MM-55608:check invite guest permission (#25708)

* check for invite_guest permission when inviting guests

* update description for invite_guest

* check team permission first

* update returned error

* update from review comments

---------

Co-authored-by: Mattermost Build <build@mattermost.com>

server/channels/api4/team_test.go

@@ -2498,6 +2498,12 @@ func TestAddTeamMembers(t *testing.T) {
 		otherUser.Id,
 	}
 
+	guestUser := th.CreateUser()
+	th.App.UpdateUserRoles(th.Context, guestUser.Id, model.SystemGuestRoleId, false)
+	guestList := []string{
+		guestUser.Id,
+	}
+
 	th.App.UpdateConfig(func(cfg *model.Config) {
 		*cfg.ServiceSettings.EnableBotAccountCreation = true
 	})
@@ -2526,6 +2532,23 @@ func TestAddTeamMembers(t *testing.T) {
 
 	require.Equal(t, tm[0].TeamId, team.Id, "team ids should have matched")
 
+	// Check the appropriate permissions are enforced.
+	defaultRolePermissions := th.SaveDefaultRolePermissions()
+	defer func() {
+		th.RestoreDefaultRolePermissions(defaultRolePermissions)
+	}()
+
+	// Regular user can add a guest member to a team they belong to.
+	th.AddPermissionToRole(model.PermissionInviteGuest.Id, model.TeamUserRoleId)
+	tm, resp, err = client.AddTeamMembers(context.Background(), team.Id, guestList)
+	require.NoError(t, err)
+	CheckCreatedStatus(t, resp)
+
+	// Check all the returned data.
+	require.NotNil(t, tm[0], "should have returned team member")
+	require.Equal(t, tm[0].UserId, guestUser.Id, "user ids should have matched")
+	require.Equal(t, tm[0].TeamId, team.Id, "team ids should have matched")
+
 	// Check with various invalid requests.
 	_, resp, err = client.AddTeamMembers(context.Background(), "junk", userList)
 	require.Error(t, err)
@@ -2550,12 +2573,6 @@ func TestAddTeamMembers(t *testing.T) {
 
 	client.Logout(context.Background())
 
-	// Check the appropriate permissions are enforced.
-	defaultRolePermissions := th.SaveDefaultRolePermissions()
-	defer func() {
-		th.RestoreDefaultRolePermissions(defaultRolePermissions)
-	}()
-
 	// Set the config so that only team admins can add a user to a team.
 	th.AddPermissionToRole(model.PermissionInviteUser.Id, model.TeamAdminRoleId)
 	th.AddPermissionToRole(model.PermissionAddUserToTeam.Id, model.TeamAdminRoleId)
@@ -2592,6 +2609,13 @@ func TestAddTeamMembers(t *testing.T) {
 	_, _, err = client.AddTeamMembers(context.Background(), team.Id, userList)
 	require.NoError(t, err)
 
+	// remove invite guests
+	th.RemovePermissionFromRole(model.PermissionInviteGuest.Id, model.TeamUserRoleId)
+	// Regular user can no longer add a guest member to a team they belong to.
+	_, resp, err = client.AddTeamMembers(context.Background(), team.Id, guestList)
+	require.Error(t, err)
+	CheckForbiddenStatus(t, resp)
+
 	// Set a team to group-constrained
 	team.GroupConstrained = model.NewBool(true)
 	_, appErr = th.App.UpdateTeam(team)