[MM-22791] Prevent account creation if new user does not have allowed domain for the team (#14012)

* app/user: prevent user creation for restricted domains for a team

* app/user_test: add error message checks to CreateUserWithInviteId

app/user_test.go

@@ -567,6 +567,34 @@ func TestGetUsersByStatus(t *testing.T) {
 	})
 }
 
+func TestCreateUserWithInviteId(t *testing.T) {
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+
+	user := model.User{Email: strings.ToLower(model.NewId()) + "success+test@example.com", Nickname: "Darth Vader", Username: "vader" + model.NewId(), Password: "passwd1", AuthService: ""}
+
+	t.Run("should create a user", func(t *testing.T) {
+		u, err := th.App.CreateUserWithInviteId(&user, th.BasicTeam.InviteId)
+		require.Nil(t, err)
+		require.Equal(t, u.Id, user.Id)
+	})
+
+	t.Run("invalid invite id", func(t *testing.T) {
+		_, err := th.App.CreateUserWithInviteId(&user, "")
+		require.NotNil(t, err)
+		require.Contains(t, err.Id, "store.sql_team.get_by_invite_id")
+	})
+
+	t.Run("invalid domain", func(t *testing.T) {
+		th.BasicTeam.AllowedDomains = "mattermost.com"
+		_, err := th.App.Srv().Store.Team().Update(th.BasicTeam)
+		require.Nil(t, err)
+		_, err = th.App.CreateUserWithInviteId(&user, th.BasicTeam.InviteId)
+		require.NotNil(t, err)
+		require.Equal(t, "api.team.invite_members.invalid_email.app_error", err.Id)
+	})
+}
+
 func TestCreateUserWithToken(t *testing.T) {
 	th := Setup(t).InitBasic()
 	defer th.TearDown()