MM-45715: Fix incorrect permissions (Round 2) (#20731)

We missed a case to return if there are no
items in the slice. Otherwise it falls through
and returns false incorrectly.

Rectified the tests to trigger the case.

https://mattermost.atlassian.net/browse/MM-45715

```release-note
NONE
```

api4/resolver_team_member_test.go

@@ -293,11 +293,31 @@ func TestGraphQLTeamMembers(t *testing.T) {
 func TestGraphQLTeamMembersAsGuest(t *testing.T) {
 	os.Setenv("MM_FEATUREFLAGS_GRAPHQL", "true")
 	defer os.Unsetenv("MM_FEATUREFLAGS_GRAPHQL")
-	th := Setup(t).InitBasic()
+
+	th := Setup(t)
+
+	id := model.NewId()
+	team := &model.Team{
+		DisplayName:     "dn_" + id,
+		Name:            GenerateTestTeamName(),
+		Email:           th.GenerateTestEmail(),
+		Type:            model.TeamOpen,
+		AllowOpenInvite: true,
+	}
+
+	var err error
+	team, _, err = th.Client.CreateTeam(team)
+	require.NoError(t, err)
+	th.BasicTeam = team
+
+	th.BasicChannel = th.CreatePublicChannel()
+	th.LinkUserToTeam(th.BasicUser, th.BasicTeam)
+	th.App.AddUserToChannel(th.Context, th.BasicUser, th.BasicChannel, false)
+	th.LoginBasic()
+
 	defer th.TearDown()
 
-	th.App.DemoteUserToGuest(th.Context, th.BasicUser)
-	th.BasicUser, _ = th.App.UpdateUserRoles(th.Context, th.BasicUser.Id, model.SystemGuestRoleId, false)
+	require.Nil(t, th.App.DemoteUserToGuest(th.Context, th.BasicUser))
 
 	var q struct {
 		TeamMembers []struct {

app/authorization.go

@@ -59,6 +59,10 @@ func (a *App) SessionHasPermissionToTeam(session model.Session, teamID string, p
 
 // SessionHasPermissionToTeams returns true only if user has access to all teams.
 func (a *App) SessionHasPermissionToTeams(c request.CTX, session model.Session, teamIDs []string, permission *model.Permission) bool {
+	if len(teamIDs) == 0 {
+		return true
+	}
+
 	for _, teamID := range teamIDs {
 		if teamID == "" {
 			return false
@@ -126,6 +130,10 @@ func (a *App) SessionHasPermissionToChannel(c request.CTX, session model.Session
 
 // SessionHasPermissionToChannels returns true only if user has access to all channels.
 func (a *App) SessionHasPermissionToChannels(c request.CTX, session model.Session, channelIDs []string, permission *model.Permission) bool {
+	if len(channelIDs) == 0 {
+		return true
+	}
+
 	for _, channelID := range channelIDs {
 		if channelID == "" {
 			return false