[MM-22791] Prevent account creation if new user does not have allowed domain for the team (#14012)

* app/user: prevent user creation for restricted domains for a team

* app/user_test: add error message checks to CreateUserWithInviteId

app/user.go

@@ -121,6 +121,10 @@ func (a *App) CreateUserWithInviteId(user *model.User, inviteId string) (*model.
 		return nil, model.NewAppError("CreateUserWithInviteId", "app.team.invite_id.group_constrained.error", nil, "", http.StatusForbidden)
 	}
 
+	if !CheckUserDomain(user, team.AllowedDomains) {
+		return nil, model.NewAppError("CreateUserWithInviteId", "api.team.invite_members.invalid_email.app_error", map[string]interface{}{"Addresses": team.AllowedDomains}, "", http.StatusForbidden)
+	}
+
 	user.EmailVerified = false
 
 	ruser, err := a.CreateUser(user)

app/user_test.go

@@ -567,6 +567,34 @@ func TestGetUsersByStatus(t *testing.T) {
 	})
 }
 
+func TestCreateUserWithInviteId(t *testing.T) {
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+
+	user := model.User{Email: strings.ToLower(model.NewId()) + "success+test@example.com", Nickname: "Darth Vader", Username: "vader" + model.NewId(), Password: "passwd1", AuthService: ""}
+
+	t.Run("should create a user", func(t *testing.T) {
+		u, err := th.App.CreateUserWithInviteId(&user, th.BasicTeam.InviteId)
+		require.Nil(t, err)
+		require.Equal(t, u.Id, user.Id)
+	})
+
+	t.Run("invalid invite id", func(t *testing.T) {
+		_, err := th.App.CreateUserWithInviteId(&user, "")
+		require.NotNil(t, err)
+		require.Contains(t, err.Id, "store.sql_team.get_by_invite_id")
+	})
+
+	t.Run("invalid domain", func(t *testing.T) {
+		th.BasicTeam.AllowedDomains = "mattermost.com"
+		_, err := th.App.Srv().Store.Team().Update(th.BasicTeam)
+		require.Nil(t, err)
+		_, err = th.App.CreateUserWithInviteId(&user, th.BasicTeam.InviteId)
+		require.NotNil(t, err)
+		require.Equal(t, "api.team.invite_members.invalid_email.app_error", err.Id)
+	})
+}
+
 func TestCreateUserWithToken(t *testing.T) {
 	th := Setup(t).InitBasic()
 	defer th.TearDown()