[MM-22622] Add Ephemeral response when using mentions without permissions (#13902)

* MM-22282 Add Ephemeral response when using mentions without permission and add new prop to disable mention highlights on client

* MM-22622 Make test name test actually what it does and fix comment style

* MM-22622 Check ephemeral post created when post create with mentions on API

* MM-22622 More tests for App>CreatePost

* MM-22622 Make DisableMentionHighlights more concise and rename ephemeral post

* MM-22622 Dont send ephemeral message for system message created by user

* Trigger build

app/post.go

@@ -189,6 +189,22 @@ func (a *App) CreatePost(post *model.Post, channel *model.Channel, triggerWebhoo
 		return nil, model.NewAppError("createPost", "api.post.create_post.town_square_read_only", nil, "", http.StatusForbidden)
 	}
 
+	var ephemeralPost *model.Post
+	if post.Type == "" && !a.HasPermissionToChannel(user.Id, channel.Id, model.PERMISSION_USE_CHANNEL_MENTIONS) {
+		mention := post.DisableMentionHighlights()
+		if mention != "" {
+			T := utils.GetUserTranslations(user.Locale)
+			ephemeralPost = &model.Post{
+				UserId:    user.Id,
+				RootId:    post.RootId,
+				ParentId:  post.ParentId,
+				ChannelId: channel.Id,
+				Message:   T("model.post.channel_notifications_disabled_in_channel.message", model.StringInterface{"ChannelName": channel.Name, "Mention": mention}),
+				Props:     model.StringInterface{model.POST_PROPS_MENTION_HIGHLIGHT_DISABLED: true},
+			}
+		}
+	}
+
 	// Verify the parent/child relationships are correct
 	var parentPostList *model.PostList
 	if pchan != nil {
@@ -311,6 +327,11 @@ func (a *App) CreatePost(post *model.Post, channel *model.Channel, triggerWebhoo
 		mlog.Error("Failed to handle post events", mlog.Err(err))
 	}
 
+	// Send any ephemeral posts after the post is created to ensure it shows up after the latest post created
+	if ephemeralPost != nil {
+		a.SendEphemeralPost(post.UserId, ephemeralPost)
+	}
+
 	return rpost, nil
 }
 
@@ -604,6 +625,10 @@ func (a *App) PatchPost(postId string, patch *model.PostPatch) (*model.Post, *mo
 		return nil, err
 	}
 
+	if !a.HasPermissionToChannel(post.UserId, post.ChannelId, model.PERMISSION_USE_CHANNEL_MENTIONS) {
+		patch.DisableMentionHighlights()
+	}
+
 	post.Patch(patch)
 
 	updatedPost, err := a.UpdatePost(post, false)

app/post_test.go

@@ -680,6 +680,56 @@ func TestCreatePost(t *testing.T) {
 		require.Nil(t, err)
 		assert.Equal(t, "![image]("+proxiedImageURL+")", rpost.Message)
 	})
+
+	t.Run("Sets prop MENTION_HIGHLIGHT_DISABLED when it should", func(t *testing.T) {
+		th := Setup(t).InitBasic()
+		defer th.TearDown()
+		th.AddUserToChannel(th.BasicUser, th.BasicChannel)
+
+		t.Run("Does not set prop when user has USE_CHANNEL_MENTIONS", func(t *testing.T) {
+			postWithNoMention := &model.Post{
+				ChannelId: th.BasicChannel.Id,
+				Message:   "This post does not have mentions",
+				UserId:    th.BasicUser.Id,
+			}
+			rpost, err := th.App.CreatePost(postWithNoMention, th.BasicChannel, false)
+			require.Nil(t, err)
+			assert.Equal(t, rpost.Props, model.StringInterface{})
+
+			postWithMention := &model.Post{
+				ChannelId: th.BasicChannel.Id,
+				Message:   "This post has @here mention @all",
+				UserId:    th.BasicUser.Id,
+			}
+			rpost, err = th.App.CreatePost(postWithMention, th.BasicChannel, false)
+			require.Nil(t, err)
+			assert.Equal(t, rpost.Props, model.StringInterface{})
+		})
+
+		t.Run("Sets prop when post has mentions and user does not have USE_CHANNEL_MENTIONS", func(t *testing.T) {
+			th.RemovePermissionFromRole(model.PERMISSION_USE_CHANNEL_MENTIONS.Id, model.CHANNEL_USER_ROLE_ID)
+
+			postWithNoMention := &model.Post{
+				ChannelId: th.BasicChannel.Id,
+				Message:   "This post does not have mentions",
+				UserId:    th.BasicUser.Id,
+			}
+			rpost, err := th.App.CreatePost(postWithNoMention, th.BasicChannel, false)
+			require.Nil(t, err)
+			assert.Equal(t, rpost.Props, model.StringInterface{})
+
+			postWithMention := &model.Post{
+				ChannelId: th.BasicChannel.Id,
+				Message:   "This post has @here mention @all",
+				UserId:    th.BasicUser.Id,
+			}
+			rpost, err = th.App.CreatePost(postWithMention, th.BasicChannel, false)
+			require.Nil(t, err)
+			assert.Equal(t, rpost.Props[model.POST_PROPS_MENTION_HIGHLIGHT_DISABLED], true)
+
+			th.AddPermissionToRole(model.PERMISSION_USE_CHANNEL_MENTIONS.Id, model.CHANNEL_USER_ROLE_ID)
+		})
+	})
 }
 
 func TestPatchPost(t *testing.T) {
@@ -716,6 +766,53 @@ func TestPatchPost(t *testing.T) {
 		require.Nil(t, err)
 		assert.Equal(t, "![image]("+proxiedImageURL+")", rpost.Message)
 	})
+
+	t.Run("Sets Prop MENTION_HIGHLIGHT_DISABLED when it should", func(t *testing.T) {
+		th := Setup(t).InitBasic()
+		defer th.TearDown()
+
+		th.AddUserToChannel(th.BasicUser, th.BasicChannel)
+
+		post := &model.Post{
+			ChannelId: th.BasicChannel.Id,
+			Message:   "This post does not have mentions",
+			UserId:    th.BasicUser.Id,
+		}
+
+		rpost, err := th.App.CreatePost(post, th.BasicChannel, false)
+		require.Nil(t, err)
+
+		t.Run("Does not set prop when user has USE_CHANNEL_MENTIONS", func(t *testing.T) {
+			patchWithNoMention := &model.PostPatch{Message: model.NewString("This patch has no channel mention")}
+
+			rpost, err = th.App.PatchPost(rpost.Id, patchWithNoMention)
+			require.Nil(t, err)
+			assert.Equal(t, rpost.Props, model.StringInterface{})
+
+			patchWithMention := &model.PostPatch{Message: model.NewString("This patch has a mention now @here")}
+
+			rpost, err = th.App.PatchPost(rpost.Id, patchWithMention)
+			require.Nil(t, err)
+			assert.Equal(t, rpost.Props, model.StringInterface{})
+		})
+
+		t.Run("Sets prop when user does not have USE_CHANNEL_MENTIONS", func(t *testing.T) {
+			th.RemovePermissionFromRole(model.PERMISSION_USE_CHANNEL_MENTIONS.Id, model.CHANNEL_USER_ROLE_ID)
+
+			patchWithNoMention := &model.PostPatch{Message: model.NewString("This patch still does not have a mention")}
+			rpost, err = th.App.PatchPost(rpost.Id, patchWithNoMention)
+			require.Nil(t, err)
+			assert.Equal(t, rpost.Props, model.StringInterface{})
+
+			patchWithMention := &model.PostPatch{Message: model.NewString("This patch has a mention now @here")}
+
+			rpost, err = th.App.PatchPost(rpost.Id, patchWithMention)
+			require.Nil(t, err)
+			assert.Equal(t, rpost.Props[model.POST_PROPS_MENTION_HIGHLIGHT_DISABLED], true)
+
+			th.AddPermissionToRole(model.PERMISSION_USE_CHANNEL_MENTIONS.Id, model.CHANNEL_USER_ROLE_ID)
+		})
+	})
 }
 
 func TestPatchPostInArchivedChannel(t *testing.T) {