Avoid using token from sanitized remote cluster (#28335)

After creating a remote cluster, we were using its token field to
generate the remote invite. As we're going to return that remote
cluster in the response, we sanitize the entity, emptying the token
field before generating the invite, and causing it not to contain the
token itself.

This changes store the token in an independent variable to avoid
mutating it as part of the sanitization.

Co-authored-by: Mattermost Build <build@mattermost.com>

server/channels/api4/remote_cluster.go

@@ -378,12 +378,13 @@ func createRemoteCluster(c *Context, w http.ResponseWriter, r *http.Request) {
 		rcWithTeamAndPassword.DisplayName = rcWithTeamAndPassword.Name
 	}
 
+	token := model.NewId()
 	rc := &model.RemoteCluster{
 		Name:          rcWithTeamAndPassword.Name,
 		DisplayName:   rcWithTeamAndPassword.DisplayName,
 		SiteURL:       model.SiteURLPending + model.NewId(),
 		DefaultTeamId: rcWithTeamAndPassword.DefaultTeamId,
-		Token:         model.NewId(),
+		Token:         token,
 		CreatorId:     c.AppContext.Session().UserId,
 	}
 
@@ -401,7 +402,7 @@ func createRemoteCluster(c *Context, w http.ResponseWriter, r *http.Request) {
 		password = utils.SecureRandString(16)
 	}
 
-	inviteCode, iErr := c.App.CreateRemoteClusterInvite(rcSaved.RemoteId, url, rcSaved.Token, password)
+	inviteCode, iErr := c.App.CreateRemoteClusterInvite(rcSaved.RemoteId, url, token, password)
 	if iErr != nil {
 		c.Err = iErr
 		return

server/channels/api4/remote_cluster_test.go

@@ -249,7 +249,7 @@ func TestCreateRemoteCluster(t *testing.T) {
 		rci, appErr := th.App.DecryptRemoteClusterInvite(rcWithInvite.Invite, rcWithInvite.Password)
 		require.Nil(t, appErr)
 		require.Equal(t, rc.RemoteId, rci.RemoteId)
-		require.Equal(t, rc.RemoteToken, rci.Token)
+		require.Equal(t, rc.Token, rci.Token)
 		require.Equal(t, th.App.GetSiteURL(), rci.SiteURL)
 	})
 
@@ -273,7 +273,7 @@ func TestCreateRemoteCluster(t *testing.T) {
 		rci, appErr := th.App.DecryptRemoteClusterInvite(rcWithInvite.Invite, rcWithTeamAndPassword.Password)
 		require.Nil(t, appErr)
 		require.Equal(t, rc.RemoteId, rci.RemoteId)
-		require.Equal(t, rc.RemoteToken, rci.Token)
+		require.Equal(t, rc.Token, rci.Token)
 		require.Equal(t, th.App.GetSiteURL(), rci.SiteURL)
 	})
 }