[MM-27274] Add permission to convert public channel to private (#15370)

* Add permission to convert public channel to private

* Rename to PERMISSION_CONVERT_PUBLIC_CHANNEL_TO_PRIVATE

* Fix tests

* Update definitions for roles that have manage_team

* Fix tests

* Add convert private channel to public permission

* Add to channel scoped perms

* Update permission checks on channel privacy endpoint

* Trigger CI

api4/channel_test.go

@@ -1686,6 +1686,13 @@ func TestConvertChannelToPrivate(t *testing.T) {
 	CheckForbiddenStatus(t, resp)
 
 	th.LoginTeamAdmin()
+	th.RemovePermissionFromRole(model.PERMISSION_CONVERT_PUBLIC_CHANNEL_TO_PRIVATE.Id, model.TEAM_ADMIN_ROLE_ID)
+
+	_, resp = Client.ConvertChannelToPrivate(publicChannel.Id)
+	CheckForbiddenStatus(t, resp)
+
+	th.AddPermissionToRole(model.PERMISSION_CONVERT_PUBLIC_CHANNEL_TO_PRIVATE.Id, model.TEAM_ADMIN_ROLE_ID)
+
 	rchannel, resp := Client.ConvertChannelToPrivate(publicChannel.Id)
 	CheckOKStatus(t, resp)
 	require.Equal(t, model.CHANNEL_PRIVATE, rchannel.Type, "channel should be converted from public to private")
@@ -1790,6 +1797,25 @@ func TestUpdateChannelPrivacy(t *testing.T) {
 			assert.Equal(t, tc.expectedPrivacy, updatedChannel.Type)
 		})
 	}
+
+	t.Run("Enforces convert channel permissions", func(t *testing.T) {
+		th.RemovePermissionFromRole(model.PERMISSION_CONVERT_PUBLIC_CHANNEL_TO_PRIVATE.Id, model.TEAM_ADMIN_ROLE_ID)
+		th.RemovePermissionFromRole(model.PERMISSION_CONVERT_PRIVATE_CHANNEL_TO_PUBLIC.Id, model.TEAM_ADMIN_ROLE_ID)
+
+		_, resp := Client.UpdateChannelPrivacy(publicChannel.Id, model.CHANNEL_PRIVATE)
+		CheckForbiddenStatus(t, resp)
+		_, resp = Client.UpdateChannelPrivacy(privateChannel.Id, model.CHANNEL_OPEN)
+		CheckForbiddenStatus(t, resp)
+
+		th.AddPermissionToRole(model.PERMISSION_CONVERT_PUBLIC_CHANNEL_TO_PRIVATE.Id, model.TEAM_ADMIN_ROLE_ID)
+		th.AddPermissionToRole(model.PERMISSION_CONVERT_PRIVATE_CHANNEL_TO_PUBLIC.Id, model.TEAM_ADMIN_ROLE_ID)
+
+		_, resp = Client.UpdateChannelPrivacy(privateChannel.Id, model.CHANNEL_OPEN)
+		CheckNoError(t, resp)
+		_, resp = Client.UpdateChannelPrivacy(publicChannel.Id, model.CHANNEL_PRIVATE)
+		CheckNoError(t, resp)
+	})
+
 }
 
 func TestRestoreChannel(t *testing.T) {