Take view archived config into account on users and posts api endpoints (#19014)

* Take view archived config into account on users and posts api endpoints

* Move the inChannel check to the top level

api4/user_test.go

@@ -2657,6 +2657,51 @@ func TestGetUsersInChannel(t *testing.T) {
 
 	_, _, err = th.SystemAdminClient.GetUsersInChannel(channelId, 0, 60, "")
 	require.NoError(t, err)
+
+	t.Run("Should forbid getting the members of an archived channel if users are not allowed to view archived messages", func(t *testing.T) {
+		th.LoginBasic()
+		channel, _, appErr := th.SystemAdminClient.CreateChannel(&model.Channel{
+			DisplayName: "User Created Channel",
+			Name:        model.NewId(),
+			Type:        model.ChannelTypeOpen,
+			TeamId:      th.BasicTeam.Id,
+		})
+		require.NoError(t, appErr)
+		_, aErr := th.App.AddUserToChannel(th.BasicUser, channel, false)
+		require.Nil(t, aErr)
+		_, aErr = th.App.AddUserToChannel(th.BasicUser2, channel, false)
+		require.Nil(t, aErr)
+		th.SystemAdminClient.DeleteChannel(channel.Id)
+
+		experimentalViewArchivedChannels := *th.App.Config().TeamSettings.ExperimentalViewArchivedChannels
+		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalViewArchivedChannels = true })
+		defer th.App.UpdateConfig(func(cfg *model.Config) {
+			*cfg.TeamSettings.ExperimentalViewArchivedChannels = experimentalViewArchivedChannels
+		})
+
+		// the endpoint should work fine for all clients when viewing
+		// archived channels is enabled
+		for _, client := range []*model.Client4{th.SystemAdminClient, th.Client, th.LocalClient} {
+			users, _, userErr := client.GetUsersInChannel(channel.Id, 0, 1000, "")
+			require.NoError(t, userErr)
+			require.Len(t, users, 3)
+		}
+
+		// the endpoint should return forbidden if viewing archived
+		// channels is disabled for all clients but the Local one
+		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalViewArchivedChannels = false })
+		for _, client := range []*model.Client4{th.SystemAdminClient, th.Client} {
+			users, resp, userErr := client.GetUsersInChannel(channel.Id, 0, 1000, "")
+			require.Error(t, userErr)
+			require.Len(t, users, 0)
+			CheckForbiddenStatus(t, resp)
+		}
+
+		// local client should be able to get the users still
+		users, _, appErr := th.LocalClient.GetUsersInChannel(channel.Id, 0, 1000, "")
+		require.NoError(t, appErr)
+		require.Len(t, users, 3)
+	})
 }
 
 func TestGetUsersNotInChannel(t *testing.T) {