Custom groups (#18839)

* WIP * adding initial creategroup endpoint * fetching by group source * fixing startup error * updating create endpoint to take an array of user_ids, this will allow us to create the group with one request * adding delete group endpoint and appropriate test * adding source param for getGroups * adding add members and delete members endpoints * locking down crud endpoints to only be allowed for custom groups * user search stuff * allowing remoteid be null by changing field to pointer * code cleanup and store level tests * adding new tests and removing unused endpoint * resolving conflicts * Adds authz check for group. * Adds authz checks to groups APIs. * Updated create group authz tests. * Updates delete group tests. * Tests create group. * Adds some tests and validations. * adding new parameter so I can get users not in a group * Fixed all lint warnings. * Fix type. * fixing search users not in group * Fixes some lint errors. * Moves entry in JSON array. * Fixed SQL query. * Fixes permission migration test. * Fixes migration test. * Fixes some group store tests. * Fix test. * Fix test. * Revert lint change. * Migrated CreateWithUserIds to sqlx. * Adds tests for GetMember; migrates implementation to sqlx. * Tests GetNonMemberUsersPage and hanles wrong group id. * Fixes test. * Switches GetMaster to GetMasterX. * Switches GetReplica to GetReplicaX. * Fixes logic. * Fixes shadow declaration. * Adds include_member_count to get group API endpoint. * Adds filter_has_member param to getGroups. * Fixes. * Removes array of group sources. * fixing error * Testing reverting CreateWithUserIds back to gorp. * Added websocket event for CreateGroupWithUserIds. * Changed a few response status codes. Switched to correct permission. * Added member count to ws payload for group when updating or creating. * Adds feature flag checks for custom groups. * Added middleware function to require license. Added config to disable custom groups. * Change for function signature change of executePossiblyEmptyQuery. * Lint fixes. * Adds telemetry none comment. * Adds translations. * Migrated to sqlx. * Temp. removal of translation. * Fixed typo. * Added an intermediary model to query with a field that is now ignored by sqlx on read queries. * Re-used existing store struct. * Inludes member count. * Fix for merge error.' * Require license for group endpoints. * Updates translations. * Fix shadow declaration. * Renames permissions. Switches to new method to retrieve remoteid. * Added WS events for upsert and delete member(s). * Added new store error type ErrUniqueConstraint. * Added EnableCustonGroups to the client config. * Sanitized some user records. * Added parameter to include_total_count for listing groups. * Added translations. * adding deleteAt field to getByUsers query * Revert sanitize. * Added uniqueness constraint error to UpdateGroup. * Removed the FutureFeatures flag so that the feature is not enabled on old Enterprise licenses. * Renamed function. * Updates authz check for user search related to groups. * Removed debug statement. * Removed unused app method. * Added telemetry for enable_custom_groups. * Returns early from nil license. * Updates test. * Returned early to avoid nesting in (*SqlGroupStore).checkUserExist. Switched to reading from replica in (*SqlGroupStore).GetMember. Handled JSON marshal error in (*Client4).UpsertGroupMembers * Switched to SanitizeProfile. * Switched to model.NewInt. * Switched from status NotImplemented to Forbidden for missing license. * Removed deactivated users from 'exists' set. * Revert gotool update. * Ignored lint error that I think is invalid. * Added the approprate access tag for disabling custom groups. * Revert change to response status. * Fixed refactor mistake. * Limited the group member WS events to individual users. * Removed WS event of deleted groups. * Updated license check for searchUsers endpoint. * Switched from license feature to license sku. * Update app/group.go Co-authored-by: Claudio Costa <cstcld91@gmail.com> * Update app/group.go Co-authored-by: Claudio Costa <cstcld91@gmail.com> * Remove linter ignore comment. * Added function to create sku-specific license. * Fixed typo. Removed comment. * Fixed for wrong type. * Added missing param to client. Removed unnecessary props setting. Added test for retrieving groups by source. * Updated some tests now that we're validating group membership not created for deactivated user. * Fix for groups endpoint returning all group types by default. * Changes constant names. Adds migration for all users to manage custom group members. * Removes requirement for manage_system permission to filter user search by group. * Added migration mock. * Removes default permissions from custom_group_user role. * Fixes migration. * Fixes emoji migration test. * fixing issue with member counts * fixing search issue for deleted members Co-authored-by: Benjamin Cooke <benjamincooke@Benjamins-MacBook-Pro.local> Co-authored-by: Benjamin Cooke <benjamincooke@Benjamins-MBP.ht.home> Co-authored-by: Mattermod <mattermod@users.noreply.github.com> Co-authored-by: Benjamin Cooke <benjamincooke@Benjamins-MacBook-Pro.fritz.box> Co-authored-by: Claudio Costa <cstcld91@gmail.com>
2022-02-17 12:34:39 -05:00
--- a/api4/apitestlib.go
+++ b/api4/apitestlib.go
@@ -894,7 +894,7 @@ func (th *TestHelper) CreateGroup() *model.Group {
 		Name:        model.NewString("n-" + id),
 		DisplayName: "dn_" + id,
 		Source:      model.GroupSourceLdap,
-		RemoteId:    "ri_" + id,
+		RemoteId:    model.NewString("ri_" + model.NewId()),
 	}

 	group, err := th.App.CreateGroup(group)
--- a/api4/channel_test.go
+++ b/api4/channel_test.go
@@ -4320,7 +4320,7 @@ func TestGetChannelMemberCountsByGroup(t *testing.T) {
 		DisplayName: "dn_" + id,
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	}

 	_, appErr = th.App.CreateGroup(group)
--- a/api4/group.go
+++ b/api4/group.go
@@ -11,70 +11,86 @@ import (
 	"strconv"
 	"strings"

+	"github.com/mattermost/mattermost-server/v6/app"
 	"github.com/mattermost/mattermost-server/v6/audit"
 	"github.com/mattermost/mattermost-server/v6/model"
 )

 func (api *API) InitGroup() {
 	// GET /api/v4/groups
-	api.BaseRoutes.Groups.Handle("", api.APISessionRequired(getGroups)).Methods("GET")
+	api.BaseRoutes.Groups.Handle("", api.APISessionRequired(requireLicense(getGroups))).Methods("GET")
+
+	// POST /api/v4/groups
+	api.BaseRoutes.Groups.Handle("", api.APISessionRequired(requireLicense(createGroup))).Methods("POST")

 	// GET /api/v4/groups/:group_id
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}",
-		api.APISessionRequired(getGroup)).Methods("GET")
+		api.APISessionRequired(requireLicense(getGroup))).Methods("GET")

 	// PUT /api/v4/groups/:group_id/patch
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/patch",
-		api.APISessionRequired(patchGroup)).Methods("PUT")
+		api.APISessionRequired(requireLicense(patchGroup))).Methods("PUT")

 	// POST /api/v4/groups/:group_id/teams/:team_id/link
 	// POST /api/v4/groups/:group_id/channels/:channel_id/link
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/{syncable_type:teams|channels}/{syncable_id:[A-Za-z0-9]+}/link",
-		api.APISessionRequired(linkGroupSyncable)).Methods("POST")
+		api.APISessionRequired(requireLicense(linkGroupSyncable))).Methods("POST")

 	// DELETE /api/v4/groups/:group_id/teams/:team_id/link
 	// DELETE /api/v4/groups/:group_id/channels/:channel_id/link
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/{syncable_type:teams|channels}/{syncable_id:[A-Za-z0-9]+}/link",
-		api.APISessionRequired(unlinkGroupSyncable)).Methods("DELETE")
+		api.APISessionRequired(requireLicense(unlinkGroupSyncable))).Methods("DELETE")

 	// GET /api/v4/groups/:group_id/teams/:team_id
 	// GET /api/v4/groups/:group_id/channels/:channel_id
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/{syncable_type:teams|channels}/{syncable_id:[A-Za-z0-9]+}",
-		api.APISessionRequired(getGroupSyncable)).Methods("GET")
+		api.APISessionRequired(requireLicense(getGroupSyncable))).Methods("GET")

 	// GET /api/v4/groups/:group_id/teams
 	// GET /api/v4/groups/:group_id/channels
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/{syncable_type:teams|channels}",
-		api.APISessionRequired(getGroupSyncables)).Methods("GET")
+		api.APISessionRequired(requireLicense(getGroupSyncables))).Methods("GET")

 	// PUT /api/v4/groups/:group_id/teams/:team_id/patch
 	// PUT /api/v4/groups/:group_id/channels/:channel_id/patch
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/{syncable_type:teams|channels}/{syncable_id:[A-Za-z0-9]+}/patch",
-		api.APISessionRequired(patchGroupSyncable)).Methods("PUT")
+		api.APISessionRequired(requireLicense(patchGroupSyncable))).Methods("PUT")

 	// GET /api/v4/groups/:group_id/stats
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/stats",
-		api.APISessionRequired(getGroupStats)).Methods("GET")
+		api.APISessionRequired(requireLicense(getGroupStats))).Methods("GET")

-	// GET /api/v4/groups/:group_id/members?page=0&per_page=100
+	// GET /api/v4/groups/:group_id/members
 	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/members",
-		api.APISessionRequired(getGroupMembers)).Methods("GET")
+		api.APISessionRequired(requireLicense(getGroupMembers))).Methods("GET")

-	// GET /api/v4/users/:user_id/groups?page=0&per_page=100
+	// GET /api/v4/users/:user_id/groups
 	api.BaseRoutes.Users.Handle("/{user_id:[A-Za-z0-9]+}/groups",
-		api.APISessionRequired(getGroupsByUserId)).Methods("GET")
+		api.APISessionRequired(requireLicense(getGroupsByUserId))).Methods("GET")

-	// GET /api/v4/channels/:channel_id/groups?page=0&per_page=100
+	// GET /api/v4/channels/:channel_id/groups
 	api.BaseRoutes.Channels.Handle("/{channel_id:[A-Za-z0-9]+}/groups",
-		api.APISessionRequired(getGroupsByChannel)).Methods("GET")
+		api.APISessionRequired(requireLicense(getGroupsByChannel))).Methods("GET")

-	// GET /api/v4/teams/:team_id/groups?page=0&per_page=100
+	// GET /api/v4/teams/:team_id/groups
 	api.BaseRoutes.Teams.Handle("/{team_id:[A-Za-z0-9]+}/groups",
-		api.APISessionRequired(getGroupsByTeam)).Methods("GET")
+		api.APISessionRequired(requireLicense(getGroupsByTeam))).Methods("GET")

-	// GET /api/v4/teams/:team_id/groups_by_channels?page=0&per_page=100
+	// GET /api/v4/teams/:team_id/groups_by_channels
 	api.BaseRoutes.Teams.Handle("/{team_id:[A-Za-z0-9]+}/groups_by_channels",
-		api.APISessionRequired(getGroupsAssociatedToChannelsByTeam)).Methods("GET")
+		api.APISessionRequired(requireLicense(getGroupsAssociatedToChannelsByTeam))).Methods("GET")
+
+	// DELETE /api/v4/groups/:group_id
+	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}",
+		api.APISessionRequired(requireLicense(deleteGroup))).Methods("DELETE")
+
+	// POST /api/v4/groups/:group_id/members
+	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/members",
+		api.APISessionRequired(requireLicense(addGroupMembers))).Methods("POST")
+
+	// DELETE /api/v4/groups/:group_id/members
+	api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}/members",
+		api.APISessionRequired(requireLicense(deleteGroupMembers))).Methods("DELETE")
 }

 func getGroup(c *Context, w http.ResponseWriter, r *http.Request) {
@@ -83,22 +99,27 @@ func getGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	if c.App.Srv().License() == nil || !*c.App.Srv().License().Features.LDAPGroups {
-		c.Err = model.NewAppError("Api4.getGroup", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
-		return
-	}
-
-	if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionSysconsoleReadUserManagementGroups) {
-		c.SetPermissionError(model.PermissionSysconsoleReadUserManagementGroups)
-		return
-	}
-
-	group, err := c.App.GetGroup(c.Params.GroupId)
+	group, err := c.App.GetGroup(c.Params.GroupId, &model.GetGroupOpts{
+		IncludeMemberCount: c.Params.IncludeMemberCount,
+	})
 	if err != nil {
 		c.Err = err
 		return
 	}

+	if group.Source == model.GroupSourceLdap {
+		if !c.App.SessionHasPermissionToGroup(*c.AppContext.Session(), c.Params.GroupId, model.PermissionSysconsoleReadUserManagementGroups) {
+			c.SetPermissionError(model.PermissionSysconsoleReadUserManagementGroups)
+			return
+		}
+	}
+
+	if lcErr := licensedAndConfiguredForGroupBySource(c.App, group.Source); lcErr != nil {
+		lcErr.Where = "Api4.getGroup"
+		c.Err = lcErr
+		return
+	}
+
 	b, marshalErr := json.Marshal(group)
 	if marshalErr != nil {
 		c.Err = model.NewAppError("Api4.getGroup", "api.marshal_error", nil, marshalErr.Error(), http.StatusInternalServerError)
@@ -108,36 +129,102 @@ func getGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 	w.Write(b)
 }

+func createGroup(c *Context, w http.ResponseWriter, r *http.Request) {
+	var group *model.GroupWithUserIds
+	if jsonErr := json.NewDecoder(r.Body).Decode(&group); jsonErr != nil {
+		c.SetInvalidParam("group")
+		return
+	}
+
+	if group.Source != model.GroupSourceCustom {
+		c.Err = model.NewAppError("createGroup", "app.group.crud_permission", nil, "", http.StatusNotImplemented)
+		return
+	}
+
+	if lcErr := licensedAndConfiguredForGroupBySource(c.App, group.Source); lcErr != nil {
+		lcErr.Where = "Api4.createGroup"
+		c.Err = lcErr
+		return
+	}
+
+	if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionCreateCustomGroup) {
+		c.SetPermissionError(model.PermissionCreateCustomGroup)
+		return
+	}
+
+	if !group.AllowReference {
+		c.Err = model.NewAppError("createGroup", "api.custom_groups.must_be_referenceable", nil, "", http.StatusNotImplemented)
+		return
+	}
+
+	if group.GetRemoteId() != "" {
+		c.Err = model.NewAppError("createGroup", "api.custom_groups.no_remote_id", nil, "", http.StatusNotImplemented)
+		return
+	}
+
+	auditRec := c.MakeAuditRecord("createGroup", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+	auditRec.AddMeta("group", group)
+
+	newGroup, err := c.App.CreateGroupWithUserIds(group)
+	if err != nil {
+		c.Err = err
+		return
+	}
+
+	auditRec.AddMeta("group", newGroup)
+	js, jsonErr := json.Marshal(newGroup)
+	if jsonErr != nil {
+		c.Err = model.NewAppError("createGroup", "api.marshal_error", nil, jsonErr.Error(), http.StatusInternalServerError)
+		return
+	}
+	auditRec.Success()
+	w.WriteHeader(http.StatusCreated)
+	w.Write(js)
+}
+
 func patchGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 	c.RequireGroupId()
 	if c.Err != nil {
 		return
 	}

+	group, err := c.App.GetGroup(c.Params.GroupId, nil)
+	if err != nil {
+		c.Err = err
+		return
+	}
+
+	if lcErr := licensedAndConfiguredForGroupBySource(c.App, group.Source); lcErr != nil {
+		lcErr.Where = "Api4.patchGroup"
+		c.Err = lcErr
+		return
+	}
+
+	var requiredPermission *model.Permission
+	if group.Source == model.GroupSourceCustom {
+		requiredPermission = model.PermissionEditCustomGroup
+	} else {
+		requiredPermission = model.PermissionSysconsoleWriteUserManagementGroups
+	}
+	if !c.App.SessionHasPermissionToGroup(*c.AppContext.Session(), c.Params.GroupId, requiredPermission) {
+		c.SetPermissionError(requiredPermission)
+		return
+	}
+
 	var groupPatch model.GroupPatch
 	if jsonErr := json.NewDecoder(r.Body).Decode(&groupPatch); jsonErr != nil {
 		c.SetInvalidParam("group")
 		return
 	}

+	if group.Source == model.GroupSourceCustom && groupPatch.AllowReference != nil && !*groupPatch.AllowReference {
+		c.Err = model.NewAppError("Api4.patchGroup", "api.custom_groups.must_be_referenceable", nil, "", http.StatusBadRequest)
+		return
+	}
+
 	auditRec := c.MakeAuditRecord("patchGroup", audit.Fail)
 	defer c.LogAuditRec(auditRec)
-
-	if c.App.Srv().License() == nil || !*c.App.Srv().License().Features.LDAPGroups {
-		c.Err = model.NewAppError("Api4.patchGroup", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
-		return
-	}
-
-	if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionSysconsoleWriteUserManagementGroups) {
-		c.SetPermissionError(model.PermissionSysconsoleWriteUserManagementGroups)
-		return
-	}
-
-	group, err := c.App.GetGroup(c.Params.GroupId)
-	if err != nil {
-		c.Err = err
-		return
-	}
 	auditRec.AddMeta("group", group)

 	if groupPatch.AllowReference != nil && *groupPatch.AllowReference {
@@ -223,7 +310,7 @@ func linkGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	if c.App.Srv().License() == nil || !*c.App.Srv().License().Features.LDAPGroups {
+	if !*c.App.Srv().License().Features.LDAPGroups {
 		c.Err = model.NewAppError("Api4.createGroupSyncable", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
 		return
 	}
@@ -279,7 +366,7 @@ func getGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 	syncableType := c.Params.SyncableType

-	if c.App.Srv().License() == nil || !*c.App.Srv().License().Features.LDAPGroups {
+	if !*c.App.Srv().License().Features.LDAPGroups {
 		c.Err = model.NewAppError("Api4.getGroupSyncable", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
 		return
 	}
@@ -316,7 +403,7 @@ func getGroupSyncables(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 	syncableType := c.Params.SyncableType

-	if c.App.Srv().License() == nil || !*c.App.Srv().License().Features.LDAPGroups {
+	if !*c.App.Srv().License().Features.LDAPGroups {
 		c.Err = model.NewAppError("Api4.getGroupSyncables", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
 		return
 	}
@@ -378,7 +465,7 @@ func patchGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	if c.App.Srv().License() == nil || !*c.App.Srv().License().Features.LDAPGroups {
+	if !*c.App.Srv().License().Features.LDAPGroups {
 		c.Err = model.NewAppError("Api4.patchGroupSyncable", "api.ldap_groups.license_error", nil, "",
 			http.StatusNotImplemented)
 		return
@@ -444,7 +531,7 @@ func unlinkGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
 	auditRec.AddMeta("syncable_id", syncableID)
 	auditRec.AddMeta("syncable_type", syncableType)

-	if c.App.Srv().License() == nil || !*c.App.Srv().License().Features.LDAPGroups {
+	if !*c.App.Srv().License().Features.LDAPGroups {
 		c.Err = model.NewAppError("Api4.unlinkGroupSyncable", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
 		return
 	}
@@ -503,12 +590,19 @@ func getGroupMembers(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	if c.App.Srv().License() == nil || !*c.App.Srv().License().Features.LDAPGroups {
-		c.Err = model.NewAppError("Api4.getGroupMembers", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
+	group, err := c.App.GetGroup(c.Params.GroupId, nil)
+	if err != nil {
+		c.Err = err
 		return
 	}

-	if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionSysconsoleReadUserManagementGroups) {
+	if lcErr := licensedAndConfiguredForGroupBySource(c.App, group.Source); lcErr != nil {
+		lcErr.Where = "Api4.getGroupMembers"
+		c.Err = lcErr
+		return
+	}
+
+	if group.Source == model.GroupSourceLdap && !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionSysconsoleReadUserManagementGroups) {
 		c.SetPermissionError(model.PermissionSysconsoleReadUserManagementGroups)
 		return
 	}
@@ -540,7 +634,7 @@ func getGroupStats(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	if c.App.Srv().License() == nil || !*c.App.Srv().License().Features.LDAPGroups {
+	if !*c.App.Srv().License().Features.LDAPGroups {
 		c.Err = model.NewAppError("Api4.getGroupStats", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
 		return
 	}
@@ -580,7 +674,7 @@ func getGroupsByUserId(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	if c.App.Srv().License() == nil || !*c.App.Srv().License().Features.LDAPGroups {
+	if !*c.App.Srv().License().Features.LDAPGroups {
 		c.Err = model.NewAppError("Api4.getGroupsByUserId", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
 		return
 	}
@@ -663,7 +757,6 @@ func getGroupsByTeam(c *Context, w http.ResponseWriter, r *http.Request) {
 	if c.Err != nil {
 		return
 	}
-
 	if c.App.Srv().License() == nil || !*c.App.Srv().License().Features.LDAPGroups {
 		c.Err = model.NewAppError("Api4.getGroupsByTeam", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
 		return
@@ -706,7 +799,7 @@ func getGroupsAssociatedToChannelsByTeam(c *Context, w http.ResponseWriter, r *h
 		return
 	}

-	if c.App.Srv().License() == nil || !*c.App.Srv().License().Features.LDAPGroups {
+	if !*c.App.Srv().License().Features.LDAPGroups {
 		c.Err = model.NewAppError("Api4.getGroupsAssociatedToChannelsByTeam", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
 		return
 	}
@@ -741,10 +834,6 @@ func getGroupsAssociatedToChannelsByTeam(c *Context, w http.ResponseWriter, r *h
 }

 func getGroups(c *Context, w http.ResponseWriter, r *http.Request) {
-	if c.App.Srv().License() == nil || !*c.App.Srv().License().Features.LDAPGroups {
-		c.Err = model.NewAppError("Api4.getGroups", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
-		return
-	}
 	var teamID, channelID string

 	if id := c.Params.NotAssociatedToTeam; model.IsValidId(id) {
@@ -760,6 +849,19 @@ func getGroups(c *Context, w http.ResponseWriter, r *http.Request) {
 		IncludeMemberCount:        c.Params.IncludeMemberCount,
 		FilterAllowReference:      c.Params.FilterAllowReference,
 		FilterParentTeamPermitted: c.Params.FilterParentTeamPermitted,
+		Source:                    c.Params.GroupSource,
+		FilterHasMember:           c.Params.FilterHasMember,
+	}
+
+	if !c.App.Config().FeatureFlags.CustomGroups && opts.Source == model.GroupSourceCustom {
+		c.Err = model.NewAppError("getGroups", "api.custom_groups.feature_disabled", nil, "", http.StatusNotImplemented)
+		return
+	}
+
+	if lcErr := licensedAndConfiguredForGroupBySource(c.App, opts.Source); lcErr != nil {
+		lcErr.Where = "Api4.getGroups"
+		c.Err = lcErr
+		return
 	}

 	if teamID != "" {
@@ -807,7 +909,23 @@ func getGroups(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	b, marshalErr := json.Marshal(groups)
+	var b []byte
+	var marshalErr error
+	if c.Params.IncludeTotalCount {
+		totalCount, countErr := c.App.Srv().Store.Group().GroupCount()
+		if countErr != nil {
+			c.Err = model.NewAppError("Api4.getGroups", "api.custom_groups.count_err", nil, countErr.Error(), http.StatusInternalServerError)
+			return
+		}
+		gwc := &model.GroupsWithCount{
+			Groups:     groups,
+			TotalCount: totalCount,
+		}
+		b, marshalErr = json.Marshal(gwc)
+	} else {
+		b, marshalErr = json.Marshal(groups)
+	}
+
 	if marshalErr != nil {
 		c.Err = model.NewAppError("Api4.getGroups", "api.marshal_error", nil, marshalErr.Error(), http.StatusInternalServerError)
 		return
@@ -815,3 +933,181 @@ func getGroups(c *Context, w http.ResponseWriter, r *http.Request) {

 	w.Write(b)
 }
+
+func deleteGroup(c *Context, w http.ResponseWriter, r *http.Request) {
+	c.RequireGroupId()
+	if c.Err != nil {
+		return
+	}
+
+	group, err := c.App.GetGroup(c.Params.GroupId, nil)
+	if err != nil {
+		c.Err = err
+		return
+	}
+
+	if group.Source != model.GroupSourceCustom {
+		c.Err = model.NewAppError("Api4.deleteGroup", "app.group.crud_permission", nil, "", http.StatusNotImplemented)
+		return
+	}
+
+	if lcErr := licensedAndConfiguredForGroupBySource(c.App, model.GroupSourceCustom); lcErr != nil {
+		lcErr.Where = "Api4.deleteGroup"
+		c.Err = lcErr
+		return
+	}
+
+	if !c.App.SessionHasPermissionToGroup(*c.AppContext.Session(), c.Params.GroupId, model.PermissionDeleteCustomGroup) {
+		c.SetPermissionError(model.PermissionDeleteCustomGroup)
+		return
+	}
+
+	auditRec := c.MakeAuditRecord("deleteGroup", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+	auditRec.AddMeta("group_id", c.Params.GroupId)
+
+	_, err = c.App.DeleteGroup(c.Params.GroupId)
+	if err != nil {
+		c.Err = err
+		return
+	}
+
+	auditRec.Success()
+
+	ReturnStatusOK(w)
+}
+
+func addGroupMembers(c *Context, w http.ResponseWriter, r *http.Request) {
+	c.RequireGroupId()
+	if c.Err != nil {
+		return
+	}
+
+	group, err := c.App.GetGroup(c.Params.GroupId, nil)
+	if err != nil {
+		c.Err = err
+		return
+	}
+
+	if group.Source != model.GroupSourceCustom {
+		c.Err = model.NewAppError("Api4.deleteGroup", "app.group.crud_permission", nil, "", http.StatusNotImplemented)
+		return
+	}
+
+	if lcErr := licensedAndConfiguredForGroupBySource(c.App, model.GroupSourceCustom); lcErr != nil {
+		lcErr.Where = "Api4.deleteGroup"
+		c.Err = lcErr
+		return
+	}
+
+	if !c.App.SessionHasPermissionToGroup(*c.AppContext.Session(), c.Params.GroupId, model.PermissionManageCustomGroupMembers) {
+		c.SetPermissionError(model.PermissionManageCustomGroupMembers)
+		return
+	}
+
+	var newMembers *model.GroupModifyMembers
+	if jsonErr := json.NewDecoder(r.Body).Decode(&newMembers); jsonErr != nil {
+		c.SetInvalidParam("addGroupMembers")
+		return
+	}
+
+	auditRec := c.MakeAuditRecord("addGroupMembers", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+	auditRec.AddMeta("addGroupMembers", newMembers)
+
+	members, err := c.App.UpsertGroupMembers(c.Params.GroupId, newMembers.UserIds)
+	if err != nil {
+		c.Err = err
+		return
+	}
+
+	b, marshalErr := json.Marshal(members)
+	if marshalErr != nil {
+		c.Err = model.NewAppError("Api4.addGroupMembers", "api.marshal_error", nil, marshalErr.Error(), http.StatusInternalServerError)
+		return
+	}
+	auditRec.Success()
+	w.Write(b)
+}
+
+func deleteGroupMembers(c *Context, w http.ResponseWriter, r *http.Request) {
+	c.RequireGroupId()
+	if c.Err != nil {
+		return
+	}
+
+	group, err := c.App.GetGroup(c.Params.GroupId, nil)
+	if err != nil {
+		c.Err = err
+		return
+	}
+
+	if group.Source != model.GroupSourceCustom {
+		c.Err = model.NewAppError("Api4.deleteGroup", "app.group.crud_permission", nil, "", http.StatusNotImplemented)
+		return
+	}
+
+	if lcErr := licensedAndConfiguredForGroupBySource(c.App, model.GroupSourceCustom); lcErr != nil {
+		lcErr.Where = "Api4.deleteGroup"
+		c.Err = lcErr
+		return
+	}
+
+	if !c.App.SessionHasPermissionToGroup(*c.AppContext.Session(), c.Params.GroupId, model.PermissionManageCustomGroupMembers) {
+		c.SetPermissionError(model.PermissionManageCustomGroupMembers)
+		return
+	}
+
+	var deleteBody *model.GroupModifyMembers
+	if jsonErr := json.NewDecoder(r.Body).Decode(&deleteBody); jsonErr != nil {
+		c.SetInvalidParam("deleteGroupMembers")
+		return
+	}
+
+	auditRec := c.MakeAuditRecord("deleteGroupMembers", audit.Fail)
+	defer c.LogAuditRec(auditRec)
+	auditRec.AddMeta("deleteGroupMembers", deleteBody)
+
+	members, err := c.App.DeleteGroupMembers(c.Params.GroupId, deleteBody.UserIds)
+	if err != nil {
+		c.Err = err
+		return
+	}
+
+	b, marshalErr := json.Marshal(members)
+	if marshalErr != nil {
+		c.Err = model.NewAppError("Api4.addGroupMembers", "api.marshal_error", nil, marshalErr.Error(), http.StatusInternalServerError)
+		return
+	}
+	auditRec.Success()
+	w.Write(b)
+}
+
+// licensedAndConfiguredForGroupBySource returns an app error if not properly license or configured for the given group type. The returned app error
+// will have a blank 'Where' field, which should be subsequently set by the caller, for example:
+//
+//    err := licensedAndConfiguredForGroupBySource(c.App, group.Source)
+//    err.Where = "Api4.getGroup"
+//
+// Temporarily, this function also checks for the CustomGroups feature flag.
+func licensedAndConfiguredForGroupBySource(app app.AppIface, source model.GroupSource) *model.AppError {
+	lic := app.Srv().License()
+
+	if lic == nil {
+		return model.NewAppError("", "api.license_error", nil, "", http.StatusNotImplemented)
+	}
+
+	if source == model.GroupSourceLdap && !*lic.Features.LDAPGroups {
+		return model.NewAppError("", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
+	}
+
+	if source == model.GroupSourceCustom && lic.SkuShortName != model.LicenseShortSkuProfessional && lic.SkuShortName != model.LicenseShortSkuEnterprise {
+		return model.NewAppError("", "api.custom_groups.license_error", nil, "", http.StatusNotImplemented)
+	}
+
+	if source == model.GroupSourceCustom && (!app.Config().FeatureFlags.CustomGroups || !*app.Config().ServiceSettings.EnableCustomGroups) {
+		return model.NewAppError("", "api.custom_groups.feature_disabled", nil, "", http.StatusNotImplemented)
+	}
+
+	return nil
+}
--- a/api4/group_test.go
+++ b/api4/group_test.go
@@ -26,7 +26,7 @@ func TestGetGroup(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

@@ -65,7 +65,135 @@ func TestGetGroup(t *testing.T) {
 	require.Error(t, err)
 	CheckUnauthorizedStatus(t, response)
 }
+func TestCreateGroup(t *testing.T) {
+	th := Setup(t)
+	defer th.TearDown()

+	id := model.NewId()
+	g := &model.Group{
+		DisplayName:    "dn_" + id,
+		Name:           model.NewString("name" + id),
+		Source:         model.GroupSourceCustom,
+		Description:    "description_" + id,
+		AllowReference: true,
+	}
+
+	th.App.Srv().SetLicense(model.NewTestLicenseSKU(model.LicenseShortSkuProfessional, "ldap"))
+
+	group, _, err := th.SystemAdminClient.CreateGroup(g)
+	require.NoError(t, err)
+
+	assert.Equal(t, g.DisplayName, group.DisplayName)
+	assert.Equal(t, g.Name, group.Name)
+	assert.Equal(t, g.Source, group.Source)
+	assert.Equal(t, g.Description, group.Description)
+	assert.Equal(t, g.RemoteId, group.RemoteId)
+
+	gbroken := &model.Group{
+		DisplayName: "dn_" + id,
+		Name:        model.NewString("name" + id),
+		Source:      "rrrr",
+		Description: "description_" + id,
+	}
+
+	_, response, err := th.SystemAdminClient.CreateGroup(gbroken)
+	require.Error(t, err)
+	CheckNotImplementedStatus(t, response)
+
+	validGroup := &model.Group{
+		DisplayName:    "dn_" + model.NewId(),
+		Name:           model.NewString("name" + model.NewId()),
+		Source:         model.GroupSourceCustom,
+		AllowReference: true,
+	}
+
+	th.RemovePermissionFromRole(model.PermissionCreateCustomGroup.Id, model.SystemAdminRoleId)
+	th.RemovePermissionFromRole(model.PermissionCreateCustomGroup.Id, model.SystemUserRoleId)
+	defer th.AddPermissionToRole(model.PermissionCreateCustomGroup.Id, model.SystemUserRoleId)
+	_, response, err = th.SystemAdminClient.CreateGroup(validGroup)
+	require.Error(t, err)
+	CheckForbiddenStatus(t, response)
+
+	th.AddPermissionToRole(model.PermissionCreateCustomGroup.Id, model.SystemAdminRoleId)
+	_, response, err = th.SystemAdminClient.CreateGroup(validGroup)
+	require.NoError(t, err)
+	CheckCreatedStatus(t, response)
+
+	unReferenceableCustomGroup := &model.Group{
+		DisplayName:    "dn_" + model.NewId(),
+		Name:           model.NewString("name" + model.NewId()),
+		Source:         model.GroupSourceCustom,
+		AllowReference: false,
+	}
+	_, response, err = th.SystemAdminClient.CreateGroup(unReferenceableCustomGroup)
+	require.Error(t, err)
+	CheckNotImplementedStatus(t, response)
+	unReferenceableCustomGroup.AllowReference = true
+	_, response, err = th.SystemAdminClient.CreateGroup(unReferenceableCustomGroup)
+	require.NoError(t, err)
+	CheckCreatedStatus(t, response)
+
+	customGroupWithRemoteID := &model.Group{
+		DisplayName:    "dn_" + model.NewId(),
+		Name:           model.NewString("name" + model.NewId()),
+		Source:         model.GroupSourceCustom,
+		AllowReference: true,
+		RemoteId:       model.NewString(model.NewId()),
+	}
+	_, response, err = th.SystemAdminClient.CreateGroup(customGroupWithRemoteID)
+	require.Error(t, err)
+	CheckNotImplementedStatus(t, response)
+
+	th.SystemAdminClient.Logout()
+	_, response, err = th.SystemAdminClient.CreateGroup(g)
+	require.Error(t, err)
+	CheckUnauthorizedStatus(t, response)
+}
+
+func TestDeleteGroup(t *testing.T) {
+	th := Setup(t)
+	defer th.TearDown()
+
+	id := model.NewId()
+	g, appErr := th.App.CreateGroup(&model.Group{
+		DisplayName: "dn_" + id,
+		Name:        model.NewString("name" + id),
+		Source:      model.GroupSourceLdap,
+		Description: "description_" + id,
+		RemoteId:    model.NewString(model.NewId()),
+	})
+	assert.Nil(t, appErr)
+
+	th.App.Srv().SetLicense(model.NewTestLicenseSKU(model.LicenseShortSkuProfessional))
+
+	_, response, err := th.Client.DeleteGroup(g.Id)
+	require.Error(t, err)
+	CheckNotImplementedStatus(t, response)
+
+	th.AddPermissionToRole(model.PermissionDeleteCustomGroup.Id, model.SystemUserRoleId)
+	_, response, err = th.Client.DeleteGroup(g.Id)
+	require.Error(t, err)
+	CheckNotImplementedStatus(t, response)
+
+	_, response, err = th.Client.DeleteGroup(g.Id)
+	require.Error(t, err)
+	CheckNotImplementedStatus(t, response)
+
+	_, response, err = th.Client.DeleteGroup("wertyuijhbgvfcde")
+	require.Error(t, err)
+	CheckBadRequestStatus(t, response)
+
+	validGroup, appErr := th.App.CreateGroup(&model.Group{
+		DisplayName: "dn_" + model.NewId(),
+		Name:        model.NewString("name" + model.NewId()),
+		Source:      model.GroupSourceCustom,
+	})
+	assert.Nil(t, appErr)
+
+	_, response, err = th.Client.DeleteGroup(validGroup.Id)
+	require.NoError(t, err)
+	CheckOKStatus(t, response)
+}
 func TestPatchGroup(t *testing.T) {
 	th := Setup(t)
 	defer th.TearDown()
@@ -76,7 +204,15 @@ func TestPatchGroup(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
+	})
+	assert.Nil(t, appErr)
+
+	g2, appErr := th.App.CreateGroup(&model.Group{
+		DisplayName:    "dn_" + model.NewId(),
+		Name:           model.NewString("name" + model.NewId()),
+		Source:         model.GroupSourceCustom,
+		AllowReference: true,
 	})
 	assert.Nil(t, appErr)

@@ -100,7 +236,7 @@ func TestPatchGroup(t *testing.T) {
 	require.Error(t, err)
 	CheckNotImplementedStatus(t, response)

-	th.App.Srv().SetLicense(model.NewTestLicense("ldap"))
+	th.App.Srv().SetLicense(model.NewTestLicenseSKU(model.LicenseShortSkuProfessional, "ldap"))

 	group2, response, err := th.SystemAdminClient.PatchGroup(g.Id, gp)
 	require.NoError(t, err)
@@ -131,6 +267,23 @@ func TestPatchGroup(t *testing.T) {
 	require.Error(t, err)
 	CheckNotFoundStatus(t, response)

+	_, response, err = th.SystemAdminClient.PatchGroup(g2.Id, &model.GroupPatch{
+		Name:           model.NewString(model.NewId()),
+		DisplayName:    model.NewString("foo"),
+		AllowReference: model.NewBool(false),
+	})
+	require.Error(t, err)
+	CheckBadRequestStatus(t, response)
+
+	// ensure that omitting the AllowReference field from the patch doesn't patch it to false
+	patchedG2, response, err := th.SystemAdminClient.PatchGroup(g2.Id, &model.GroupPatch{
+		Name:        model.NewString(model.NewId()),
+		DisplayName: model.NewString("foo"),
+	})
+	require.NoError(t, err)
+	CheckOKStatus(t, response)
+	require.Equal(t, true, patchedG2.AllowReference)
+
 	th.SystemAdminClient.Logout()
 	_, response, err = th.SystemAdminClient.PatchGroup(group.Id, gp)
 	require.Error(t, err)
@@ -147,7 +300,7 @@ func TestLinkGroupTeam(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

@@ -187,7 +340,7 @@ func TestLinkGroupChannel(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

@@ -229,7 +382,7 @@ func TestUnlinkGroupTeam(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

@@ -280,7 +433,7 @@ func TestUnlinkGroupChannel(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

@@ -332,7 +485,7 @@ func TestGetGroupTeam(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

@@ -394,7 +547,7 @@ func TestGetGroupChannel(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

@@ -456,7 +609,7 @@ func TestGetGroupTeams(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

@@ -509,7 +662,7 @@ func TestGetGroupChannels(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

@@ -561,7 +714,7 @@ func TestPatchGroupTeam(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

@@ -633,7 +786,7 @@ func TestPatchGroupChannel(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

@@ -716,7 +869,7 @@ func TestGetGroupsByChannel(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

@@ -735,6 +888,8 @@ func TestGetGroupsByChannel(t *testing.T) {
 		},
 	}

+	th.App.Srv().SetLicense(model.NewTestLicense("ldap"))
+
 	th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
 		_, _, response, err := client.GetGroupsByChannel("asdfasdf", opts)
 		require.Error(t, err)
@@ -795,7 +950,7 @@ func TestGetGroupsAssociatedToChannelsByTeam(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

@@ -814,6 +969,8 @@ func TestGetGroupsAssociatedToChannelsByTeam(t *testing.T) {
 		},
 	}

+	th.App.Srv().SetLicense(model.NewTestLicense("ldap"))
+
 	_, response, err := th.SystemAdminClient.GetGroupsAssociatedToChannelsByTeam("asdfasdf", opts)
 	require.Error(t, err)
 	CheckBadRequestStatus(t, response)
@@ -871,7 +1028,7 @@ func TestGetGroupsByTeam(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, err)

@@ -890,13 +1047,15 @@ func TestGetGroupsByTeam(t *testing.T) {
 		},
 	}

+	th.App.Srv().SetLicense(model.NewTestLicenseSKU(model.LicenseShortSkuProfessional))
+
 	th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
 		_, _, response, err := client.GetGroupsByTeam("asdfasdf", opts)
 		require.Error(t, err)
 		CheckBadRequestStatus(t, response)
 	})

-	th.App.Srv().SetLicense(nil)
+	th.App.Srv().RemoveLicense()

 	th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
 		_, _, response, err := client.GetGroupsByTeam(th.BasicTeam.Id, opts)
@@ -945,27 +1104,32 @@ func TestGetGroups(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)
 	start := group.UpdateAt - 1

+	id2 := model.NewId()
+	group2, appErr := th.App.CreateGroup(&model.Group{
+		DisplayName: "dn-foo_" + id2,
+		Name:        model.NewString("name" + id2),
+		Source:      model.GroupSourceCustom,
+		Description: "description_" + id2,
+		RemoteId:    model.NewString(model.NewId()),
+	})
+	assert.Nil(t, appErr)
+
 	opts := model.GroupSearchOpts{
+		Source: model.GroupSourceLdap,
 		PageOpts: &model.PageOpts{
 			Page:    0,
 			PerPage: 60,
 		},
 	}

-	th.App.Srv().SetLicense(nil)
+	th.App.Srv().SetLicense(model.NewTestLicenseSKU(model.LicenseShortSkuProfessional))

-	_, response, err := th.SystemAdminClient.GetGroups(opts)
-	require.Error(t, err)
-	CheckNotImplementedStatus(t, response)
-
-	th.App.Srv().SetLicense(model.NewTestLicense("ldap"))
-
-	_, _, err = th.SystemAdminClient.GetGroups(opts)
+	_, _, err := th.SystemAdminClient.GetGroups(opts)
 	require.NoError(t, err)

 	_, err = th.SystemAdminClient.UpdateChannelRoles(th.BasicChannel.Id, th.BasicUser.Id, "")
@@ -1031,6 +1195,12 @@ func TestGetGroups(t *testing.T) {
 	assert.Len(t, groups, 1)
 	// make sure it returned th.Group,not group
 	assert.Equal(t, groups[0].Id, th.Group.Id)
+
+	opts.Source = model.GroupSourceCustom
+	groups, _, err = th.Client.GetGroups(opts)
+	assert.NoError(t, err)
+	assert.Len(t, groups, 1)
+	assert.Equal(t, groups[0].Id, group2.Id)
 }

 func TestGetGroupsByUserId(t *testing.T) {
@@ -1043,7 +1213,7 @@ func TestGetGroupsByUserId(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

@@ -1059,7 +1229,7 @@ func TestGetGroupsByUserId(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

@@ -1109,7 +1279,7 @@ func TestGetGroupStats(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

@@ -1129,7 +1299,8 @@ func TestGetGroupStats(t *testing.T) {
 	})

 	t.Run("Returns stats for a group with no members", func(t *testing.T) {
-		stats, _, _ := th.SystemAdminClient.GetGroupStats(group.Id)
+		stats, _, err := th.SystemAdminClient.GetGroupStats(group.Id)
+		require.NoError(t, err)
 		assert.Equal(t, stats.GroupID, group.Id)
 		assert.Equal(t, stats.TotalMemberCount, int64(0))
 	})
@@ -1160,7 +1331,7 @@ func TestGetGroupsGroupConstrainedParentTeam(t *testing.T) {
 			Name:        model.NewString("name" + id),
 			Source:      model.GroupSourceLdap,
 			Description: "description_" + id,
-			RemoteId:    model.NewId(),
+			RemoteId:    model.NewString(model.NewId()),
 		})
 		require.Nil(t, err)
 		groups = append(groups, group)
@@ -1228,3 +1399,149 @@ func TestGetGroupsGroupConstrainedParentTeam(t *testing.T) {
 	require.NotContains(t, apiGroups, groups[0])
 	require.Contains(t, apiGroups, groups[2])
 }
+
+func TestAddMembersToGroup(t *testing.T) {
+	th := Setup(t)
+	defer th.TearDown()
+
+	// 1. Test with custom source
+	id := model.NewId()
+	group, err := th.App.CreateGroup(&model.Group{
+		DisplayName: "dn_" + id,
+		Name:        model.NewString("name" + id),
+		Source:      model.GroupSourceCustom,
+		Description: "description_" + id,
+	})
+	assert.Nil(t, err)
+
+	user1, appErr := th.App.CreateUser(th.Context, &model.User{Email: th.GenerateTestEmail(), Nickname: "test user1", Password: "test-password-1", Username: "test-user-1", Roles: model.SystemUserRoleId})
+	assert.Nil(t, appErr)
+
+	user2, appErr := th.App.CreateUser(th.Context, &model.User{Email: th.GenerateTestEmail(), Nickname: "test user2", Password: "test-password-2", Username: "test-user-2", Roles: model.SystemUserRoleId})
+	assert.Nil(t, appErr)
+
+	members := &model.GroupModifyMembers{
+		UserIds: []string{user1.Id, user2.Id},
+	}
+
+	th.App.Srv().SetLicense(model.NewTestLicenseSKU(model.LicenseShortSkuProfessional))
+
+	groupMembers, response, upsertErr := th.SystemAdminClient.UpsertGroupMembers(group.Id, members)
+	require.NoError(t, upsertErr)
+	CheckOKStatus(t, response)
+
+	assert.Len(t, groupMembers, 2)
+
+	count, countErr := th.App.GetGroupMemberCount(group.Id)
+	assert.Nil(t, countErr)
+
+	assert.Equal(t, count, int64(2))
+
+	// 2. Test invalid group ID
+	_, response, upsertErr = th.Client.UpsertGroupMembers("abc123", members)
+	require.Error(t, upsertErr)
+	CheckBadRequestStatus(t, response)
+
+	// 3. Test invalid user ID
+	invalidMembers := &model.GroupModifyMembers{
+		UserIds: []string{"abc123"},
+	}
+
+	_, response, upsertErr = th.SystemAdminClient.UpsertGroupMembers(group.Id, invalidMembers)
+	require.Error(t, upsertErr)
+	CheckInternalErrorStatus(t, response)
+
+	// 4. Test with ldap source
+	ldapId := model.NewId()
+	ldapGroup, err := th.App.CreateGroup(&model.Group{
+		DisplayName: "dn_" + ldapId,
+		Name:        model.NewString("name" + ldapId),
+		Source:      model.GroupSourceLdap,
+		Description: "description_" + ldapId,
+		RemoteId:    model.NewString(model.NewId()),
+	})
+	assert.Nil(t, err)
+
+	_, response, upsertErr = th.SystemAdminClient.UpsertGroupMembers(ldapGroup.Id, members)
+
+	require.Error(t, upsertErr)
+	CheckNotImplementedStatus(t, response)
+}
+
+func TestDeleteMembersFromGroup(t *testing.T) {
+	th := Setup(t)
+	defer th.TearDown()
+
+	// 1. Test with custom source
+	user1, appErr := th.App.CreateUser(th.Context, &model.User{Email: th.GenerateTestEmail(), Nickname: "test user1", Password: "test-password-1", Username: "test-user-1", Roles: model.SystemUserRoleId})
+	assert.Nil(t, appErr)
+
+	user2, appErr := th.App.CreateUser(th.Context, &model.User{Email: th.GenerateTestEmail(), Nickname: "test user2", Password: "test-password-2", Username: "test-user-2", Roles: model.SystemUserRoleId})
+	assert.Nil(t, appErr)
+
+	id := model.NewId()
+	g := &model.Group{
+		DisplayName: "dn_" + id,
+		Name:        model.NewString("name" + id),
+		Source:      model.GroupSourceCustom,
+		Description: "description_" + id,
+	}
+	group, err := th.App.CreateGroupWithUserIds(&model.GroupWithUserIds{
+		Group:   *g,
+		UserIds: []string{user1.Id, user2.Id},
+	})
+	assert.Nil(t, err)
+
+	members := &model.GroupModifyMembers{
+		UserIds: []string{user1.Id},
+	}
+
+	th.App.Srv().SetLicense(model.NewTestLicenseSKU(model.LicenseShortSkuProfessional))
+
+	groupMembers, response, deleteErr := th.SystemAdminClient.DeleteGroupMembers(group.Id, members)
+	require.NoError(t, deleteErr)
+	CheckOKStatus(t, response)
+
+	assert.Len(t, groupMembers, 1)
+	assert.Equal(t, groupMembers[0].UserId, user1.Id)
+
+	users, usersErr := th.App.GetGroupMemberUsers(group.Id)
+	assert.Nil(t, usersErr)
+
+	assert.Len(t, users, 1)
+	assert.Equal(t, users[0].Id, user2.Id)
+
+	// 2. Test invalid group ID
+	_, response, deleteErr = th.Client.DeleteGroupMembers("abc123", members)
+	require.Error(t, deleteErr)
+	CheckBadRequestStatus(t, response)
+
+	// 3. Test invalid user ID
+	invalidMembers := &model.GroupModifyMembers{
+		UserIds: []string{"abc123"},
+	}
+
+	_, response, deleteErr = th.SystemAdminClient.DeleteGroupMembers(group.Id, invalidMembers)
+	require.Error(t, deleteErr)
+	CheckInternalErrorStatus(t, response)
+
+	// 4. Test with ldap source
+	ldapId := model.NewId()
+	g1 := &model.Group{
+		DisplayName: "dn_" + ldapId,
+		Name:        model.NewString("name" + ldapId),
+		Source:      model.GroupSourceLdap,
+		Description: "description_" + ldapId,
+		RemoteId:    model.NewString(model.NewId()),
+	}
+	ldapGroup, err := th.App.CreateGroupWithUserIds(&model.GroupWithUserIds{
+		Group:   *g1,
+		UserIds: []string{user1.Id, user2.Id},
+	})
+	assert.Nil(t, err)
+
+	_, response, deleteErr = th.SystemAdminClient.DeleteGroupMembers(ldapGroup.Id, members)
+
+	require.Error(t, deleteErr)
+	CheckNotImplementedStatus(t, response)
+}
--- a/api4/handlers.go
+++ b/api4/handlers.go
@@ -8,14 +8,17 @@ import (

 	"github.com/mattermost/gziphandler"

+	"github.com/mattermost/mattermost-server/v6/model"
 	"github.com/mattermost/mattermost-server/v6/web"
 )

 type Context = web.Context

+type handlerFunc func(*Context, http.ResponseWriter, *http.Request)
+
 // APIHandler provides a handler for API endpoints which do not require the user to be logged in order for access to be
 // granted.
-func (api *API) APIHandler(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
+func (api *API) APIHandler(h handlerFunc) http.Handler {
 	handler := &web.Handler{
 		Srv:            api.srv,
 		HandleFunc:     h,
@@ -34,7 +37,7 @@ func (api *API) APIHandler(h func(*Context, http.ResponseWriter, *http.Request))

 // APISessionRequired provides a handler for API endpoints which require the user to be logged in in order for access to
 // be granted.
-func (api *API) APISessionRequired(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
+func (api *API) APISessionRequired(h handlerFunc) http.Handler {
 	handler := &web.Handler{
 		Srv:            api.srv,
 		HandleFunc:     h,
@@ -53,7 +56,7 @@ func (api *API) APISessionRequired(h func(*Context, http.ResponseWriter, *http.R
 }

 // CloudAPIKeyRequired provides a handler for webhook endpoints to access Cloud installations from CWS
-func (api *API) CloudAPIKeyRequired(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
+func (api *API) CloudAPIKeyRequired(h handlerFunc) http.Handler {
 	handler := &web.Handler{
 		Srv:             api.srv,
 		HandleFunc:      h,
@@ -73,7 +76,7 @@ func (api *API) CloudAPIKeyRequired(h func(*Context, http.ResponseWriter, *http.
 }

 // RemoteClusterTokenRequired provides a handler for remote cluster requests to /remotecluster endpoints.
-func (api *API) RemoteClusterTokenRequired(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
+func (api *API) RemoteClusterTokenRequired(h handlerFunc) http.Handler {
 	handler := &web.Handler{
 		Srv:                       api.srv,
 		HandleFunc:                h,
@@ -95,7 +98,7 @@ func (api *API) RemoteClusterTokenRequired(h func(*Context, http.ResponseWriter,
 // APISessionRequiredMfa provides a handler for API endpoints which require a logged-in user session  but when accessed,
 // if MFA is enabled, the MFA process is not yet complete, and therefore the requirement to have completed the MFA
 // authentication must be waived.
-func (api *API) APISessionRequiredMfa(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
+func (api *API) APISessionRequiredMfa(h handlerFunc) http.Handler {
 	handler := &web.Handler{
 		Srv:            api.srv,
 		HandleFunc:     h,
@@ -116,7 +119,7 @@ func (api *API) APISessionRequiredMfa(h func(*Context, http.ResponseWriter, *htt
 // APIHandlerTrustRequester provides a handler for API endpoints which do not require the user to be logged in and are
 // allowed to be requested directly rather than via javascript/XMLHttpRequest, such as site branding images or the
 // websocket.
-func (api *API) APIHandlerTrustRequester(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
+func (api *API) APIHandlerTrustRequester(h handlerFunc) http.Handler {
 	handler := &web.Handler{
 		Srv:            api.srv,
 		HandleFunc:     h,
@@ -136,7 +139,7 @@ func (api *API) APIHandlerTrustRequester(h func(*Context, http.ResponseWriter, *

 // APISessionRequiredTrustRequester provides a handler for API endpoints which do require the user to be logged in and
 // are allowed to be requested directly rather than via javascript/XMLHttpRequest, such as emoji or file uploads.
-func (api *API) APISessionRequiredTrustRequester(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
+func (api *API) APISessionRequiredTrustRequester(h handlerFunc) http.Handler {
 	handler := &web.Handler{
 		Srv:            api.srv,
 		HandleFunc:     h,
@@ -156,7 +159,7 @@ func (api *API) APISessionRequiredTrustRequester(h func(*Context, http.ResponseW

 // DisableWhenBusy provides a handler for API endpoints which should be disabled when the server is under load,
 // responding with HTTP 503 (Service Unavailable).
-func (api *API) APISessionRequiredDisableWhenBusy(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
+func (api *API) APISessionRequiredDisableWhenBusy(h handlerFunc) http.Handler {
 	handler := &web.Handler{
 		Srv:             api.srv,
 		HandleFunc:      h,
@@ -179,7 +182,7 @@ func (api *API) APISessionRequiredDisableWhenBusy(h func(*Context, http.Response
 // mode, this is, through a UNIX socket and without an authenticated
 // session, but with one that has no user set and no permission
 // restrictions
-func (api *API) APILocal(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
+func (api *API) APILocal(h handlerFunc) http.Handler {
 	handler := &web.Handler{
 		Srv:            api.srv,
 		HandleFunc:     h,
@@ -196,3 +199,13 @@ func (api *API) APILocal(h func(*Context, http.ResponseWriter, *http.Request)) h
 	}
 	return handler
 }
+
+func requireLicense(f handlerFunc) handlerFunc {
+	return func(c *Context, w http.ResponseWriter, r *http.Request) {
+		if c.App.Srv().License() == nil {
+			c.Err = model.NewAppError("", "api.license_error", nil, "", http.StatusNotImplemented)
+			return
+		}
+		f(c, w, r)
+	}
+}
--- a/api4/ldap.go
+++ b/api4/ldap.go
@@ -117,7 +117,7 @@ func getLdapGroups(c *Context, w http.ResponseWriter, r *http.Request) {
 	for _, group := range groups {
 		mug := &mixedUnlinkedGroup{
 			DisplayName: group.DisplayName,
-			RemoteId:    group.RemoteId,
+			RemoteId:    group.GetRemoteId(),
 		}
 		if len(group.Id) == 26 {
 			mug.Id = &group.Id
@@ -170,7 +170,7 @@ func linkLdapGroup(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	group, err := c.App.GetGroupByRemoteID(ldapGroup.RemoteId, model.GroupSourceLdap)
+	group, err := c.App.GetGroupByRemoteID(ldapGroup.GetRemoteId(), model.GroupSourceLdap)
 	if err != nil && err.Id != "app.group.no_rows" {
 		c.Err = err
 		return
--- a/api4/team_test.go
+++ b/api4/team_test.go
@@ -2915,7 +2915,7 @@ func TestImportTeam(t *testing.T) {
 		fileData, err := base64.StdEncoding.DecodeString(fileResp["results"])
 		require.NoError(t, err, "failed to decode base64 results data")

-		fileReturned := fmt.Sprintf("%s", fileData)
+		fileReturned := string(fileData)
 		require.Truef(t, strings.Contains(fileReturned, "darth.vader@stardeath.com"), "failed to report the user was imported, fileReturned: %s", fileReturned)

 		// Checking the imported users
--- a/api4/user.go
+++ b/api4/user.go
@@ -19,6 +19,7 @@ import (
 	"github.com/mattermost/mattermost-server/v6/shared/mlog"
 	"github.com/mattermost/mattermost-server/v6/store"
 	"github.com/mattermost/mattermost-server/v6/utils"
+	"github.com/mattermost/mattermost-server/v6/web"
 )

 func (api *API) InitUser() {
@@ -641,6 +642,7 @@ func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {
 	notInTeamId := r.URL.Query().Get("not_in_team")
 	inChannelId := r.URL.Query().Get("in_channel")
 	inGroupId := r.URL.Query().Get("in_group")
+	notInGroupId := r.URL.Query().Get("not_in_group")
 	notInChannelId := r.URL.Query().Get("not_in_channel")
 	groupConstrained := r.URL.Query().Get("group_constrained")
 	withoutTeam := r.URL.Query().Get("without_team")
@@ -664,7 +666,7 @@ func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {

 	// Currently only supports sorting on a team
 	// or sort="status" on inChannelId
-	if (sort == "last_activity_at" || sort == "create_at") && (inTeamId == "" || notInTeamId != "" || inChannelId != "" || notInChannelId != "" || withoutTeam != "" || inGroupId != "") {
+	if (sort == "last_activity_at" || sort == "create_at") && (inTeamId == "" || notInTeamId != "" || inChannelId != "" || notInChannelId != "" || withoutTeam != "" || inGroupId != "" || notInGroupId != "") {
 		c.SetInvalidURLParam("sort")
 		return
 	}
@@ -720,6 +722,7 @@ func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {
 		NotInTeamId:      notInTeamId,
 		NotInChannelId:   notInChannelId,
 		InGroupId:        inGroupId,
+		NotInGroupId:     notInGroupId,
 		GroupConstrained: groupConstrainedBool,
 		WithoutTeam:      withoutTeamBool,
 		Inactive:         inactiveBool,
@@ -807,13 +810,9 @@ func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {
 			profiles, err = c.App.GetUsersInChannelPage(userGetOptions, c.IsSystemAdmin())
 		}
 	} else if inGroupId != "" {
-		if c.App.Srv().License() == nil || !*c.App.Srv().License().Features.LDAPGroups {
-			c.Err = model.NewAppError("Api4.getUsersInGroup", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
-			return
-		}
-
-		if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionSysconsoleReadUserManagementGroups) {
-			c.SetPermissionError(model.PermissionSysconsoleReadUserManagementGroups)
+		if gErr := requireGroupAccess(c, inGroupId); gErr != nil {
+			gErr.Where = "Api.getUsers"
+			c.Err = gErr
 			return
 		}

@@ -822,6 +821,18 @@ func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {
 			c.Err = err
 			return
 		}
+	} else if notInGroupId != "" {
+		if gErr := requireGroupAccess(c, notInGroupId); gErr != nil {
+			gErr.Where = "Api.getUsers"
+			c.Err = gErr
+			return
+		}
+
+		profiles, err = c.App.GetUsersNotInGroupPage(notInGroupId, c.Params.Page, c.Params.PerPage)
+		if err != nil {
+			c.Err = err
+			return
+		}
 	} else {
 		userGetOptions, err = c.App.RestrictUsersGetByPermissions(c.AppContext.Session().UserId, userGetOptions)
 		if err != nil {
@@ -850,6 +861,25 @@ func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {
 	w.Write(js)
 }

+func requireGroupAccess(c *web.Context, groupID string) *model.AppError {
+	group, err := c.App.GetGroup(groupID, nil)
+	if err != nil {
+		return err
+	}
+
+	if lcErr := licensedAndConfiguredForGroupBySource(c.App, group.Source); lcErr != nil {
+		return lcErr
+	}
+
+	if group.Source == model.GroupSourceLdap {
+		if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionSysconsoleReadUserManagementGroups) {
+			return c.App.MakePermissionError(c.AppContext.Session(), []*model.Permission{model.PermissionSysconsoleReadUserManagementGroups})
+		}
+	}
+
+	return nil
+}
+
 func getUsersByIds(c *Context, w http.ResponseWriter, r *http.Request) {
 	userIds := model.ArrayFromJSON(r.Body)

@@ -958,13 +988,17 @@ func searchUsers(c *Context, w http.ResponseWriter, r *http.Request) {
 	}

 	if props.InGroupId != "" {
-		if c.App.Srv().License() == nil || !*c.App.Srv().License().Features.LDAPGroups {
-			c.Err = model.NewAppError("Api4.searchUsers", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
+		if gErr := requireGroupAccess(c, props.InGroupId); gErr != nil {
+			gErr.Where = "Api.searchUsers"
+			c.Err = gErr
 			return
 		}
+	}

-		if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionManageSystem) {
-			c.SetPermissionError(model.PermissionManageSystem)
+	if props.NotInGroupId != "" {
+		if gErr := requireGroupAccess(c, props.NotInGroupId); gErr != nil {
+			gErr.Where = "Api.searchUsers"
+			c.Err = gErr
 			return
 		}
 	}
@@ -1904,7 +1938,7 @@ func loginCWS(c *Context, w http.ResponseWriter, r *http.Request) {
 	if err != nil {
 		c.LogAuditWithUserId("", "failure - login_id="+loginID)
 		c.LogErrorByCode(err)
-		http.Redirect(w, r, *c.App.Config().ServiceSettings.SiteURL, 302)
+		http.Redirect(w, r, *c.App.Config().ServiceSettings.SiteURL, http.StatusNotFound)
 		return
 	}
 	auditRec.AddMeta("user", user)
@@ -1912,12 +1946,12 @@ func loginCWS(c *Context, w http.ResponseWriter, r *http.Request) {
 	err = c.App.DoLogin(c.AppContext, w, r, user, "", false, false, false)
 	if err != nil {
 		c.LogErrorByCode(err)
-		http.Redirect(w, r, *c.App.Config().ServiceSettings.SiteURL, 302)
+		http.Redirect(w, r, *c.App.Config().ServiceSettings.SiteURL, http.StatusNotFound)
 		return
 	}
 	c.LogAuditWithUserId(user.Id, "success")
 	c.App.AttachSessionCookies(c.AppContext, w, r)
-	http.Redirect(w, r, *c.App.Config().ServiceSettings.SiteURL, 302)
+	http.Redirect(w, r, *c.App.Config().ServiceSettings.SiteURL, http.StatusNotFound)
 }

 func logout(c *Context, w http.ResponseWriter, r *http.Request) {
--- a/api4/user_test.go
+++ b/api4/user_test.go
@@ -1179,7 +1179,7 @@ func TestSearchUsers(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

@@ -2751,7 +2751,7 @@ func TestGetUsersInGroup(t *testing.T) {
 		Name:        model.NewString("name" + id),
 		Source:      model.GroupSourceLdap,
 		Description: "description_" + id,
-		RemoteId:    model.NewId(),
+		RemoteId:    model.NewString(model.NewId()),
 	})
 	assert.Nil(t, appErr)

--- a/api4/webhook_test.go
+++ b/api4/webhook_test.go
@@ -719,7 +719,7 @@ func TestGetOutgoingWebhook(t *testing.T) {
 	CheckForbiddenStatus(t, resp)

 	th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
-		nonExistentHook := &model.OutgoingWebhook{ChannelId: th.BasicChannel.Id}
+		nonExistentHook := &model.OutgoingWebhook{}
 		_, resp, err = client.GetOutgoingWebhook(nonExistentHook.Id)
 		require.Error(t, err)
 		CheckNotFoundStatus(t, resp)
--- a/api4/websocket_norace_test.go
+++ b/api4/websocket_norace_test.go
@@ -1,8 +1,9 @@
-// +build !race
-
 // Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
 // See LICENSE.txt for license information.

+//go:build !race
+// +build !race
+
 package api4

 import (