[MM-42421] Prevent guests from seeing users through groups API (#21151)

store/sqlstore/group_store.go

@@ -401,58 +401,59 @@ func (s *SqlGroupStore) GetMemberUsers(groupID string) ([]*model.User, error) {
 	return groupMembers, nil
 }
 
-func (s *SqlGroupStore) GetMemberUsersPage(groupID string, page int, perPage int) ([]*model.User, error) {
+func (s *SqlGroupStore) GetMemberUsersPage(groupID string, page int, perPage int, viewRestrictions *model.ViewUsersRestrictions) ([]*model.User, error) {
 	groupMembers := []*model.User{}
 
-	query := `
-		SELECT
-			Users.*
-		FROM
-			GroupMembers
-			JOIN Users ON Users.Id = GroupMembers.UserId
-		WHERE
-			GroupMembers.DeleteAt = 0
-			AND Users.DeleteAt = 0
-			AND GroupId = ?
-		ORDER BY
-			GroupMembers.CreateAt DESC
-		LIMIT
-			?
-		OFFSET
-			?`
+	query := s.getQueryBuilder().
+		Select("u.*").
+		From("GroupMembers").
+		Join("Users u ON u.Id = GroupMembers.UserId").
+		Where(sq.Eq{"GroupMembers.DeleteAt": 0}).
+		Where(sq.Eq{"u.DeleteAt": 0}).
+		Where(sq.Eq{"GroupId": groupID}).
+		Limit(uint64(perPage)).
+		Offset(uint64(page * perPage)).
+		OrderBy("u.CreateAt DESC")
 
-	if err := s.GetReplicaX().Select(&groupMembers, query, groupID, perPage, page*perPage); err != nil {
+	query = applyViewRestrictionsFilter(query, viewRestrictions, true)
+
+	queryString, args, err := query.ToSql()
+	if err != nil {
+		return nil, errors.Wrap(err, "")
+	}
+
+	if err := s.GetReplicaX().Select(&groupMembers, queryString, args...); err != nil {
 		return nil, errors.Wrapf(err, "failed to find member Users for Group with id=%s", groupID)
 	}
 
 	return groupMembers, nil
 }
 
-func (s *SqlGroupStore) GetNonMemberUsersPage(groupID string, page int, perPage int) ([]*model.User, error) {
+func (s *SqlGroupStore) GetNonMemberUsersPage(groupID string, page int, perPage int, viewRestrictions *model.ViewUsersRestrictions) ([]*model.User, error) {
 	groupMembers := []*model.User{}
 
 	if err := s.GetReplicaX().Get(&model.Group{}, "SELECT * FROM UserGroups WHERE Id = ?", groupID); err != nil {
 		return nil, errors.Wrap(err, "GetNonMemberUsersPage")
 	}
 
-	query := `
-	SELECT 
-		Users.*
-	FROM
-		Users
-	LEFT JOIN 
-		GroupMembers ON (GroupMembers.UserId = Users.Id AND GroupMembers.GroupId = ?)
-	WHERE
-		Users.DeleteAt = 0
-		AND ( GroupMembers.UserId IS NULL OR GroupMembers.DeleteAt != 0)
-	ORDER BY
-		GroupMembers.CreateAt DESC
-	LIMIT
-		?
-	OFFSET
-		?`
+	query := s.getQueryBuilder().
+		Select("u.*").
+		From("Users u").
+		LeftJoin("GroupMembers ON (GroupMembers.UserId = u.Id AND GroupMembers.GroupId = ?)", groupID).
+		Where(sq.Eq{"u.DeleteAt": 0}).
+		Where("(GroupMembers.UserID IS NULL OR GroupMembers.DeleteAt != 0)").
+		Limit(uint64(perPage)).
+		Offset(uint64(page * perPage)).
+		OrderBy("u.CreateAt DESC")
 
-	if err := s.GetReplicaX().Select(&groupMembers, query, groupID, perPage, page*perPage); err != nil {
+	query = applyViewRestrictionsFilter(query, viewRestrictions, true)
+
+	queryString, args, err := query.ToSql()
+	if err != nil {
+		return nil, errors.Wrap(err, "")
+	}
+
+	if err := s.GetReplicaX().Select(&groupMembers, queryString, args...); err != nil {
 		return nil, errors.Wrapf(err, "failed to find member Users for Group with id=%s", groupID)
 	}
 
@@ -460,19 +461,27 @@ func (s *SqlGroupStore) GetNonMemberUsersPage(groupID string, page int, perPage
 }
 
 func (s *SqlGroupStore) GetMemberCount(groupID string) (int64, error) {
-	query := `
-		SELECT
-			count(*)
-		FROM
-			GroupMembers
-			JOIN Users ON Users.Id = GroupMembers.UserId
-		WHERE
-			GroupMembers.GroupId = ?
-			AND Users.DeleteAt = 0
-			AND GroupMembers.DeleteAt = 0`
+	return s.GetMemberCountWithRestrictions(groupID, nil)
+}
+
+func (s *SqlGroupStore) GetMemberCountWithRestrictions(groupID string, viewRestrictions *model.ViewUsersRestrictions) (int64, error) {
+	query := s.getQueryBuilder().
+		Select("COUNT(DISTINCT u.Id)").
+		From("GroupMembers").
+		Join("Users u ON u.Id = GroupMembers.UserId").
+		Where(sq.Eq{"GroupMembers.GroupId": groupID}).
+		Where(sq.Eq{"u.DeleteAt": 0}).
+		Where(sq.Eq{"GroupMembers.DeleteAt": 0})
+
+	query = applyViewRestrictionsFilter(query, viewRestrictions, false)
+
+	queryString, args, err := query.ToSql()
+	if err != nil {
+		return int64(0), errors.Wrap(err, "")
+	}
 
 	var count int64
-	err := s.GetReplicaX().Get(&count, query, groupID)
+	err = s.GetReplicaX().Get(&count, queryString, args...)
 	if err != nil {
 		return int64(0), errors.Wrapf(err, "failed to count member Users for Group with id=%s", groupID)
 	}
@@ -1385,15 +1394,30 @@ func (s *SqlGroupStore) GetGroupsAssociatedToChannelsByTeam(teamId string, opts
 	return groups, nil
 }
 
-func (s *SqlGroupStore) GetGroups(page, perPage int, opts model.GroupSearchOpts) ([]*model.Group, error) {
+func (s *SqlGroupStore) GetGroups(page, perPage int, opts model.GroupSearchOpts, viewRestrictions *model.ViewUsersRestrictions) ([]*model.Group, error) {
 	groupsVar := groups{}
 
 	groupsQuery := s.getQueryBuilder().Select("g.*")
 
 	if opts.IncludeMemberCount {
+		countQuery := s.getQueryBuilder().
+			Select("GroupMembers.GroupId, COUNT(DISTINCT u.Id) AS MemberCount").
+			From("GroupMembers").
+			LeftJoin("Users u ON u.Id = GroupMembers.UserId").
+			Where(sq.Eq{"GroupMembers.DeleteAt": 0}).
+			Where(sq.Eq{"u.DeleteAt": 0}).
+			GroupBy("GroupId")
+
+		countQuery = applyViewRestrictionsFilter(countQuery, viewRestrictions, false)
+
+		countString, params, err := countQuery.PlaceholderFormat(sq.Question).ToSql()
+		if err != nil {
+			return nil, errors.Wrap(err, "get_groups_tosql")
+		}
+
 		groupsQuery = s.getQueryBuilder().
 			Select("g.*, coalesce(Members.MemberCount, 0) AS MemberCount").
-			LeftJoin("(SELECT GroupMembers.GroupId, COUNT(*) AS MemberCount FROM GroupMembers LEFT JOIN Users ON Users.Id = GroupMembers.UserId WHERE GroupMembers.DeleteAt = 0 AND Users.DeleteAt = 0 GROUP BY GroupId) AS Members ON Members.GroupId = g.Id")
+			LeftJoin("("+countString+") AS Members ON Members.GroupId = g.Id", params...)
 	}
 
 	if opts.FilterHasMember != "" {