[MM-47538] Pass handler functions directly while creating API endpoints (#21441)

* Pass handler functions directly without permission check middlewares

* Create necessary handlers in api4/group_local.go

* Refactor GetGroupsByTeam, GetGroupsByChannel to a common function for local and API

api4/group.go

@@ -18,82 +18,88 @@ import (
 
 func (api *API) InitGroup() {
 	// GET /api/v4/groups
-	api.BaseRoutes.Groups.Handle("", api.APISessionRequired(requireLicense(getGroups))).Methods("GET")
+	api.BaseRoutes.Groups.Handle("", api.APISessionRequired(getGroups)).Methods("GET")
 
 	// POST /api/v4/groups
-	api.BaseRoutes.Groups.Handle("", api.APISessionRequired(requireLicense(createGroup))).Methods("POST")
+	api.BaseRoutes.Groups.Handle("", api.APISessionRequired(createGroup)).Methods("POST")
 
 	// GET /api/v4/groups/:group_id
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}",
-		api.APISessionRequired(requireLicense(getGroup))).Methods("GET")
+		api.APISessionRequired(getGroup)).Methods("GET")
 
 	// PUT /api/v4/groups/:group_id/patch
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/patch",
-		api.APISessionRequired(requireLicense(patchGroup))).Methods("PUT")
+		api.APISessionRequired(patchGroup)).Methods("PUT")
 
 	// POST /api/v4/groups/:group_id/teams/:team_id/link
 	// POST /api/v4/groups/:group_id/channels/:channel_id/link
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/{syncable_type:teams|channels}/{syncable_id:[A-Za-z0-9]+}/link",
-		api.APISessionRequired(requireLicense(linkGroupSyncable))).Methods("POST")
+		api.APISessionRequired(linkGroupSyncable)).Methods("POST")
 
 	// DELETE /api/v4/groups/:group_id/teams/:team_id/link
 	// DELETE /api/v4/groups/:group_id/channels/:channel_id/link
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/{syncable_type:teams|channels}/{syncable_id:[A-Za-z0-9]+}/link",
-		api.APISessionRequired(requireLicense(unlinkGroupSyncable))).Methods("DELETE")
+		api.APISessionRequired(unlinkGroupSyncable)).Methods("DELETE")
 
 	// GET /api/v4/groups/:group_id/teams/:team_id
 	// GET /api/v4/groups/:group_id/channels/:channel_id
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/{syncable_type:teams|channels}/{syncable_id:[A-Za-z0-9]+}",
-		api.APISessionRequired(requireLicense(getGroupSyncable))).Methods("GET")
+		api.APISessionRequired(getGroupSyncable)).Methods("GET")
 
 	// GET /api/v4/groups/:group_id/teams
 	// GET /api/v4/groups/:group_id/channels
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/{syncable_type:teams|channels}",
-		api.APISessionRequired(requireLicense(getGroupSyncables))).Methods("GET")
+		api.APISessionRequired(getGroupSyncables)).Methods("GET")
 
 	// PUT /api/v4/groups/:group_id/teams/:team_id/patch
 	// PUT /api/v4/groups/:group_id/channels/:channel_id/patch
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/{syncable_type:teams|channels}/{syncable_id:[A-Za-z0-9]+}/patch",
-		api.APISessionRequired(requireLicense(patchGroupSyncable))).Methods("PUT")
+		api.APISessionRequired(patchGroupSyncable)).Methods("PUT")
 
 	// GET /api/v4/groups/:group_id/stats
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/stats",
-		api.APISessionRequired(requireLicense(getGroupStats))).Methods("GET")
+		api.APISessionRequired(getGroupStats)).Methods("GET")
 
 	// GET /api/v4/groups/:group_id/members
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/members",
-		api.APISessionRequired(requireLicense(getGroupMembers))).Methods("GET")
+		api.APISessionRequired(getGroupMembers)).Methods("GET")
 
 	// GET /api/v4/users/:user_id/groups
 	api.BaseRoutes.Users.Handle("/{user_id:[A-Za-z0-9]+}/groups",
-		api.APISessionRequired(requireLicense(getGroupsByUserId))).Methods("GET")
+		api.APISessionRequired(getGroupsByUserId)).Methods("GET")
 
 	// GET /api/v4/channels/:channel_id/groups
 	api.BaseRoutes.Channels.Handle("/{channel_id:[A-Za-z0-9]+}/groups",
-		api.APISessionRequired(requireLicense(getGroupsByChannel))).Methods("GET")
+		api.APISessionRequired(getGroupsByChannel)).Methods("GET")
 
 	// GET /api/v4/teams/:team_id/groups
 	api.BaseRoutes.Teams.Handle("/{team_id:[A-Za-z0-9]+}/groups",
-		api.APISessionRequired(requireLicense(getGroupsByTeam))).Methods("GET")
+		api.APISessionRequired(getGroupsByTeam)).Methods("GET")
 
 	// GET /api/v4/teams/:team_id/groups_by_channels
 	api.BaseRoutes.Teams.Handle("/{team_id:[A-Za-z0-9]+}/groups_by_channels",
-		api.APISessionRequired(requireLicense(getGroupsAssociatedToChannelsByTeam))).Methods("GET")
+		api.APISessionRequired(getGroupsAssociatedToChannelsByTeam)).Methods("GET")
 
 	// DELETE /api/v4/groups/:group_id
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}",
-		api.APISessionRequired(requireLicense(deleteGroup))).Methods("DELETE")
+		api.APISessionRequired(deleteGroup)).Methods("DELETE")
 
 	// POST /api/v4/groups/:group_id/members
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/members",
-		api.APISessionRequired(requireLicense(addGroupMembers))).Methods("POST")
+		api.APISessionRequired(addGroupMembers)).Methods("POST")
 
 	// DELETE /api/v4/groups/:group_id/members
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/members",
-		api.APISessionRequired(requireLicense(deleteGroupMembers))).Methods("DELETE")
+		api.APISessionRequired(deleteGroupMembers)).Methods("DELETE")
 }
 
 func getGroup(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+
 	c.RequireGroupId()
 	if c.Err != nil {
 		return
@@ -130,6 +136,11 @@ func getGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func createGroup(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
 	var group *model.GroupWithUserIds
 	if err := json.NewDecoder(r.Body).Decode(&group); err != nil {
 		c.SetInvalidParamWithErr("group", err)
@@ -185,6 +196,11 @@ func createGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func patchGroup(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
 	c.RequireGroupId()
 	if c.Err != nil {
 		return
@@ -277,6 +293,11 @@ func patchGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func linkGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
 	c.RequireGroupId()
 	if c.Err != nil {
 		return
@@ -368,6 +389,11 @@ func linkGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func getGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
 	c.RequireGroupId()
 	if c.Err != nil {
 		return
@@ -411,6 +437,11 @@ func getGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func getGroupSyncables(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
 	c.RequireGroupId()
 	if c.Err != nil {
 		return
@@ -448,6 +479,11 @@ func getGroupSyncables(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func patchGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
 	c.RequireGroupId()
 	if c.Err != nil {
 		return
@@ -529,6 +565,11 @@ func patchGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func unlinkGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
 	c.RequireGroupId()
 	if c.Err != nil {
 		return
@@ -606,6 +647,11 @@ func verifyLinkUnlinkPermission(c *Context, syncableType model.GroupSyncableType
 }
 
 func getGroupMembers(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
 	c.RequireGroupId()
 	if c.Err != nil {
 		return
@@ -651,6 +697,11 @@ func getGroupMembers(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func getGroupStats(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
 	c.RequireGroupId()
 	if c.Err != nil {
 		return
@@ -686,6 +737,11 @@ func getGroupStats(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func getGroupsByUserId(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
 	c.RequireUserId()
 	if c.Err != nil {
 		return
@@ -717,72 +773,46 @@ func getGroupsByUserId(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func getGroupsByChannel(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
 	c.RequireChannelId()
 	if c.Err != nil {
 		return
 	}
-
+	b, appErr := getGroupsByChannelCommon(c, r)
-	if c.App.Channels().License() == nil || !*c.App.Channels().License().Features.LDAPGroups {
-		c.Err = model.NewAppError("Api4.getGroupsByChannel", "api.ldap_groups.license_error", nil, "", http.StatusForbidden)
-		return
-	}
-
-	channel, appErr := c.App.GetChannel(c.AppContext, c.Params.ChannelId)
 	if appErr != nil {
 		c.Err = appErr
 		return
 	}
-
-	var permission *model.Permission
-	if channel.Type == model.ChannelTypePrivate {
-		permission = model.PermissionReadPrivateChannelGroups
-	} else {
-		permission = model.PermissionReadPublicChannelGroups
-	}
-	if !c.App.SessionHasPermissionToChannel(c.AppContext, *c.AppContext.Session(), c.Params.ChannelId, permission) {
-		c.SetPermissionError(permission)
-		return
-	}
-
-	opts := model.GroupSearchOpts{
-		Q:                    c.Params.Q,
-		IncludeMemberCount:   c.Params.IncludeMemberCount,
-		FilterAllowReference: c.Params.FilterAllowReference,
-	}
-	if c.Params.Paginate == nil || *c.Params.Paginate {
-		opts.PageOpts = &model.PageOpts{Page: c.Params.Page, PerPage: c.Params.PerPage}
-	}
-
-	groups, totalCount, appErr := c.App.GetGroupsByChannel(c.Params.ChannelId, opts)
-	if appErr != nil {
-		c.Err = appErr
-		return
-	}
-
-	b, err := json.Marshal(struct {
-		Groups []*model.GroupWithSchemeAdmin `json:"groups"`
-		Count  int                           `json:"total_group_count"`
-	}{
-		Groups: groups,
-		Count:  totalCount,
-	})
-	if err != nil {
-		c.Err = model.NewAppError("Api4.getGroupsByChannel", "api.marshal_error", nil, "", http.StatusInternalServerError).Wrap(err)
-		return
-	}
-
 	w.Write(b)
 }
 
 func getGroupsByTeam(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
 	c.RequireTeamId()
 	if c.Err != nil {
 		return
 	}
-	if c.App.Channels().License() == nil || !*c.App.Channels().License().Features.LDAPGroups {
+
-		c.Err = model.NewAppError("Api4.getGroupsByTeam", "api.ldap_groups.license_error", nil, "", http.StatusForbidden)
+	b, appError := getGroupsByTeamCommon(c, r)
+	if appError != nil {
+		c.Err = appError
 		return
 	}
+	w.Write(b)
+}
+
+func getGroupsByTeamCommon(c *Context, r *http.Request) ([]byte, *model.AppError) {
+	if c.App.Channels().License() == nil || !*c.App.Channels().License().Features.LDAPGroups {
+		return nil, model.NewAppError("Api4.getGroupsByTeam", "api.ldap_groups.license_error", nil, "", http.StatusForbidden)
+	}
 
 	opts := model.GroupSearchOpts{
 		Q:                    c.Params.Q,
@@ -795,8 +825,7 @@ func getGroupsByTeam(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	groups, totalCount, appErr := c.App.GetGroupsByTeam(c.Params.TeamId, opts)
 	if appErr != nil {
-		c.Err = appErr
+		return nil, appErr
-		return
 	}
 
 	b, err := json.Marshal(struct {
@@ -808,14 +837,64 @@ func getGroupsByTeam(c *Context, w http.ResponseWriter, r *http.Request) {
 	})
 
 	if err != nil {
-		c.Err = model.NewAppError("Api4.getGroupsByTeam", "api.marshal_error", nil, "", http.StatusInternalServerError).Wrap(err)
+		return nil, model.NewAppError("Api4.getGroupsByTeam", "api.marshal_error", nil, "", http.StatusInternalServerError).Wrap(err)
-		return
 	}
 
-	w.Write(b)
+	return b, nil
+}
+func getGroupsByChannelCommon(c *Context, r *http.Request) ([]byte, *model.AppError) {
+	if c.App.Channels().License() == nil || !*c.App.Channels().License().Features.LDAPGroups {
+		return nil, model.NewAppError("Api4.getGroupsByChannel", "api.ldap_groups.license_error", nil, "", http.StatusForbidden)
+	}
+
+	channel, appErr := c.App.GetChannel(c.AppContext, c.Params.ChannelId)
+	if appErr != nil {
+		return nil, appErr
+	}
+
+	var permission *model.Permission
+	if channel.Type == model.ChannelTypePrivate {
+		permission = model.PermissionReadPrivateChannelGroups
+	} else {
+		permission = model.PermissionReadPublicChannelGroups
+	}
+	if !c.App.SessionHasPermissionToChannel(c.AppContext, *c.AppContext.Session(), c.Params.ChannelId, permission) {
+		return nil, c.App.MakePermissionError(c.AppContext.Session(), []*model.Permission{permission})
+	}
+
+	opts := model.GroupSearchOpts{
+		Q:                    c.Params.Q,
+		IncludeMemberCount:   c.Params.IncludeMemberCount,
+		FilterAllowReference: c.Params.FilterAllowReference,
+	}
+	if c.Params.Paginate == nil || *c.Params.Paginate {
+		opts.PageOpts = &model.PageOpts{Page: c.Params.Page, PerPage: c.Params.PerPage}
+	}
+
+	groups, totalCount, appErr := c.App.GetGroupsByChannel(c.Params.ChannelId, opts)
+	if appErr != nil {
+		return nil, appErr
+	}
+
+	b, err := json.Marshal(struct {
+		Groups []*model.GroupWithSchemeAdmin `json:"groups"`
+		Count  int                           `json:"total_group_count"`
+	}{
+		Groups: groups,
+		Count:  totalCount,
+	})
+	if err != nil {
+		return nil, model.NewAppError("Api4.getGroupsByChannel", "api.marshal_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+	return b, nil
 }
 
 func getGroupsAssociatedToChannelsByTeam(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
 	c.RequireTeamId()
 	if c.Err != nil {
 		return
@@ -855,6 +934,11 @@ func getGroupsAssociatedToChannelsByTeam(c *Context, w http.ResponseWriter, r *h
 }
 
 func getGroups(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
 	var teamID, channelID string
 
 	source := c.Params.GroupSource
@@ -961,6 +1045,11 @@ func getGroups(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func deleteGroup(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
 	c.RequireGroupId()
 	if c.Err != nil {
 		return
@@ -1004,6 +1093,11 @@ func deleteGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func addGroupMembers(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
 	c.RequireGroupId()
 	if c.Err != nil {
 		return
@@ -1058,6 +1152,11 @@ func addGroupMembers(c *Context, w http.ResponseWriter, r *http.Request) {
 }
 
 func deleteGroupMembers(c *Context, w http.ResponseWriter, r *http.Request) {
+	permissionErr := requireLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
 	c.RequireGroupId()
 	if c.Err != nil {
 		return

api4/group_local.go

@@ -3,7 +3,39 @@
 
 package api4
 
+import (
+	"net/http"
+)
+
 func (api *API) InitGroupLocal() {
-	api.BaseRoutes.Channels.Handle("/{channel_id:[A-Za-z0-9]+}/groups", api.APILocal(getGroupsByChannel)).Methods("GET")
+	api.BaseRoutes.Channels.Handle("/{channel_id:[A-Za-z0-9]+}/groups", api.APILocal(getGroupsByChannelLocal)).Methods("GET")
-	api.BaseRoutes.Teams.Handle("/{team_id:[A-Za-z0-9]+}/groups", api.APILocal(getGroupsByTeam)).Methods("GET")
+	api.BaseRoutes.Teams.Handle("/{team_id:[A-Za-z0-9]+}/groups", api.APILocal(getGroupsByTeamLocal)).Methods("GET")
+}
+
+func getGroupsByChannelLocal(c *Context, w http.ResponseWriter, r *http.Request) {
+	c.RequireChannelId()
+	if c.Err != nil {
+		return
+	}
+	b, appErr := getGroupsByChannelCommon(c, r)
+	if appErr != nil {
+		c.Err = appErr
+		return
+	}
+
+	w.Write(b)
+}
+
+func getGroupsByTeamLocal(c *Context, w http.ResponseWriter, r *http.Request) {
+	c.RequireTeamId()
+	if c.Err != nil {
+		return
+	}
+	b, appError := getGroupsByTeamCommon(c, r)
+	if appError != nil {
+		c.Err = appError
+		return
+	}
+
+	w.Write(b)
 }

api4/handlers.go

@@ -200,33 +200,27 @@ func (api *API) APILocal(h handlerFunc) http.Handler {
 	return handler
 }
 
-func requireLicense(f handlerFunc) handlerFunc {
+func requireLicense(c *Context) *model.AppError {
-	return func(c *Context, w http.ResponseWriter, r *http.Request) {
+	if c.App.Channels().License() == nil {
-		if c.App.Channels().License() == nil {
+		err := model.NewAppError("", "api.license_error", nil, "", http.StatusNotImplemented)
-			c.Err = model.NewAppError("", "api.license_error", nil, "", http.StatusNotImplemented)
+		return err
-			return
-		}
-		f(c, w, r)
 	}
+	return nil
 }
 
-func minimumProfessionalLicense(f handlerFunc) handlerFunc {
+func minimumProfessionalLicense(c *Context) *model.AppError {
-	return func(c *Context, w http.ResponseWriter, r *http.Request) {
+	lic := c.App.Srv().License()
-		lic := c.App.Srv().License()
+	if lic == nil || (lic.SkuShortName != model.LicenseShortSkuProfessional && lic.SkuShortName != model.LicenseShortSkuEnterprise) {
-		if lic == nil || (lic.SkuShortName != model.LicenseShortSkuProfessional && lic.SkuShortName != model.LicenseShortSkuEnterprise) {
+		err := model.NewAppError("", model.NoTranslation, nil, "license is neither professional nor enterprise", http.StatusNotImplemented)
-			c.Err = model.NewAppError("", model.NoTranslation, nil, "license is neither professional nor enterprise", http.StatusNotImplemented)
+		return err
-			return
-		}
-		f(c, w, r)
 	}
+	return nil
 }
 
-func rejectGuests(f handlerFunc) handlerFunc {
+func rejectGuests(c *Context) *model.AppError {
-	return func(c *Context, w http.ResponseWriter, r *http.Request) {
+	if c.AppContext.Session().Props[model.SessionPropIsGuest] == "true" {
-		if c.AppContext.Session().Props[model.SessionPropIsGuest] == "true" {
+		err := model.NewAppError("", model.NoTranslation, nil, "insufficient permissions as a guest user", http.StatusNotImplemented)
-			c.Err = model.NewAppError("", model.NoTranslation, nil, "insufficient permissions as a guest user", http.StatusNotImplemented)
+		return err
-			return
-		}
-		f(c, w, r)
 	}
+	return nil
 }

api4/insights.go

@@ -13,31 +13,44 @@ import (
 
 func (api *API) InitInsights() {
 	// Reactions
-	api.BaseRoutes.InsightsForTeam.Handle("/reactions", api.APISessionRequired(minimumProfessionalLicense(rejectGuests(getTopReactionsForTeamSince)))).Methods("GET")
+	api.BaseRoutes.InsightsForTeam.Handle("/reactions", api.APISessionRequired(getTopReactionsForTeamSince)).Methods("GET")
-	api.BaseRoutes.InsightsForUser.Handle("/reactions", api.APISessionRequired(minimumProfessionalLicense(rejectGuests(getTopReactionsForUserSince)))).Methods("GET")
+	api.BaseRoutes.InsightsForUser.Handle("/reactions", api.APISessionRequired(getTopReactionsForUserSince)).Methods("GET")
 
 	// Channels
-	api.BaseRoutes.InsightsForTeam.Handle("/channels", api.APISessionRequired(minimumProfessionalLicense(rejectGuests(getTopChannelsForTeamSince)))).Methods("GET")
+	api.BaseRoutes.InsightsForTeam.Handle("/channels", api.APISessionRequired(getTopChannelsForTeamSince)).Methods("GET")
-	api.BaseRoutes.InsightsForUser.Handle("/channels", api.APISessionRequired(minimumProfessionalLicense(rejectGuests(getTopChannelsForUserSince)))).Methods("GET")
+	api.BaseRoutes.InsightsForUser.Handle("/channels", api.APISessionRequired(getTopChannelsForUserSince)).Methods("GET")
 
 	// Threads
-	api.BaseRoutes.InsightsForTeam.Handle("/threads", api.APISessionRequired(minimumProfessionalLicense(rejectGuests(getTopThreadsForTeamSince)))).Methods("GET")
+	api.BaseRoutes.InsightsForTeam.Handle("/threads", api.APISessionRequired(getTopThreadsForTeamSince)).Methods("GET")
-	api.BaseRoutes.InsightsForUser.Handle("/threads", api.APISessionRequired(minimumProfessionalLicense(rejectGuests(getTopThreadsForUserSince)))).Methods("GET")
+	api.BaseRoutes.InsightsForUser.Handle("/threads", api.APISessionRequired(getTopThreadsForUserSince)).Methods("GET")
 
 	// user DMs
-	api.BaseRoutes.InsightsForUser.Handle("/dms", api.APISessionRequired(minimumProfessionalLicense(rejectGuests(getTopDMsForUserSince)))).Methods("GET")
+	api.BaseRoutes.InsightsForUser.Handle("/dms", api.APISessionRequired(getTopDMsForUserSince)).Methods("GET")
 
 	// Inactive channels
-	api.BaseRoutes.InsightsForTeam.Handle("/inactive_channels", api.APISessionRequired(minimumProfessionalLicense(rejectGuests(getTopInactiveChannelsForTeamSince)))).Methods("GET")
+	api.BaseRoutes.InsightsForTeam.Handle("/inactive_channels", api.APISessionRequired(getTopInactiveChannelsForTeamSince)).Methods("GET")
-	api.BaseRoutes.InsightsForUser.Handle("/inactive_channels", api.APISessionRequired(minimumProfessionalLicense(rejectGuests(getTopInactiveChannelsForUserSince)))).Methods("GET")
+	api.BaseRoutes.InsightsForUser.Handle("/inactive_channels", api.APISessionRequired(getTopInactiveChannelsForUserSince)).Methods("GET")
 
 	// New teammembers
-	api.BaseRoutes.InsightsForTeam.Handle("/team_members", api.APISessionRequired(minimumProfessionalLicense(rejectGuests(getNewTeamMembersSince)))).Methods("GET")
+	api.BaseRoutes.InsightsForTeam.Handle("/team_members", api.APISessionRequired(getNewTeamMembersSince)).Methods("GET")
 }
 
 // Top Reactions
 
 func getTopReactionsForTeamSince(c *Context, w http.ResponseWriter, r *http.Request) {
+
+	// license and guest user check
+	permissionErr := minimumProfessionalLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+	permissionErr = rejectGuests(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+
 	c.RequireTeamId()
 	if c.Err != nil {
 		return
@@ -82,6 +95,18 @@ func getTopReactionsForTeamSince(c *Context, w http.ResponseWriter, r *http.Requ
 }
 
 func getTopReactionsForUserSince(c *Context, w http.ResponseWriter, r *http.Request) {
+	// license and guest user check
+	permissionErr := minimumProfessionalLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+	permissionErr = rejectGuests(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+
 	c.Params.TeamId = r.URL.Query().Get("team_id")
 
 	// TeamId is an optional parameter
@@ -133,6 +158,18 @@ func getTopReactionsForUserSince(c *Context, w http.ResponseWriter, r *http.Requ
 // Top Channels
 
 func getTopChannelsForTeamSince(c *Context, w http.ResponseWriter, r *http.Request) {
+	// license and guest user check
+	permissionErr := minimumProfessionalLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+	permissionErr = rejectGuests(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+
 	c.RequireTeamId()
 	if c.Err != nil {
 		return
@@ -184,6 +221,18 @@ func getTopChannelsForTeamSince(c *Context, w http.ResponseWriter, r *http.Reque
 }
 
 func getTopChannelsForUserSince(c *Context, w http.ResponseWriter, r *http.Request) {
+	// license and guest user check
+	permissionErr := minimumProfessionalLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+	permissionErr = rejectGuests(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+
 	c.Params.TeamId = r.URL.Query().Get("team_id")
 
 	// TeamId is an optional parameter
@@ -241,6 +290,18 @@ func getTopChannelsForUserSince(c *Context, w http.ResponseWriter, r *http.Reque
 
 // Top Threads
 func getTopThreadsForTeamSince(c *Context, w http.ResponseWriter, r *http.Request) {
+	// license and guest user check
+	permissionErr := minimumProfessionalLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+	permissionErr = rejectGuests(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+
 	c.RequireTeamId()
 	if c.Err != nil {
 		return
@@ -286,6 +347,18 @@ func getTopThreadsForTeamSince(c *Context, w http.ResponseWriter, r *http.Reques
 }
 
 func getTopThreadsForUserSince(c *Context, w http.ResponseWriter, r *http.Request) {
+	// license and guest user check
+	permissionErr := minimumProfessionalLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+	permissionErr = rejectGuests(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+
 	c.Params.TeamId = r.URL.Query().Get("team_id")
 
 	// restrict users with no access to team
@@ -336,6 +409,18 @@ func getTopThreadsForUserSince(c *Context, w http.ResponseWriter, r *http.Reques
 
 // Top DMs
 func getTopDMsForUserSince(c *Context, w http.ResponseWriter, r *http.Request) {
+	// license and guest user check
+	permissionErr := minimumProfessionalLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+	permissionErr = rejectGuests(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+
 	user, err := c.App.GetUser(c.AppContext.Session().UserId)
 	if err != nil {
 		c.Err = err
@@ -367,6 +452,18 @@ func getTopDMsForUserSince(c *Context, w http.ResponseWriter, r *http.Request) {
 // Top Channels
 
 func getTopInactiveChannelsForTeamSince(c *Context, w http.ResponseWriter, r *http.Request) {
+	// license and guest user check
+	permissionErr := minimumProfessionalLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+	permissionErr = rejectGuests(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+
 	c.RequireTeamId()
 	if c.Err != nil {
 		return
@@ -411,6 +508,18 @@ func getTopInactiveChannelsForTeamSince(c *Context, w http.ResponseWriter, r *ht
 // top inactive channels
 
 func getTopInactiveChannelsForUserSince(c *Context, w http.ResponseWriter, r *http.Request) {
+	// license and guest user check
+	permissionErr := minimumProfessionalLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+	permissionErr = rejectGuests(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+
 	c.Params.TeamId = r.URL.Query().Get("team_id")
 
 	// TeamId is an optional parameter
@@ -479,6 +588,18 @@ func postCountByDurationViewModel(c *Context, topChannelList *model.TopChannelLi
 }
 
 func getNewTeamMembersSince(c *Context, w http.ResponseWriter, r *http.Request) {
+	// license and guest user check
+	permissionErr := minimumProfessionalLicense(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+	permissionErr = rejectGuests(c)
+	if permissionErr != nil {
+		c.Err = permissionErr
+		return
+	}
+
 	c.RequireTeamId()
 	if c.Err != nil {
 		return