[MM-30016] Allows to create incoming and outgoing webhooks for a different user (#16425)

* [MM-30016] Allows to create an incoming webhook for a different user

* [MM-30021] Allows to create an outgoing webhook for a different user

* Fix update test

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

api4/webhook.go

@@ -54,7 +54,23 @@ func createIncomingHook(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	incomingHook, err := c.App.CreateIncomingWebhookForChannel(c.App.Session().UserId, channel, hook)
+	userId := c.App.Session().UserId
+	if hook.UserId != "" && hook.UserId != userId {
+		if !c.App.SessionHasPermissionToTeam(*c.App.Session(), channel.TeamId, model.PERMISSION_MANAGE_OTHERS_INCOMING_WEBHOOKS) {
+			c.LogAudit("fail - innapropriate permissions")
+			c.SetPermissionError(model.PERMISSION_MANAGE_OTHERS_INCOMING_WEBHOOKS)
+			return
+		}
+
+		if _, err = c.App.GetUser(hook.UserId); err != nil {
+			c.Err = err
+			return
+		}
+
+		userId = hook.UserId
+	}
+
+	incomingHook, err := c.App.CreateIncomingWebhookForChannel(userId, channel, hook)
 	if err != nil {
 		c.Err = err
 		return
@@ -374,13 +390,27 @@ func createOutgoingHook(c *Context, w http.ResponseWriter, r *http.Request) {
 	auditRec.AddMeta("hook_id", hook.Id)
 	c.LogAudit("attempt")
 
-	hook.CreatorId = c.App.Session().UserId
-
 	if !c.App.SessionHasPermissionToTeam(*c.App.Session(), hook.TeamId, model.PERMISSION_MANAGE_OUTGOING_WEBHOOKS) {
 		c.SetPermissionError(model.PERMISSION_MANAGE_OUTGOING_WEBHOOKS)
 		return
 	}
 
+	if hook.CreatorId == "" {
+		hook.CreatorId = c.App.Session().UserId
+	} else {
+		if !c.App.SessionHasPermissionToTeam(*c.App.Session(), hook.TeamId, model.PERMISSION_MANAGE_OTHERS_OUTGOING_WEBHOOKS) {
+			c.LogAudit("fail - innapropriate permissions")
+			c.SetPermissionError(model.PERMISSION_MANAGE_OTHERS_OUTGOING_WEBHOOKS)
+			return
+		}
+
+		_, err := c.App.GetUser(hook.CreatorId)
+		if err != nil {
+			c.Err = err
+			return
+		}
+	}
+
 	rhook, err := c.App.CreateOutgoingWebhook(hook)
 	if err != nil {
 		c.LogAudit("fail")