[MM-25647]: ability to permanently delete users (#14944)

Summary:
    Config option to allow permanent user deletion ServiceSettings.EnableAPIUserDeletion
    Expose permanent user deletion through API
    Local mode for delete user for use in mmctl

Ticket Link:
    Server part of https://mattermost.atlassian.net/browse/MM-25647

api4/user_test.go

@@ -1857,34 +1857,32 @@ func TestDeleteUser(t *testing.T) {
 	th := Setup(t).InitBasic()
 	defer th.TearDown()
 
-	user := th.BasicUser
 	th.LoginBasic()
-
-	testUser := th.SystemAdminUser
-	_, resp := th.Client.DeleteUser(testUser.Id)
+	_, resp := th.Client.DeleteUser(th.SystemAdminUser.Id)
 	CheckForbiddenStatus(t, resp)
 
 	th.Client.Logout()
-
-	_, resp = th.Client.DeleteUser(user.Id)
+	_, resp = th.Client.DeleteUser(th.BasicUser.Id)
 	CheckUnauthorizedStatus(t, resp)
 
-	th.Client.Login(testUser.Email, testUser.Password)
+	th.TestForSystemAdminAndLocal(t, func(t *testing.T, c *model.Client4) {
+		_, resp = c.DeleteUser(model.NewId())
+		CheckNotFoundStatus(t, resp)
 
-	user.Id = model.NewId()
-	_, resp = th.Client.DeleteUser(user.Id)
-	CheckNotFoundStatus(t, resp)
+		_, resp = c.DeleteUser("junk")
+		CheckBadRequestStatus(t, resp)
 
-	user.Id = "junk"
-	_, resp = th.Client.DeleteUser(user.Id)
-	CheckBadRequestStatus(t, resp)
-
-	_, resp = th.Client.DeleteUser(testUser.Id)
-	CheckNoError(t, resp)
+		userToDelete := th.CreateUser()
+		_, resp = c.DeleteUser(userToDelete.Id)
+		CheckNoError(t, resp)
+	})
 
 	selfDeleteUser := th.CreateUser()
-	th.Client.Login(selfDeleteUser.Email, selfDeleteUser.Password)
+	th.LoginBasic()
+	_, resp = th.Client.DeleteUser(selfDeleteUser.Id)
+	CheckForbiddenStatus(t, resp)
 
+	th.Client.Login(selfDeleteUser.Email, selfDeleteUser.Password)
 	th.App.UpdateConfig(func(c *model.Config) {
 		*c.TeamSettings.EnableUserDeactivation = false
 	})
@@ -1898,6 +1896,46 @@ func TestDeleteUser(t *testing.T) {
 	CheckNoError(t, resp)
 }
 
+func TestPermanentDeleteUser(t *testing.T) {
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+
+	enableAPIUserDeletion := *th.App.Config().ServiceSettings.EnableAPIUserDeletion
+	defer func() {
+		th.App.UpdateConfig(func(cfg *model.Config) { cfg.ServiceSettings.EnableAPIUserDeletion = &enableAPIUserDeletion })
+	}()
+
+	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableAPIUserDeletion = false })
+
+	userToDelete := th.CreateUser()
+
+	t.Run("Permanent deletion not available through API if EnableAPIUserDeletion is not set", func(t *testing.T) {
+		_, resp := th.SystemAdminClient.PermanentDeleteUser(userToDelete.Id)
+		CheckUnauthorizedStatus(t, resp)
+	})
+
+	t.Run("Permanent deletion available through local mode even if EnableAPIUserDeletion is not set", func(t *testing.T) {
+		ok, resp := th.LocalClient.PermanentDeleteUser(userToDelete.Id)
+		CheckNoError(t, resp)
+		assert.True(t, ok)
+	})
+
+	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableAPIUserDeletion = true })
+	th.TestForSystemAdminAndLocal(t, func(t *testing.T, c *model.Client4) {
+		userToDelete = th.CreateUser()
+		ok, resp := c.PermanentDeleteUser(userToDelete.Id)
+		CheckNoError(t, resp)
+		assert.True(t, ok)
+
+		_, err := th.App.GetTeam(userToDelete.Id)
+		assert.NotNil(t, err)
+
+		ok, resp = c.PermanentDeleteUser("junk")
+		CheckBadRequestStatus(t, resp)
+		require.False(t, ok, "should have returned false")
+	}, "Permanent deletion with EnableAPIUserDeletion set")
+}
+
 func TestPermanentDeleteAllUsers(t *testing.T) {
 	th := Setup(t).InitBasic()
 	defer th.TearDown()