[MM-62798][MM-63193] Restrict channel permissions on archived channels when viewing archived channels is disabled (#30314)

* [MM-62798][MM-63193] Restrict channel permissions on archived channels when viewing archived channels is disabled

* PR feedback

* PR feedback

server/channels/app/authorization.go

@@ -82,6 +82,19 @@ func (a *App) SessionHasPermissionToChannel(c request.CTX, session model.Session
 		return false
 	}
 
+	channel, appErr := a.GetChannel(c, channelID)
+	if appErr != nil && appErr.StatusCode == http.StatusNotFound {
+		return false
+	}
+
+	if session.IsUnrestricted() || a.RolesGrantPermission(session.GetUserRoles(), model.PermissionManageSystem.Id) {
+		return true
+	}
+
+	if a.isChannelArchivedAndHidden(channel) {
+		return false
+	}
+
 	ids, err := a.Srv().Store().Channel().GetAllChannelMembersForUser(c, session.UserId, true, true)
 	var channelRoles []string
 	if err == nil {
@@ -93,15 +106,6 @@ func (a *App) SessionHasPermissionToChannel(c request.CTX, session model.Session
 		}
 	}
 
-	channel, appErr := a.GetChannel(c, channelID)
-	if appErr != nil && appErr.StatusCode == http.StatusNotFound {
-		return false
-	}
-
-	if session.IsUnrestricted() {
-		return true
-	}
-
 	if appErr == nil && channel.TeamId != "" {
 		return a.SessionHasPermissionToTeam(session, channel.TeamId, permission)
 	}
@@ -115,22 +119,32 @@ func (a *App) SessionHasPermissionToChannels(c request.CTX, session model.Sessio
 		return true
 	}
 
+	if session.IsUnrestricted() || a.RolesGrantPermission(session.GetUserRoles(), model.PermissionManageSystem.Id) {
+		return true
+	}
+
 	for _, channelID := range channelIDs {
 		if channelID == "" {
 			return false
 		}
+
+		// make sure all channels exist, otherwise return false.
+		for _, channelID := range channelIDs {
+			channel, appErr := a.GetChannel(c, channelID)
+			if appErr != nil {
+				return false
+			}
+
+			// if any channel is archived and the user doesn't have permission to view archived channels, return false
+			if a.isChannelArchivedAndHidden(channel) {
+				return false
+			}
+		}
 	}
 
 	// if System Roles (i.e. Admin, TeamAdmin) allow permissions
 	// if so, no reason to check team
 	if a.SessionHasPermissionTo(session, permission) {
-		// make sure all channels exist, otherwise return false.
-		for _, channelID := range channelIDs {
-			_, appErr := a.GetChannel(c, channelID)
-			if appErr != nil && appErr.StatusCode == http.StatusNotFound {
-				return false
-			}
-		}
 		return true
 	}
 
@@ -148,6 +162,7 @@ func (a *App) SessionHasPermissionToChannels(c request.CTX, session model.Sessio
 		}
 		return false
 	}
+
 	return true
 }
 
@@ -389,7 +404,7 @@ func (a *App) SessionHasPermissionToReadChannel(c request.CTX, session model.Ses
 }
 
 func (a *App) HasPermissionToReadChannel(c request.CTX, userID string, channel *model.Channel) bool {
-	if !*a.Config().TeamSettings.ExperimentalViewArchivedChannels && channel.DeleteAt != 0 {
+	if a.isChannelArchivedAndHidden(channel) {
 		return false
 	}
 	if a.HasPermissionToChannel(c, userID, channel.Id, model.PermissionReadChannelContent) {
@@ -404,7 +419,7 @@ func (a *App) HasPermissionToReadChannel(c request.CTX, userID string, channel *
 }
 
 func (a *App) HasPermissionToChannelMemberCount(c request.CTX, userID string, channel *model.Channel) bool {
-	if !*a.Config().TeamSettings.ExperimentalViewArchivedChannels && channel.DeleteAt != 0 {
+	if a.isChannelArchivedAndHidden(channel) {
 		return false
 	}
 	if a.HasPermissionToChannel(c, userID, channel.Id, model.PermissionReadChannelContent) {
@@ -417,3 +432,7 @@ func (a *App) HasPermissionToChannelMemberCount(c request.CTX, userID string, ch
 
 	return false
 }
+
+func (a *App) isChannelArchivedAndHidden(channel *model.Channel) bool {
+	return !*a.Config().TeamSettings.ExperimentalViewArchivedChannels && channel.DeleteAt != 0
+}