[MM-44842] Add restore_group permission (#21806)

* Add restore_group permission

* Fix tests failing due to new permission in groups

* Add new migration to add custom_group_restore permission

* Add mock for new migration function

* Fix tests

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

api4/group.go

@@ -1185,8 +1185,8 @@ func restoreGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if !c.App.SessionHasPermissionToGroup(*c.AppContext.Session(), c.Params.GroupId, model.PermissionDeleteCustomGroup) {
-		c.SetPermissionError(model.PermissionDeleteCustomGroup)
+	if !c.App.SessionHasPermissionToGroup(*c.AppContext.Session(), c.Params.GroupId, model.PermissionRestoreCustomGroup) {
+		c.SetPermissionError(model.PermissionRestoreCustomGroup)
 		return
 	}
 

api4/group_test.go

@@ -231,7 +231,13 @@ func TestUndeleteGroup(t *testing.T) {
 	_, response, err := th.Client.DeleteGroup(validGroup.Id)
 	require.NoError(t, err)
 	CheckOKStatus(t, response)
+	th.RemovePermissionFromRole(model.PermissionRestoreCustomGroup.Id, model.SystemUserRoleId)
+	// shouldn't allow restoring unless user has required permission
+	_, response, err = th.Client.RestoreGroup(validGroup.Id, "")
+	require.Error(t, err)
+	CheckForbiddenStatus(t, response)
 
+	th.AddPermissionToRole(model.PermissionRestoreCustomGroup.Id, model.SystemUserRoleId)
 	_, response, err = th.Client.RestoreGroup(validGroup.Id, "")
 	require.NoError(t, err)
 	CheckOKStatus(t, response)