diff --git a/server/channels/store/sqlstore/channel_store.go b/server/channels/store/sqlstore/channel_store.go index fcd80e1529..f2fd2fd3bb 100644 --- a/server/channels/store/sqlstore/channel_store.go +++ b/server/channels/store/sqlstore/channel_store.go @@ -3176,11 +3176,12 @@ func (s SqlChannelStore) Autocomplete(rctx request.CTX, userID, term string, inc OrderBy("c.DisplayName"). Limit(model.ChannelSearchDefaultLimit) + // Always filter out soft-deleted team memberships - users removed from + // a team should not see channels from that team regardless of includeDeleted + query = query.Where(sq.Eq{"tm.DeleteAt": 0}) + if !includeDeleted { - query = query.Where(sq.And{ - sq.Eq{"c.DeleteAt": 0}, - sq.Eq{"tm.DeleteAt": 0}, - }) + query = query.Where(sq.Eq{"c.DeleteAt": 0}) } if isGuest { diff --git a/server/channels/store/storetest/channel_store.go b/server/channels/store/storetest/channel_store.go index 1acfb1aae2..d55acfb058 100644 --- a/server/channels/store/storetest/channel_store.go +++ b/server/channels/store/storetest/channel_store.go @@ -6464,6 +6464,24 @@ func testAutocomplete(t *testing.T, rctx request.CTX, ss store.Store, s SqlStore }) } + // MM-67049: Verify that users removed from a team cannot see channels from that + // team, regardless of includeDeleted. The includeDeleted parameter should only + // affect channel deletion status, not team membership. + t.Run("MM-67049: removed team member cannot see channels regardless of includeDeleted", func(t *testing.T) { + // Sanity check: o5 is in leftTeamID and matches search term + require.Equal(t, leftTeamID, o5.TeamId) + require.Contains(t, o5.DisplayName, "ChannelA") + + // m1.UserId was removed from leftTeamID (tm5.DeleteAt was set above in the test setup) + for _, includeDeleted := range []bool{false, true} { + channels, err2 := ss.Channel().Autocomplete(rctx, m1.UserId, "ChannelA", includeDeleted, false) + require.NoError(t, err2) + for _, ch := range channels { + require.NotEqual(t, o5.Id, ch.Id, "includeDeleted=%v: channel from left team should not be returned", includeDeleted) + } + } + }) + t.Run("Limit", func(t *testing.T) { for i := 0; i < model.ChannelSearchDefaultLimit+10; i++ { _, err = ss.Channel().Save(rctx, &model.Channel{