[MM-15270] Add Team.InviteId sanitization (#12952)

* Filter out InviteId in Team sanitize function

* Keep InviteId for authorized users

* Update team sanitization tests

* Improve tests and revert conflicting lines

api4/team_test.go

@@ -102,6 +102,7 @@ func TestCreateTeamSanitization(t *testing.T) {
 		rteam, resp := th.Client.CreateTeam(team)
 		CheckNoError(t, resp)
 		require.NotEmpty(t, rteam.Email, "should not have sanitized email")
+		require.NotEmpty(t, rteam.InviteId, "should not have sanitized inviteid")
 	})
 
 	t.Run("system admin", func(t *testing.T) {
@@ -116,6 +117,7 @@ func TestCreateTeamSanitization(t *testing.T) {
 		rteam, resp := th.SystemAdminClient.CreateTeam(team)
 		CheckNoError(t, resp)
 		require.NotEmpty(t, rteam.Email, "should not have sanitized email")
+		require.NotEmpty(t, rteam.InviteId, "should not have sanitized inviteid")
 	})
 }
 
@@ -187,18 +189,37 @@ func TestGetTeamSanitization(t *testing.T) {
 		CheckNoError(t, resp)
 
 		require.Empty(t, rteam.Email, "should have sanitized email")
+		require.NotEmpty(t, rteam.InviteId, "should not have sanitized inviteid")
+	})
+
+	t.Run("team user without invite permissions", func(t *testing.T) {
+		th.RemovePermissionFromRole(model.PERMISSION_INVITE_USER.Id, model.TEAM_USER_ROLE_ID)
+		th.LinkUserToTeam(th.BasicUser2, team)
+
+		client := th.CreateClient()
+		th.LoginBasic2WithClient(client)
+
+		rteam, resp := client.GetTeam(team.Id, "")
+		CheckNoError(t, resp)
+
+		require.Empty(t, rteam.Email, "should have sanitized email")
+		require.Empty(t, rteam.InviteId, "should have sanitized inviteid")
 	})
 
 	t.Run("team admin", func(t *testing.T) {
 		rteam, resp := th.Client.GetTeam(team.Id, "")
 		CheckNoError(t, resp)
+
 		require.NotEmpty(t, rteam.Email, "should not have sanitized email")
+		require.NotEmpty(t, rteam.InviteId, "should not have sanitized inviteid")
 	})
 
 	t.Run("system admin", func(t *testing.T) {
 		rteam, resp := th.SystemAdminClient.GetTeam(team.Id, "")
 		CheckNoError(t, resp)
+
 		require.NotEmpty(t, rteam.Email, "should not have sanitized email")
+		require.NotEmpty(t, rteam.InviteId, "should not have sanitized inviteid")
 	})
 }
 
@@ -337,13 +358,17 @@ func TestUpdateTeamSanitization(t *testing.T) {
 	t.Run("team admin", func(t *testing.T) {
 		rteam, resp := th.Client.UpdateTeam(team)
 		CheckNoError(t, resp)
+
 		require.NotEmpty(t, rteam.Email, "should not have sanitized email for admin")
+		require.NotEmpty(t, rteam.InviteId, "should not have sanitized inviteid")
 	})
 
 	t.Run("system admin", func(t *testing.T) {
 		rteam, resp := th.SystemAdminClient.UpdateTeam(team)
 		CheckNoError(t, resp)
+
 		require.NotEmpty(t, rteam.Email, "should not have sanitized email for admin")
+		require.NotEmpty(t, rteam.InviteId, "should not have sanitized inviteid")
 	})
 }
 
@@ -421,13 +446,17 @@ func TestPatchTeamSanitization(t *testing.T) {
 	t.Run("team admin", func(t *testing.T) {
 		rteam, resp := th.Client.PatchTeam(team.Id, &model.TeamPatch{})
 		CheckNoError(t, resp)
+
 		require.NotEmpty(t, rteam.Email, "should not have sanitized email for admin")
+		require.NotEmpty(t, rteam.InviteId, "should not have sanitized inviteid")
 	})
 
 	t.Run("system admin", func(t *testing.T) {
 		rteam, resp := th.SystemAdminClient.PatchTeam(team.Id, &model.TeamPatch{})
 		CheckNoError(t, resp)
+
 		require.NotEmpty(t, rteam.Email, "should not have sanitized email for admin")
+		require.NotEmpty(t, rteam.InviteId, "should not have sanitized inviteid")
 	})
 }
 
@@ -702,9 +731,11 @@ func TestGetAllTeamsSanitization(t *testing.T) {
 			if rteam.Id == team.Id {
 				teamFound = true
 				require.NotEmpty(t, rteam.Email, "should not have sanitized email for team admin")
+				require.NotEmpty(t, rteam.InviteId, "should not have sanitized inviteid")
 			} else if rteam.Id == team2.Id {
 				team2Found = true
-				require.Empty(t, rteam.Email, "should've sanitized email for non-admin")
+				require.Empty(t, rteam.Email, "should have sanitized email for team admin")
+				require.Empty(t, rteam.InviteId, "should have sanitized inviteid")
 			}
 		}
 
@@ -721,6 +752,7 @@ func TestGetAllTeamsSanitization(t *testing.T) {
 			}
 
 			require.NotEmpty(t, rteam.Email, "should not have sanitized email")
+			require.NotEmpty(t, rteam.InviteId, "should not have sanitized inviteid")
 		}
 	})
 }
@@ -791,19 +823,40 @@ func TestGetTeamByNameSanitization(t *testing.T) {
 
 		rteam, resp := client.GetTeamByName(team.Name, "")
 		CheckNoError(t, resp)
+
 		require.Empty(t, rteam.Email, "should've sanitized email")
+		require.NotEmpty(t, rteam.InviteId, "should have not sanitized inviteid")
+	})
+
+	t.Run("team user without invite permissions", func(t *testing.T) {
+		th.RemovePermissionFromRole(model.PERMISSION_INVITE_USER.Id, model.TEAM_USER_ROLE_ID)
+		th.LinkUserToTeam(th.BasicUser2, team)
+
+		client := th.CreateClient()
+
+		th.LoginBasic2WithClient(client)
+
+		rteam, resp := client.GetTeam(team.Id, "")
+		CheckNoError(t, resp)
+
+		require.Empty(t, rteam.Email, "should have sanitized email")
+		require.Empty(t, rteam.InviteId, "should have sanitized inviteid")
 	})
 
 	t.Run("team admin/non-admin", func(t *testing.T) {
 		rteam, resp := th.Client.GetTeamByName(team.Name, "")
 		CheckNoError(t, resp)
+
 		require.NotEmpty(t, rteam.Email, "should not have sanitized email")
+		require.NotEmpty(t, rteam.InviteId, "should have not sanitized inviteid")
 	})
 
 	t.Run("system admin", func(t *testing.T) {
 		rteam, resp := th.SystemAdminClient.GetTeamByName(team.Name, "")
 		CheckNoError(t, resp)
+
 		require.NotEmpty(t, rteam.Email, "should not have sanitized email")
+		require.NotEmpty(t, rteam.InviteId, "should have not sanitized inviteid")
 	})
 }
 
@@ -899,6 +952,7 @@ func TestSearchAllTeamsSanitization(t *testing.T) {
 		for _, rteam := range rteams {
 			require.Empty(t, rteam.Email, "should've sanitized email")
 			require.Empty(t, rteam.AllowedDomains, "should've sanitized allowed domains")
+			require.Empty(t, rteam.InviteId, "should have sanitized inviteid")
 		}
 	})
 
@@ -913,6 +967,7 @@ func TestSearchAllTeamsSanitization(t *testing.T) {
 		for _, rteam := range rteams {
 			require.Empty(t, rteam.Email, "should've sanitized email")
 			require.Empty(t, rteam.AllowedDomains, "should've sanitized allowed domains")
+			require.NotEmpty(t, rteam.InviteId, "should have not sanitized inviteid")
 		}
 	})
 
@@ -922,6 +977,7 @@ func TestSearchAllTeamsSanitization(t *testing.T) {
 		for _, rteam := range rteams {
 			if rteam.Id == team.Id || rteam.Id == team2.Id || rteam.Id == th.BasicTeam.Id {
 				require.NotEmpty(t, rteam.Email, "should not have sanitized email")
+				require.NotEmpty(t, rteam.InviteId, "should have not sanitized inviteid")
 			}
 		}
 	})
@@ -931,6 +987,7 @@ func TestSearchAllTeamsSanitization(t *testing.T) {
 		CheckNoError(t, resp)
 		for _, rteam := range rteams {
 			require.NotEmpty(t, rteam.Email, "should not have sanitized email")
+			require.NotEmpty(t, rteam.InviteId, "should have not sanitized inviteid")
 		}
 	})
 }
@@ -1010,6 +1067,27 @@ func TestGetTeamsForUserSanitization(t *testing.T) {
 			}
 
 			require.Empty(t, rteam.Email, "should've sanitized email")
+			require.NotEmpty(t, rteam.InviteId, "should have not sanitized inviteid")
+		}
+	})
+
+	t.Run("team user without invite permissions", func(t *testing.T) {
+		th.LinkUserToTeam(th.BasicUser2, team)
+		th.LinkUserToTeam(th.BasicUser2, team2)
+
+		client := th.CreateClient()
+		th.RemovePermissionFromRole(model.PERMISSION_INVITE_USER.Id, model.TEAM_USER_ROLE_ID)
+		th.LoginBasic2WithClient(client)
+
+		rteams, resp := client.GetTeamsForUser(th.BasicUser2.Id, "")
+		CheckNoError(t, resp)
+		for _, rteam := range rteams {
+			if rteam.Id != team.Id && rteam.Id != team2.Id {
+				continue
+			}
+
+			require.Empty(t, rteam.Email, "should have sanitized email")
+			require.Empty(t, rteam.InviteId, "should have sanitized inviteid")
 		}
 	})
 
@@ -1022,6 +1100,7 @@ func TestGetTeamsForUserSanitization(t *testing.T) {
 			}
 
 			require.NotEmpty(t, rteam.Email, "should not have sanitized email")
+			require.NotEmpty(t, rteam.InviteId, "should have not sanitized inviteid")
 		}
 	})
 
@@ -1034,6 +1113,7 @@ func TestGetTeamsForUserSanitization(t *testing.T) {
 			}
 
 			require.NotEmpty(t, rteam.Email, "should not have sanitized email")
+			require.NotEmpty(t, rteam.InviteId, "should have not sanitized inviteid")
 		}
 	})
 }

app/team.go

@@ -1333,10 +1333,19 @@ func (a *App) GetTeamIdFromQuery(query url.Values) (string, *model.AppError) {
 }
 
 func (a *App) SanitizeTeam(session model.Session, team *model.Team) *model.Team {
-	if !a.SessionHasPermissionToTeam(session, team.Id, model.PERMISSION_MANAGE_TEAM) {
-		team.Sanitize()
+	if a.SessionHasPermissionToTeam(session, team.Id, model.PERMISSION_MANAGE_TEAM) {
+		return team
 	}
 
+	if a.SessionHasPermissionToTeam(session, team.Id, model.PERMISSION_INVITE_USER) {
+		inviteId := team.InviteId
+		team.Sanitize()
+		team.InviteId = inviteId
+		return team
+	}
+
+	team.Sanitize()
+
 	return team
 }
 

app/team_test.go

@@ -419,6 +419,7 @@ func TestSanitizeTeam(t *testing.T) {
 	team := &model.Team{
 		Id:             model.NewId(),
 		Email:          th.MakeEmail(),
+		InviteId:       model.NewId(),
 		AllowedDomains: "example.com",
 	}
 
@@ -443,6 +444,7 @@ func TestSanitizeTeam(t *testing.T) {
 
 		sanitized := th.App.SanitizeTeam(session, copyTeam())
 		require.Empty(t, sanitized.Email, "should've sanitized team")
+		require.Empty(t, sanitized.InviteId, "should've sanitized inviteid")
 	})
 
 	t.Run("user of the team", func(t *testing.T) {
@@ -460,6 +462,7 @@ func TestSanitizeTeam(t *testing.T) {
 
 		sanitized := th.App.SanitizeTeam(session, copyTeam())
 		require.Empty(t, sanitized.Email, "should've sanitized team")
+		require.NotEmpty(t, sanitized.InviteId, "should have not sanitized inviteid")
 	})
 
 	t.Run("team admin", func(t *testing.T) {
@@ -477,6 +480,7 @@ func TestSanitizeTeam(t *testing.T) {
 
 		sanitized := th.App.SanitizeTeam(session, copyTeam())
 		require.NotEmpty(t, sanitized.Email, "shouldn't have sanitized team")
+		require.NotEmpty(t, sanitized.InviteId, "shouldn't have sanitized inviteid")
 	})
 
 	t.Run("team admin of another team", func(t *testing.T) {
@@ -494,6 +498,7 @@ func TestSanitizeTeam(t *testing.T) {
 
 		sanitized := th.App.SanitizeTeam(session, copyTeam())
 		require.Empty(t, sanitized.Email, "should've sanitized team")
+		require.Empty(t, sanitized.InviteId, "should've sanitized inviteid")
 	})
 
 	t.Run("system admin, not a user of team", func(t *testing.T) {
@@ -511,6 +516,7 @@ func TestSanitizeTeam(t *testing.T) {
 
 		sanitized := th.App.SanitizeTeam(session, copyTeam())
 		require.NotEmpty(t, sanitized.Email, "shouldn't have sanitized team")
+		require.NotEmpty(t, sanitized.InviteId, "shouldn't have sanitized inviteid")
 	})
 
 	t.Run("system admin, user of team", func(t *testing.T) {
@@ -528,6 +534,7 @@ func TestSanitizeTeam(t *testing.T) {
 
 		sanitized := th.App.SanitizeTeam(session, copyTeam())
 		require.NotEmpty(t, sanitized.Email, "shouldn't have sanitized team")
+		require.NotEmpty(t, sanitized.InviteId, "shouldn't have sanitized inviteid")
 	})
 }
 

model/team.go

@@ -268,6 +268,7 @@ func CleanTeamName(s string) string {
 
 func (o *Team) Sanitize() {
 	o.Email = ""
+	o.InviteId = ""
 }
 
 func (t *Team) Patch(patch *TeamPatch) {