Skip to content

initial_snapshot: Centralize group-permission defaults; fix admin permission for legacy servers #1853

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Sep 19, 2025
Merged

initial_snapshot: Centralize group-permission defaults; fix admin permission for legacy servers #1853

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
a55ee82
message test: Vary user role in pre-291 selfCanDeleteMessage tests
chrisbobbe Sep 16, 2025
35f4dda
message: Fix permissions for admins on pre-291 servers
chrisbobbe Sep 16, 2025
4495100
message test [nfc]: Reword comment on pre-407 selfCanDeleteMessage tests
chrisbobbe Sep 16, 2025
391b56a
model [nfc]: Move has-passed-waiting-period method to RealmStore
chrisbobbe Sep 18, 2025
b584db5
permission [nfc]: Move some permissions code out to new file
chrisbobbe Sep 18, 2025
7e76531
initial_snapshot [nfc]: Add PermissionSettingsItem.defaultGroupName
chrisbobbe Sep 15, 2025
3730c90
initial_snapshot: Centralize (most of) the group-permission defaults
chrisbobbe Sep 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
245 changes: 0 additions & 245 deletions lib/api/model/initial_snapshot.dart
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -424,248 +424,3 @@ class UnreadHuddleSnapshot {

Map<String, dynamic> toJson() => _$UnreadHuddleSnapshotToJson(this);
}

/// Metadata about how to interpret the various group-based permission settings.
///
/// This is the type that [InitialSnapshot.serverSupportedPermissionSettings]
/// would have, according to the API as it exists as of 2025-08;
/// but that API is documented as unstable and subject to change.
///
/// For a useful value of this type, see [SupportedPermissionSettings.fixture].
///
/// For docs, search for "d_perm" in: https://zulip.com/api/register-queue
@JsonSerializable(fieldRename: FieldRename.snake)
class SupportedPermissionSettings {
final Map<String, PermissionSettingsItem> realm;
final Map<String, PermissionSettingsItem> stream;
final Map<String, PermissionSettingsItem> group;

/// Metadata about how to interpret certain group-based permission settings,
/// including all those that this client uses, based on "current" servers.
///
/// "Current" here means as of when this code was written, or last updated;
/// details in comments below. Naturally it'd be better to have an API to
/// get this information from the actual server.
///
/// Effectively we're counting on it being uncommon for the metadata for a
/// given permission to ever change from one server version to the next,
/// so that the values we take from one server version usually remain valid
/// for all past and future server versions that have the corresponding
/// permission at all.
///
/// TODO(server): Stabilize [InitialSnapshot.serverSupportedPermissionSettings]
/// or a similar API, and switch to using that. See thread:
/// https://chat.zulip.org/#narrow/channel/378-api-design/topic/server_supported_permission_settings/near/2247549
static SupportedPermissionSettings fixture = SupportedPermissionSettings(
realm: {
// From the server's Realm.REALM_PERMISSION_GROUP_SETTINGS,
// in zerver/models/realms.py. Current as of 6ab30fcce, 2025-08.
'create_multiuse_invite_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: false,
// default_group_name=SystemGroups.ADMINISTRATORS,
),
'can_access_all_users_group': PermissionSettingsItem(
// require_system_group=True,
// allow_nobody_group=False,
allowEveryoneGroup: true,
// default_group_name=SystemGroups.EVERYONE,
// # Note that user_can_access_all_other_users in the web
// # app is relying on members always have access.
// allowed_system_groups=[SystemGroups.EVERYONE, SystemGroups.MEMBERS],
),
'can_add_subscribers_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: false,
// default_group_name=SystemGroups.MEMBERS,
),
'can_add_custom_emoji_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: false,
// default_group_name=SystemGroups.MEMBERS,
),
'can_create_bots_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: false,
// default_group_name=SystemGroups.MEMBERS,
),
'can_create_groups': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: false,
// default_group_name=SystemGroups.MEMBERS,
),
'can_create_public_channel_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: false,
// default_group_name=SystemGroups.MEMBERS,
),
'can_create_private_channel_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: false,
// default_group_name=SystemGroups.MEMBERS,
),
'can_create_web_public_channel_group': PermissionSettingsItem(
// require_system_group=True,
// allow_nobody_group=True,
allowEveryoneGroup: false,
// default_group_name=SystemGroups.OWNERS,
// allowed_system_groups=[
// SystemGroups.MODERATORS,
// SystemGroups.ADMINISTRATORS,
// SystemGroups.OWNERS,
// SystemGroups.NOBODY,
// ],
),
'can_create_write_only_bots_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: false,
// default_group_name=SystemGroups.MEMBERS,
),
'can_delete_any_message_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: false,
// default_group_name=SystemGroups.ADMINISTRATORS,
),
'can_delete_own_message_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: true,
// default_group_name=SystemGroups.EVERYONE,
),
'can_invite_users_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: false,
// default_group_name=SystemGroups.MEMBERS,
),
'can_manage_all_groups': PermissionSettingsItem(
// allow_nobody_group=False,
allowEveryoneGroup: false,
// default_group_name=SystemGroups.OWNERS,
),
'can_manage_billing_group': PermissionSettingsItem(
// allow_nobody_group=False,
allowEveryoneGroup: false,
// default_group_name=SystemGroups.ADMINISTRATORS,
),
'can_mention_many_users_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: true,
// default_group_name=SystemGroups.ADMINISTRATORS,
),
'can_move_messages_between_channels_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: false,
// default_group_name=SystemGroups.MEMBERS,
),
'can_move_messages_between_topics_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: true,
// default_group_name=SystemGroups.EVERYONE,
),
'can_resolve_topics_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: true,
// default_group_name=SystemGroups.EVERYONE,
),
'can_set_delete_message_policy_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: false,
// default_group_name=SystemGroups.MODERATORS,
),
'can_set_topics_policy_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: true,
// default_group_name=SystemGroups.MEMBERS,
),
'can_summarize_topics_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: true,
// default_group_name=SystemGroups.EVERYONE,
),
'direct_message_initiator_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: true,
// default_group_name=SystemGroups.EVERYONE,
),
'direct_message_permission_group': PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: true,
// default_group_name=SystemGroups.EVERYONE,
),
},
group: {}, // Please go ahead and fill this in when we come to need it.
stream: {
// From the server's Stream.stream_permission_group_settings,
// in zerver/models/streams.py. Current as of f9dc13014, 2025-08.
"can_add_subscribers_group": PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: false,
// default_group_name=SystemGroups.NOBODY,
),
"can_administer_channel_group": PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: false,
// default_group_name="stream_creator_or_nobody",
),
"can_delete_any_message_group": PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: true,
// default_group_name=SystemGroups.NOBODY,
),
"can_delete_own_message_group": PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: true,
// default_group_name=SystemGroups.NOBODY,
),
"can_move_messages_out_of_channel_group": PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: true,
// default_group_name=SystemGroups.NOBODY,
),
"can_move_messages_within_channel_group": PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: true,
// default_group_name=SystemGroups.NOBODY,
),
"can_remove_subscribers_group": PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: true,
// default_group_name=SystemGroups.ADMINISTRATORS,
),
"can_send_message_group": PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: true,
// default_group_name=SystemGroups.EVERYONE,
),
"can_subscribe_group": PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: false,
// default_group_name=SystemGroups.NOBODY,
),
"can_resolve_topics_group": PermissionSettingsItem(
// allow_nobody_group=True,
allowEveryoneGroup: true,
// default_group_name=SystemGroups.NOBODY,
),
},
);

SupportedPermissionSettings({required this.realm, required this.stream, required this.group});

factory SupportedPermissionSettings.fromJson(Map<String, dynamic> json) =>
_$SupportedPermissionSettingsFromJson(json);

Map<String, dynamic> toJson() => _$SupportedPermissionSettingsToJson(this);
}

@JsonSerializable(fieldRename: FieldRename.snake)
class PermissionSettingsItem {
final bool allowEveryoneGroup;
// also other fields not yet used

PermissionSettingsItem({required this.allowEveryoneGroup});

factory PermissionSettingsItem.fromJson(Map<String, dynamic> json) =>
_$PermissionSettingsItemFromJson(json);

Map<String, dynamic> toJson() => _$PermissionSettingsItemToJson(this);
}
35 changes: 0 additions & 35 deletions lib/api/model/initial_snapshot.g.dart
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading