config/diff: add utility function to get diffs scoped with struct tags (#20297)

* config/diff: add utility function to get diffs scoped with struct tags

* api4/config.go: check cloud accessible settings after merge

api4/config.go

@@ -159,10 +159,13 @@ func updateConfig(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	// There are some settings that cannot be changed in a cloud env
 	if c.App.Channels().License() != nil && *c.App.Channels().License().Features.Cloud {
-		// Both of them cannot be nil since cfg.SetDefaults is called earlier for cfg,
-		// and appCfg is the existing earlier config and if it's nil, server sets a default value.
-		if *appCfg.ComplianceSettings.Directory != *cfg.ComplianceSettings.Directory {
-			c.Err = model.NewAppError("updateConfig", "api.config.update_config.not_allowed_security.app_error", map[string]interface{}{"Name": "ComplianceSettings.Directory"}, "", http.StatusForbidden)
+		diffs, diffErr := config.DiffTags(appCfg, cfg, "access", "cloud_restrictable")
+		if diffErr != nil {
+			c.Err = model.NewAppError("updateConfig", "api.config.update_config.diff.app_error", nil, diffErr.Error(), http.StatusInternalServerError)
+			return
+		}
+		if len(diffs) > 0 {
+			c.Err = model.NewAppError("updateConfig", "api.config.update_config.not_allowed_security.app_error", map[string]interface{}{"Name": diffs[0].Path}, "", http.StatusForbidden)
 			return
 		}
 	}
@@ -296,14 +299,6 @@ func patchConfig(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// There are some settings that cannot be changed in a cloud env
-	if c.App.Channels().License() != nil && *c.App.Channels().License().Features.Cloud {
-		if cfg.ComplianceSettings.Directory != nil && *appCfg.ComplianceSettings.Directory != *cfg.ComplianceSettings.Directory {
-			c.Err = model.NewAppError("patchConfig", "api.config.update_config.not_allowed_security.app_error", map[string]interface{}{"Name": "ComplianceSettings.Directory"}, "", http.StatusForbidden)
-			return
-		}
-	}
-
 	if cfg.MessageExportSettings.EnableExport != nil {
 		c.App.HandleMessageExportConfig(cfg, appCfg)
 	}
@@ -317,6 +312,19 @@ func patchConfig(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// There are some settings that cannot be changed in a cloud env
+	if c.App.Channels().License() != nil && *c.App.Channels().License().Features.Cloud {
+		diffs, diffErr := config.DiffTags(appCfg, updatedCfg, "access", "cloud_restrictable")
+		if diffErr != nil {
+			c.Err = model.NewAppError("patchConfig", "api.config.update_config.diff.app_error", nil, diffErr.Error(), http.StatusInternalServerError)
+			return
+		}
+		if len(diffs) > 0 {
+			c.Err = model.NewAppError("patchConfig", "api.config.update_config.not_allowed_security.app_error", map[string]interface{}{"Name": diffs[0].Path}, "", http.StatusForbidden)
+			return
+		}
+	}
+
 	err := updatedCfg.IsValid()
 	if err != nil {
 		c.Err = err