MM-47228 - restrict guest invitation flow if subscription plan does n… (#21195)

* MM-47228 - restrict guest invitation flow if subscription plan does not support it

* fix i18n texts and add unit test

* test the scenario where guest invites are blocked by subscription

* cover the success scenarios for cloud free trial and paid subscription

* fix go vet

* use the cloud prefix for the sku

* fix unit tests

* check the licence value to determine if the guest accounts are enabled

* remove unnecessary changes for getting the subscription information

* restrict user demotion if guestAccounts is not available in license

Co-authored-by: Pablo Velez Vidal <pablo.velez@mattermost.com>

api4/team.go

@@ -1462,12 +1462,12 @@ func inviteUsersToTeam(c *Context, w http.ResponseWriter, r *http.Request) {
 func inviteGuestsToChannels(c *Context, w http.ResponseWriter, r *http.Request) {
 	graceful := r.URL.Query().Get("graceful") != ""
 	if c.App.Channels().License() == nil {
-		c.Err = model.NewAppError("Api4.InviteGuestsToChannels", "api.team.invate_guests_to_channels.license.error", nil, "", http.StatusNotImplemented)
+		c.Err = model.NewAppError("Api4.InviteGuestsToChannels", "api.team.invite_guests_to_channels.license.error", nil, "", http.StatusNotImplemented)
 		return
 	}
 
 	if !*c.App.Config().GuestAccountsSettings.Enable {
-		c.Err = model.NewAppError("Api4.InviteGuestsToChannels", "api.team.invate_guests_to_channels.disabled.error", nil, "", http.StatusNotImplemented)
+		c.Err = model.NewAppError("Api4.InviteGuestsToChannels", "api.team.invite_guests_to_channels.disabled.error", nil, "", http.StatusNotImplemented)
 		return
 	}
 
@@ -1485,6 +1485,13 @@ func inviteGuestsToChannels(c *Context, w http.ResponseWriter, r *http.Request)
 		return
 	}
 
+	guestEnabled := c.App.Channels().License() != nil && *c.App.Channels().License().Features.GuestAccounts
+
+	if !guestEnabled {
+		c.Err = model.NewAppError("Api4.InviteGuestsToChannels", "api.team.invite_guests_to_channels.disabled.error", nil, "", http.StatusForbidden)
+		return
+	}
+
 	var guestsInvite model.GuestsInvite
 	if err := json.NewDecoder(r.Body).Decode(&guestsInvite); err != nil {
 		c.Err = model.NewAppError("Api4.inviteGuestsToChannels", "api.team.invite_guests_to_channels.invalid_body.app_error", nil, "", http.StatusBadRequest).Wrap(err)

api4/team_test.go

@@ -3361,6 +3361,52 @@ func TestInviteGuestsToTeam(t *testing.T) {
 	})
 }
 
+func TestInviteGuest(t *testing.T) {
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+	guest1 := th.GenerateTestEmail()
+	guest2 := th.GenerateTestEmail()
+
+	emailList := []string{guest1, guest2}
+	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.GuestAccountsSettings.Enable = true })
+	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableEmailInvitations = true })
+
+	t.Run("Guest Account not available in license returns forbidden", func(t *testing.T) {
+		th.App.Srv().SetLicense(model.NewTestLicenseWithFalseDefaults("guest_accounts"))
+
+		guestsInvite := model.GuestsInvite{
+			Emails:   emailList,
+			Channels: []string{th.BasicChannel.Id},
+			Message:  "test message",
+		}
+		buf, err := json.Marshal(guestsInvite)
+		require.NoError(t, err)
+
+		res, err := th.SystemAdminClient.DoAPIPost("/teams/"+th.BasicTeam.Id+"/invite-guests/email", string(buf))
+
+		require.Equal(t, http.StatusForbidden, res.StatusCode)
+		require.True(t, strings.Contains(err.Error(), "Guest accounts are disabled"))
+		require.Error(t, err)
+	})
+
+	t.Run("Guest Account available in license returns OK", func(t *testing.T) {
+		th.App.Srv().SetLicense(model.NewTestLicense("guest_accounts"))
+
+		guestsInvite := model.GuestsInvite{
+			Emails:   emailList,
+			Channels: []string{th.BasicChannel.Id},
+			Message:  "test message",
+		}
+		buf, err := json.Marshal(guestsInvite)
+		require.NoError(t, err)
+
+		res, err := th.SystemAdminClient.DoAPIPost("/teams/"+th.BasicTeam.Id+"/invite-guests/email", string(buf))
+
+		require.Equal(t, http.StatusOK, res.StatusCode)
+		require.NoError(t, err)
+	})
+}
+
 func TestGetTeamInviteInfo(t *testing.T) {
 	th := Setup(t).InitBasic()
 	defer th.TearDown()

api4/user.go

@@ -2699,6 +2699,13 @@ func demoteUserToGuest(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	guestEnabled := c.App.Channels().License() != nil && *c.App.Channels().License().Features.GuestAccounts
+
+	if !guestEnabled {
+		c.Err = model.NewAppError("Api4.demoteUserToGuest", "api.team.invite_guests_to_channels.disabled.error", nil, "", http.StatusForbidden)
+		return
+	}
+
 	auditRec := c.MakeAuditRecord("demoteUserToGuest", audit.Fail)
 	auditRec.AddEventParameter("user_id", c.Params.UserId)
 	defer c.LogAuditRec(auditRec)

api4/user_test.go

@@ -5204,6 +5204,26 @@ func TestDemoteUserToGuest(t *testing.T) {
 	th.App.Srv().SetLicense(model.NewTestLicense())
 
 	user := th.BasicUser
+	user2 := th.BasicUser2
+
+	t.Run("Guest Account not available in license returns forbidden", func(t *testing.T) {
+		th.App.Srv().SetLicense(model.NewTestLicenseWithFalseDefaults("guest_accounts"))
+
+		res, err := th.SystemAdminClient.DoAPIPost("/users/"+user2.Id+"/demote", "")
+
+		require.Equal(t, http.StatusForbidden, res.StatusCode)
+		require.True(t, strings.Contains(err.Error(), "Guest accounts are disabled"))
+		require.Error(t, err)
+	})
+
+	t.Run("Guest Account available in license returns OK", func(t *testing.T) {
+		th.App.Srv().SetLicense(model.NewTestLicense("guest_accounts"))
+
+		res, err := th.SystemAdminClient.DoAPIPost("/users/"+user2.Id+"/demote", "")
+
+		require.Equal(t, http.StatusOK, res.StatusCode)
+		require.NoError(t, err)
+	})
 
 	th.TestForSystemAdminAndLocal(t, func(t *testing.T, c *model.Client4) {
 		_, _, err := c.GetUser(user.Id, "")