From a9a6d3c7fb8a98954600b64cc1eb5a8ca1c9cd9b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pablo=20Andr=C3=A9s=20V=C3=A9lez=20Vidal?=
 <pablovv2012@gmail.com>
Date: Wed, 8 Feb 2023 00:38:34 +0100
Subject: [PATCH] MM-50355 - add senderId so the channel validations function
 can validate sender permissions when inviting guests (#22267)

Automatic Merge
---
 api4/user_test.go  | 38 ++++++++++++++++++++++++++++++++++++++
 app/email/email.go |  1 +
 2 files changed, 39 insertions(+)

diff --git a/api4/user_test.go b/api4/user_test.go
index 6700ad3a55..7280340ec1 100644
--- a/api4/user_test.go
+++ b/api4/user_test.go
@@ -420,6 +420,44 @@ func TestCreateUserWithToken(t *testing.T) {
 		// one channel from the two he was invited (plus the two default channels)
 		require.Len(t, channelList, 3)
 	})
+
+	t.Run("Validate inviterUser permissions on channels he is inviting, when inviting guests", func(t *testing.T) {
+		user := model.User{Email: th.GenerateTestEmail(), Nickname: "Guest User", Password: "hello1", Username: GenerateTestUsername(), Roles: model.SystemUserRoleId}
+		channelIdWithoutPermissions := th.BasicPrivateChannel2.Id
+		channelIds := th.BasicChannel.Id + " " + channelIdWithoutPermissions
+		token := model.NewToken(
+			app.TokenTypeTeamInvitation,
+			model.MapToJSON(map[string]string{"guest": "true", "teamId": th.BasicTeam.Id, "email": user.Email, "senderId": th.BasicUser.Id, "channels": channelIds}),
+		)
+		require.NoError(t, th.App.Srv().Store().Token().Save(token))
+
+		ruser, resp, err := th.Client.CreateUserWithToken(&user, token.Token)
+		require.NoError(t, err)
+		CheckCreatedStatus(t, resp)
+
+		th.Client.Login(user.Email, user.Password)
+		require.Equal(t, user.Nickname, ruser.Nickname)
+		require.Equal(t, model.SystemUserRoleId, ruser.Roles, "should clear roles")
+		CheckUserSanitization(t, ruser)
+		_, err = th.App.Srv().Store().Token().GetByToken(token.Token)
+		require.Error(t, err, "The token must be deleted after being used")
+
+		teams, appErr := th.App.GetTeamsForUser(ruser.Id)
+		require.Nil(t, appErr)
+		require.NotEmpty(t, teams, "The guest must have teams")
+		require.Equal(t, th.BasicTeam.Id, teams[0].Id, "The guest joined team must be the team provided.")
+
+		// Now we get all the channels for the just created guest
+		channelList, cErr := th.App.GetChannelsForTeamForUser(th.Context, th.BasicTeam.Id, ruser.Id, &model.ChannelSearchOpts{
+			IncludeDeleted: false,
+			LastDeleteAt:   0,
+		})
+		require.Nil(t, cErr)
+
+		// basicUser has no permissions on BasicPrivateChannel2 so the new invited guest should be able to only access
+		// one channel from the two he was invited (plus the two default channels)
+		require.Len(t, channelList, 3)
+	})
 }
 
 func TestCreateUserWebSocketEvent(t *testing.T) {
diff --git a/app/email/email.go b/app/email/email.go
index fcf7651350..eb238aee9c 100644
--- a/app/email/email.go
+++ b/app/email/email.go
@@ -567,6 +567,7 @@ func (es *Service) SendGuestInviteEmails(
 					"channels": strings.Join(channelIDs, " "),
 					"email":    invite,
 					"guest":    "true",
+					"senderId": senderUserId,
 				}),
 			)