MM-14754: Prevent team invites or tokens from working for group-constrained teams. (#10626)

api4/team_test.go

@@ -1481,6 +1481,19 @@ func TestAddTeamMember(t *testing.T) {
 	_, err := th.App.UpdateTeam(team)
 	require.Nil(t, err)
 
+	// Attempt to use a token on a group-constrained team
+	token = model.NewToken(
+		app.TOKEN_TYPE_TEAM_INVITATION,
+		model.MapToJson(map[string]string{"teamId": team.Id}),
+	)
+	<-th.App.Srv.Store.Token().Save(token)
+	tm, resp = Client.AddTeamMemberFromInvite(token.Token, "")
+	require.Equal(t, "app.team.invite_token.group_constrained.error", resp.Error.Id)
+
+	// Attempt to use an invite id
+	tm, resp = Client.AddTeamMemberFromInvite("", team.InviteId)
+	require.Equal(t, "app.team.invite_id.group_constrained.error", resp.Error.Id)
+
 	// User is not in associated groups so shouldn't be allowed
 	_, resp = th.SystemAdminClient.AddTeamMember(team.Id, otherUser.Id)
 	CheckErrorMessage(t, resp, "api.team.add_members.user_denied")

app/team.go

@@ -394,6 +394,10 @@ func (a *App) AddUserToTeamByToken(userId string, tokenId string) (*model.Team,
 	}
 	team := result.Data.(*model.Team)
 
+	if team.GroupConstrained != nil && *team.GroupConstrained {
+		return nil, model.NewAppError("AddUserToTeamByToken", "app.team.invite_token.group_constrained.error", nil, "", http.StatusForbidden)
+	}
+
 	result = <-uchan
 	if result.Err != nil {
 		return nil, result.Err
@@ -744,6 +748,10 @@ func (a *App) AddTeamMemberByInviteId(inviteId, userId string) (*model.TeamMembe
 		return nil, err
 	}
 
+	if team.GroupConstrained != nil && *team.GroupConstrained {
+		return nil, model.NewAppError("AddTeamMemberByInviteId", "app.team.invite_id.group_constrained.error", nil, "", http.StatusForbidden)
+	}
+
 	teamMember, err := a.GetTeamMember(team.Id, userId)
 	if err != nil {
 		return nil, err

app/team_test.go

@@ -264,6 +264,31 @@ func TestAddUserToTeamByToken(t *testing.T) {
 		}
 	})
 
+	t.Run("group-constrained team", func(t *testing.T) {
+		th.BasicTeam.GroupConstrained = model.NewBool(true)
+		if _, err := th.App.UpdateTeam(th.BasicTeam); err != nil {
+			t.Log(err)
+			t.Fatal("Should update the team")
+		}
+
+		token := model.NewToken(
+			TOKEN_TYPE_TEAM_INVITATION,
+			model.MapToJson(map[string]string{"teamId": th.BasicTeam.Id}),
+		)
+		<-th.App.Srv.Store.Token().Save(token)
+		if _, err := th.App.AddUserToTeamByToken(ruser.Id, token.Token); err == nil {
+			t.Fatal("Should return an error when trying to join a group-constrained team.")
+		} else {
+			require.Equal(t, "app.team.invite_token.group_constrained.error", err.Id)
+		}
+
+		th.BasicTeam.GroupConstrained = model.NewBool(false)
+		if _, err := th.App.UpdateTeam(th.BasicTeam); err != nil {
+			t.Log(err)
+			t.Fatal("Should update the team")
+		}
+	})
+
 	t.Run("block user", func(t *testing.T) {
 		th.BasicTeam.AllowedDomains = "example.com"
 		if _, err := th.App.UpdateTeam(th.BasicTeam); err != nil {

i18n/en.json

@@ -3342,6 +3342,14 @@
     "id": "app.system_install_date.parse_int.app_error",
     "translation": "Failed to parse installation date"
   },
+  {
+    "id": "app.team.invite_id.group_constrained.error",
+    "translation": "Unable to join a group-constrained team by invite."
+  },
+  {
+    "id": "app.team.invite_token.group_constrained.error",
+    "translation": "Unable to join a group-constrained team by token."
+  },
   {
     "id": "app.team.join_user_to_team.max_accounts.app_error",
     "translation": "This team has reached the maximum number of allowed accounts. Contact your System Administrator to set a higher limit."