From eed869ac9031c63f47c0ecea7d8ddfa9aa8440c8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Oliver=20J=C3=A4gle?= <github@beimir.net>
Date: Fri, 17 Nov 2017 18:28:14 +0100
Subject: [PATCH] Allow maintenance of per-setting permissions - first draft,
 not beautified yet

---
 package-lock.json                             |  12 +-
 package.json                                  |   4 +-
 .../client/lib/SettingPermissions.js          |   8 +
 .../client/views/permissions.html             |  66 ++++---
 .../client/views/permissions.js               |  75 +++++---
 .../lib/rocketchat.js                         |   4 +
 packages/rocketchat-authorization/package.js  |   1 +
 .../server/publications/permissions.js        |  21 ++-
 .../server/startup.js                         | 174 +++++++++++-------
 .../server/publications/settings.js           |  30 +++
 .../rocketchat-livechat/app/package-lock.json |  22 +--
 packages/rocketchat-ui-admin/client/admin.js  |  82 ++++++---
 12 files changed, 337 insertions(+), 162 deletions(-)
 create mode 100644 packages/rocketchat-authorization/client/lib/SettingPermissions.js

diff --git a/package-lock.json b/package-lock.json
index 9827c6fdf1d0..139e1f2264cd 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -327,7 +327,7 @@
     "async": {
       "version": "2.5.0",
       "resolved": "https://registry.npmjs.org/async/-/async-2.5.0.tgz",
-      "integrity": "sha512-e+lJAJeNWuPCNyxZKOBdaJGyLGHugXVQtrAwtuAe2vhxTYxFTKE73p8JuTmdH0qdQZtDvI4dhJwjZc5zsfIsYw==",
+      "integrity": "sha1-hDGQ/WtzV6C54clW7d3V7IRitU0=",
       "requires": {
         "lodash": "4.17.4"
       }
@@ -352,7 +352,7 @@
     "autoprefixer": {
       "version": "7.1.6",
       "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-7.1.6.tgz",
-      "integrity": "sha512-C9yv/UF3X+eJTi/zvfxuyfxmLibYrntpF3qoJYrMeQwgUJOZrZvpJiMG2FMQ3qnhWtF/be4pYONBBw95ZGe3vA==",
+      "integrity": "sha1-+5MwOfdK90qD5xIlznjZ/Vi6hNc=",
       "dev": true,
       "requires": {
         "browserslist": "2.6.1",
@@ -6927,7 +6927,7 @@
     "postcss-custom-properties": {
       "version": "6.2.0",
       "resolved": "https://registry.npmjs.org/postcss-custom-properties/-/postcss-custom-properties-6.2.0.tgz",
-      "integrity": "sha512-eNR2h9T9ciKMoQEORrPjH33XeN/nuvVuxArOKmHtsFbGbNss631tgTrKou3/pmjAZbA4QQkhLIkPQkIk3WW+8w==",
+      "integrity": "sha1-XZKafwbpuE4PETNBlMC6mjCs++k=",
       "dev": true,
       "requires": {
         "balanced-match": "1.0.0",
@@ -6949,7 +6949,7 @@
     "postcss-less": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/postcss-less/-/postcss-less-1.1.1.tgz",
-      "integrity": "sha512-zl0EEqq8Urh37Ppdv9zzhpZpLHrgkxmt6e3O4ftRa7/b8Uq2LV+/KBVM8/KuzmHNu+mthhOArg1lxbfqQ3NUdg==",
+      "integrity": "sha1-S9JA21F840B1g9knhYGE9QBF9Ks=",
       "dev": true,
       "requires": {
         "postcss": "5.2.18"
@@ -7035,7 +7035,7 @@
     "postcss-nesting": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/postcss-nesting/-/postcss-nesting-3.0.0.tgz",
-      "integrity": "sha512-ijQlEXUcYXXNPdLMFcMEr4i5SEPRKR8fq/Iya4L0mQbNOCz+szTGCBlf0Cvu2HiQLjCNqLnGO4fKFLbNnXe7Ag==",
+      "integrity": "sha1-sKdJ1+/xHSVQoE3qZCtpXXWC+x0=",
       "dev": true,
       "requires": {
         "postcss": "6.0.13"
@@ -7562,7 +7562,7 @@
     "retry-request": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/retry-request/-/retry-request-3.1.0.tgz",
-      "integrity": "sha512-jOwZQlWR/boHhbAfzfOoUn28EDDotW2A7YxV2o5mfBb07H0k/zZAgbxRcckW08GKl/aT0JtPk1NViuk2BfHqVg==",
+      "integrity": "sha1-+UjKF5JlemSryJoPrXJ90HtisNY=",
       "requires": {
         "request": "2.83.0",
         "through2": "2.0.3"
diff --git a/package.json b/package.json
index 06fc561dba30..8b92ce12e480 100644
--- a/package.json
+++ b/package.json
@@ -60,7 +60,9 @@
 		"chat"
 	],
 	"scripts": {
-		"start": "meteor npm i && meteor",
+		"start": "meteor npm i && meteor run",
+		"debug": "meteor run --inspect",
+		"debug-brk": "meteor run --inspect-brk",
 		"lint": "eslint .",
 		"lint-fix": "eslint . --fix",
 		"stylelint": "stylelint packages/**/*.css",
diff --git a/packages/rocketchat-authorization/client/lib/SettingPermissions.js b/packages/rocketchat-authorization/client/lib/SettingPermissions.js
new file mode 100644
index 000000000000..1ae099a28c64
--- /dev/null
+++ b/packages/rocketchat-authorization/client/lib/SettingPermissions.js
@@ -0,0 +1,8 @@
+RocketChat.authz.settingCachedCollectiong = new RocketChat.CachedCollection({
+	name: 'setting-permissions',
+	eventType: 'onLogged',
+	userRelated: false
+});
+RocketChat.authz.settingCachedCollectiong.init();
+
+this.SettingPermissions = RocketChat.authz.settingCachedCollectiong.collection;
diff --git a/packages/rocketchat-authorization/client/views/permissions.html b/packages/rocketchat-authorization/client/views/permissions.html
index e0e47d6b426d..8f88f6e3948d 100644
--- a/packages/rocketchat-authorization/client/views/permissions.html
+++ b/packages/rocketchat-authorization/client/views/permissions.html
@@ -1,34 +1,46 @@
+<template name="permissionsTable">
+	<table border="1" class="permission-grid secondary-background-color">
+		<thead class="content-background-color">
+		<tr>
+			<th class="border-component-color">&nbsp;</th>
+			{{#each role in allRoles}}
+				<th class="border-component-color" title="{{role.description}}">
+					<a href="{{pathFor "admin-permissions-edit" name=role._id}}">
+						{{role._id}}
+						<i class="icon-edit"></i>
+					</a>
+				</th>
+			{{/each}}
+		</tr>
+		</thead>
+		<tbody>
+		{{#each permission in permissions}}
+			<tr class="admin-table-row">
+				<td class="permission-name border-component-color" title="{{permissionDescription permission}}">{{permissionName permission}}<br>[{{permission._id}}]
+				</td>
+				{{#each role in allRoles}}
+					<td class="border-component-color">
+						<input type="checkbox" name="perm[{{_id}}][{{../_id}}]" class="role-permission"
+							   value="1" checked="{{granted permission.roles role}}" data-role="{{role._id}}"
+							   data-permission="{{permission._id}}">
+					</td>
+				{{/each}}
+			</tr>
+		{{/each}}
+		</tbody>
+	</table>
+</template>
 <template name="permissions">
 	<div class="permissions-manager">
 		{{#if hasPermission}}
 			<a href="{{pathFor "admin-permissions-new"}}" class="button primary new-role">{{_ "New_role"}}</a>
-			<table border="1" class="permission-grid secondary-background-color">
-				<thead class="content-background-color">
-					<tr>
-						<th class="border-component-color">&nbsp;</th>
-						{{#each role}}
-							<th class="border-component-color" title="{{description}}">
-								<a href="{{pathFor "admin-permissions-edit" name=_id}}">
-									{{_id}}
-									<i class="icon-edit"></i>
-								</a>
-							</th>
-						{{/each}}
-					</tr>
-				</thead>
-				<tbody>
-					{{#each permission}}
-						<tr class="admin-table-row">
-							<td class="permission-name border-component-color" title="{{_ permissionDescription}}">{{_ permissionName}}<br>[{{_id}}]</td>
-							{{#each role}}
-								<td class="border-component-color">
-									<input type="checkbox" name="perm[{{_id}}][{{../_id}}]" class="role-permission" value="1" checked="{{granted ../roles}}" data-role="{{_id}}" data-permission="{{../_id}}">
-								</td>
-							{{/each}}
-						</tr>
-					{{/each}}
-				</tbody>
-			</table>
+			{{> permissionsTable permissions=permissions allRoles=roles}}
+			{{#if settingPermissionExpanded}}
+				<div class="js-toggle-setting-permissions">{{_ "setting-permissions-collapse"}}</div>
+				{{> permissionsTable permissions=settingPermissions allRoles=roles}}
+			{{else}}
+				<div class="js-toggle-setting-permissions">{{_ "setting-permissions-expand"}}</div>
+			{{/if}}
 		{{else}}
 			{{_ "Not_authorized"}}
 		{{/if}}
diff --git a/packages/rocketchat-authorization/client/views/permissions.js b/packages/rocketchat-authorization/client/views/permissions.js
index 6205927af5a1..a7ef073d520e 100644
--- a/packages/rocketchat-authorization/client/views/permissions.js
+++ b/packages/rocketchat-authorization/client/views/permissions.js
@@ -1,11 +1,10 @@
-/* globals ChatPermissions */
-
+/* globals ChatPermissions, SettingPermissions */
 Template.permissions.helpers({
-	role() {
+	roles() {
 		return Template.instance().roles.get();
 	},
 
-	permission() {
+	permissions() {
 		return ChatPermissions.find({}, {
 			sort: {
 				_id: 1
@@ -13,33 +12,63 @@ Template.permissions.helpers({
 		});
 	},
 
-	granted(roles) {
+	settingPermissions() {
+		return SettingPermissions.find({}, {
+			sort: {
+				_id: 1
+			}
+		});
+	},
+
+	hasPermission() {
+		return RocketChat.authz.hasAllPermission('access-permissions');
+	},
+
+	settingPermissionExpanded() {
+		return Template.instance().settingPermissionsExpanded.get();
+	}
+});
+
+Template.permissions.events({
+	'click .js-toggle-setting-permissions'(event, instance) {
+		instance.settingPermissionsExpanded.set(!instance.settingPermissionsExpanded.get());
+	}
+});
+
+Template.permissions.onCreated(function() {
+	this.settingPermissionsExpanded = new ReactiveVar(false);
+	this.roles = new ReactiveVar([]);
+
+	Tracker.autorun(() => {
+		this.roles.set(RocketChat.models.Roles.find().fetch());
+	});
+});
+
+Template.permissionsTable.helpers({
+	granted(roles, role) {
 		if (roles) {
-			if (roles.indexOf(this._id) !== -1) {
+			if (roles.indexOf(role._id) !== -1) {
 				return 'checked';
 			}
 		}
 	},
 
-	permissionName() {
-		return `${ this._id }`;
-	},
-
-	permissionDescription() {
-		return `${ this._id }_description`;
+	permissionName(permission) {
+		return t(permission._id);
 	},
 
-	hasPermission() {
-		return RocketChat.authz.hasAllPermission('access-permissions');
+	permissionDescription(permission) {
+		return t(`${ permission._id }_description`);
 	}
 });
 
-Template.permissions.events({
+Template.permissionsTable.events({
 	'click .role-permission'(e, instance) {
 		const permission = e.currentTarget.getAttribute('data-permission');
 		const role = e.currentTarget.getAttribute('data-role');
 
-		if (instance.permissionByRole[permission].indexOf(role) === -1) {
+		if (!instance.permissionByRole[permission] // the permissino has this role not assigned at all (undefined)
+			|| instance.permissionByRole[permission].indexOf(role) === -1) {
 			return Meteor.call('authorization:addPermissionToRole', permission, role);
 		} else {
 			return Meteor.call('authorization:removeRoleFromPermission', permission, role);
@@ -47,8 +76,8 @@ Template.permissions.events({
 	}
 });
 
-Template.permissions.onCreated(function() {
-	this.roles = new ReactiveVar([]);
+
+Template.permissionsTable.onCreated(function() {
 	this.permissionByRole = {};
 	this.actions = {
 		added: {},
@@ -56,11 +85,7 @@ Template.permissions.onCreated(function() {
 	};
 
 	Tracker.autorun(() => {
-		this.roles.set(RocketChat.models.Roles.find().fetch());
-	});
-
-	Tracker.autorun(() => {
-		ChatPermissions.find().observeChanges({
+		const observer = {
 			added: (id, fields) => {
 				this.permissionByRole[id] = fields.roles;
 			},
@@ -70,6 +95,8 @@ Template.permissions.onCreated(function() {
 			removed: (id) => {
 				delete this.permissionByRole[id];
 			}
-		});
+		};
+		ChatPermissions.find().observeChanges(observer);
+		SettingPermissions.find().observeChanges(observer);
 	});
 });
diff --git a/packages/rocketchat-authorization/lib/rocketchat.js b/packages/rocketchat-authorization/lib/rocketchat.js
index 6445a1b8b5f0..22dc30e0348a 100644
--- a/packages/rocketchat-authorization/lib/rocketchat.js
+++ b/packages/rocketchat-authorization/lib/rocketchat.js
@@ -1 +1,5 @@
 RocketChat.authz = {};
+
+export const permissionLevel = {
+	SETTING: 'setting'
+};
diff --git a/packages/rocketchat-authorization/package.js b/packages/rocketchat-authorization/package.js
index 1f8de7d298ea..e3e6fee2ce0d 100644
--- a/packages/rocketchat-authorization/package.js
+++ b/packages/rocketchat-authorization/package.js
@@ -21,6 +21,7 @@ Package.onUse(function(api) {
 	api.addFiles('lib/rocketchat.js', ['server', 'client']);
 
 	api.addFiles('client/lib/ChatPermissions.js', ['client']);
+	api.addFiles('client/lib/SettingPermissions.js', ['client']);
 	api.addFiles('client/lib/models/Roles.js', ['client']);
 	api.addFiles('client/lib/models/Users.js', ['client']);
 	api.addFiles('client/lib/models/Subscriptions.js', ['client']);
diff --git a/packages/rocketchat-authorization/server/publications/permissions.js b/packages/rocketchat-authorization/server/publications/permissions.js
index 029109db025c..b6f9fe094794 100644
--- a/packages/rocketchat-authorization/server/publications/permissions.js
+++ b/packages/rocketchat-authorization/server/publications/permissions.js
@@ -1,8 +1,26 @@
+import {permissionLevel} from '../../lib/rocketchat';
+
 Meteor.methods({
 	'permissions/get'(updatedAt) {
 		this.unblock();
 
-		const records = RocketChat.models.Permissions.find().fetch();
+		const records = RocketChat.models.Permissions.find({level: {$ne: permissionLevel.SETTING}}).fetch();
+
+		if (updatedAt instanceof Date) {
+			return {
+				update: records.filter((record) => {
+					return record._updatedAt > updatedAt;
+				}),
+				remove: RocketChat.models.Permissions.trashFindDeletedAfter(updatedAt, {}, {fields: {_id: 1, _deletedAt: 1}}).fetch()
+			};
+		}
+
+		return records;
+	},
+	'setting-permissions/get'(updatedAt) {
+		this.unblock();
+
+		const records = RocketChat.models.Permissions.find({level: permissionLevel.SETTING}).fetch();
 
 		if (updatedAt instanceof Date) {
 			return {
@@ -21,3 +39,4 @@ Meteor.methods({
 RocketChat.models.Permissions.on('changed', (type, permission) => {
 	RocketChat.Notifications.notifyLoggedInThisInstance('permissions-changed', type, permission);
 });
+
diff --git a/packages/rocketchat-authorization/server/startup.js b/packages/rocketchat-authorization/server/startup.js
index bd1ea3ff6e44..fe3b3e110fb5 100644
--- a/packages/rocketchat-authorization/server/startup.js
+++ b/packages/rocketchat-authorization/server/startup.js
@@ -1,4 +1,7 @@
 /* eslint no-multi-spaces: 0 */
+/*  globals SystemLogger */
+
+import {permissionLevel} from '../lib/rocketchat';
 
 Meteor.startup(function() {
 	// Note:
@@ -6,85 +9,118 @@ Meteor.startup(function() {
 	// then we can define edit-<type>-message instead of edit-message
 	// 2. admin, moderator, and user roles should not be deleted as they are referened in the code.
 	const permissions = [
-		{ _id: 'access-permissions',            roles : ['admin'] },
-		{ _id: 'add-oauth-service',             roles : ['admin'] },
-		{ _id: 'add-user-to-joined-room',       roles : ['admin', 'owner', 'moderator'] },
-		{ _id: 'add-user-to-any-c-room',        roles : ['admin'] },
-		{ _id: 'add-user-to-any-p-room',        roles : [] },
-		{ _id: 'archive-room',                  roles : ['admin', 'owner'] },
-		{ _id: 'assign-admin-role',             roles : ['admin'] },
-		{ _id: 'ban-user',                      roles : ['admin', 'owner', 'moderator'] },
-		{ _id: 'bulk-create-c',                 roles : ['admin'] },
-		{ _id: 'bulk-register-user',            roles : ['admin'] },
-		{ _id: 'create-c',                      roles : ['admin', 'user', 'bot'] },
-		{ _id: 'create-d',                      roles : ['admin', 'user', 'bot'] },
-		{ _id: 'create-p',                      roles : ['admin', 'user', 'bot'] },
-		{ _id: 'create-user',                   roles : ['admin'] },
-		{ _id: 'clean-channel-history',         roles : ['admin'] }, // special permission to bulk delete a channel's mesages
-		{ _id: 'delete-c',                      roles : ['admin'] },
-		{ _id: 'delete-d',                      roles : ['admin'] },
-		{ _id: 'delete-message',                roles : ['admin', 'owner', 'moderator'] },
-		{ _id: 'delete-p',                      roles : ['admin'] },
-		{ _id: 'delete-user',                   roles : ['admin'] },
-		{ _id: 'edit-message',                  roles : ['admin', 'owner', 'moderator'] },
-		{ _id: 'edit-other-user-active-status', roles : ['admin'] },
-		{ _id: 'edit-other-user-info',          roles : ['admin'] },
-		{ _id: 'edit-other-user-password',      roles : ['admin'] },
-		{ _id: 'edit-privileged-setting',       roles : ['admin'] },
-		{ _id: 'edit-room',                     roles : ['admin', 'owner', 'moderator'] },
-		{ _id: 'force-delete-message',          roles : ['admin', 'owner'] },
-		{ _id: 'join-without-join-code',        roles : ['admin', 'bot'] },
-		{ _id: 'manage-assets',                 roles : ['admin'] },
-		{ _id: 'manage-emoji',                  roles : ['admin'] },
-		{ _id: 'manage-integrations',           roles : ['admin'] },
-		{ _id: 'manage-own-integrations',       roles : ['admin', 'bot'] },
-		{ _id: 'manage-oauth-apps',             roles : ['admin'] },
-		{ _id: 'mention-all',                   roles : ['admin', 'owner', 'moderator', 'user'] },
-		{ _id: 'mute-user',                     roles : ['admin', 'owner', 'moderator'] },
-		{ _id: 'remove-user',                   roles : ['admin', 'owner', 'moderator'] },
-		{ _id: 'run-import',                    roles : ['admin'] },
-		{ _id: 'run-migration',                 roles : ['admin'] },
-		{ _id: 'set-moderator',                 roles : ['admin', 'owner'] },
-		{ _id: 'set-owner',                     roles : ['admin', 'owner'] },
-		{ _id: 'send-many-messages',            roles : ['admin', 'bot'] },
-		{ _id: 'set-leader',                    roles : ['admin', 'owner'] },
-		{ _id: 'unarchive-room',                roles : ['admin'] },
-		{ _id: 'view-c-room',                   roles : ['admin', 'user', 'bot', 'anonymous'] },
-		{ _id: 'user-generate-access-token',    roles : ['admin'] },
-		{ _id: 'view-d-room',                   roles : ['admin', 'user', 'bot'] },
-		{ _id: 'view-full-other-user-info',     roles : ['admin'] },
-		{ _id: 'view-history',                  roles : ['admin', 'user', 'anonymous'] },
-		{ _id: 'view-joined-room',              roles : ['guest', 'bot', 'anonymous'] },
-		{ _id: 'view-join-code',                roles : ['admin'] },
-		{ _id: 'view-logs',                     roles : ['admin'] },
-		{ _id: 'view-other-user-channels',      roles : ['admin'] },
-		{ _id: 'view-p-room',                   roles : ['admin', 'user', 'anonymous'] },
-		{ _id: 'view-privileged-setting',       roles : ['admin'] },
-		{ _id: 'view-room-administration',      roles : ['admin'] },
-		{ _id: 'view-statistics',               roles : ['admin'] },
-		{ _id: 'view-user-administration',      roles : ['admin'] },
-		{ _id: 'preview-c-room',                roles : ['admin', 'user', 'anonymous'] },
-		{ _id: 'view-outside-room',             roles : ['admin', 'owner', 'moderator', 'user'] }
+		{_id: 'access-permissions', roles: ['admin']},
+		{_id: 'add-oauth-service', roles: ['admin']},
+		{_id: 'add-user-to-joined-room', roles: ['admin', 'owner', 'moderator']},
+		{_id: 'add-user-to-any-c-room', roles: ['admin']},
+		{_id: 'add-user-to-any-p-room', roles: []},
+		{_id: 'archive-room', roles: ['admin', 'owner']},
+		{_id: 'assign-admin-role', roles: ['admin']},
+		{_id: 'ban-user', roles: ['admin', 'owner', 'moderator']},
+		{_id: 'bulk-create-c', roles: ['admin']},
+		{_id: 'bulk-register-user', roles: ['admin']},
+		{_id: 'create-c', roles: ['admin', 'user', 'bot']},
+		{_id: 'create-d', roles: ['admin', 'user', 'bot']},
+		{_id: 'create-p', roles: ['admin', 'user', 'bot']},
+		{_id: 'create-user', roles: ['admin']},
+		{_id: 'clean-channel-history', roles: ['admin']}, // special permission to bulk delete a channel's mesages
+		{_id: 'delete-c', roles: ['admin']},
+		{_id: 'delete-d', roles: ['admin']},
+		{_id: 'delete-message', roles: ['admin', 'owner', 'moderator']},
+		{_id: 'delete-p', roles: ['admin']},
+		{_id: 'delete-user', roles: ['admin']},
+		{_id: 'edit-message', roles: ['admin', 'owner', 'moderator']},
+		{_id: 'edit-other-user-active-status', roles: ['admin']},
+		{_id: 'edit-other-user-info', roles: ['admin']},
+		{_id: 'edit-other-user-password', roles: ['admin']},
+		{_id: 'edit-privileged-setting', roles: ['admin']},
+		{_id: 'edit-room', roles: ['admin', 'owner', 'moderator']},
+		{_id: 'force-delete-message', roles: ['admin', 'owner']},
+		{_id: 'join-without-join-code', roles: ['admin', 'bot']},
+		{_id: 'manage-assets', roles: ['admin']},
+		{_id: 'manage-emoji', roles: ['admin']},
+		{_id: 'manage-integrations', roles: ['admin']},
+		{_id: 'manage-own-integrations', roles: ['admin', 'bot']},
+		{_id: 'manage-oauth-apps', roles: ['admin']},
+		{_id: 'mention-all', roles: ['admin', 'owner', 'moderator', 'user']},
+		{_id: 'mute-user', roles: ['admin', 'owner', 'moderator']},
+		{_id: 'remove-user', roles: ['admin', 'owner', 'moderator']},
+		{_id: 'run-import', roles: ['admin']},
+		{_id: 'run-migration', roles: ['admin']},
+		{_id: 'set-moderator', roles: ['admin', 'owner']},
+		{_id: 'set-owner', roles: ['admin', 'owner']},
+		{_id: 'send-many-messages', roles: ['admin', 'bot']},
+		{_id: 'set-leader', roles: ['admin', 'owner']},
+		{_id: 'unarchive-room', roles: ['admin']},
+		{_id: 'view-c-room', roles: ['admin', 'user', 'bot', 'anonymous']},
+		{_id: 'user-generate-access-token', roles: ['admin']},
+		{_id: 'view-d-room', roles: ['admin', 'user', 'bot']},
+		{_id: 'view-full-other-user-info', roles: ['admin']},
+		{_id: 'view-history', roles: ['admin', 'user', 'anonymous']},
+		{_id: 'view-joined-room', roles: ['guest', 'bot', 'anonymous']},
+		{_id: 'view-join-code', roles: ['admin']},
+		{_id: 'view-logs', roles: ['admin']},
+		{_id: 'view-other-user-channels', roles: ['admin']},
+		{_id: 'view-p-room', roles: ['admin', 'user', 'anonymous']},
+		{_id: 'view-privileged-setting', roles: ['admin']},
+		{_id: 'view-selected-settings', roles: ['admin']},
+		{_id: 'view-room-administration', roles: ['admin']},
+		{_id: 'view-statistics', roles: ['admin']},
+		{_id: 'view-user-administration', roles: ['admin']},
+		{_id: 'preview-c-room', roles: ['admin', 'user', 'anonymous']},
+		{_id: 'view-outside-room', roles: ['admin', 'owner', 'moderator', 'user']}
 	];
 
 	for (const permission of permissions) {
 		if (!RocketChat.models.Permissions.findOneById(permission._id)) {
-			RocketChat.models.Permissions.upsert(permission._id, {$set: permission });
+			RocketChat.models.Permissions.upsert(permission._id, {$set: permission});
 		}
 	}
 
 	const defaultRoles = [
-		{ name: 'admin',     scope: 'Users',         description: 'Admin' },
-		{ name: 'moderator', scope: 'Subscriptions', description: 'Moderator' },
-		{ name: 'leader',    scope: 'Subscriptions', description: 'Leader' },
-		{ name: 'owner',     scope: 'Subscriptions', description: 'Owner' },
-		{ name: 'user',      scope: 'Users',         description: '' },
-		{ name: 'bot',       scope: 'Users',         description: '' },
-		{ name: 'guest',     scope: 'Users',         description: '' },
-		{ name: 'anonymous', scope: 'Users',         description: '' }
+		{name: 'admin', scope: 'Users', description: 'Admin'},
+		{name: 'moderator', scope: 'Subscriptions', description: 'Moderator'},
+		{name: 'leader', scope: 'Subscriptions', description: 'Leader'},
+		{name: 'owner', scope: 'Subscriptions', description: 'Owner'},
+		{name: 'user', scope: 'Users', description: ''},
+		{name: 'bot', scope: 'Users', description: ''},
+		{name: 'guest', scope: 'Users', description: ''},
+		{name: 'anonymous', scope: 'Users', description: ''}
 	];
 
 	for (const role of defaultRoles) {
-		RocketChat.models.Roles.upsert({ _id: role.name }, { $setOnInsert: { scope: role.scope, description: role.description || '', protected: true } });
+		RocketChat.models.Roles.upsert({_id: role.name}, {
+			$setOnInsert: {
+				scope: role.scope,
+				description: role.description || '',
+				protected: true
+			}
+		});
+	}
+
+	// for each setting, create a permission to allow just this one setting
+
+	const getSettingPermissionId = function(settingId) {
+		return `change-setting-${ settingId }`;
+	};
+
+	const obsoleteSettingPermissions = {};
+	RocketChat.models.Permissions.find({level: permissionLevel.SETTING}).fetch().forEach(
+		function(permission) {
+			obsoleteSettingPermissions[permission._id] = permission;
+		});
+	RocketChat.models.Settings.findNotHidden().fetch().forEach((setting) => {
+		const permissionId = getSettingPermissionId(setting._id);
+		const permission = {_id: permissionId, level: permissionLevel.SETTING};
+		RocketChat.models.Permissions.upsert(permission._id, {$set: permission});
+		delete obsoleteSettingPermissions[permissionId];
+	});
+
+	for (const obsoletePermission in obsoleteSettingPermissions) {
+		if (obsoleteSettingPermissions.hasOwnProperty(obsoletePermission)) {
+			RocketChat.models.Permissions.remove({_id: obsoletePermission});
+			SystemLogger.info('Removed permission', obsoletePermission);
+		}
 	}
+
 });
diff --git a/packages/rocketchat-lib/server/publications/settings.js b/packages/rocketchat-lib/server/publications/settings.js
index 5707468422bf..80b41e338cb3 100644
--- a/packages/rocketchat-lib/server/publications/settings.js
+++ b/packages/rocketchat-lib/server/publications/settings.js
@@ -55,6 +55,36 @@ Meteor.methods({
 			};
 		}
 		return records;
+	},
+	'selected-settings/get'(updatedAt) {
+		if (!Meteor.userId()) {
+			return [];
+		}
+		this.unblock();
+		if (!RocketChat.authz.hasPermission(Meteor.userId(), 'view-selected-settings')) {
+			return [];
+		}
+		const records = RocketChat.models.Settings.find().fetch().filter(function(record) {
+			return record.hidden !== true && RocketChat.authz.hasPermission(Meteor.userId(), `change-setting-${ record._id }`);
+		});
+		if (updatedAt instanceof Date) {
+			return {
+				update: records.filter(function(record) {
+					return record._updatedAt > updatedAt;
+				}),
+				remove: RocketChat.models.Settings.trashFindDeletedAfter(updatedAt, {
+					hidden: {
+						$ne: true
+					}
+				}, {
+					fields: {
+						_id: 1,
+						_deletedAt: 1
+					}
+				}).fetch()
+			};
+		}
+		return records;
 	}
 });
 
diff --git a/packages/rocketchat-livechat/app/package-lock.json b/packages/rocketchat-livechat/app/package-lock.json
index ca28ccbd474c..9de02853dd0d 100644
--- a/packages/rocketchat-livechat/app/package-lock.json
+++ b/packages/rocketchat-livechat/app/package-lock.json
@@ -7,7 +7,7 @@
     "abbrev": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-1.1.1.tgz",
-      "integrity": "sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q=="
+      "integrity": "sha1-+PLIh60Qv2f2NPAFtph/7TF5qsg="
     },
     "ajv": {
       "version": "5.3.0",
@@ -28,7 +28,7 @@
     "aproba": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/aproba/-/aproba-1.2.0.tgz",
-      "integrity": "sha512-Y9J6ZjXtoYh8RnXVCMOU/ttDmk1aBjunq9vO0ta5x85WDQiQfUF9sIPBITdbiiIVcBo03Hi3jMxigBtsddlXRw=="
+      "integrity": "sha1-aALmJk79GMeQobDVF/DyYnvyyUo="
     },
     "are-we-there-yet": {
       "version": "1.1.4",
@@ -180,7 +180,7 @@
         "boom": {
           "version": "5.2.0",
           "resolved": "https://registry.npmjs.org/boom/-/boom-5.2.0.tgz",
-          "integrity": "sha512-Z5BTk6ZRe4tXXQlkqftmsAUANpXmuwlsF5Oov8ThoMbQRzdGTA1ngYRW160GexgOgjsFOKJz0LYhoNi+2AMBUw==",
+          "integrity": "sha1-XdnabuOl8wIHdDYpDLcX0/SlTgI=",
           "requires": {
             "hoek": "4.2.0"
           }
@@ -198,7 +198,7 @@
     "debug": {
       "version": "2.6.9",
       "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "integrity": "sha1-XRKFFd8TT/Mn6QpMk/Tgd6U2NB8=",
       "requires": {
         "ms": "2.0.0"
       }
@@ -351,7 +351,7 @@
     "hawk": {
       "version": "6.0.2",
       "resolved": "https://registry.npmjs.org/hawk/-/hawk-6.0.2.tgz",
-      "integrity": "sha512-miowhl2+U7Qle4vdLqDdPt9m09K6yZhkLDTWGoUiUzrQCn+mHHSmfJgAyGaLRZbPmTqfFFjRV1QWCW0VWUJBbQ==",
+      "integrity": "sha1-r02RTrBl+bXOTZ0RwcshJu7MMDg=",
       "requires": {
         "boom": "4.3.1",
         "cryptiles": "3.1.2",
@@ -362,7 +362,7 @@
     "hoek": {
       "version": "4.2.0",
       "resolved": "https://registry.npmjs.org/hoek/-/hoek-4.2.0.tgz",
-      "integrity": "sha512-v0XCLxICi9nPfYrS9RL8HbYnXi9obYAeLbSP00BmnZwCK9+Ih9WOjoZ8YoHCoav2csqn4FOz4Orldsy2dmDwmQ=="
+      "integrity": "sha1-ctnQdU9/4lyi0BrY+PmpRJqJUm0="
     },
     "http-signature": {
       "version": "1.2.0",
@@ -603,7 +603,7 @@
     "qs": {
       "version": "6.5.1",
       "resolved": "https://registry.npmjs.org/qs/-/qs-6.5.1.tgz",
-      "integrity": "sha512-eRzhrN1WSINYCDCbrz796z37LOe3m5tmW7RQf6oBntukAG1nmovJvhnwHHRMAfeoItc1m2Hk02WER2aQ/iqs+A=="
+      "integrity": "sha1-NJzfbu+J7EXBLX1es/wMhwNDptg="
     },
     "rc": {
       "version": "1.2.2",
@@ -645,7 +645,7 @@
     "request": {
       "version": "2.83.0",
       "resolved": "https://registry.npmjs.org/request/-/request-2.83.0.tgz",
-      "integrity": "sha512-lR3gD69osqm6EYLk9wB/G1W/laGWjzH90t1vEa2xuxHD5KUrSzp9pUSfTm+YC5Nxt2T8nMPEvKlhbQayU7bgFw==",
+      "integrity": "sha1-ygtl2gLtYpNYh4COb1EDgQNOM1Y=",
       "requires": {
         "aws-sign2": "0.7.0",
         "aws4": "1.6.0",
@@ -674,7 +674,7 @@
     "rimraf": {
       "version": "2.6.2",
       "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-2.6.2.tgz",
-      "integrity": "sha512-lreewLK/BlghmxtfH36YYVg1i8IAce4TI7oao75I1g245+6BctqTVQiBP3YUJ9C6DQOXJmkYR9X9fCLtCOJc5w==",
+      "integrity": "sha1-LtgVDSShbqhlHm1u8PR8QVjOejY=",
       "requires": {
         "glob": "7.1.2"
       }
@@ -702,7 +702,7 @@
     "sntp": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/sntp/-/sntp-2.1.0.tgz",
-      "integrity": "sha512-FL1b58BDrqS3A11lJ0zEdnJ3UOKqVxawAkF3k7F0CVN7VQ34aZrV+G8BZ1WC9ZL7NyrwsW0oviwsWDgRuVYtJg==",
+      "integrity": "sha1-LGzsFP7cIiJznK+bXD2F0cxaLMg=",
       "requires": {
         "hoek": "4.2.0"
       }
@@ -774,7 +774,7 @@
     "tar-pack": {
       "version": "3.4.1",
       "resolved": "https://registry.npmjs.org/tar-pack/-/tar-pack-3.4.1.tgz",
-      "integrity": "sha512-PPRybI9+jM5tjtCbN2cxmmRU7YmqT3Zv/UDy48tAh2XRkLa9bAORtSWLkVc13+GJF+cdTh1yEnHEk3cpTaL5Kg==",
+      "integrity": "sha1-4dvAOpudO6B+iWrQJzF+tnmhCh8=",
       "requires": {
         "debug": "2.6.9",
         "fstream": "1.0.11",
diff --git a/packages/rocketchat-ui-admin/client/admin.js b/packages/rocketchat-ui-admin/client/admin.js
index f3ce8fc6874a..d0155c2b608d 100644
--- a/packages/rocketchat-ui-admin/client/admin.js
+++ b/packages/rocketchat-ui-admin/client/admin.js
@@ -31,7 +31,12 @@ const setFieldValue = function(settingId, value, type, editor) {
 			const selectedRooms = Template.instance().selectedRooms.get();
 			selectedRooms[settingId] = value;
 			Template.instance().selectedRooms.set(selectedRooms);
-			TempSettings.update({ _id: settingId }, { $set: { value, changed: JSON.stringify(RocketChat.settings.collectionPrivate.findOne(settingId).value) !== JSON.stringify(value) } });
+			TempSettings.update({_id: settingId}, {
+				$set: {
+					value,
+					changed: JSON.stringify(RocketChat.settings.collectionPrivate.findOne(settingId).value) !== JSON.stringify(value)
+				}
+			});
 			break;
 		default:
 			input.val(value).change();
@@ -47,8 +52,18 @@ Template.admin.onCreated(function() {
 		RocketChat.settings.collectionPrivate = RocketChat.settings.cachedCollectionPrivate.collection;
 		RocketChat.settings.cachedCollectionPrivate.init();
 	}
+
+	// settings which the user is explicitly allowed to change
+	if (RocketChat.settings.cachedCollectionSelected == null) {
+		RocketChat.settings.cachedCollectionSelected = new RocketChat.CachedCollection({
+			name: 'selected-settings',
+			eventType: 'onLogged'
+		});
+		RocketChat.settings.collectionSelected = RocketChat.settings.cachedCollectionSelected.collection;
+		RocketChat.settings.cachedCollectionSelected.init();
+	}
 	this.selectedRooms = new ReactiveVar({});
-	RocketChat.settings.collectionPrivate.find().observe({
+	const observation = {
 		added: (data) => {
 			const selectedRooms = this.selectedRooms.get();
 			if (data.type === 'roomPick') {
@@ -73,7 +88,10 @@ Template.admin.onCreated(function() {
 			}
 			TempSettings.remove(data._id);
 		}
-	});
+	};
+
+	RocketChat.settings.collectionPrivate.find().observe(observation);
+	RocketChat.settings.collectionSelected.find().observe(observation);
 });
 
 Template.admin.onDestroyed(function() {
@@ -86,7 +104,7 @@ Template.admin.helpers({
 
 		let result = Object.keys(languages).map(key => {
 			const language = languages[key];
-			return _.extend(language, { key });
+			return _.extend(language, {key});
 		});
 
 		result = _.sortBy(result, 'key');
@@ -110,7 +128,13 @@ Template.admin.helpers({
 		if (!group) {
 			return;
 		}
-		const settings = RocketChat.settings.collectionPrivate.find({ group: groupId }, { sort: { section: 1, sorter: 1, i18nLabel: 1 }}).fetch();
+		const settings = RocketChat.settings.collectionPrivate.find({group: groupId}, {
+			sort: {
+				section: 1,
+				sorter: 1,
+				i18nLabel: 1
+			}
+		}).fetch();
 		const sections = {};
 
 		Object.keys(settings).forEach(key => {
@@ -138,7 +162,7 @@ Template.admin.helpers({
 			sections[settingSection].push(setting);
 		});
 
-		group.sections = Object.keys(sections).map(key =>{
+		group.sections = Object.keys(sections).map(key => {
 			const value = sections[key];
 			return {
 				section: key,
@@ -170,7 +194,7 @@ Template.admin.helpers({
 		}
 		let found = 0;
 
-		Object.keys(enableQuery).forEach(key =>{
+		Object.keys(enableQuery).forEach(key => {
 			const item = enableQuery[key];
 			if (TempSettings.findOne(item) != null) {
 				found++;
@@ -255,7 +279,7 @@ Template.admin.helpers({
 		return Meteor.absoluteUrl(url);
 	},
 	selectedOption(_id, val) {
-		const option = RocketChat.settings.collectionPrivate.findOne({ _id });
+		const option = RocketChat.settings.collectionPrivate.findOne({_id});
 		return option && option.value === val;
 	},
 	random() {
@@ -286,7 +310,12 @@ Template.admin.helpers({
 			}
 			const onChange = function() {
 				const value = codeMirror.getValue();
-				TempSettings.update({ _id }, { $set: { value, changed: RocketChat.settings.collectionPrivate.findOne(_id).value !== value }});
+				TempSettings.update({_id}, {
+					$set: {
+						value,
+						changed: RocketChat.settings.collectionPrivate.findOne(_id).value !== value
+					}
+				});
 			};
 			const onChangeDelayed = _.debounce(onChange, 500);
 			codeMirror.on('change', onChangeDelayed);
@@ -328,7 +357,7 @@ Template.admin.helpers({
 		return color.replace(/theme-color-/, '@');
 	},
 	showResetButton() {
-		const setting = TempSettings.findOne({ _id: this._id }, { fields: { value: 1, packageValue: 1 }});
+		const setting = TempSettings.findOne({_id: this._id}, {fields: {value: 1, packageValue: 1}});
 		return this.type !== 'asset' && setting.value !== setting.packageValue && !this.blocked;
 	}
 });
@@ -357,8 +386,8 @@ Template.admin.events({
 	}, 500),
 	'change select[name=color-editor]'(e) {
 		const value = s.trim($(e.target).val());
-		TempSettings.update({ _id: this._id }, { $set: { editor: value }});
-		RocketChat.settings.collectionPrivate.update({ _id: this._id }, { $set: { editor: value }});
+		TempSettings.update({_id: this._id}, {$set: {editor: value}});
+		RocketChat.settings.collectionPrivate.update({_id: this._id}, {$set: {editor: value}});
 	},
 	'click .submit .discard'() {
 		const group = FlowRouter.getParam('group');
@@ -367,9 +396,16 @@ Template.admin.events({
 			changed: true
 		};
 		const settings = TempSettings.find(query, {
-			fields: { _id: 1, value: 1, packageValue: 1 }}).fetch();
+			fields: {_id: 1, value: 1, packageValue: 1}
+		}).fetch();
 		settings.forEach(function(setting) {
-			const oldSetting = RocketChat.settings.collectionPrivate.findOne({ _id: setting._id }, { fields: { value: 1, type: 1, editor: 1 }});
+			const oldSetting = RocketChat.settings.collectionPrivate.findOne({_id: setting._id}, {
+				fields: {
+					value: 1,
+					type: 1,
+					editor: 1
+				}
+			});
 			setFieldValue(setting._id, oldSetting.value, oldSetting.type, oldSetting.editor);
 		});
 	},
@@ -388,14 +424,14 @@ Template.admin.events({
 		const group = FlowRouter.getParam('group');
 		const section = $(e.target).data('section');
 		if (section === '') {
-			settings = TempSettings.find({ group, section: { $exists: false }}, { fields: { _id: 1 }}).fetch();
+			settings = TempSettings.find({group, section: {$exists: false}}, {fields: {_id: 1}}).fetch();
 		} else {
-			settings = TempSettings.find({ group, section }, { fields: { _id: 1 }}).fetch();
+			settings = TempSettings.find({group, section}, {fields: {_id: 1}}).fetch();
 		}
 		settings.forEach(function(setting) {
 			const defaultValue = getDefaultSetting(setting._id);
 			setFieldValue(setting._id, defaultValue.packageValue, defaultValue.type, defaultValue.editor);
-			TempSettings.update({_id: setting._id }, {
+			TempSettings.update({_id: setting._id}, {
 				$set: {
 					value: defaultValue.packageValue,
 					changed: RocketChat.settings.collectionPrivate.findOne(setting._id).value !== defaultValue.packageValue
@@ -405,14 +441,14 @@ Template.admin.events({
 	},
 	'click .submit .save'() {
 		const group = FlowRouter.getParam('group');
-		const query = { group, changed: true };
-		const settings = TempSettings.find(query, { fields: { _id: 1, value: 1, editor: 1 }}).fetch();
+		const query = {group, changed: true};
+		const settings = TempSettings.find(query, {fields: {_id: 1, value: 1, editor: 1}}).fetch();
 		if (!_.isEmpty(settings)) {
 			RocketChat.settings.batchSet(settings, function(err) {
 				if (err) {
 					return handleError(err);
 				}
-				TempSettings.update({ changed: true }, { $unset: { changed: 1 }});
+				TempSettings.update({changed: true}, {$unset: {changed: 1}});
 				toastr.success(TAPi18n.__('Settings_updated'));
 			});
 		}
@@ -544,7 +580,7 @@ Template.admin.events({
 		selectedRooms[this.id] = (selectedRooms[this.id] || []).concat(doc);
 		instance.selectedRooms.set(selectedRooms);
 		const value = selectedRooms[this.id];
-		TempSettings.update({ _id: this.id }, { $set: { value }});
+		TempSettings.update({_id: this.id}, {$set: {value}});
 		event.currentTarget.value = '';
 		event.currentTarget.focus();
 	},
@@ -557,7 +593,7 @@ Template.admin.events({
 		});
 		instance.selectedRooms.set(selectedRooms);
 		const value = selectedRooms[settingId];
-		TempSettings.update({ _id: settingId }, {
+		TempSettings.update({_id: settingId}, {
 			$set: {
 				value
 			}
@@ -574,7 +610,7 @@ Template.admin.onRendered(function() {
 		const hasColor = TempSettings.find({
 			group: FlowRouter.getParam('group'),
 			type: 'color'
-		}, { fields: { _id: 1, editor: 1 }}).fetch().length;
+		}, {fields: {_id: 1, editor: 1}}).fetch().length;
 		if (hasColor) {
 			Meteor.setTimeout(function() {
 				$('.colorpicker-input').each(function(index, el) {