MM-10570: Make permissions reset command clear custom role assignments. (#8976)

6 files changed, 204 insertions, 1 deletions

diff --git a/store/storetest/channel_store.go b/store/storetest/channel_store.go
index eea79d42f..ecec7fab9 100644
--- a/store/storetest/channel_store.go
+++ b/store/storetest/channel_store.go
@@ -55,6 +55,7 @@ func TestChannelStore(t *testing.T, ss store.Store) {
 	t.Run("GetChannelsByScheme", func(t *testing.T) { testChannelStoreGetChannelsByScheme(t, ss) })
 	t.Run("MigrateChannelMembers", func(t *testing.T) { testChannelStoreMigrateChannelMembers(t, ss) })
 	t.Run("ResetAllChannelSchemes", func(t *testing.T) { testResetAllChannelSchemes(t, ss) })
+	t.Run("ClearAllCustomRoleAssignments", func(t *testing.T) { testChannelStoreClearAllCustomRoleAssignments(t, ss) })
 
 }
 
@@ -2358,3 +2359,62 @@ func testResetAllChannelSchemes(t *testing.T, ss store.Store) {
 	assert.Equal(t, "", *c1.SchemeId)
 	assert.Equal(t, "", *c2.SchemeId)
 }
+
+func testChannelStoreClearAllCustomRoleAssignments(t *testing.T, ss store.Store) {
+	c := &model.Channel{
+		TeamId:      model.NewId(),
+		DisplayName: "Name",
+		Name:        model.NewId(),
+		Type:        model.CHANNEL_OPEN,
+	}
+
+	c = (<-ss.Channel().Save(c, 100)).Data.(*model.Channel)
+
+	m1 := &model.ChannelMember{
+		ChannelId:     c.Id,
+		UserId:        model.NewId(),
+		NotifyProps:   model.GetDefaultChannelNotifyProps(),
+		ExplicitRoles: "channel_user channel_admin system_user_access_token",
+	}
+	m2 := &model.ChannelMember{
+		ChannelId:     c.Id,
+		UserId:        model.NewId(),
+		NotifyProps:   model.GetDefaultChannelNotifyProps(),
+		ExplicitRoles: "channel_user custom_role channel_admin another_custom_role",
+	}
+	m3 := &model.ChannelMember{
+		ChannelId:     c.Id,
+		UserId:        model.NewId(),
+		NotifyProps:   model.GetDefaultChannelNotifyProps(),
+		ExplicitRoles: "channel_user",
+	}
+	m4 := &model.ChannelMember{
+		ChannelId:     c.Id,
+		UserId:        model.NewId(),
+		NotifyProps:   model.GetDefaultChannelNotifyProps(),
+		ExplicitRoles: "custom_only",
+	}
+
+	store.Must(ss.Channel().SaveMember(m1))
+	store.Must(ss.Channel().SaveMember(m2))
+	store.Must(ss.Channel().SaveMember(m3))
+	store.Must(ss.Channel().SaveMember(m4))
+
+	require.Nil(t, (<-ss.Channel().ClearAllCustomRoleAssignments()).Err)
+
+	r1 := <-ss.Channel().GetMember(m1.ChannelId, m1.UserId)
+	require.Nil(t, r1.Err)
+	assert.Equal(t, m1.ExplicitRoles, r1.Data.(*model.ChannelMember).Roles)
+
+	r2 := <-ss.Channel().GetMember(m2.ChannelId, m2.UserId)
+	require.Nil(t, r2.Err)
+	assert.Equal(t, "channel_user channel_admin", r2.Data.(*model.ChannelMember).Roles)
+
+	r3 := <-ss.Channel().GetMember(m3.ChannelId, m3.UserId)
+	require.Nil(t, r3.Err)
+	assert.Equal(t, m3.ExplicitRoles, r3.Data.(*model.ChannelMember).Roles)
+
+	r4 := <-ss.Channel().GetMember(m4.ChannelId, m4.UserId)
+	require.Nil(t, r4.Err)
+	assert.Equal(t, "", r4.Data.(*model.ChannelMember).Roles)
+}
diff --git a/store/storetest/mocks/ChannelStore.go b/store/storetest/mocks/ChannelStore.go
index 114914bb8..4929557ea 100644
--- a/store/storetest/mocks/ChannelStore.go
+++ b/store/storetest/mocks/ChannelStore.go
@@ -61,6 +61,22 @@ func (_m *ChannelStore) AutocompleteInTeam(teamId string, term string) store.Sto
 	return r0
 }
 
+// ClearAllCustomRoleAssignments provides a mock function with given fields:
+func (_m *ChannelStore) ClearAllCustomRoleAssignments() store.StoreChannel {
+	ret := _m.Called()
+
+	var r0 store.StoreChannel
+	if rf, ok := ret.Get(0).(func() store.StoreChannel); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(store.StoreChannel)
+		}
+	}
+
+	return r0
+}
+
 // ClearCaches provides a mock function with given fields:
 func (_m *ChannelStore) ClearCaches() {
 	_m.Called()
diff --git a/store/storetest/mocks/TeamStore.go b/store/storetest/mocks/TeamStore.go
index ee9999bad..47ea6587b 100644
--- a/store/storetest/mocks/TeamStore.go
+++ b/store/storetest/mocks/TeamStore.go
@@ -29,6 +29,22 @@ func (_m *TeamStore) AnalyticsTeamCount() store.StoreChannel {
 	return r0
 }
 
+// ClearAllCustomRoleAssignments provides a mock function with given fields:
+func (_m *TeamStore) ClearAllCustomRoleAssignments() store.StoreChannel {
+	ret := _m.Called()
+
+	var r0 store.StoreChannel
+	if rf, ok := ret.Get(0).(func() store.StoreChannel); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(store.StoreChannel)
+		}
+	}
+
+	return r0
+}
+
 // Get provides a mock function with given fields: id
 func (_m *TeamStore) Get(id string) store.StoreChannel {
 	ret := _m.Called(id)
diff --git a/store/storetest/mocks/UserStore.go b/store/storetest/mocks/UserStore.go
index 6fc787de7..760b6e934 100644
--- a/store/storetest/mocks/UserStore.go
+++ b/store/storetest/mocks/UserStore.go
@@ -77,6 +77,22 @@ func (_m *UserStore) AnalyticsUniqueUserCount(teamId string) store.StoreChannel
 	return r0
 }
 
+// ClearAllCustomRoleAssignments provides a mock function with given fields:
+func (_m *UserStore) ClearAllCustomRoleAssignments() store.StoreChannel {
+	ret := _m.Called()
+
+	var r0 store.StoreChannel
+	if rf, ok := ret.Get(0).(func() store.StoreChannel); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(store.StoreChannel)
+		}
+	}
+
+	return r0
+}
+
 // ClearCaches provides a mock function with given fields:
 func (_m *UserStore) ClearCaches() {
 	_m.Called()
diff --git a/store/storetest/team_store.go b/store/storetest/team_store.go
index 346b55c18..f21583cd1 100644
--- a/store/storetest/team_store.go
+++ b/store/storetest/team_store.go
@@ -9,10 +9,10 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/mattermost/mattermost-server/model"
 	"github.com/mattermost/mattermost-server/store"
-	"github.com/stretchr/testify/require"
 )
 
 func TestTeamStore(t *testing.T, ss store.Store) {
@@ -43,6 +43,7 @@ func TestTeamStore(t *testing.T, ss store.Store) {
 	t.Run("GetTeamsByScheme", func(t *testing.T) { testGetTeamsByScheme(t, ss) })
 	t.Run("MigrateTeamMembers", func(t *testing.T) { testTeamStoreMigrateTeamMembers(t, ss) })
 	t.Run("ResetAllTeamSchemes", func(t *testing.T) { testResetAllTeamSchemes(t, ss) })
+	t.Run("ClearAllCustomRoleAssignments", func(t *testing.T) { testTeamStoreClearAllCustomRoleAssignments(t, ss) })
 }
 
 func testTeamStoreSave(t *testing.T, ss store.Store) {
@@ -1245,3 +1246,49 @@ func testResetAllTeamSchemes(t *testing.T, ss store.Store) {
 	assert.Equal(t, "", *t1.SchemeId)
 	assert.Equal(t, "", *t2.SchemeId)
 }
+
+func testTeamStoreClearAllCustomRoleAssignments(t *testing.T, ss store.Store) {
+	m1 := &model.TeamMember{
+		TeamId:        model.NewId(),
+		UserId:        model.NewId(),
+		ExplicitRoles: "team_user team_admin team_post_all_public",
+	}
+	m2 := &model.TeamMember{
+		TeamId:        model.NewId(),
+		UserId:        model.NewId(),
+		ExplicitRoles: "team_user custom_role team_admin another_custom_role",
+	}
+	m3 := &model.TeamMember{
+		TeamId:        model.NewId(),
+		UserId:        model.NewId(),
+		ExplicitRoles: "team_user",
+	}
+	m4 := &model.TeamMember{
+		TeamId:        model.NewId(),
+		UserId:        model.NewId(),
+		ExplicitRoles: "custom_only",
+	}
+
+	store.Must(ss.Team().SaveMember(m1, -1))
+	store.Must(ss.Team().SaveMember(m2, -1))
+	store.Must(ss.Team().SaveMember(m3, -1))
+	store.Must(ss.Team().SaveMember(m4, -1))
+
+	require.Nil(t, (<-ss.Team().ClearAllCustomRoleAssignments()).Err)
+
+	r1 := <-ss.Team().GetMember(m1.TeamId, m1.UserId)
+	require.Nil(t, r1.Err)
+	assert.Equal(t, m1.ExplicitRoles, r1.Data.(*model.TeamMember).Roles)
+
+	r2 := <-ss.Team().GetMember(m2.TeamId, m2.UserId)
+	require.Nil(t, r2.Err)
+	assert.Equal(t, "team_user team_admin", r2.Data.(*model.TeamMember).Roles)
+
+	r3 := <-ss.Team().GetMember(m3.TeamId, m3.UserId)
+	require.Nil(t, r3.Err)
+	assert.Equal(t, m3.ExplicitRoles, r3.Data.(*model.TeamMember).Roles)
+
+	r4 := <-ss.Team().GetMember(m4.TeamId, m4.UserId)
+	require.Nil(t, r4.Err)
+	assert.Equal(t, "", r4.Data.(*model.TeamMember).Roles)
+}
diff --git a/store/storetest/user_store.go b/store/storetest/user_store.go
index 66f54df39..2c5e3b0bf 100644
--- a/store/storetest/user_store.go
+++ b/store/storetest/user_store.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/mattermost/mattermost-server/model"
 	"github.com/mattermost/mattermost-server/store"
@@ -49,6 +50,7 @@ func TestUserStore(t *testing.T, ss store.Store) {
 	t.Run("AnalyticsGetInactiveUsersCount", func(t *testing.T) { testUserStoreAnalyticsGetInactiveUsersCount(t, ss) })
 	t.Run("AnalyticsGetSystemAdminCount", func(t *testing.T) { testUserStoreAnalyticsGetSystemAdminCount(t, ss) })
 	t.Run("GetProfilesNotInTeam", func(t *testing.T) { testUserStoreGetProfilesNotInTeam(t, ss) })
+	t.Run("ClearAllCustomRoleAssignments", func(t *testing.T) { testUserStoreClearAllCustomRoleAssignments(t, ss) })
 }
 
 func testUserStoreSave(t *testing.T, ss store.Store) {
@@ -2118,3 +2120,49 @@ func testUserStoreGetProfilesNotInTeam(t *testing.T, ss store.Store) {
 		}
 	}
 }
+
+func testUserStoreClearAllCustomRoleAssignments(t *testing.T, ss store.Store) {
+	u1 := model.User{
+		Email:    model.NewId(),
+		Username: model.NewId(),
+		Roles:    "system_user system_admin system_post_all",
+	}
+	u2 := model.User{
+		Email:    model.NewId(),
+		Username: model.NewId(),
+		Roles:    "system_user custom_role system_admin another_custom_role",
+	}
+	u3 := model.User{
+		Email:    model.NewId(),
+		Username: model.NewId(),
+		Roles:    "system_user",
+	}
+	u4 := model.User{
+		Email:    model.NewId(),
+		Username: model.NewId(),
+		Roles:    "custom_only",
+	}
+
+	store.Must(ss.User().Save(&u1))
+	store.Must(ss.User().Save(&u2))
+	store.Must(ss.User().Save(&u3))
+	store.Must(ss.User().Save(&u4))
+
+	require.Nil(t, (<-ss.User().ClearAllCustomRoleAssignments()).Err)
+
+	r1 := <-ss.User().GetByUsername(u1.Username)
+	require.Nil(t, r1.Err)
+	assert.Equal(t, u1.Roles, r1.Data.(*model.User).Roles)
+
+	r2 := <-ss.User().GetByUsername(u2.Username)
+	require.Nil(t, r2.Err)
+	assert.Equal(t, "system_user system_admin", r2.Data.(*model.User).Roles)
+
+	r3 := <-ss.User().GetByUsername(u3.Username)
+	require.Nil(t, r3.Err)
+	assert.Equal(t, u3.Roles, r3.Data.(*model.User).Roles)
+
+	r4 := <-ss.User().GetByUsername(u4.Username)
+	require.Nil(t, r4.Err)
+	assert.Equal(t, "", r4.Data.(*model.User).Roles)
+}