[MM-13500] Adds channel /search_group endpoint (#10805)

* [MM-13500] Adds channel /search_group endpoint

* Add LIMIT to the queries

* Fix i18n extract

* Fix tests

* Add a new endpoint to get profiles by group channel ids

* Rebase fix

api4/channel.go

@@ -18,6 +18,7 @@ func (api *API) InitChannel() {
 	api.BaseRoutes.Channels.Handle("", api.ApiSessionRequired(createChannel)).Methods("POST")
 	api.BaseRoutes.Channels.Handle("/direct", api.ApiSessionRequired(createDirectChannel)).Methods("POST")
 	api.BaseRoutes.Channels.Handle("/search", api.ApiSessionRequired(searchAllChannels)).Methods("POST")
+	api.BaseRoutes.Channels.Handle("/group/search", api.ApiSessionRequired(searchGroupChannels)).Methods("POST")
 	api.BaseRoutes.Channels.Handle("/group", api.ApiSessionRequired(createGroupChannel)).Methods("POST")
 	api.BaseRoutes.Channels.Handle("/members/{user_id:[A-Za-z0-9]+}/view", api.ApiSessionRequired(viewChannel)).Methods("POST")
 	api.BaseRoutes.Channels.Handle("/{channel_id:[A-Za-z0-9]+}/scheme", api.ApiSessionRequired(updateChannelScheme)).Methods("PUT")
@@ -356,6 +357,22 @@ func createDirectChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 	w.Write([]byte(sc.ToJson()))
 }
 
+func searchGroupChannels(c *Context, w http.ResponseWriter, r *http.Request) {
+	props := model.ChannelSearchFromJson(r.Body)
+	if props == nil {
+		c.SetInvalidParam("channel_search")
+		return
+	}
+
+	groupChannels, err := c.App.SearchGroupChannels(c.App.Session.UserId, props.Term)
+	if err != nil {
+		c.Err = err
+		return
+	}
+
+	w.Write([]byte(groupChannels.ToJson()))
+}
+
 func createGroupChannel(c *Context, w http.ResponseWriter, r *http.Request) {
 	userIds := model.ArrayFromJson(r.Body)
 

api4/channel_test.go

@@ -918,6 +918,64 @@ func TestSearchAllChannels(t *testing.T) {
 	CheckForbiddenStatus(t, resp)
 }
 
+func TestSearchGroupChannels(t *testing.T) {
+	th := Setup().InitBasic()
+	defer th.TearDown()
+	Client := th.Client
+
+	u1 := th.CreateUserWithClient(th.SystemAdminClient)
+
+	// Create a group channel in which base user belongs but not sysadmin
+	gc1, resp := th.Client.CreateGroupChannel([]string{th.BasicUser.Id, th.BasicUser2.Id, u1.Id})
+	CheckNoError(t, resp)
+	defer th.Client.DeleteChannel(gc1.Id)
+
+	gc2, resp := th.Client.CreateGroupChannel([]string{th.BasicUser.Id, th.BasicUser2.Id, th.SystemAdminUser.Id})
+	CheckNoError(t, resp)
+	defer th.Client.DeleteChannel(gc2.Id)
+
+	search := &model.ChannelSearch{Term: th.BasicUser2.Username}
+
+	// sysadmin should only find gc2 as he doesn't belong to gc1
+	channels, resp := th.SystemAdminClient.SearchGroupChannels(search)
+	CheckNoError(t, resp)
+
+	assert.Len(t, channels, 1)
+	assert.Equal(t, channels[0].Id, gc2.Id)
+
+	// basic user should find both
+	Client.Login(th.BasicUser.Username, th.BasicUser.Password)
+	channels, resp = Client.SearchGroupChannels(search)
+	CheckNoError(t, resp)
+
+	assert.Len(t, channels, 2)
+	channelIds := []string{}
+	for _, c := range channels {
+		channelIds = append(channelIds, c.Id)
+	}
+	assert.ElementsMatch(t, channelIds, []string{gc1.Id, gc2.Id})
+
+	// searching for sysadmin, it should only find gc1
+	search = &model.ChannelSearch{Term: th.SystemAdminUser.Username}
+	channels, resp = Client.SearchGroupChannels(search)
+	CheckNoError(t, resp)
+
+	assert.Len(t, channels, 1)
+	assert.Equal(t, channels[0].Id, gc2.Id)
+
+	// with an empty search, response should be empty
+	search = &model.ChannelSearch{Term: ""}
+	channels, resp = Client.SearchGroupChannels(search)
+	CheckNoError(t, resp)
+
+	assert.Len(t, channels, 0)
+
+	// search unprivileged, forbidden
+	th.Client.Logout()
+	_, resp = Client.SearchAllChannels(search)
+	CheckUnauthorizedStatus(t, resp)
+}
+
 func TestDeleteChannel(t *testing.T) {
 	th := Setup().InitBasic()
 	defer th.TearDown()

api4/user.go

@@ -4,6 +4,7 @@
 package api4
 
 import (
+	"encoding/json"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -25,6 +26,7 @@ func (api *API) InitUser() {
 	api.BaseRoutes.Users.Handle("/search", api.ApiSessionRequired(searchUsers)).Methods("POST")
 	api.BaseRoutes.Users.Handle("/autocomplete", api.ApiSessionRequired(autocompleteUsers)).Methods("GET")
 	api.BaseRoutes.Users.Handle("/stats", api.ApiSessionRequired(getTotalUsersStats)).Methods("GET")
+	api.BaseRoutes.Users.Handle("/group_channels", api.ApiSessionRequired(getUsersByGroupChannelIds)).Methods("POST")
 
 	api.BaseRoutes.User.Handle("", api.ApiSessionRequired(getUser)).Methods("GET")
 	api.BaseRoutes.User.Handle("/image/default", api.ApiSessionRequiredTrustRequester(getDefaultProfileImage)).Methods("GET")
@@ -447,6 +449,24 @@ func getTotalUsersStats(c *Context, w http.ResponseWriter, r *http.Request) {
 	w.Write([]byte(stats.ToJson()))
 }
 
+func getUsersByGroupChannelIds(c *Context, w http.ResponseWriter, r *http.Request) {
+	channelIds := model.ArrayFromJson(r.Body)
+
+	if len(channelIds) == 0 {
+		c.SetInvalidParam("channel_ids")
+		return
+	}
+
+	usersByChannelId, err := c.App.GetUsersByGroupChannelIds(channelIds, c.IsSystemAdmin())
+	if err != nil {
+		c.Err = err
+		return
+	}
+
+	b, _ := json.Marshal(usersByChannelId)
+	w.Write(b)
+}
+
 func getUsers(c *Context, w http.ResponseWriter, r *http.Request) {
 	inTeamId := r.URL.Query().Get("in_team")
 	notInTeamId := r.URL.Query().Get("not_in_team")

api4/user_test.go

@@ -1127,6 +1127,35 @@ func TestGetUsersByIds(t *testing.T) {
 	CheckUnauthorizedStatus(t, resp)
 }
 
+func TestGetUsersByGroupChannelIds(t *testing.T) {
+	th := Setup().InitBasic()
+	defer th.TearDown()
+
+	gc1, err := th.App.CreateGroupChannel([]string{th.BasicUser.Id, th.SystemAdminUser.Id, th.TeamAdminUser.Id}, th.BasicUser.Id)
+	require.Nil(t, err)
+
+	usersByChannelId, resp := th.Client.GetUsersByGroupChannelIds([]string{gc1.Id})
+	CheckNoError(t, resp)
+
+	users, _ := usersByChannelId[gc1.Id]
+	userIds := []string{}
+	for _, user := range users {
+		userIds = append(userIds, user.Id)
+	}
+
+	require.ElementsMatch(t, []string{th.SystemAdminUser.Id, th.TeamAdminUser.Id}, userIds)
+
+	th.LoginBasic2()
+	usersByChannelId, resp = th.Client.GetUsersByGroupChannelIds([]string{gc1.Id})
+
+	_, ok := usersByChannelId[gc1.Id]
+	require.False(t, ok)
+
+	th.Client.Logout()
+	_, resp = th.Client.GetUsersByGroupChannelIds([]string{gc1.Id})
+	CheckUnauthorizedStatus(t, resp)
+}
+
 func TestGetUsersByUsernames(t *testing.T) {
 	th := Setup().InitBasic()
 	defer th.TearDown()