[MM-55054] Consider a matching origin for a media request as a trusted URL when checking permissions

[devinbinnie]

Summary

With the new permission changes, we were stopping servers with subpaths from being able to grant the media permission, due to being too strict about which URLs we were considering trusted.

The media permission generally populates the securityOrigin field when doing a permission check, so when checking for that permission if the URL can be trusted, we just need to match the two origins.

This PR makes that exception in the permissions handler.

Ticket Link

https://mattermost.atlassian.net/browse/MM-55054
Closes #2881

Fixed an issue where servers on a subpath could not grant the `media` permission

[marianunez]

@devinbinnie could we add steps in the tickets on how we will do QA validation on this ?

[esarafianou]

@devinbinnie if a domain e.g. example.com hosts 2 Mattermost servers: one with URL example.com/mm1 and one with URL example.com/mm2, will after this change these 2 Mattermost servers need to ask for media permission separately or if example.com/mm1 is granted media permission, example.com/mm2 will inherit that permission without asking?

[devinbinnie]

@devinbinnie if a domain e.g. example.com hosts 2 Mattermost servers: one with URL example.com/mm1 and one with URL example.com/mm2, will after this change these 2 Mattermost servers need to ask for media permission separately or if example.com/mm1 is granted media permission, example.com/mm2 will inherit that permission without asking?

Correct, because we are using the securityOrigin field which is what I assume is the correct field to use for the media permission. It's not provided for the others. Not sure if this is a problem or not.

[esarafianou]

LGTM!