": "System Role",
"admin.permissions.roles.system_secure_connection_manager.description": "Can create, manage, and remove secure connections to remote servers.",
"admin.permissions.roles.system_secure_connection_manager.introduction": "The built-in Secure Connection Manager role can be used to delegate the ability to create, manage, and remove <a>secure connections</a> to remote servers to users other than the System Admin.",
"admin.permissions.roles.system_secure_connection_manager.name": "Secure Connection Manager",
"admin.permissions.roles.system_secure_connection_manager.permissions_info": "This role has the <b>manage_secure_connections</b> permission, which allows creating, editing, and deleting secure connections to remote servers.",
"admin.permissions.roles.system_secure_connection_manager.type": "System Role",
"admin.permissions.roles.system_shared_channel_manager.description": "Can browse available connections and share or unshare channels with remote servers.",
"admin.permissions.roles.system_shared_channel_manager.introduction": "The built-in Shared Channel Manager role can be used to delegate the ability to browse available connections and share or unshare channels with <a>remote servers</a> to users other than the System Admin.",
"admin.permissions.roles.system_shared_channel_manager.name": "Shared Channel Manager",
webapp/channels/src/packages/mattermost-redux/src/constants/general.ts
-1
View File
@@ -36,7 +36,6 @@ export default {
SYSTEM_READ_ONLY_ADMIN_ROLE: 'system_read_only_admin',
SYSTEM_MANAGER_ROLE: 'system_manager',
SHARED_CHANNEL_MANAGER_ROLE: 'system_shared_channel_manager',
SECURE_CONNECTION_MANAGER_ROLE: 'system_secure_connection_manager',
SYSTEM_USER_ACCESS_TOKEN_ROLE: 'system_user_access_token',
SYSTEM_POST_ALL_ROLE: 'system_post_all',
SYSTEM_POST_ALL_PUBLIC_ROLE: 'system_post_all_public',
webapp/channels/src/packages/mattermost-redux/src/utils/user_utils.ts
-1
View File
@@ -77,7 +77,6 @@ export function includesAnAdminRole(roles: string): boolean {
General.SYSTEM_READ_ONLY_ADMIN_ROLE,
General.SYSTEM_MANAGER_ROLE,
General.SHARED_CHANNEL_MANAGER_ROLE,
General.SECURE_CONNECTION_MANAGER_ROLE,
].some((el) => rolesArray.includes(el));
}
webapp/channels/src/utils/constants.tsx
-1
View File
@@ -2023,7 +2023,6 @@ export const Constants = {
PERMISSIONS_DELETE_POST_SYSTEM_ADMIN: 'system_admin',
PERMISSIONS_SYSTEM_CUSTOM_GROUP_ADMIN: 'system_custom_group_admin',
PERMISSIONS_SHARED_CHANNEL_MANAGER: 'system_shared_channel_manager',
PERMISSIONS_SECURE_CONNECTION_MANAGER: 'system_secure_connection_manager',
ALLOW_EDIT_POST_ALWAYS: 'always',
ALLOW_EDIT_POST_NEVER: 'never',
ALLOW_EDIT_POST_TIME_LIMIT: 'time_limit',