[MM-50007] WorkTemplate: disallow creating private playbook without an enterprise license (#22159)

app/worktemplates/model.go

@@ -21,6 +21,8 @@ type ExecutionRequest struct {
 }
 
 type PermissionSet struct {
+	License *model.License
+
 	// channels
 	CanCreatePublicChannel  bool
 	CanCreatePrivateChannel bool
@@ -62,6 +64,10 @@ func (r *ExecutionRequest) CanBeExecuted(p PermissionSet) *model.AppError {
 			if !public && !p.CanCreatePrivatePlaybook {
 				return model.NewAppError("WorkTemplateExecutionRequest.CanBeExecuted", "app.worktemplate.execution_request.cannot_create_private_playbook", nil, "", http.StatusForbidden)
 			}
+			// private playbook is an E20/Enterprise feature
+			if !public && (p.License == nil || (p.License.SkuShortName != model.LicenseShortSkuE20 && p.License.SkuShortName != model.LicenseShortSkuEnterprise)) {
+				return model.NewAppError("WorkTemplateExecutionRequest.CanBeExecuted", "app.worktemplate.execution_request.license_cannot_create_private_playbook", nil, "", http.StatusForbidden)
+			}
 
 			// we need to check what's the template default run execution mode
 			// to determine how the channel is created

app/worktemplates/model_test.go

@@ -58,6 +58,46 @@ func TestCanBeExecuted(t *testing.T) {
 		assert.Nil(t, appErr)
 	})
 
+	t.Run("cannot create private playbook if the license is not enterprise", func(t *testing.T) {
+		wtcrMod := *wtcr
+		wtcrMod.Visibility = model.WorkTemplateVisibilityPrivate
+		appErr := wtcrMod.CanBeExecuted(PermissionSet{
+			License:                  model.NewTestLicenseSKU(model.LicenseShortSkuProfessional, ""),
+			CanCreatePrivateChannel:  true,
+			CanCreatePrivateBoard:    true,
+			CanCreatePrivatePlaybook: true,
+			CanCreatePublicChannel:   true, // needed for the channel run
+		})
+		require.NotNil(t, appErr)
+
+		appErr = wtcrMod.CanBeExecuted(PermissionSet{
+			License:                  nil,
+			CanCreatePrivateChannel:  true,
+			CanCreatePrivateBoard:    true,
+			CanCreatePrivatePlaybook: true,
+			CanCreatePublicChannel:   true,
+		})
+		require.NotNil(t, appErr)
+
+		// enterprise and E20 ok
+		appErr = wtcrMod.CanBeExecuted(PermissionSet{
+			License:                  model.NewTestLicenseSKU(model.LicenseShortSkuEnterprise, ""),
+			CanCreatePrivateChannel:  true,
+			CanCreatePrivateBoard:    true,
+			CanCreatePrivatePlaybook: true,
+			CanCreatePublicChannel:   true,
+		})
+		require.Nil(t, appErr)
+		appErr = wtcrMod.CanBeExecuted(PermissionSet{
+			License:                  model.NewTestLicenseSKU(model.LicenseShortSkuE20, ""),
+			CanCreatePrivateChannel:  true,
+			CanCreatePrivateBoard:    true,
+			CanCreatePrivatePlaybook: true,
+			CanCreatePublicChannel:   true,
+		})
+		require.Nil(t, appErr)
+	})
+
 	t.Run("fails when something is not allowed", func(t *testing.T) {
 		appErr := wtcr.CanBeExecuted(PermissionSet{
 			CanCreatePublicChannel:  true,