Fix MM-67648 (and preserve MM-66249 fix)#2204
Merged
jgheithcock merged 3 commits intomasterfrom Feb 20, 2026
Merged
Conversation
We only require that a user can post in a channel (and thus, that a channel is provided) to create a checklist. The prior code checked if the user had the run_create in the team. This isn't the default in production but was part of the test setup. This also fixes a number of checklist specific tests to remove run_create from the 'team_user' as well as supply an existing channel ID.
calebroseland
requested changes
Feb 19, 2026
server/api/playbook_runs.go
Outdated
| if !h.pluginAPI.User.HasPermissionToTeam(userID, playbookRun.TeamID, model.PermissionRunCreate) { | ||
| return nil, errors.Wrap(app.ErrNoPermissions, "You do not have permission to create runs on this team") | ||
| // For checklists, verify a channel ID and verify user has permission to post in the channel below. | ||
| if playbookRun.ChannelID == "" { |
Member
There was a problem hiding this comment.
Suggested change
| if playbookRun.ChannelID == "" { | |
| if channel == nil { |
Contributor
Author
There was a problem hiding this comment.
Good call, done
calebroseland
added
2: Dev Review
|
Plugin Spinwick PR #2204 🎉 Test server created! Access here: https://playbooks-pr-2204-y3b3h.test.mattermost.cloud
Installation ID: Credentials: Posted securely in this Mattermost channel - Look for PR #2204 |
calebroseland
approved these changes
Feb 19, 2026
JulienTant
approved these changes
Feb 19, 2026
This was referenced Feb 20, 2026
mattermost-build
removed
the
Setup Cloud Test Server
|
Test server destroyed |
|
Plugin test server update attempted, but encountered an issue: The test server is still available. You can manually download and install the updated plugin using the artifact link below. Updated with git commit
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
What was wrong with the fix for MM-667648
We only require that a user can post in a channel (and thus, that a channel is provided) to create a checklist. The prior code checked if the user had the run_create in the team. This isn't the default in production but was part of the test setup.
Why did this not get caught by our tests
The short answer is that our tests do not match the reality of what is default in production. The worse part is that neither Claude nor i can determine where this happens. We test that a member (aka 'team_user') has the
run_createpermission and, while it does not in the default system configs, it does in our test environment but we cannot find where that is happening. So, for these checklist specific tests, we removerun_createfrom the 'team_user' as well as supply an existing channel ID. This made it so that, without the fix in playbook_runs.go, the tests now fail, and with that fix, all tests inmake testpass.Ticket Link
https://mattermost.atlassian.net/browse/MM-67648
Checklist
Gated by experimental feature flag