Matttermost, Inc.

[Team version] User permission preventing bots to send PUT request to update channel header

For feature requests, please see: http://www.mattermost.org/feature-requests/.

For troubleshooting questions, please post in the following format:

Summary

After updating to mattermost server version 5.1x, bot user need permission=manage_private_channel_properties to update private channels

In Team version, Advance Policies management is not visible and as a result, bots currently have to be added to channels.

Steps to reproduce

Mattermost Team version

Mattermost Version: 5.11.0

Database Schema Version: 5.11.0

Database: mysql

Mattermost docker image built from https://github.com/mattermost/mattermost-docker/blob/master/app/Dockerfile

Expected behavior

Bots able to update channel header

Observed behavior

Logs:
{“level”:“error”,“ts”:,“caller”:“mlog/log.go:172”,“msg”:“You do not have the appropriate permissions”,“path”:"/api/v4/channels//patch",“request_id”:"",“ip_addr”:"",“user_id”:"",“method”:“PUT”,“err_where”:“Permissions”,“http_code”:403,“err_details”:“userId=, permission=manage_private_channel_properties”

Hi @LuckyLuke192,

We have some bug tickets related to bot accounts, wondering if some of these might describe your use case:

Hello @amy.blais,

Thank you for your answer.

Is it possible in the future Team versions that we don’t have to add bot to channel to call channel related APIs? Example use case is that we don’t necessarily want the owner of the bots to be able to view the content of the channels. If there are a better way to do this, we’d appreciate if you can let us know.

@jasonblais Your team probably knows about the above question.

Is it possible in the future Team versions that we don’t have to add bot to channel to call channel related APIs? Example use case is that we don’t necessarily want the owner of the bots to be able to view the content of the channels.

@LuckyLuke192 Soon you will!

In Mattermost 5.12 releasing on June 16th, we’ll add a new type of user account called “bots”. It acts as any other regular user account, except it cannot be used to log in.

Moreover, you’ll be able to enable the bot to post to any channel in the system:

image

Awesome!

Thanks for info and keep up the good work!