Added migration for Self-Serve Integration permissions

refs https://github.com/TryGhost/Team/issues/2790

- This migration adds permissions for Self-Serve Migration Integration to have access to Admin APIs:

POST /ghost/api/admin/db
POST /ghost/api/admin/db/media/inline
POST /ghost/api/admin/members/upload
GET  /ghost/api/admin/tags/:id
GET  /ghost/api/admin/tags/slug/:slug

ghost/core/core/server/data/migrations/versions/5.40/2023-03-21-18-43-add-self-serve-migration-and-permissions.js

@@ -0,0 +1,25 @@
+const {combineTransactionalMigrations, addPermissionWithRoles} = require('../../utils');
+
+module.exports = combineTransactionalMigrations(
+    addPermissionWithRoles({
+        name: 'Import database',
+        action: 'importContent',
+        object: 'db'
+    }, [
+        'Self-Serve Migration Integration'
+    ]),
+    addPermissionWithRoles({
+        name: 'Add Members',
+        action: 'add',
+        object: 'member'
+    }, [
+        'Self-Serve Migration Integration'
+    ]),
+    addPermissionWithRoles({
+        name: 'Read tags',
+        action: 'read',
+        object: 'tag'
+    }, [
+        'Self-Serve Migration Integration'
+    ])
+);

ghost/core/core/server/data/schema/fixtures/fixtures.json

@@ -796,6 +796,11 @@
                 "Ghost Explore Integration": {
                     "explore": "read"
                 },
+                "Self-Serve Migration Integration": {
+                    "db": "importContent",
+                    "member": "add",
+                    "tag": "read"
+                },
                 "Admin Integration": {
                     "mail": "all",
                     "notification": "all",

ghost/core/test/integration/migrations/migration.test.js

@@ -48,7 +48,7 @@ describe('Database Migration (special functions)', function () {
             permissions.length.should.eql(110);
 
             permissions.should.havePermission('Export database', ['Administrator', 'DB Backup Integration']);
-            permissions.should.havePermission('Import database', ['Administrator', 'DB Backup Integration']);
+            permissions.should.havePermission('Import database', ['Administrator', 'Self-Serve Migration Integration', 'DB Backup Integration']);
             permissions.should.havePermission('Delete all content', ['Administrator', 'DB Backup Integration']);
             permissions.should.havePermission('Backup database', ['Administrator', 'DB Backup Integration']);
 
@@ -72,7 +72,7 @@ describe('Database Migration (special functions)', function () {
             permissions.should.havePermission('Generate slugs', ['Administrator', 'Editor', 'Author', 'Contributor', 'Admin Integration']);
 
             permissions.should.havePermission('Browse tags', ['Administrator', 'Editor', 'Author', 'Contributor', 'Admin Integration']);
-            permissions.should.havePermission('Read tags', ['Administrator', 'Editor', 'Author', 'Contributor', 'Admin Integration']);
+            permissions.should.havePermission('Read tags', ['Administrator', 'Editor', 'Author', 'Contributor', 'Admin Integration', 'Self-Serve Migration Integration']);
             permissions.should.havePermission('Edit tags', ['Administrator', 'Editor', 'Admin Integration']);
             permissions.should.havePermission('Add tags', ['Administrator', 'Editor', 'Author', 'Admin Integration']);
             permissions.should.havePermission('Delete tags', ['Administrator', 'Editor', 'Admin Integration']);
@@ -145,7 +145,7 @@ describe('Database Migration (special functions)', function () {
             permissions.should.havePermission('Browse Members');
             permissions.should.havePermission('Read Members');
             permissions.should.havePermission('Edit Members');
-            permissions.should.havePermission('Add Members');
+            permissions.should.havePermission('Add Members', ['Administrator', 'Admin Integration', 'Self-Serve Migration Integration']);
             permissions.should.havePermission('Delete Members');
 
             permissions.should.havePermission('Browse offers');

ghost/core/test/unit/server/data/schema/fixtures/fixture-manager.test.js

@@ -191,7 +191,7 @@ describe('Migration Fixture Utils', function () {
             const rolesAllStub = sinon.stub(models.Role, 'findAll').returns(Promise.resolve(dataMethodStub));
 
             fixtureManager.addFixturesForRelation(fixtures.relations[0]).then(function (result) {
-                const FIXTURE_COUNT = 98;
+                const FIXTURE_COUNT = 101;
                 should.exist(result);
                 result.should.be.an.Object();
                 result.should.have.property('expected', FIXTURE_COUNT);
@@ -201,7 +201,7 @@ describe('Migration Fixture Utils', function () {
                 permsAllStub.calledOnce.should.be.true();
                 rolesAllStub.calledOnce.should.be.true();
                 dataMethodStub.filter.callCount.should.eql(FIXTURE_COUNT);
-                dataMethodStub.find.callCount.should.eql(8);
+                dataMethodStub.find.callCount.should.eql(9);
                 baseUtilAttachStub.callCount.should.eql(FIXTURE_COUNT);
 
                 fromItem.related.callCount.should.eql(FIXTURE_COUNT);

ghost/core/test/unit/server/data/schema/integrity.test.js

@@ -36,7 +36,7 @@ const validateRouteSettings = require('../../../../../core/server/services/route
 describe('DB version integrity', function () {
     // Only these variables should need updating
     const currentSchemaHash = '67a16bde6f7dd46c5e07d7fca1005a53';
-    const currentFixturesHash = 'dc2d5430edd212bf579e3533bdbfe806';
+    const currentFixturesHash = '869ceb3302303494c645f4201540ead3';
     const currentSettingsHash = '7b567742b9667d38191d8455c422c5d5';
     const currentRoutesHash = '3d180d52c663d173a6be791ef411ed01';
 

ghost/core/test/utils/fixtures/fixtures.json

@@ -976,6 +976,11 @@
                 "Ghost Explore Integration": {
                     "explore": "read"
                 },
+                "Self-Serve Migration Integration": {
+                    "db": "importContent",
+                    "member": "add",
+                    "tag": "read"
+                },
                 "Admin Integration": {
                     "mail": "all",
                     "notification": "all",