[MM-30016] Allows to create incoming and outgoing webhooks for a different user (#16425)

* [MM-30016] Allows to create an incoming webhook for a different user

* [MM-30021] Allows to create an outgoing webhook for a different user

* Fix update test

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

api4/webhook_test.go

@@ -17,9 +17,11 @@ func TestCreateIncomingWebhook(t *testing.T) {
 	defer th.TearDown()
 	Client := th.Client
 
-	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableIncomingWebhooks = true })
-	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnablePostUsernameOverride = true })
-	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnablePostIconOverride = true })
+	th.App.UpdateConfig(func(cfg *model.Config) {
+		*cfg.ServiceSettings.EnableIncomingWebhooks = true
+		*cfg.ServiceSettings.EnablePostUsernameOverride = true
+		*cfg.ServiceSettings.EnablePostIconOverride = true
+	})
 
 	defaultRolePermissions := th.SaveDefaultRolePermissions()
 	defer func() {
@@ -61,6 +63,38 @@ func TestCreateIncomingWebhook(t *testing.T) {
 	_, resp = Client.CreateIncomingWebhook(hook)
 	CheckNoError(t, resp)
 
+	th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
+		hook.UserId = th.BasicUser2.Id
+		defer func() { hook.UserId = "" }()
+
+		newHook, response := client.CreateIncomingWebhook(hook)
+		CheckNoError(t, response)
+		require.Equal(t, th.BasicUser2.Id, newHook.UserId)
+	}, "Create an incoming webhook for a different user")
+
+	th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
+		hook.UserId = "invalid-user"
+		defer func() { hook.UserId = "" }()
+
+		_, response := client.CreateIncomingWebhook(hook)
+		CheckNotFoundStatus(t, response)
+	}, "Create an incoming webhook for an invalid user")
+
+	t.Run("Create an incoming webhook for a different user without permissions", func(t *testing.T) {
+		hook.UserId = th.BasicUser2.Id
+		defer func() { hook.UserId = "" }()
+
+		_, response := Client.CreateIncomingWebhook(hook)
+		CheckForbiddenStatus(t, response)
+	})
+
+	t.Run("Create an incoming webhook in local mode without providing user", func(t *testing.T) {
+		hook.UserId = ""
+
+		_, response := th.LocalClient.CreateIncomingWebhook(hook)
+		CheckBadRequestStatus(t, response)
+	})
+
 	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableIncomingWebhooks = false })
 	_, resp = Client.CreateIncomingWebhook(hook)
 	CheckNotImplementedStatus(t, resp)
@@ -381,6 +415,38 @@ func TestCreateOutgoingWebhook(t *testing.T) {
 	_, resp = Client.CreateOutgoingWebhook(hook)
 	CheckNoError(t, resp)
 
+	th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
+		hook.CreatorId = th.BasicUser2.Id
+		defer func() { hook.CreatorId = "" }()
+
+		newHook, response := client.CreateOutgoingWebhook(hook)
+		CheckNoError(t, response)
+		require.Equal(t, th.BasicUser2.Id, newHook.CreatorId)
+	}, "Create an outgoing webhook for a different user")
+
+	th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
+		hook.CreatorId = "invalid-user"
+		defer func() { hook.CreatorId = "" }()
+
+		_, response := client.CreateOutgoingWebhook(hook)
+		CheckNotFoundStatus(t, response)
+	}, "Create an incoming webhook for an invalid user")
+
+	t.Run("Create an outgoing webhook for a different user without permissions", func(t *testing.T) {
+		hook.CreatorId = th.BasicUser2.Id
+		defer func() { hook.CreatorId = "" }()
+
+		_, response := Client.CreateOutgoingWebhook(hook)
+		CheckForbiddenStatus(t, response)
+	})
+
+	t.Run("Create an outgoing webhook in local mode without providing user", func(t *testing.T) {
+		hook.CreatorId = ""
+
+		_, response := th.LocalClient.CreateOutgoingWebhook(hook)
+		CheckBadRequestStatus(t, response)
+	})
+
 	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableOutgoingWebhooks = false })
 	_, resp = Client.CreateOutgoingWebhook(hook)
 	CheckNotImplementedStatus(t, resp)
@@ -755,11 +821,12 @@ func TestUpdateIncomingHook(t *testing.T) {
 		th.AddPermissionToRole(model.PERMISSION_MANAGE_INCOMING_WEBHOOKS.Id, model.TEAM_USER_ROLE_ID)
 
 		t.Run("UpdateHookOfSameUser", func(t *testing.T) {
-			sameUserHook := &model.IncomingWebhook{ChannelId: th.BasicChannel.Id, UserId: th.BasicUser2.Id}
+			sameUserHook := &model.IncomingWebhook{ChannelId: th.BasicChannel.Id}
 
 			sameUserHook, resp := th.Client.CreateIncomingWebhook(sameUserHook)
 			CheckNoError(t, resp)
 
+			sameUserHook.UserId = th.BasicUser2.Id
 			_, resp = th.Client.UpdateIncomingWebhook(sameUserHook)
 			CheckNoError(t, resp)
 		})