[MM-34725] app/user: check if username or email is in use before patching a user (#17392)

* app/user: check if username or email is in use before patching a user

* reflect review comments

* fix tests

app/user.go

@@ -1281,15 +1281,13 @@ func (a *App) UpdateUser(user *model.User, sendNotifications bool) (*model.User,
 			}
 		}
 
-		if _, appErr := a.GetUserByEmail(user.Email); appErr == nil {
-			return nil, model.NewAppError("UpdateUser", "store.sql_user.update.email_taken.app_error", nil, "user_id="+user.Id, http.StatusBadRequest)
-		}
-
-		// Don't set new eMail on user account if email verification is required, this will be done as a post-verification action
-		// to avoid users being able to set non-controlled eMails as their account email
-
 		if *a.Config().EmailSettings.RequireEmailVerification {
 			newEmail = user.Email
+			// Don't set new eMail on user account if email verification is required, this will be done as a post-verification action
+			// to avoid users being able to set non-controlled eMails as their account email
+			if _, appErr := a.GetUserByEmail(newEmail); appErr == nil {
+				return nil, model.NewAppError("UpdateUser", "app.user.save.email_exists.app_error", nil, "user_id="+user.Id, http.StatusBadRequest)
+			}
 
 			//  When a bot is created, prev.Email will be an autogenerated faked email,
 			//  which will not match a CLI email input during bot to user conversions.
@@ -1305,11 +1303,17 @@ func (a *App) UpdateUser(user *model.User, sendNotifications bool) (*model.User,
 	if err != nil {
 		var appErr *model.AppError
 		var invErr *store.ErrInvalidInput
+		var conErr *store.ErrConflict
 		switch {
 		case errors.As(err, &appErr):
 			return nil, appErr
 		case errors.As(err, &invErr):
 			return nil, model.NewAppError("UpdateUser", "app.user.update.find.app_error", nil, invErr.Error(), http.StatusBadRequest)
+		case errors.As(err, &conErr):
+			if cErr, ok := err.(*store.ErrConflict); ok && cErr.Resource == "Username" {
+				return nil, model.NewAppError("UpdateUser", "app.user.save.username_exists.app_error", nil, "", http.StatusBadRequest)
+			}
+			return nil, model.NewAppError("UpdateUser", "app.user.save.email_exists.app_error", nil, "", http.StatusBadRequest)
 		default:
 			return nil, model.NewAppError("UpdateUser", "app.user.update.finding.app_error", nil, err.Error(), http.StatusInternalServerError)
 		}