summaryrefslogtreecommitdiffstats
path: root/utils/authorization.go
diff options
context:
space:
mode:
Diffstat (limited to 'utils/authorization.go')
-rw-r--r--utils/authorization.go75
1 files changed, 43 insertions, 32 deletions
diff --git a/utils/authorization.go b/utils/authorization.go
index 42815b807..bc71404ef 100644
--- a/utils/authorization.go
+++ b/utils/authorization.go
@@ -7,14 +7,7 @@ import (
"github.com/mattermost/mattermost-server/model"
)
-func DefaultRolesBasedOnConfig(cfg *model.Config, isLicensed bool) map[string]*model.Role {
- roles := make(map[string]*model.Role)
- for id, role := range model.DefaultRoles {
- copy := &model.Role{}
- *copy = *role
- roles[id] = copy
- }
-
+func SetRolePermissionsFromConfig(roles map[string]*model.Role, cfg *model.Config, isLicensed bool) map[string]*model.Role {
if isLicensed {
switch *cfg.TeamSettings.RestrictPublicChannelCreation {
case model.PERMISSIONS_ALL:
@@ -38,8 +31,8 @@ func DefaultRolesBasedOnConfig(cfg *model.Config, isLicensed bool) map[string]*m
if isLicensed {
switch *cfg.TeamSettings.RestrictPublicChannelManagement {
case model.PERMISSIONS_ALL:
- roles[model.TEAM_USER_ROLE_ID].Permissions = append(
- roles[model.TEAM_USER_ROLE_ID].Permissions,
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions,
model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id,
)
case model.PERMISSIONS_CHANNEL_ADMIN:
@@ -58,8 +51,8 @@ func DefaultRolesBasedOnConfig(cfg *model.Config, isLicensed bool) map[string]*m
)
}
} else {
- roles[model.TEAM_USER_ROLE_ID].Permissions = append(
- roles[model.TEAM_USER_ROLE_ID].Permissions,
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions,
model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES.Id,
)
}
@@ -67,8 +60,8 @@ func DefaultRolesBasedOnConfig(cfg *model.Config, isLicensed bool) map[string]*m
if isLicensed {
switch *cfg.TeamSettings.RestrictPublicChannelDeletion {
case model.PERMISSIONS_ALL:
- roles[model.TEAM_USER_ROLE_ID].Permissions = append(
- roles[model.TEAM_USER_ROLE_ID].Permissions,
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions,
model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id,
)
case model.PERMISSIONS_CHANNEL_ADMIN:
@@ -87,8 +80,8 @@ func DefaultRolesBasedOnConfig(cfg *model.Config, isLicensed bool) map[string]*m
)
}
} else {
- roles[model.TEAM_USER_ROLE_ID].Permissions = append(
- roles[model.TEAM_USER_ROLE_ID].Permissions,
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions,
model.PERMISSION_DELETE_PUBLIC_CHANNEL.Id,
)
}
@@ -116,8 +109,8 @@ func DefaultRolesBasedOnConfig(cfg *model.Config, isLicensed bool) map[string]*m
if isLicensed {
switch *cfg.TeamSettings.RestrictPrivateChannelManagement {
case model.PERMISSIONS_ALL:
- roles[model.TEAM_USER_ROLE_ID].Permissions = append(
- roles[model.TEAM_USER_ROLE_ID].Permissions,
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions,
model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id,
)
case model.PERMISSIONS_CHANNEL_ADMIN:
@@ -136,8 +129,8 @@ func DefaultRolesBasedOnConfig(cfg *model.Config, isLicensed bool) map[string]*m
)
}
} else {
- roles[model.TEAM_USER_ROLE_ID].Permissions = append(
- roles[model.TEAM_USER_ROLE_ID].Permissions,
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions,
model.PERMISSION_MANAGE_PRIVATE_CHANNEL_PROPERTIES.Id,
)
}
@@ -145,8 +138,8 @@ func DefaultRolesBasedOnConfig(cfg *model.Config, isLicensed bool) map[string]*m
if isLicensed {
switch *cfg.TeamSettings.RestrictPrivateChannelDeletion {
case model.PERMISSIONS_ALL:
- roles[model.TEAM_USER_ROLE_ID].Permissions = append(
- roles[model.TEAM_USER_ROLE_ID].Permissions,
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions,
model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id,
)
case model.PERMISSIONS_CHANNEL_ADMIN:
@@ -165,8 +158,8 @@ func DefaultRolesBasedOnConfig(cfg *model.Config, isLicensed bool) map[string]*m
)
}
} else {
- roles[model.TEAM_USER_ROLE_ID].Permissions = append(
- roles[model.TEAM_USER_ROLE_ID].Permissions,
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions,
model.PERMISSION_DELETE_PRIVATE_CHANNEL.Id,
)
}
@@ -222,8 +215,8 @@ func DefaultRolesBasedOnConfig(cfg *model.Config, isLicensed bool) map[string]*m
model.PERMISSION_ADD_USER_TO_TEAM.Id,
)
} else if *cfg.TeamSettings.RestrictTeamInvite == model.PERMISSIONS_ALL {
- roles[model.SYSTEM_USER_ROLE_ID].Permissions = append(
- roles[model.SYSTEM_USER_ROLE_ID].Permissions,
+ roles[model.TEAM_USER_ROLE_ID].Permissions = append(
+ roles[model.TEAM_USER_ROLE_ID].Permissions,
model.PERMISSION_INVITE_USER.Id,
model.PERMISSION_ADD_USER_TO_TEAM.Id,
)
@@ -243,11 +236,6 @@ func DefaultRolesBasedOnConfig(cfg *model.Config, isLicensed bool) map[string]*m
roles[model.CHANNEL_USER_ROLE_ID].Permissions,
model.PERMISSION_DELETE_POST.Id,
)
- roles[model.CHANNEL_ADMIN_ROLE_ID].Permissions = append(
- roles[model.CHANNEL_ADMIN_ROLE_ID].Permissions,
- model.PERMISSION_DELETE_POST.Id,
- model.PERMISSION_DELETE_OTHERS_POSTS.Id,
- )
roles[model.TEAM_ADMIN_ROLE_ID].Permissions = append(
roles[model.TEAM_ADMIN_ROLE_ID].Permissions,
model.PERMISSION_DELETE_POST.Id,
@@ -272,12 +260,35 @@ func DefaultRolesBasedOnConfig(cfg *model.Config, isLicensed bool) map[string]*m
)
}
- if cfg.TeamSettings.EnableTeamCreation {
+ if *cfg.TeamSettings.EnableTeamCreation {
roles[model.SYSTEM_USER_ROLE_ID].Permissions = append(
roles[model.SYSTEM_USER_ROLE_ID].Permissions,
model.PERMISSION_CREATE_TEAM.Id,
)
}
+ if isLicensed {
+ switch *cfg.ServiceSettings.AllowEditPost {
+ case model.ALLOW_EDIT_POST_ALWAYS, model.ALLOW_EDIT_POST_TIME_LIMIT:
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions,
+ model.PERMISSION_EDIT_POST.Id,
+ )
+ roles[model.SYSTEM_ADMIN_ROLE_ID].Permissions = append(
+ roles[model.SYSTEM_ADMIN_ROLE_ID].Permissions,
+ model.PERMISSION_EDIT_POST.Id,
+ )
+ }
+ } else {
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions = append(
+ roles[model.CHANNEL_USER_ROLE_ID].Permissions,
+ model.PERMISSION_EDIT_POST.Id,
+ )
+ roles[model.SYSTEM_ADMIN_ROLE_ID].Permissions = append(
+ roles[model.SYSTEM_ADMIN_ROLE_ID].Permissions,
+ model.PERMISSION_EDIT_POST.Id,
+ )
+ }
+
return roles
}
generated by cgit v1.2.3-1-g7c22 (git 2.25.1) at 2024-06-02 22:27:48 +0000