DEV: Move shared_drafts_min_trust_level to group setting (#24257)

No plugins or themes rely on shared_drafts_min_trust_level so we
can just switch straight over to shared_drafts_allowed_groups

c.f. https://meta.discourse.org/t/changes-coming-to-settings-for-giving-access-to-features-from-trust-levels-to-groups/283408

config/locales/server.en.yml

@@ -2430,6 +2430,7 @@ en:
 
     shared_drafts_category: "Enable the Shared Drafts feature by designating a category for topic drafts. Topics in this category will be suppressed from topic lists for staff users."
     shared_drafts_min_trust_level: "Allow users to see and edit Shared Drafts."
+    shared_drafts_allowed_groups: "Allow users in these groups to see and edit Shared Drafts."
 
     push_notifications_prompt: "Display user consent prompt."
     push_notifications_icon: "The badge icon that appears in the notification corner. A 96×96 monochromatic PNG with transparency is recommended."

config/site_settings.yml

@@ -879,6 +879,14 @@ posting:
   shared_drafts_min_trust_level:
     default: "staff"
     enum: "TrustLevelAndStaffSetting"
+    hidden: true
+  shared_drafts_allowed_groups:
+    default: "3" # auto group staff
+    type: group_list
+    client: true
+    allow_any: false
+    refresh: true
+    validator: "AtLeastOneGroupValidator"
   post_edit_time_limit:
     default: 1440
     max: 10080

db/migrate/20231107014123_migrate_shared_drafts_min_trust_level_to_group.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+class MigrateSharedDraftsMinTrustLevelToGroup < ActiveRecord::Migration[7.0]
+  def up
+    shared_drafts_min_trust_level_raw =
+      DB.query_single(
+        "SELECT value FROM site_settings WHERE name = 'shared_drafts_min_trust_level'",
+      ).first
+
+    # Default for old setting is staff and is TrustLevelAndStaffSetting, we only need to do anything if it's been changed in the DB.
+    if shared_drafts_min_trust_level_raw.present?
+      # Matches Group::AUTO_GROUPS to the trust levels & special admin/staff cases.
+      shared_drafts_allowed_groups =
+        case shared_drafts_min_trust_level_raw
+        when "admin"
+          "1"
+        when "staff"
+          "3"
+        when "0"
+          "10"
+        when "1"
+          "11"
+        when "2"
+          "12"
+        when "3"
+          "13"
+        when "4"
+          "14"
+        end
+
+      # Data_type 20 is group_list.
+      DB.exec(<<~SQL, setting: shared_drafts_allowed_groups)
+        INSERT INTO site_settings(name, value, data_type, created_at, updated_at)
+        VALUES('shared_drafts_allowed_groups', :setting, 20, NOW(), NOW())
+      SQL
+    end
+  end
+
+  def down
+    raise ActiveRecord::IrreversibleMigration
+  end
+end

lib/guardian/topic_guardian.rb

@@ -29,7 +29,7 @@ module TopicGuardian
   end
 
   def can_see_shared_draft?
-    @user.has_trust_level_or_staff?(SiteSetting.shared_drafts_min_trust_level)
+    @user.in_any_groups?(SiteSetting.shared_drafts_allowed_groups_map)
   end
 
   def can_create_whisper?

lib/site_settings/deprecated_settings.rb

@@ -9,6 +9,7 @@ module SiteSettings::DeprecatedSettings
     ["search_tokenize_chinese_japanese_korean", "search_tokenize_chinese", true, "2.9"],
     ["default_categories_regular", "default_categories_normal", true, "3.0"],
     ["anonymous_posting_min_trust_level", "anonymous_posting_allowed_groups", false, "3.3"],
+    ["shared_drafts_min_trust_level", "shared_drafts_allowed_groups", false, "3.3"],
   ]
 
   def setup_deprecated_methods

spec/fabricators/user_fabricator.rb

@@ -3,6 +3,8 @@
 Fabricator(:user_stat) {}
 
 Fabricator(:user, class_name: :user) do
+  transient refresh_auto_groups: false
+
   name "Bruce Wayne"
   username { sequence(:username) { |i| "bruce#{i}" } }
   email { sequence(:email) { |i| "bruce#{i}@wayne.com" } }
@@ -10,6 +12,10 @@ Fabricator(:user, class_name: :user) do
   trust_level TrustLevel[1]
   ip_address { sequence(:ip_address) { |i| "99.232.23.#{i % 254}" } }
   active true
+
+  after_create do |user, transients|
+    Group.user_trust_level_change!(user.id, user.trust_level) if transients[:refresh_auto_groups]
+  end
 end
 
 Fabricator(:user_with_secondary_email, from: :user) do

spec/lib/guardian/topic_guardian_spec.rb

@@ -18,58 +18,62 @@ RSpec.describe TopicGuardian do
   after { Guardian.disable_topic_can_see_consistency_check }
 
   describe "#can_create_shared_draft?" do
+    before { Group.refresh_automatic_groups! }
+
     it "when shared_drafts are disabled" do
-      SiteSetting.shared_drafts_min_trust_level = "admin"
+      SiteSetting.shared_drafts_allowed_groups = Group::AUTO_GROUPS[:admins]
 
       expect(Guardian.new(admin).can_create_shared_draft?).to eq(false)
     end
 
     it "when user is a moderator and access is set to admin" do
       SiteSetting.shared_drafts_category = category.id
-      SiteSetting.shared_drafts_min_trust_level = "admin"
+      SiteSetting.shared_drafts_allowed_groups = Group::AUTO_GROUPS[:admins]
 
       expect(Guardian.new(moderator).can_create_shared_draft?).to eq(false)
     end
 
     it "when user is a moderator and access is set to staff" do
       SiteSetting.shared_drafts_category = category.id
-      SiteSetting.shared_drafts_min_trust_level = "staff"
+      SiteSetting.shared_drafts_allowed_groups = Group::AUTO_GROUPS[:staff]
 
       expect(Guardian.new(moderator).can_create_shared_draft?).to eq(true)
     end
 
     it "when user is TL3 and access is set to TL2" do
       SiteSetting.shared_drafts_category = category.id
-      SiteSetting.shared_drafts_min_trust_level = "2"
+      SiteSetting.shared_drafts_allowed_groups = Group::AUTO_GROUPS[:trust_level_2]
 
       expect(Guardian.new(tl3_user).can_create_shared_draft?).to eq(true)
     end
   end
 
   describe "#can_see_shared_draft?" do
+    before { Group.refresh_automatic_groups! }
+
     it "when shared_drafts are disabled (existing shared drafts)" do
-      SiteSetting.shared_drafts_min_trust_level = "admin"
+      SiteSetting.shared_drafts_allowed_groups = Group::AUTO_GROUPS[:admins]
 
       expect(Guardian.new(admin).can_see_shared_draft?).to eq(true)
     end
 
     it "when user is a moderator and access is set to admin" do
       SiteSetting.shared_drafts_category = category.id
-      SiteSetting.shared_drafts_min_trust_level = "admin"
+      SiteSetting.shared_drafts_allowed_groups = Group::AUTO_GROUPS[:admins]
 
       expect(Guardian.new(moderator).can_see_shared_draft?).to eq(false)
     end
 
     it "when user is a moderator and access is set to staff" do
       SiteSetting.shared_drafts_category = category.id
-      SiteSetting.shared_drafts_min_trust_level = "staff"
+      SiteSetting.shared_drafts_allowed_groups = Group::AUTO_GROUPS[:staff]
 
       expect(Guardian.new(moderator).can_see_shared_draft?).to eq(true)
     end
 
     it "when user is TL3 and access is set to TL2" do
       SiteSetting.shared_drafts_category = category.id
-      SiteSetting.shared_drafts_min_trust_level = "2"
+      SiteSetting.shared_drafts_allowed_groups = Group::AUTO_GROUPS[:trust_level_2]
 
       expect(Guardian.new(tl3_user).can_see_shared_draft?).to eq(true)
     end
@@ -130,11 +134,11 @@ RSpec.describe TopicGuardian do
 
   describe "#can_edit_topic?" do
     context "when the topic is a shared draft" do
-      let(:tl2_user) { Fabricate(:user, trust_level: TrustLevel[2]) }
+      let(:tl2_user) { Fabricate(:user, trust_level: TrustLevel[2], refresh_auto_groups: true) }
 
       before do
         SiteSetting.shared_drafts_category = category.id
-        SiteSetting.shared_drafts_min_trust_level = "2"
+        SiteSetting.shared_drafts_allowed_groups = Group::AUTO_GROUPS[:trust_level_2]
       end
 
       it "returns false if the topic is a PM" do

spec/lib/guardian_spec.rb

@@ -1716,8 +1716,9 @@ RSpec.describe Guardian do
 
         before do
           SiteSetting.shared_drafts_category = category.id
-          SiteSetting.shared_drafts_min_trust_level = "2"
+          SiteSetting.shared_drafts_allowed_groups = Group::AUTO_GROUPS[:trust_level_2]
           Fabricate(:shared_draft, topic: topic)
+          Group.refresh_automatic_groups!
         end
 
         it "returns true if a shared draft exists" do

spec/lib/topic_query_spec.rb

@@ -1838,7 +1838,9 @@ RSpec.describe TopicQuery do
       shared_drafts_category.set_permissions(group => :full)
       shared_drafts_category.save
       SiteSetting.shared_drafts_category = shared_drafts_category.id
-      SiteSetting.shared_drafts_min_trust_level = TrustLevel[3]
+      SiteSetting.shared_drafts_allowed_groups =
+        Group::AUTO_GROUPS[:trust_level_3].to_s + "|" + Group::AUTO_GROUPS[:staff].to_s
+      Group.refresh_automatic_groups!
     end
 
     context "with destination_category_id" do
@@ -1853,7 +1855,7 @@ RSpec.describe TopicQuery do
       end
 
       it "allow group members with enough trust level to query destination_category_id" do
-        member = Fabricate(:user, trust_level: TrustLevel[3])
+        member = Fabricate(:user, trust_level: TrustLevel[3], refresh_auto_groups: true)
         group.add(member)
 
         list = TopicQuery.new(member, destination_category_id: category.id).list_latest
@@ -1862,7 +1864,7 @@ RSpec.describe TopicQuery do
       end
 
       it "doesn't allow group members without enough trust level to query destination_category_id" do
-        member = Fabricate(:user, trust_level: TrustLevel[2])
+        member = Fabricate(:user, trust_level: TrustLevel[2], refresh_auto_groups: true)
         group.add(member)
 
         list = TopicQuery.new(member, destination_category_id: category.id).list_latest