snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

e2e-tests/playwright/specs/functional/system_console/permissions/system_role_assignment.spec.ts

@@ -0,0 +1,74 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+import {expect, test} from '@mattermost/playwright-lib';
+
+const roleCases = [{accessor: 'sharedChannelManager' as const, roleId: 'system_shared_channel_manager'}];
+
+for (const {accessor, roleId} of roleCases) {
+    test(
+        `Assigning a user to ${roleId} persists after page reload`,
+        {tag: ['@smoke', '@system_console']},
+        async ({pw}) => {
+            const {adminUser, adminClient, user} = await pw.initSetup();
+
+            // Login as admin and navigate to System Console
+            const {systemConsolePage} = await pw.testBrowser.login(adminUser);
+            await systemConsolePage.goto();
+
+            // Navigate to Delegated Granular Administration
+            await systemConsolePage.sidebar.delegatedGranularAdministration.click();
+            await systemConsolePage.delegatedGranularAdministration.toBeVisible();
+
+            // Click Edit on the role
+            await systemConsolePage.delegatedGranularAdministration.adminRolesPanel[accessor].clickEdit();
+            await systemConsolePage.delegatedGranularAdministration.systemRoles.toBeVisible();
+
+            // Click "Add People" to open the modal
+            await systemConsolePage.delegatedGranularAdministration.systemRoles.assignedPeoplePanel.clickAddPeople();
+
+            // Interact with the Add Users modal
+            const modal = systemConsolePage.page.locator('#addUsersToRoleModal');
+            await expect(modal).toBeVisible();
+
+            // Search for the test user using react-select's combobox input
+            const searchInput = modal.getByRole('combobox', {name: 'Search for people'});
+            await searchInput.click();
+            await searchInput.pressSequentially(user.username, {delay: 50});
+
+            // Wait for search results and click the user row
+            const userRow = modal.locator('.more-modal__row').filter({hasText: user.username});
+            await expect(userRow).toBeVisible();
+            await userRow.click();
+
+            // Click the Add button in the modal
+            await modal.locator('#saveItems').click();
+
+            // The user should now appear in the Assigned People panel
+            const assignedPanel = systemConsolePage.delegatedGranularAdministration.systemRoles.assignedPeoplePanel;
+            const assignedUserRow = assignedPanel.getUserRowByUsername(user.username);
+            await assignedUserRow.toBeVisible();
+
+            // Save the role assignment
+            await systemConsolePage.delegatedGranularAdministration.systemRoles.save();
+
+            // Wait for redirect back to system_roles list
+            await systemConsolePage.page.waitForURL('**/admin_console/user_management/system_roles');
+
+            // Navigate back to the role
+            await systemConsolePage.delegatedGranularAdministration.adminRolesPanel[accessor].clickEdit();
+            await systemConsolePage.delegatedGranularAdministration.systemRoles.toBeVisible();
+
+            // Verify the user persists in the Assigned People panel
+            const persistedUserRow =
+                systemConsolePage.delegatedGranularAdministration.systemRoles.assignedPeoplePanel.getUserRowByUsername(
+                    user.username,
+                );
+            await persistedUserRow.toBeVisible();
+
+            // Also verify via API that the user has the role
+            const updatedUser = await adminClient.getUser(user.id);
+            expect(updatedUser.roles).toContain(roleId);
+        },
+    );
+}

e2e-tests/playwright/specs/functional/system_console/permissions/team_access.spec.ts

@@ -0,0 +1,136 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+import type {UserProfile} from '@mattermost/types/users';
+
+import type {PlaywrightExtended, SystemConsolePage} from '@mattermost/playwright-lib';
+import {expect, test} from '@mattermost/playwright-lib';
+
+test(
+    'MM-63378 System Manager without team access permissions cannot view team details',
+    {tag: ['@smoke', '@system_console']},
+    async ({pw}) => {
+        const {
+            adminUser,
+            adminClient,
+            user: systemManagerUser,
+            userClient: systemManagerClient,
+            team,
+        } = await pw.initSetup();
+
+        // Update user with system_manager role
+        await adminClient.updateUserRoles(systemManagerUser.id, 'system_user system_manager');
+
+        // Create another team of which the user is not a member.
+        const otherTeam = await adminClient.createTeam(await pw.random.team());
+
+        // Configure the system manager with the default permissions (as admin).
+        await setupSystemManagerPermission(pw, adminUser, 'reporting', 'team_statistics', 'Can edit');
+        await setupSystemManagerPermission(pw, adminUser, 'userManagement', 'teams', 'Can edit');
+
+        // Re-login as the system manager (the admin login above replaced the page context)
+        const {systemConsolePage} = await pw.testBrowser.login(systemManagerUser);
+
+        // Verify the system manager has access to the site statistics for all teams
+        await systemConsolePage.goto();
+
+        // Navigate to Team Statistics and verify access to user's team
+        await verifyTeamStatisticsAccess(systemConsolePage, team.id, team.display_name);
+
+        // Select the other team by value and verify access
+        await systemConsolePage.teamStatistics.selectTeamById(otherTeam.id);
+        await systemConsolePage.teamStatistics.toHaveTeamHeader(otherTeam.display_name);
+
+        // Verify the user has API access to the otherTeam.
+        const fetchedOtherTeam = await systemManagerClient.getTeam(otherTeam.id);
+        expect(fetchedOtherTeam.id).toEqual(otherTeam.id);
+
+        // Configure the system manager without access to team user management
+        await setupSystemManagerPermission(pw, adminUser, 'userManagement', 'teams', 'No access');
+
+        // Re-login as the system manager again after permission change
+        const {systemConsolePage: systemConsolePage2} = await pw.testBrowser.login(systemManagerUser);
+
+        // Verify the system manager only has access to the site statistics for the team they belong to
+        await systemConsolePage2.goto();
+
+        // Navigate to Team Statistics and verify access to user's team
+        await verifyTeamStatisticsAccess(systemConsolePage2, team.id, team.display_name);
+
+        // Verify the user has no API access to the otherTeam.
+        let apiError: Error | null = null;
+        try {
+            await systemManagerClient.getTeam(otherTeam.id);
+        } catch (error) {
+            apiError = error as Error;
+        }
+        expect(apiError).not.toBeNull();
+        expect(apiError?.message).toContain('You do not have the appropriate permissions');
+    },
+);
+
+// Helper function to navigate to Team Statistics and verify team access
+const verifyTeamStatisticsAccess = async (
+    systemConsolePage: SystemConsolePage,
+    teamId: string,
+    teamDisplayName: string,
+) => {
+    // Navigate to Team Statistics
+    await systemConsolePage.sidebar.reporting.teamStatistics.click();
+    await systemConsolePage.teamStatistics.toBeVisible();
+
+    // Select the team by value
+    await systemConsolePage.teamStatistics.selectTeamById(teamId);
+
+    // Verify the text shows "Team Statistics for <team name>"
+    await systemConsolePage.teamStatistics.toHaveTeamHeader(teamDisplayName);
+};
+
+type PermissionValue = 'Can edit' | 'Read only' | 'No access';
+
+// setupSystemManagerRole configures the system manager with the given permission ("Can edit", "Read only", "No access")
+// for the given section and subsection.
+//
+// We do this via the system console and not the API because this page has multiple queries to build up the
+// final API call that are all ultimately part of the spec, and we want to test the effects of those, not
+// merely a hand-created version of the same.
+const setupSystemManagerPermission = async (
+    pw: PlaywrightExtended,
+    adminUser: UserProfile,
+    sectionName: 'reporting' | 'userManagement',
+    subsectionName: string,
+    permission: PermissionValue,
+) => {
+    // Login as admin and navigate to System Console
+    const {systemConsolePage} = await pw.testBrowser.login(adminUser);
+
+    // Go to System Console
+    await systemConsolePage.goto();
+
+    // Navigate to Delegated Granular Administration
+    await systemConsolePage.sidebar.delegatedGranularAdministration.click();
+    await systemConsolePage.delegatedGranularAdministration.toBeVisible();
+
+    // Click on the System Manager row to go to its settings page
+    await systemConsolePage.delegatedGranularAdministration.adminRolesPanel.systemManager.clickEdit();
+    await systemConsolePage.delegatedGranularAdministration.systemRoles.toBeVisible();
+
+    // Get the section from privileges panel
+    const section = systemConsolePage.delegatedGranularAdministration.systemRoles.privilegesPanel[sectionName];
+
+    // Expand subsections if needed
+    await section.expandSubsections();
+
+    // Get the subsection and set permission
+    const subsection = section.getSubsection(subsectionName);
+    await subsection.setPermission(permission);
+
+    // Save
+    await systemConsolePage.delegatedGranularAdministration.systemRoles.save();
+
+    // Wait for save to complete - successful save redirects to system_roles list
+    await systemConsolePage.page.waitForURL('**/admin_console/user_management/system_roles');
+
+    // Wait for the page to fully load
+    await systemConsolePage.page.waitForLoadState('networkidle');
+};