MM-14754: Prevent team invites or tokens from working for group-constrained teams. (#10626)

app/team.go

@@ -394,6 +394,10 @@ func (a *App) AddUserToTeamByToken(userId string, tokenId string) (*model.Team,
 	}
 	team := result.Data.(*model.Team)
 
+	if team.GroupConstrained != nil && *team.GroupConstrained {
+		return nil, model.NewAppError("AddUserToTeamByToken", "app.team.invite_token.group_constrained.error", nil, "", http.StatusForbidden)
+	}
+
 	result = <-uchan
 	if result.Err != nil {
 		return nil, result.Err
@@ -744,6 +748,10 @@ func (a *App) AddTeamMemberByInviteId(inviteId, userId string) (*model.TeamMembe
 		return nil, err
 	}
 
+	if team.GroupConstrained != nil && *team.GroupConstrained {
+		return nil, model.NewAppError("AddTeamMemberByInviteId", "app.team.invite_id.group_constrained.error", nil, "", http.StatusForbidden)
+	}
+
 	teamMember, err := a.GetTeamMember(team.Id, userId)
 	if err != nil {
 		return nil, err

app/team_test.go

@@ -264,6 +264,31 @@ func TestAddUserToTeamByToken(t *testing.T) {
 		}
 	})
 
+	t.Run("group-constrained team", func(t *testing.T) {
+		th.BasicTeam.GroupConstrained = model.NewBool(true)
+		if _, err := th.App.UpdateTeam(th.BasicTeam); err != nil {
+			t.Log(err)
+			t.Fatal("Should update the team")
+		}
+
+		token := model.NewToken(
+			TOKEN_TYPE_TEAM_INVITATION,
+			model.MapToJson(map[string]string{"teamId": th.BasicTeam.Id}),
+		)
+		<-th.App.Srv.Store.Token().Save(token)
+		if _, err := th.App.AddUserToTeamByToken(ruser.Id, token.Token); err == nil {
+			t.Fatal("Should return an error when trying to join a group-constrained team.")
+		} else {
+			require.Equal(t, "app.team.invite_token.group_constrained.error", err.Id)
+		}
+
+		th.BasicTeam.GroupConstrained = model.NewBool(false)
+		if _, err := th.App.UpdateTeam(th.BasicTeam); err != nil {
+			t.Log(err)
+			t.Fatal("Should update the team")
+		}
+	})
+
 	t.Run("block user", func(t *testing.T) {
 		th.BasicTeam.AllowedDomains = "example.com"
 		if _, err := th.App.UpdateTeam(th.BasicTeam); err != nil {