MM-22067: Check guest email allowance separately (#13776)

app/user_test.go

@@ -653,6 +653,88 @@ func TestCreateUserWithToken(t *testing.T) {
 		require.Len(t, *members, 1)
 		assert.Equal(t, (*members)[0].ChannelId, th.BasicChannel.Id)
 	})
+
+	t.Run("create guest having email domain restrictions", func(t *testing.T) {
+		enableGuestDomainRestricions := *th.App.Config().GuestAccountsSettings.RestrictCreationToDomains
+		defer func() {
+			th.App.UpdateConfig(func(cfg *model.Config) {
+				cfg.GuestAccountsSettings.RestrictCreationToDomains = &enableGuestDomainRestricions
+			})
+		}()
+		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.GuestAccountsSettings.RestrictCreationToDomains = "restricted.com" })
+		forbiddenInvitationEmail := model.NewId() + "other-email@test.com"
+		grantedInvitationEmail := model.NewId() + "other-email@restricted.com"
+		forbiddenDomainToken := model.NewToken(
+			TOKEN_TYPE_GUEST_INVITATION,
+			model.MapToJson(map[string]string{"teamId": th.BasicTeam.Id, "email": forbiddenInvitationEmail, "channels": th.BasicChannel.Id}),
+		)
+		grantedDomainToken := model.NewToken(
+			TOKEN_TYPE_GUEST_INVITATION,
+			model.MapToJson(map[string]string{"teamId": th.BasicTeam.Id, "email": grantedInvitationEmail, "channels": th.BasicChannel.Id}),
+		)
+		require.Nil(t, th.App.Srv.Store.Token().Save(forbiddenDomainToken))
+		require.Nil(t, th.App.Srv.Store.Token().Save(grantedDomainToken))
+		guest := model.User{
+			Email:       strings.ToLower(model.NewId()) + "+test@example.com",
+			Nickname:    "Darth Vader",
+			Username:    "vader" + model.NewId(),
+			Password:    "passwd1",
+			AuthService: "",
+		}
+		newGuest, err := th.App.CreateUserWithToken(&guest, forbiddenDomainToken)
+		require.NotNil(t, err)
+		require.Nil(t, newGuest)
+		assert.Equal(t, "api.user.create_user.accepted_domain.app_error", err.Id)
+
+		newGuest, err = th.App.CreateUserWithToken(&guest, grantedDomainToken)
+		require.Nil(t, err)
+		assert.True(t, newGuest.IsGuest())
+		require.Equal(t, grantedInvitationEmail, newGuest.Email)
+		_, err = th.App.Srv.Store.Token().GetByToken(grantedDomainToken.Token)
+		require.NotNil(t, err)
+
+		members, err := th.App.GetChannelMembersForUser(th.BasicTeam.Id, newGuest.Id)
+		require.Nil(t, err)
+		require.Len(t, *members, 1)
+		assert.Equal(t, (*members)[0].ChannelId, th.BasicChannel.Id)
+	})
+
+	t.Run("create guest having team and system email domain restrictions", func(t *testing.T) {
+		th.BasicTeam.AllowedDomains = "restricted-team.com"
+		_, err := th.App.UpdateTeam(th.BasicTeam)
+		require.Nil(t, err, "Should update the team")
+		enableGuestDomainRestricions := *th.App.Config().TeamSettings.RestrictCreationToDomains
+		defer func() {
+			th.App.UpdateConfig(func(cfg *model.Config) {
+				cfg.TeamSettings.RestrictCreationToDomains = &enableGuestDomainRestricions
+			})
+		}()
+		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.RestrictCreationToDomains = "restricted.com" })
+		invitationEmail := model.NewId() + "other-email@test.com"
+		token := model.NewToken(
+			TOKEN_TYPE_GUEST_INVITATION,
+			model.MapToJson(map[string]string{"teamId": th.BasicTeam.Id, "email": invitationEmail, "channels": th.BasicChannel.Id}),
+		)
+		require.Nil(t, th.App.Srv.Store.Token().Save(token))
+		guest := model.User{
+			Email:       strings.ToLower(model.NewId()) + "+test@example.com",
+			Nickname:    "Darth Vader",
+			Username:    "vader" + model.NewId(),
+			Password:    "passwd1",
+			AuthService: "",
+		}
+		newGuest, err := th.App.CreateUserWithToken(&guest, token)
+		require.Nil(t, err)
+		assert.True(t, newGuest.IsGuest())
+		assert.Equal(t, invitationEmail, newGuest.Email, "The user email must be the invitation one")
+		_, err = th.App.Srv.Store.Token().GetByToken(token.Token)
+		require.NotNil(t, err)
+
+		members, err := th.App.GetChannelMembersForUser(th.BasicTeam.Id, newGuest.Id)
+		require.Nil(t, err)
+		require.Len(t, *members, 1)
+		assert.Equal(t, (*members)[0].ChannelId, th.BasicChannel.Id)
+	})
 }
 
 func TestPermanentDeleteUser(t *testing.T) {