Deactivating and invalidating sessions of guest users on guest disable (#13007)

Automatic Merge

api4/user.go

@@ -1051,6 +1051,11 @@ func updateUserActive(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if active && user.IsGuest() && !*c.App.Config().GuestAccountsSettings.Enable {
+		c.Err = model.NewAppError("updateUserActive", "api.user.update_active.cannot_enable_guest_when_guest_feature_is_disabled.app_error", nil, "userId="+c.Params.UserId, http.StatusUnauthorized)
+		return
+	}
+
 	if _, err = c.App.UpdateActive(user, active); err != nil {
 		c.Err = err
 	}

api4/user_test.go

@@ -1718,6 +1718,49 @@ func TestUpdateUserActive(t *testing.T) {
 		assertWebsocketEventUserUpdatedWithEmail(t, webSocketClient, "")
 		assertWebsocketEventUserUpdatedWithEmail(t, adminWebSocketClient, user.Email)
 	})
+
+	t.Run("activate guest should fail when guests feature is disable", func(t *testing.T) {
+		th := Setup().InitBasic()
+		defer th.TearDown()
+
+		id := model.NewId()
+		guest := &model.User{
+			Email:         "success+" + id + "@simulator.amazonses.com",
+			Username:      "un_" + id,
+			Nickname:      "nn_" + id,
+			Password:      "Password1",
+			EmailVerified: true,
+		}
+		user, err := th.App.CreateGuest(guest)
+		require.Nil(t, err)
+		th.App.UpdateActive(user, false)
+
+		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.GuestAccountsSettings.Enable = false })
+		defer th.App.UpdateConfig(func(cfg *model.Config) { *cfg.GuestAccountsSettings.Enable = true })
+		_, resp := th.SystemAdminClient.UpdateUserActive(user.Id, true)
+		CheckUnauthorizedStatus(t, resp)
+	})
+
+	t.Run("activate guest should work when guests feature is enabled", func(t *testing.T) {
+		th := Setup().InitBasic()
+		defer th.TearDown()
+
+		id := model.NewId()
+		guest := &model.User{
+			Email:         "success+" + id + "@simulator.amazonses.com",
+			Username:      "un_" + id,
+			Nickname:      "nn_" + id,
+			Password:      "Password1",
+			EmailVerified: true,
+		}
+		user, err := th.App.CreateGuest(guest)
+		require.Nil(t, err)
+		th.App.UpdateActive(user, false)
+
+		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.GuestAccountsSettings.Enable = true })
+		_, resp := th.SystemAdminClient.UpdateUserActive(user.Id, true)
+		CheckNoError(t, resp)
+	})
 }
 
 func TestGetUsers(t *testing.T) {