Growth spike guest accounts (#19437)

* tools updates

* Revert "tools updates"

This reverts commit 6293297b55803c5a263e200ebd80192899666ae9.

* new endpoint to get users that should potentially be guests

* checking authservice to ensure they were an email signup

* adding tests for new endpoint

* fixing translation issue

* permissions for new endpoint

* fixing tests

* fixing when domain array is empty

* fixing when domain array is empty

* removing bots from request

Co-authored-by: Benjamin Cooke <benjamincooke@Benjamins-MacBook-Pro.local>
Co-authored-by: Benjamin Cooke <benjamincooke@Benjamins-MBP.ht.home>
Co-authored-by: mkraft <martinkraft@gmail.com>

api4/user.go

@@ -92,6 +92,8 @@ func (api *API) InitUser() {
 	api.BaseRoutes.User.Handle("/uploads", api.APISessionRequired(getUploadsForUser)).Methods("GET")
 	api.BaseRoutes.User.Handle("/channel_members", api.APISessionRequired(getChannelMembersForUser)).Methods("GET")
 
+	api.BaseRoutes.Users.Handle("/invalid_emails", api.APISessionRequired(getUsersWithInvalidEmails)).Methods("GET")
+
 	api.BaseRoutes.UserThreads.Handle("", api.APISessionRequired(getThreadsForUser)).Methods("GET")
 	api.BaseRoutes.UserThreads.Handle("/read", api.APISessionRequired(updateReadStateAllThreadsByUser)).Methods("PUT")
 
@@ -3171,3 +3173,24 @@ func updateReadStateAllThreadsByUser(c *Context, w http.ResponseWriter, r *http.
 	ReturnStatusOK(w)
 	auditRec.Success()
 }
+
+func getUsersWithInvalidEmails(c *Context, w http.ResponseWriter, r *http.Request) {
+	if *c.App.Config().TeamSettings.EnableOpenServer {
+		c.Err = model.NewAppError("GetUsersWithInvalidEmails", "api.users.invalid_emails.enable_open_server.app_error", nil, "", http.StatusBadRequest)
+		return
+	}
+
+	if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionSysconsoleReadUserManagementUsers) {
+		c.SetPermissionError(model.PermissionSysconsoleReadUserManagementUsers)
+		return
+	}
+
+	users, err := c.App.GetUsersWithInvalidEmails(c.Params.Page, c.Params.PerPage)
+	if err != nil {
+		c.Err = err
+		return
+	}
+
+	b, _ := json.Marshal(users)
+	w.Write(b)
+}

api4/user_test.go

@@ -6662,6 +6662,53 @@ func TestSetProfileImageWithProviderAttributes(t *testing.T) {
 	})
 }
 
+func TestGetUsersWithInvalidEmails(t *testing.T) {
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+	client := th.SystemAdminClient
+
+	user := model.User{
+		Email:    "ben@invalid.mattermost.com",
+		Nickname: "Ben Cooke",
+		Password: "hello1",
+		Username: GenerateTestUsername(),
+		Roles:    model.SystemAdminRoleId + " " + model.SystemUserRoleId,
+	}
+
+	_, resp, err := client.CreateUser(&user)
+	require.NoError(t, err)
+	CheckCreatedStatus(t, resp)
+
+	th.App.UpdateConfig(func(cfg *model.Config) {
+		*cfg.TeamSettings.EnableOpenServer = false
+		*cfg.TeamSettings.RestrictCreationToDomains = "localhost,simulator.amazonses.com"
+	})
+
+	users, _, err := client.GetUsersWithInvalidEmails(0, 50)
+	require.NoError(t, err)
+	assert.Len(t, users, 1)
+
+	th.App.UpdateConfig(func(cfg *model.Config) {
+		*cfg.TeamSettings.EnableOpenServer = true
+	})
+
+	_, resp, err = client.GetUsersWithInvalidEmails(0, 50)
+	require.Error(t, err)
+	CheckBadRequestStatus(t, resp)
+
+	th.App.UpdateConfig(func(cfg *model.Config) {
+		*cfg.TeamSettings.EnableOpenServer = false
+		*cfg.TeamSettings.RestrictCreationToDomains = "localhost,simulator.amazonses.com,invalid.mattermost.com"
+	})
+
+	users, _, err = client.GetUsersWithInvalidEmails(0, 50)
+	require.NoError(t, err)
+	assert.Len(t, users, 0)
+
+	_, resp, err = th.Client.GetUsersWithInvalidEmails(0, 50)
+	require.Error(t, err)
+	CheckForbiddenStatus(t, resp)
+}
 func TestUserUpdateEvents(t *testing.T) {
 	th := Setup(t).InitBasic()
 	defer th.TearDown()
@@ -6710,5 +6757,4 @@ func TestUserUpdateEvents(t *testing.T) {
 			require.Empty(t, eventUser.NotifyProps, "user event for non-source users should be sanitized")
 		})
 	})
-
 }