From 28c7a04734e619b2e9e8911bd61e45885c44bec2 Mon Sep 17 00:00:00 2001
From: Vector73 <v.shm.kunal@gmail.com>
Date: Wed, 11 Sep 2024 22:43:37 +0530
Subject: [PATCH] settings: Add `can_delete_own_message_group` realm setting.

Added `can_delete_message_group` realm setting to replace
`delete_own_message_policy` property.
---
 api_docs/changelog.md                         |   8 ++
 version.py                                    |   3 +-
 web/src/admin.js                              |   4 +-
 web/src/server_events_dispatch.js             |   1 +
 web/src/settings_components.ts                |   3 +
 web/src/settings_data.ts                      |   8 +-
 web/src/settings_org.js                       |  63 +++------
 web/src/state_data.ts                         |   2 +-
 .../organization_permissions_admin.hbs        |  12 +-
 web/tests/popover_menus_data.test.js          |   4 +-
 web/tests/settings_data.test.js               |   5 +-
 zerver/lib/event_schema.py                    |   1 +
 zerver/lib/server_initialization.py           |   1 -
 ...0579_realm_can_delete_own_message_group.py |  23 ++++
 ..._value_for_can_delete_own_message_group.py |  46 +++++++
 ...lter_realm_can_delete_own_message_group.py |  22 +++
 zerver/models/realms.py                       |  17 +++
 zerver/models/users.py                        |   4 +-
 zerver/openapi/zulip.yaml                     |  32 +++++
 zerver/tests/test_home.py                     |   1 +
 zerver/tests/test_message_delete.py           | 128 ++++++++----------
 zerver/tests/test_message_move_topic.py       |  13 +-
 zerver/views/message_edit.py                  |   2 +-
 zerver/views/realm.py                         |   1 +
 24 files changed, 264 insertions(+), 140 deletions(-)
 create mode 100644 zerver/migrations/0579_realm_can_delete_own_message_group.py
 create mode 100644 zerver/migrations/0580_set_default_value_for_can_delete_own_message_group.py
 create mode 100644 zerver/migrations/0581_alter_realm_can_delete_own_message_group.py

diff --git a/api_docs/changelog.md b/api_docs/changelog.md
index 90e791731b..5cf265a5b4 100644
--- a/api_docs/changelog.md
+++ b/api_docs/changelog.md
@@ -20,6 +20,14 @@ format used by the Zulip server that they are interacting with.
 
 ## Changes in Zulip 10.0
 
+**Feature level 291**
+
+* `PATCH /realm`, [`GET /events`](/api/get-events),
+  [`POST /register`](/api/register-queue):
+  Added `can_delete_own_message_group` realm setting which is a
+  [group-setting value](/api/group-setting-values) describing the set of users
+  with permission to delete the messages that they have sent in the organization.
+
 **Feature level 290**
 
 * [`POST /user_groups/{user_group_id}/deactivate`](/api/deactivate-user-group):
diff --git a/version.py b/version.py
index 3a19db9b2b..eb66ba1072 100644
--- a/version.py
+++ b/version.py
@@ -34,7 +34,8 @@ DESKTOP_WARNING_VERSION = "5.9.3"
 # new level means in api_docs/changelog.md, as well as "**Changes**"
 # entries in the endpoint's documentation in `zulip.yaml`.
 
-API_FEATURE_LEVEL = 290  # Last bumped for UserGroup.deactivated
+
+API_FEATURE_LEVEL = 291  # Last bumped for can_delete_own_message_group
 
 # Bump the minor PROVISION_VERSION to indicate that folks should provision
 # only when going from an old version of the code to a newer version. Bump
diff --git a/web/src/admin.js b/web/src/admin.js
index b2385120ae..2db7ce4cf3 100644
--- a/web/src/admin.js
+++ b/web/src/admin.js
@@ -185,9 +185,7 @@ export function build_page() {
         can_create_user_groups: settings_data.user_can_create_user_groups(),
         policy_values: settings_config.common_policy_values,
         realm_can_delete_any_message_group: realm.realm_can_delete_any_message_group,
-        realm_delete_own_message_policy: realm.realm_delete_own_message_policy,
-        DELETE_OWN_MESSAGE_POLICY_ADMINS_ONLY:
-            settings_config.common_message_policy_values.by_admins_only.code,
+        realm_can_delete_own_message_group: realm.realm_can_delete_own_message_group,
         ...settings_org.get_organization_settings_options(),
         demote_inactive_streams_values: settings_config.demote_inactive_streams_values,
         web_mark_read_on_scroll_policy_values:
diff --git a/web/src/server_events_dispatch.js b/web/src/server_events_dispatch.js
index f23366248a..96ffd12bf5 100644
--- a/web/src/server_events_dispatch.js
+++ b/web/src/server_events_dispatch.js
@@ -210,6 +210,7 @@ export function dispatch_normal_event(event) {
                 avatar_changes_disabled: settings_account.update_avatar_change_display,
                 bot_creation_policy: settings_bots.update_bot_permissions_ui,
                 can_delete_any_message_group: noop,
+                can_delete_own_message_group: noop,
                 create_multiuse_invite_group: noop,
                 invite_to_stream_policy: noop,
                 default_code_block_language: noop,
diff --git a/web/src/settings_components.ts b/web/src/settings_components.ts
index ee8e137776..a6ad79c33d 100644
--- a/web/src/settings_components.ts
+++ b/web/src/settings_components.ts
@@ -482,6 +482,7 @@ const dropdown_widget_map = new Map<string, DropdownWidget | null>([
     ["realm_can_create_private_channel_group", null],
     ["realm_can_create_web_public_channel_group", null],
     ["realm_can_delete_any_message_group", null],
+    ["realm_can_delete_own_message_group", null],
     ["realm_direct_message_initiator_group", null],
     ["realm_direct_message_permission_group", null],
 ]);
@@ -802,6 +803,7 @@ export function check_realm_settings_property_changed(elem: HTMLElement): boolea
         case "realm_can_create_private_channel_group":
         case "realm_can_create_web_public_channel_group":
         case "realm_can_delete_any_message_group":
+        case "realm_can_delete_own_message_group":
         case "realm_direct_message_initiator_group":
         case "realm_direct_message_permission_group":
             proposed_val = get_dropdown_list_widget_setting_value($elem);
@@ -1000,6 +1002,7 @@ export function populate_data_for_realm_settings_request(
                     "can_create_public_channel_group",
                     "can_create_web_public_channel_group",
                     "can_delete_any_message_group",
+                    "can_delete_own_message_group",
                     "direct_message_initiator_group",
                     "direct_message_permission_group",
                 ]);
diff --git a/web/src/settings_data.ts b/web/src/settings_data.ts
index fa6440fd81..29457b938a 100644
--- a/web/src/settings_data.ts
+++ b/web/src/settings_data.ts
@@ -212,7 +212,13 @@ export function user_can_delete_any_message(): boolean {
 }
 
 export function user_can_delete_own_message(): boolean {
-    return user_has_permission(realm.realm_delete_own_message_policy);
+    if (page_params.is_spectator) {
+        return false;
+    }
+    return user_groups.is_user_in_group(
+        realm.realm_can_delete_own_message_group,
+        current_user.user_id,
+    );
 }
 
 export function should_mask_unread_count(sub_muted: boolean): boolean {
diff --git a/web/src/settings_org.js b/web/src/settings_org.js
index 8e8a85db29..88409f4a33 100644
--- a/web/src/settings_org.js
+++ b/web/src/settings_org.js
@@ -266,41 +266,19 @@ function message_delete_limit_setting_enabled() {
     // should be enabled. The setting is disabled when every user
     // who is allowed to delete their own messages is also allowed
     // to delete any message in the organization.
-    const realm_delete_own_message_policy = Number.parseInt(
-        $("#id_realm_delete_own_message_policy").val(),
-        10,
-    );
+    const realm_can_delete_own_message_group_id =
+        settings_components.get_dropdown_list_widget_setting_value(
+            $("#id_realm_can_delete_own_message_group"),
+        );
     const realm_can_delete_any_message_group_id =
         settings_components.get_dropdown_list_widget_setting_value(
             $("#id_realm_can_delete_any_message_group"),
         );
-    const realm_can_delete_any_message_group_name = user_groups.get_user_group_from_id(
-        realm_can_delete_any_message_group_id,
-    ).name;
-    const common_message_policy_values = settings_config.common_message_policy_values;
-
-    if (realm_delete_own_message_policy === common_message_policy_values.by_admins_only.code) {
-        return false;
-    }
-    if (realm_can_delete_any_message_group_name === "role:administrators") {
-        return true;
-    }
-    if (realm_delete_own_message_policy === common_message_policy_values.by_moderators_only.code) {
-        return false;
-    }
-    if (realm_can_delete_any_message_group_name === "role:moderators") {
-        return true;
-    }
-    if (realm_delete_own_message_policy === common_message_policy_values.by_full_members.code) {
-        return false;
-    }
-    if (realm_can_delete_any_message_group_name === "role:fullmembers") {
-        return true;
-    }
-    if (realm_delete_own_message_policy === common_message_policy_values.by_members.code) {
-        return false;
-    }
-    return true;
+    const can_delete_any_message_subgroups = user_groups.get_recursive_subgroups(
+        user_groups.get_user_group_from_id(realm_can_delete_any_message_group_id),
+    );
+    can_delete_any_message_subgroups.add(realm_can_delete_any_message_group_id);
+    return !can_delete_any_message_subgroups.has(realm_can_delete_own_message_group_id);
 }
 
 function check_disable_message_delete_limit_setting_dropdown() {
@@ -318,11 +296,6 @@ function check_disable_message_delete_limit_setting_dropdown() {
     }
 }
 
-function set_delete_own_message_policy_dropdown(setting_value) {
-    $("#id_realm_delete_own_message_policy").val(setting_value);
-    check_disable_message_delete_limit_setting_dropdown();
-}
-
 function set_msg_delete_limit_dropdown() {
     settings_components.set_time_limit_setting("realm_message_content_delete_limit_seconds");
 }
@@ -488,8 +461,8 @@ function update_dependent_subsettings(property_name) {
         case "realm_can_delete_any_message_group":
             check_disable_message_delete_limit_setting_dropdown();
             break;
-        case "realm_delete_own_message_policy":
-            set_delete_own_message_policy_dropdown(realm.realm_delete_own_message_policy);
+        case "realm_can_delete_own_message_group":
+            check_disable_message_delete_limit_setting_dropdown();
             break;
         case "realm_org_join_restrictions":
             set_org_join_restrictions_dropdown();
@@ -542,6 +515,7 @@ export function discard_realm_property_element_changes(elem) {
         case "realm_can_create_private_channel_group":
         case "realm_can_create_web_public_channel_group":
         case "realm_can_delete_any_message_group":
+        case "realm_can_delete_own_message_group":
             settings_components.set_dropdown_list_widget_setting_value(
                 property_name,
                 property_value,
@@ -861,7 +835,10 @@ export function set_up_dropdown_widget_for_realm_group_settings() {
         if (setting_name === "direct_message_permission_group") {
             dropdown_list_item_click_callback =
                 check_disable_direct_message_initiator_group_dropdown;
-        } else if (setting_name === "can_delete_any_message_group") {
+        } else if (
+            setting_name === "can_delete_any_message_group" ||
+            setting_name === "can_delete_own_message_group"
+        ) {
             dropdown_list_item_click_callback = check_disable_message_delete_limit_setting_dropdown;
         }
         set_up_dropdown_widget(
@@ -1044,7 +1021,6 @@ export function build_page() {
     set_msg_move_limit_setting("realm_move_messages_within_stream_limit_seconds");
     set_msg_move_limit_setting("realm_move_messages_between_streams_limit_seconds");
     set_msg_delete_limit_dropdown();
-    set_delete_own_message_policy_dropdown(realm.realm_delete_own_message_policy);
     set_message_retention_setting_dropdown();
     set_org_join_restrictions_dropdown();
     set_message_content_in_email_notifications_visibility();
@@ -1153,11 +1129,6 @@ export function build_page() {
         );
     });
 
-    $("#id_realm_delete_own_message_policy").on("change", (e) => {
-        const setting_value = Number.parseInt($(e.target).val(), 10);
-        set_delete_own_message_policy_dropdown(setting_value);
-    });
-
     $("#id_realm_org_join_restrictions").on("click", (e) => {
         // This prevents the disappearance of modal when there are
         // no allowed domains otherwise it gets closed due to
@@ -1225,6 +1196,8 @@ export function build_page() {
         });
     }
 
+    check_disable_message_delete_limit_setting_dropdown();
+
     realm_icon.build_realm_icon_widget(upload_realm_logo_or_icon, null, true);
     if (realm.zulip_plan_is_not_limited) {
         realm_logo.build_realm_logo_widget(upload_realm_logo_or_icon, false);
diff --git a/web/src/state_data.ts b/web/src/state_data.ts
index 60aef3a63e..50bfb697bb 100644
--- a/web/src/state_data.ts
+++ b/web/src/state_data.ts
@@ -269,6 +269,7 @@ const realm_schema = z.object({
     realm_can_create_private_channel_group: z.number(),
     realm_can_create_web_public_channel_group: z.number(),
     realm_can_delete_any_message_group: z.number(),
+    realm_can_delete_own_message_group: z.number(),
     realm_create_multiuse_invite_group: z.number(),
     realm_create_private_stream_policy: z.number(),
     realm_date_created: z.number(),
@@ -283,7 +284,6 @@ const realm_schema = z.object({
         }),
     ),
     realm_default_language: z.string(),
-    realm_delete_own_message_policy: z.number(),
     realm_description: z.string(),
     realm_digest_emails_enabled: NOT_TYPED_YET,
     realm_digest_weekday: NOT_TYPED_YET,
diff --git a/web/templates/settings/organization_permissions_admin.hbs b/web/templates/settings/organization_permissions_admin.hbs
index a711531034..70f42bf4cd 100644
--- a/web/templates/settings/organization_permissions_admin.hbs
+++ b/web/templates/settings/organization_permissions_admin.hbs
@@ -241,14 +241,10 @@
                   label=(t 'Who can delete any message')
                   value_type="number" }}
 
-                <div class="input-group">
-                    <label for="realm_delete_own_message_policy" class="settings-field-label">
-                        {{t "Who can delete their own messages" }}
-                    </label>
-                    <select name="realm_delete_own_message_policy" id="id_realm_delete_own_message_policy" class="prop-element bootstrap-focus-style settings_select" data-setting-widget-type="number">
-                        {{> dropdown_options_widget option_values=common_message_policy_values}}
-                    </select>
-                </div>
+                {{> ../dropdown_widget_with_label
+                  widget_name="realm_can_delete_own_message_group"
+                  label=(t 'Who can delete their own messages')
+                  value_type="number" }}
 
                 <div class="input-group time-limit-setting">
                     <label for="realm_message_content_delete_limit_seconds" class="settings-field-label">
diff --git a/web/tests/popover_menus_data.test.js b/web/tests/popover_menus_data.test.js
index f96a9274d2..ae3f3da4be 100644
--- a/web/tests/popover_menus_data.test.js
+++ b/web/tests/popover_menus_data.test.js
@@ -5,7 +5,7 @@ const {strict: assert} = require("assert");
 const {mock_esm, zrequire} = require("./lib/namespace");
 const {run_test} = require("./lib/test");
 const $ = require("./lib/zjquery");
-const {page_params, realm} = require("./lib/zpage_params");
+const {page_params, realm, current_user} = require("./lib/zpage_params");
 
 const {Filter} = zrequire("filter");
 const {MessageList} = zrequire("message_list");
@@ -150,6 +150,8 @@ test("my_message_all_actions", () => {
     // Set page parameters.
     set_page_params_no_edit_restrictions();
     realm.realm_can_delete_any_message_group = everyone.id;
+    realm.realm_can_delete_own_message_group = everyone.id;
+    current_user.user_id = me.user_id;
     // Get message with maximum permissions available
     // Initialize message list
     const list = init_message_list();
diff --git a/web/tests/settings_data.test.js b/web/tests/settings_data.test.js
index 7dd658788e..81ae6de0d5 100644
--- a/web/tests/settings_data.test.js
+++ b/web/tests/settings_data.test.js
@@ -237,9 +237,8 @@ test_realm_group_settings(
     settings_data.user_can_delete_any_message,
 );
 
-test_message_policy(
-    "user_can_delete_own_message",
-    "realm_delete_own_message_policy",
+test_realm_group_settings(
+    "realm_can_delete_own_message_group",
     settings_data.user_can_delete_own_message,
 );
 
diff --git a/zerver/lib/event_schema.py b/zerver/lib/event_schema.py
index 06bab2b140..f20c678ede 100644
--- a/zerver/lib/event_schema.py
+++ b/zerver/lib/event_schema.py
@@ -1051,6 +1051,7 @@ group_setting_update_data_type = DictType(
         ("can_create_private_channel_group", group_setting_type),
         ("can_create_web_public_channel_group", group_setting_type),
         ("can_delete_any_message_group", group_setting_type),
+        ("can_delete_own_message_group", group_setting_type),
         ("direct_message_initiator_group", group_setting_type),
         ("direct_message_permission_group", group_setting_type),
     ],
diff --git a/zerver/lib/server_initialization.py b/zerver/lib/server_initialization.py
index fb0c8a0210..a3100f2f8d 100644
--- a/zerver/lib/server_initialization.py
+++ b/zerver/lib/server_initialization.py
@@ -34,7 +34,6 @@ def create_internal_realm() -> None:
     # is changed later before the transaction is committed.
     for permission_configuration in Realm.REALM_PERMISSION_GROUP_SETTINGS.values():
         setattr(realm, permission_configuration.id_field_name, -1)
-    realm.delete_own_message_policy = 1
     realm.save()
 
     RealmAuditLog.objects.create(
diff --git a/zerver/migrations/0579_realm_can_delete_own_message_group.py b/zerver/migrations/0579_realm_can_delete_own_message_group.py
new file mode 100644
index 0000000000..0c2455b3ee
--- /dev/null
+++ b/zerver/migrations/0579_realm_can_delete_own_message_group.py
@@ -0,0 +1,23 @@
+# Generated by Django 5.0.7 on 2024-08-28 05:15
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("zerver", "0578_namedusergroup_deactivated"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="realm",
+            name="can_delete_own_message_group",
+            field=models.ForeignKey(
+                null=True,
+                on_delete=django.db.models.deletion.RESTRICT,
+                related_name="+",
+                to="zerver.usergroup",
+            ),
+        ),
+    ]
diff --git a/zerver/migrations/0580_set_default_value_for_can_delete_own_message_group.py b/zerver/migrations/0580_set_default_value_for_can_delete_own_message_group.py
new file mode 100644
index 0000000000..28f22d6033
--- /dev/null
+++ b/zerver/migrations/0580_set_default_value_for_can_delete_own_message_group.py
@@ -0,0 +1,46 @@
+# Generated by Django 4.2.1 on 2023-06-12 10:47
+
+from django.db import migrations
+from django.db.backends.base.schema import BaseDatabaseSchemaEditor
+from django.db.migrations.state import StateApps
+from django.db.models import OuterRef
+
+
+def set_default_value_for_can_delete_own_message_group(
+    apps: StateApps, schema_editor: BaseDatabaseSchemaEditor
+) -> None:
+    Realm = apps.get_model("zerver", "Realm")
+    NamedUserGroup = apps.get_model("zerver", "NamedUserGroup")
+
+    delete_own_message_policy_to_user_group = {
+        1: "role:members",
+        2: "role:administrators",
+        3: "role:fullmembers",
+        4: "role:moderators",
+        5: "role:everyone",
+    }
+
+    for id, user_group in delete_own_message_policy_to_user_group.items():
+        Realm.objects.filter(
+            can_delete_own_message_group=None, delete_own_message_policy=id
+        ).update(
+            can_delete_own_message_group=NamedUserGroup.objects.filter(
+                name=user_group, realm=OuterRef("id"), is_system_group=True
+            ).values("pk")
+        )
+
+
+class Migration(migrations.Migration):
+    atomic = False
+
+    dependencies = [
+        ("zerver", "0579_realm_can_delete_own_message_group"),
+    ]
+
+    operations = [
+        migrations.RunPython(
+            set_default_value_for_can_delete_own_message_group,
+            elidable=True,
+            reverse_code=migrations.RunPython.noop,
+        )
+    ]
diff --git a/zerver/migrations/0581_alter_realm_can_delete_own_message_group.py b/zerver/migrations/0581_alter_realm_can_delete_own_message_group.py
new file mode 100644
index 0000000000..c95220b809
--- /dev/null
+++ b/zerver/migrations/0581_alter_realm_can_delete_own_message_group.py
@@ -0,0 +1,22 @@
+# Generated by Django 5.0.7 on 2024-08-28 05:31
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("zerver", "0580_set_default_value_for_can_delete_own_message_group"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="realm",
+            name="can_delete_own_message_group",
+            field=models.ForeignKey(
+                on_delete=django.db.models.deletion.RESTRICT,
+                related_name="+",
+                to="zerver.usergroup",
+            ),
+        ),
+    ]
diff --git a/zerver/models/realms.py b/zerver/models/realms.py
index 2a165571ba..35f91caa84 100644
--- a/zerver/models/realms.py
+++ b/zerver/models/realms.py
@@ -313,6 +313,11 @@ class Realm(models.Model):  # type: ignore[django-manager-missing] # django-stub
         "UserGroup", on_delete=models.RESTRICT, related_name="+"
     )
 
+    # Who in the organization is allowed to delete their own message.
+    can_delete_own_message_group = models.ForeignKey(
+        "UserGroup", on_delete=models.RESTRICT, related_name="+"
+    )
+
     # Who in the organization is allowed to delete messages they themselves sent.
     delete_own_message_policy = models.PositiveSmallIntegerField(
         default=CommonMessagePolicyEnum.EVERYONE
@@ -737,6 +742,15 @@ class Realm(models.Model):  # type: ignore[django-manager-missing] # django-stub
             default_group_name=SystemGroups.ADMINISTRATORS,
             id_field_name="can_delete_any_message_group_id",
         ),
+        can_delete_own_message_group=GroupPermissionSetting(
+            require_system_group=False,
+            allow_internet_group=False,
+            allow_owners_group=False,
+            allow_nobody_group=False,
+            allow_everyone_group=True,
+            default_group_name=SystemGroups.EVERYONE,
+            id_field_name="can_delete_own_message_group_id",
+        ),
         direct_message_initiator_group=GroupPermissionSetting(
             require_system_group=False,
             allow_internet_group=False,
@@ -777,6 +791,7 @@ class Realm(models.Model):  # type: ignore[django-manager-missing] # django-stub
         "can_create_public_channel_group",
         "can_create_web_public_channel_group",
         "can_delete_any_message_group",
+        "can_delete_own_message_group",
         "direct_message_initiator_group",
         "direct_message_permission_group",
     ]
@@ -1148,6 +1163,8 @@ def get_realm_with_settings(realm_id: int) -> Realm:
         "can_create_web_public_channel_group__named_user_group",
         "can_delete_any_message_group",
         "can_delete_any_message_group__named_user_group",
+        "can_delete_own_message_group",
+        "can_delete_own_message_group__named_user_group",
         "direct_message_initiator_group",
         "direct_message_initiator_group__named_user_group",
         "direct_message_permission_group",
diff --git a/zerver/models/users.py b/zerver/models/users.py
index f7127e4b26..eef863d262 100644
--- a/zerver/models/users.py
+++ b/zerver/models/users.py
@@ -777,8 +777,8 @@ class UserProfile(AbstractBaseUser, PermissionsMixin, UserBaseSettings):
             "can_create_public_channel_group",
             "can_create_web_public_channel_group",
             "can_delete_any_message_group",
+            "can_delete_own_message_group",
             "create_multiuse_invite_group",
-            "delete_own_message_policy",
             "direct_message_initiator_group",
             "direct_message_permission_group",
             "edit_topic_policy",
@@ -871,7 +871,7 @@ class UserProfile(AbstractBaseUser, PermissionsMixin, UserBaseSettings):
         return self.has_permission("can_delete_any_message_group")
 
     def can_delete_own_message(self) -> bool:
-        return self.has_permission("delete_own_message_policy")
+        return self.has_permission("can_delete_own_message_group")
 
     def can_access_public_streams(self) -> bool:
         return not (self.is_guest or self.realm.is_zephyr_mirror_realm)
diff --git a/zerver/openapi/zulip.yaml b/zerver/openapi/zulip.yaml
index 22933eb9ce..45614b6566 100644
--- a/zerver/openapi/zulip.yaml
+++ b/zerver/openapi/zulip.yaml
@@ -4326,6 +4326,21 @@ paths:
                                             **Changes**: New in Zulip 10.0 (feature level 281). Previously, this
                                             permission was limited to administrators only and was uneditable.
                                         - $ref: "#/components/schemas/GroupSettingValue"
+                                    can_delete_own_message_group:
+                                      allOf:
+                                        - description: |
+                                            A [group-setting value](/api/group-setting-values) defining the set of
+                                            users who have permission to delete messages that they have sent in the
+                                            organization.
+
+                                            **Changes**: New in Zulip 10.0 (feature level 291). Previously, this
+                                            permission was controlled by the enum `delete_own_message_policy`. Values
+                                            were 1=Members, 2=Admins, 3=Full members, 4=Moderators, 5=Everyone.
+
+                                            Before Zulip 5.0 (feature level 101), the `allow_message_deleting` boolean
+                                            setting controlled this permission; `true` corresponded to `Everyone`, and
+                                            `false` to `Admins`.
+                                        - $ref: "#/components/schemas/GroupSettingValue"
                                     default_code_block_language:
                                       type: string
                                       description: |
@@ -15666,6 +15681,23 @@ paths:
                               **Changes**: New in Zulip 10.0 (feature level 281). Previously, this
                               permission was limited to administrators only and was uneditable.
                           - $ref: "#/components/schemas/GroupSettingValue"
+                      realm_can_delete_own_message_group:
+                        allOf:
+                          - description: |
+                              Present if `realm` is present in `fetch_event_types`.
+
+                              A [group-setting value](/api/group-setting-values) defining the set of
+                              users who have permission to delete messages that they have sent in the
+                              organization.
+
+                              **Changes**: New in Zulip 10.0 (feature level 291). Previously, this
+                              permission was controlled by the enum `delete_own_message_policy`. Values
+                              were 1=Members, 2=Admins, 3=Full members, 4=Moderators, 5=Everyone.
+
+                              Before Zulip 5.0 (feature level 101), the `allow_message_deleting` boolean
+                              setting controlled this permission; `true` corresponded to `Everyone`, and
+                              `false` to `Admins`.
+                          - $ref: "#/components/schemas/GroupSettingValue"
                       realm_delete_own_message_policy:
                         type: integer
                         description: |
diff --git a/zerver/tests/test_home.py b/zerver/tests/test_home.py
index ff63185def..1102fc4c95 100644
--- a/zerver/tests/test_home.py
+++ b/zerver/tests/test_home.py
@@ -134,6 +134,7 @@ class HomeTest(ZulipTestCase):
         "realm_can_create_public_channel_group",
         "realm_can_create_web_public_channel_group",
         "realm_can_delete_any_message_group",
+        "realm_can_delete_own_message_group",
         "realm_create_multiuse_invite_group",
         "realm_create_private_stream_policy",
         "realm_create_public_stream_policy",
diff --git a/zerver/tests/test_message_delete.py b/zerver/tests/test_message_delete.py
index 3fbf592d40..e96dfd7ea9 100644
--- a/zerver/tests/test_message_delete.py
+++ b/zerver/tests/test_message_delete.py
@@ -7,14 +7,11 @@ from django.db import IntegrityError
 from django.utils.timezone import now as timezone_now
 
 from zerver.actions.message_delete import do_delete_messages
-from zerver.actions.realm_settings import (
-    do_change_realm_permission_group_setting,
-    do_set_realm_property,
-)
+from zerver.actions.realm_settings import do_change_realm_permission_group_setting
 from zerver.lib.test_classes import ZulipTestCase
 from zerver.models import Message, NamedUserGroup, UserProfile
 from zerver.models.groups import SystemGroups
-from zerver.models.realms import CommonMessagePolicyEnum, get_realm
+from zerver.models.realms import get_realm
 from zerver.models.streams import get_stream
 
 if TYPE_CHECKING:
@@ -34,7 +31,7 @@ class DeleteMessageTest(ZulipTestCase):
     def test_delete_message_by_user(self) -> None:
         def set_message_deleting_params(
             can_delete_any_message_group: NamedUserGroup,
-            delete_own_message_policy: int,
+            can_delete_own_message_group: NamedUserGroup,
             message_content_delete_limit_seconds: int | str,
         ) -> None:
             self.login("iago")
@@ -44,7 +41,9 @@ class DeleteMessageTest(ZulipTestCase):
                     "can_delete_any_message_group": orjson.dumps(
                         {"new": can_delete_any_message_group.id}
                     ).decode(),
-                    "delete_own_message_policy": orjson.dumps(delete_own_message_policy).decode(),
+                    "can_delete_own_message_group": orjson.dumps(
+                        {"new": can_delete_own_message_group.id}
+                    ).decode(),
                     "message_content_delete_limit_seconds": orjson.dumps(
                         message_content_delete_limit_seconds
                     ).decode(),
@@ -83,10 +82,13 @@ class DeleteMessageTest(ZulipTestCase):
         moderators_system_group = NamedUserGroup.objects.get(
             name=SystemGroups.MODERATORS, realm=realm, is_system_group=True
         )
+        everyone_system_group = NamedUserGroup.objects.get(
+            name=SystemGroups.EVERYONE, realm=realm, is_system_group=True
+        )
 
         # Test if message deleting is not allowed(default).
         set_message_deleting_params(
-            administrators_system_group, CommonMessagePolicyEnum.ADMINS_ONLY, "unlimited"
+            administrators_system_group, administrators_system_group, "unlimited"
         )
         hamlet = self.example_user("hamlet")
         self.login_user(hamlet)
@@ -103,9 +105,7 @@ class DeleteMessageTest(ZulipTestCase):
 
         # Test if message deleting is allowed.
         # Test if time limit is None(no limit).
-        set_message_deleting_params(
-            administrators_system_group, CommonMessagePolicyEnum.EVERYONE, "unlimited"
-        )
+        set_message_deleting_params(administrators_system_group, everyone_system_group, "unlimited")
         msg_id = self.send_stream_message(hamlet, "Denmark")
         message = Message.objects.get(id=msg_id)
         message.date_sent -= timedelta(seconds=600)
@@ -118,9 +118,7 @@ class DeleteMessageTest(ZulipTestCase):
         self.assert_json_success(result)
 
         # Test if time limit is non-zero.
-        set_message_deleting_params(
-            administrators_system_group, CommonMessagePolicyEnum.EVERYONE, 240
-        )
+        set_message_deleting_params(administrators_system_group, everyone_system_group, 240)
         msg_id_1 = self.send_stream_message(hamlet, "Denmark")
         message = Message.objects.get(id=msg_id_1)
         message.date_sent -= timedelta(seconds=120)
@@ -151,9 +149,7 @@ class DeleteMessageTest(ZulipTestCase):
         self.assert_json_error(result, "Invalid message(s)")
 
         # Test if message deletion is allowed when every member can delete any message.
-        set_message_deleting_params(
-            members_system_group, CommonMessagePolicyEnum.ADMINS_ONLY, "unlimited"
-        )
+        set_message_deleting_params(members_system_group, administrators_system_group, "unlimited")
         msg_id_1 = self.send_stream_message(hamlet, "Denmark")
         msg_id_2 = self.send_stream_message(hamlet, "Denmark")
         msg_id_3 = self.send_stream_message(hamlet, "Denmark")
@@ -169,7 +165,7 @@ class DeleteMessageTest(ZulipTestCase):
 
         # Test if there is no time limit to delete messages for users who can delete
         # any message.
-        set_message_deleting_params(moderators_system_group, CommonMessagePolicyEnum.EVERYONE, 240)
+        set_message_deleting_params(moderators_system_group, everyone_system_group, 240)
         msg_id_1 = self.send_stream_message(hamlet, "Denmark")
         message = Message.objects.get(id=msg_id_1)
         message.date_sent -= timedelta(seconds=120)
@@ -214,7 +210,7 @@ class DeleteMessageTest(ZulipTestCase):
 
         def set_message_deleting_params(
             can_delete_any_message_group: NamedUserGroup,
-            delete_own_message_policy: int,
+            can_delete_own_message_group: NamedUserGroup,
             message_content_delete_limit_seconds: int | str,
         ) -> None:
             result = self.api_patch(
@@ -224,7 +220,9 @@ class DeleteMessageTest(ZulipTestCase):
                     "can_delete_any_message_group": orjson.dumps(
                         {"new": can_delete_any_message_group.id}
                     ).decode(),
-                    "delete_own_message_policy": orjson.dumps(delete_own_message_policy).decode(),
+                    "can_delete_own_message_group": orjson.dumps(
+                        {"new": can_delete_own_message_group.id}
+                    ).decode(),
                     "message_content_delete_limit_seconds": orjson.dumps(
                         message_content_delete_limit_seconds
                     ).decode(),
@@ -256,9 +254,12 @@ class DeleteMessageTest(ZulipTestCase):
         moderators_system_group = NamedUserGroup.objects.get(
             name=SystemGroups.MODERATORS, realm=realm, is_system_group=True
         )
+        everyone_system_group = NamedUserGroup.objects.get(
+            name=SystemGroups.EVERYONE, realm=realm, is_system_group=True
+        )
 
         set_message_deleting_params(
-            moderators_system_group, CommonMessagePolicyEnum.ADMINS_ONLY, "unlimited"
+            moderators_system_group, administrators_system_group, "unlimited"
         )
 
         hamlet = self.example_user("hamlet")
@@ -280,9 +281,7 @@ class DeleteMessageTest(ZulipTestCase):
         self.assert_json_success(result)
 
         msg_id = self.send_stream_message(test_bot, "Denmark")
-        set_message_deleting_params(
-            administrators_system_group, CommonMessagePolicyEnum.EVERYONE, "unlimited"
-        )
+        set_message_deleting_params(administrators_system_group, everyone_system_group, "unlimited")
 
         result = test_delete_message_by_other_user(msg_id)
         self.assert_json_error(result, "You don't have permission to delete this message")
@@ -291,9 +290,7 @@ class DeleteMessageTest(ZulipTestCase):
         self.assert_json_success(result)
 
         msg_id = self.send_stream_message(test_bot, "Denmark")
-        set_message_deleting_params(
-            administrators_system_group, CommonMessagePolicyEnum.EVERYONE, 600
-        )
+        set_message_deleting_params(administrators_system_group, everyone_system_group, 600)
 
         message = Message.objects.get(id=msg_id)
         message.date_sent = timezone_now() - timedelta(seconds=700)
@@ -310,16 +307,12 @@ class DeleteMessageTest(ZulipTestCase):
 
         # Check that the bot can also delete the messages sent by them
         # depending on the realm permissions for message deletion.
-        set_message_deleting_params(
-            administrators_system_group, CommonMessagePolicyEnum.ADMINS_ONLY, 600
-        )
+        set_message_deleting_params(administrators_system_group, administrators_system_group, 600)
         msg_id = self.send_stream_message(test_bot, "Denmark")
         result = self.api_delete(test_bot, f"/api/v1/messages/{msg_id}")
         self.assert_json_error(result, "You don't have permission to delete this message")
 
-        set_message_deleting_params(
-            administrators_system_group, CommonMessagePolicyEnum.EVERYONE, 600
-        )
+        set_message_deleting_params(administrators_system_group, everyone_system_group, 600)
         message = Message.objects.get(id=msg_id)
         message.date_sent = timezone_now() - timedelta(seconds=700)
         message.save()
@@ -364,6 +357,9 @@ class DeleteMessageTest(ZulipTestCase):
         moderators_system_group = NamedUserGroup.objects.get(
             name=SystemGroups.MODERATORS, realm=realm, is_system_group=True
         )
+        everyone_system_group = NamedUserGroup.objects.get(
+            name=SystemGroups.EVERYONE, realm=realm, is_system_group=True
+        )
 
         do_change_realm_permission_group_setting(
             realm,
@@ -371,10 +367,10 @@ class DeleteMessageTest(ZulipTestCase):
             administrators_system_group,
             acting_user=None,
         )
-        do_set_realm_property(
+        do_change_realm_permission_group_setting(
             realm,
-            "delete_own_message_policy",
-            CommonMessagePolicyEnum.EVERYONE,
+            "can_delete_own_message_group",
+            everyone_system_group,
             acting_user=None,
         )
 
@@ -392,10 +388,10 @@ class DeleteMessageTest(ZulipTestCase):
             moderators_system_group,
             acting_user=None,
         )
-        do_set_realm_property(
+        do_change_realm_permission_group_setting(
             realm,
-            "delete_own_message_policy",
-            CommonMessagePolicyEnum.ADMINS_ONLY,
+            "can_delete_own_message_group",
+            administrators_system_group,
             acting_user=None,
         )
 
@@ -410,7 +406,7 @@ class DeleteMessageTest(ZulipTestCase):
             "hamlet", "cordelia", "You don't have permission to delete this message"
         )
 
-    def test_delete_message_according_to_delete_own_message_policy(self) -> None:
+    def test_delete_message_according_to_can_delete_own_message_group(self) -> None:
         def check_delete_message_by_sender(sender_name: str, error_msg: str | None = None) -> None:
             sender = self.example_user(sender_name)
             msg_id = self.send_stream_message(sender, "Verona")
@@ -423,19 +419,32 @@ class DeleteMessageTest(ZulipTestCase):
 
         realm = get_realm("zulip")
 
-        do_set_realm_property(
+        administrators_system_group = NamedUserGroup.objects.get(
+            name=SystemGroups.ADMINISTRATORS, realm=realm, is_system_group=True
+        )
+        moderators_system_group = NamedUserGroup.objects.get(
+            name=SystemGroups.MODERATORS, realm=realm, is_system_group=True
+        )
+        everyone_system_group = NamedUserGroup.objects.get(
+            name=SystemGroups.EVERYONE, realm=realm, is_system_group=True
+        )
+        members_system_group = NamedUserGroup.objects.get(
+            name=SystemGroups.MEMBERS, realm=realm, is_system_group=True
+        )
+
+        do_change_realm_permission_group_setting(
             realm,
-            "delete_own_message_policy",
-            CommonMessagePolicyEnum.ADMINS_ONLY,
+            "can_delete_own_message_group",
+            administrators_system_group,
             acting_user=None,
         )
         check_delete_message_by_sender("shiva", "You don't have permission to delete this message")
         check_delete_message_by_sender("iago")
 
-        do_set_realm_property(
+        do_change_realm_permission_group_setting(
             realm,
-            "delete_own_message_policy",
-            CommonMessagePolicyEnum.MODERATORS_ONLY,
+            "can_delete_own_message_group",
+            moderators_system_group,
             acting_user=None,
         )
         check_delete_message_by_sender(
@@ -443,10 +452,10 @@ class DeleteMessageTest(ZulipTestCase):
         )
         check_delete_message_by_sender("shiva")
 
-        do_set_realm_property(
+        do_change_realm_permission_group_setting(
             realm,
-            "delete_own_message_policy",
-            CommonMessagePolicyEnum.MEMBERS_ONLY,
+            "can_delete_own_message_group",
+            members_system_group,
             acting_user=None,
         )
         check_delete_message_by_sender(
@@ -454,25 +463,8 @@ class DeleteMessageTest(ZulipTestCase):
         )
         check_delete_message_by_sender("cordelia")
 
-        do_set_realm_property(
-            realm,
-            "delete_own_message_policy",
-            CommonMessagePolicyEnum.FULL_MEMBERS_ONLY,
-            acting_user=None,
-        )
-        do_set_realm_property(realm, "waiting_period_threshold", 10, acting_user=None)
-        cordelia = self.example_user("cordelia")
-        cordelia.date_joined = timezone_now() - timedelta(days=9)
-        cordelia.save()
-        check_delete_message_by_sender(
-            "cordelia", "You don't have permission to delete this message"
-        )
-        cordelia.date_joined = timezone_now() - timedelta(days=11)
-        cordelia.save()
-        check_delete_message_by_sender("cordelia")
-
-        do_set_realm_property(
-            realm, "delete_own_message_policy", CommonMessagePolicyEnum.EVERYONE, acting_user=None
+        do_change_realm_permission_group_setting(
+            realm, "can_delete_own_message_group", everyone_system_group, acting_user=None
         )
         check_delete_message_by_sender("cordelia")
         check_delete_message_by_sender("polonius")
diff --git a/zerver/tests/test_message_move_topic.py b/zerver/tests/test_message_move_topic.py
index d334c4a0f5..3d0a41a15d 100644
--- a/zerver/tests/test_message_move_topic.py
+++ b/zerver/tests/test_message_move_topic.py
@@ -14,7 +14,7 @@ from zerver.actions.message_edit import (
     maybe_send_resolve_topic_notifications,
 )
 from zerver.actions.reactions import do_add_reaction
-from zerver.actions.realm_settings import do_set_realm_property
+from zerver.actions.realm_settings import do_change_realm_permission_group_setting
 from zerver.actions.user_topics import do_set_user_topic_visibility_policy
 from zerver.lib.message import truncate_topic
 from zerver.lib.test_classes import ZulipTestCase, get_topic_messages
@@ -27,7 +27,7 @@ from zerver.lib.user_topics import (
 from zerver.lib.utils import assert_is_not_none
 from zerver.models import Message, UserMessage, UserProfile, UserTopic
 from zerver.models.constants import MAX_TOPIC_NAME_LENGTH
-from zerver.models.realms import CommonMessagePolicyEnum
+from zerver.models.groups import NamedUserGroup, SystemGroups
 from zerver.models.streams import Stream
 
 
@@ -888,10 +888,13 @@ class MessageMoveTopicTest(ZulipTestCase):
 
             # Delete the message in target topic to make it empty.
             self.login("hamlet")
-            do_set_realm_property(
+            members_system_group = NamedUserGroup.objects.get(
+                name=SystemGroups.MEMBERS, realm=hamlet.realm, is_system_group=True
+            )
+            do_change_realm_permission_group_setting(
                 hamlet.realm,
-                "delete_own_message_policy",
-                CommonMessagePolicyEnum.MEMBERS_ONLY,
+                "can_delete_own_message_group",
+                members_system_group,
                 acting_user=None,
             )
             self.client_delete(f"/json/messages/{target_message_id}")
diff --git a/zerver/views/message_edit.py b/zerver/views/message_edit.py
index 7f5c3743ea..838d40ff2b 100644
--- a/zerver/views/message_edit.py
+++ b/zerver/views/message_edit.py
@@ -154,7 +154,7 @@ def validate_can_delete_message(user_profile: UserProfile, message: Message) ->
         # Users can only delete messages sent by them or by their bots.
         raise JsonableError(_("You don't have permission to delete this message"))
     if not user_profile.can_delete_own_message():
-        # Only user with roles as allowed by delete_own_message_policy can delete message.
+        # Only user with roles as allowed by can_delete_own_message_group can delete message.
         raise JsonableError(_("You don't have permission to delete this message"))
 
     deadline_seconds: int | None = user_profile.realm.message_content_delete_limit_seconds
diff --git a/zerver/views/realm.py b/zerver/views/realm.py
index e0c94b78d3..7b8a77bcd1 100644
--- a/zerver/views/realm.py
+++ b/zerver/views/realm.py
@@ -114,6 +114,7 @@ def update_realm(
     inline_url_embed_preview: Json[bool] | None = None,
     add_custom_emoji_policy: Json[CommonPolicyEnum] | None = None,
     can_delete_any_message_group: Json[GroupSettingChangeRequest] | None = None,
+    can_delete_own_message_group: Json[GroupSettingChangeRequest] | None = None,
     delete_own_message_policy: Json[CommonMessagePolicyEnum] | None = None,
     message_content_delete_limit_seconds_raw: Annotated[
         Json[int | str] | None,