[MM-17213] Fix domain check when inviting guests and update user checks (#11793)

* Add update user check for guests and tests

* [MM-17213] Fix domain check when inviting guests

* Fix i18n strings

* Fix tests

* Add missing translation

* Adds test case for non guest user

app/team.go

@@ -1103,7 +1103,7 @@ func (a *App) InviteGuestsToChannels(teamId string, guestsInvite *model.GuestsIn
 
 	var invalidEmailList []string
 	for _, email := range guestsInvite.Emails {
-		if !a.isTeamEmailAddressAllowed(email, team.AllowedDomains) {
+		if !CheckEmailDomain(email, *a.Config().GuestAccountsSettings.RestrictCreationToDomains) {
 			invalidEmailList = append(invalidEmailList, email)
 		}
 	}

app/user.go

@@ -404,8 +404,8 @@ func (a *App) CreateOAuthUser(service string, userData io.Reader, teamId string)
 	return ruser, nil
 }
 
-// CheckUserDomain checks that a user's email domain matches a list of space-delimited domains as a string.
-func CheckUserDomain(user *model.User, domains string) bool {
+// CheckEmailDomain checks that an email domain matches a list of space-delimited domains as a string.
+func CheckEmailDomain(email string, domains string) bool {
 	if len(domains) == 0 {
 		return true
 	}
@@ -413,7 +413,7 @@ func CheckUserDomain(user *model.User, domains string) bool {
 	domainArray := strings.Fields(strings.TrimSpace(strings.ToLower(strings.Replace(strings.Replace(domains, "@", " ", -1), ",", " ", -1))))
 
 	for _, d := range domainArray {
-		if strings.HasSuffix(strings.ToLower(user.Email), "@"+d) {
+		if strings.HasSuffix(strings.ToLower(email), "@"+d) {
 			return true
 		}
 	}
@@ -421,6 +421,11 @@ func CheckUserDomain(user *model.User, domains string) bool {
 	return false
 }
 
+// CheckUserDomain checks that a user's email domain matches a list of space-delimited domains as a string.
+func CheckUserDomain(user *model.User, domains string) bool {
+	return CheckEmailDomain(user.Email, domains)
+}
+
 // IsUsernameTaken checks if the username is already used by another user. Return false if the username is invalid.
 func (a *App) IsUsernameTaken(name string) bool {
 	if !model.IsValidUsername(name) {
@@ -1089,8 +1094,14 @@ func (a *App) UpdateUser(user *model.User, sendNotifications bool) (*model.User,
 	}
 
 	if !CheckUserDomain(user, *a.Config().TeamSettings.RestrictCreationToDomains) {
-		if !prev.IsLDAPUser() && !prev.IsSAMLUser() && user.Email != prev.Email {
-			return nil, model.NewAppError("UpdateUser", "api.user.create_user.accepted_domain.app_error", nil, "", http.StatusBadRequest)
+		if !prev.IsGuest() && !prev.IsLDAPUser() && !prev.IsSAMLUser() && user.Email != prev.Email {
+			return nil, model.NewAppError("UpdateUser", "api.user.update_user.accepted_domain.app_error", nil, "", http.StatusBadRequest)
+		}
+	}
+
+	if !CheckUserDomain(user, *a.Config().GuestAccountsSettings.RestrictCreationToDomains) {
+		if prev.IsGuest() && !prev.IsLDAPUser() && !prev.IsSAMLUser() && user.Email != prev.Email {
+			return nil, model.NewAppError("UpdateUser", "api.user.update_user.accepted_guest_domain.app_error", nil, "", http.StatusBadRequest)
 		}
 	}
 

app/user_test.go

@@ -147,11 +147,43 @@ func TestUpdateUserToRestrictedDomain(t *testing.T) {
 	})
 
 	_, err := th.App.UpdateUser(user, false)
-	assert.True(t, err == nil)
+	assert.Nil(t, err)
 
 	user.Email = "asdf@ghjk.l"
 	_, err = th.App.UpdateUser(user, false)
-	assert.False(t, err == nil)
+	assert.NotNil(t, err)
+
+	t.Run("Restricted Domains must be ignored for guest users", func(t *testing.T) {
+		guest := th.CreateGuest()
+		defer th.App.PermanentDeleteUser(guest)
+
+		th.App.UpdateConfig(func(cfg *model.Config) {
+			*cfg.TeamSettings.RestrictCreationToDomains = "foo.com"
+		})
+
+		guest.Email = "asdf@bar.com"
+		updatedGuest, err := th.App.UpdateUser(guest, false)
+		require.Nil(t, err)
+		require.Equal(t, updatedGuest.Email, guest.Email)
+	})
+
+	t.Run("Guest users should be affected by guest restricted domains", func(t *testing.T) {
+		guest := th.CreateGuest()
+		defer th.App.PermanentDeleteUser(guest)
+
+		th.App.UpdateConfig(func(cfg *model.Config) {
+			*cfg.GuestAccountsSettings.RestrictCreationToDomains = "foo.com"
+		})
+
+		guest.Email = "asdf@bar.com"
+		_, err := th.App.UpdateUser(guest, false)
+		require.NotNil(t, err)
+
+		guest.Email = "asdf@foo.com"
+		updatedGuest, err := th.App.UpdateUser(guest, false)
+		require.Nil(t, err)
+		require.Equal(t, updatedGuest.Email, guest.Email)
+	})
 }
 
 func TestUpdateUserActive(t *testing.T) {