Mm 64299 disable guest invite in abac channels (#31139)

* MM-64299 - disable guest invite in abac channels

* filter the abac channel list for guest

* add filter in the back-end too

* add proper translation

* simplify the condition for enforced channels and add the unit tests

* enhance validation for not inviting guest users when abac enforced channel

* add missing translation

* add value to empty translation

* prevent showing the channel name if abac protected

server/channels/app/team.go

@@ -1499,7 +1499,13 @@ func (a *App) prepareInviteGuestsToChannels(teamID string, guestsInvite *model.G
 		if channel.TeamId != teamID {
 			return nil, nil, nil, model.NewAppError("prepareInviteGuestsToChannels", "api.team.invite_guests.channel_in_invalid_team.app_error", nil, "", http.StatusBadRequest)
 		}
+
+		// Check if the channel has access control policy enforcement
+		if channel.PolicyEnforced {
+			return nil, nil, nil, model.NewAppError("prepareInviteGuestsToChannels", "api.team.invite_guests.policy_enforced_channel.app_error", nil, "", http.StatusBadRequest)
+		}
 	}
+
 	return user, team, channels, nil
 }
 

server/channels/app/team_test.go

@@ -1707,6 +1707,52 @@ func TestInviteGuestsToChannelsGracefully(t *testing.T) {
 	})
 }
 
+func TestInviteGuestsToChannelsWithPolicyEnforced(t *testing.T) {
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+
+	th.App.UpdateConfig(func(cfg *model.Config) {
+		*cfg.ServiceSettings.EnableEmailInvitations = true
+	})
+
+	// Create a private channel
+	channel := th.CreatePrivateChannel(th.Context, th.BasicTeam)
+
+	// Create a policy with the same ID as the channel
+	channelPolicy := &model.AccessControlPolicy{
+		Type:     model.AccessControlPolicyTypeChannel,
+		ID:       channel.Id, // Use the channel ID directly
+		Name:     "Test Channel Policy",
+		Revision: 1,
+		Version:  model.AccessControlPolicyVersionV0_1,
+		Rules: []model.AccessControlPolicyRule{
+			{
+				Actions:    []string{"view", "join_channel"},
+				Expression: "user.attributes.program == \"test-program\"",
+			},
+		},
+	}
+
+	// Save the channel policy
+	channelPolicy, err := th.App.Srv().Store().AccessControlPolicy().Save(th.Context, channelPolicy)
+	require.NoError(t, err)
+	require.NotNil(t, channelPolicy)
+
+	// Attempt to invite guests to the policy-enforced channel
+	guestsInvite := &model.GuestsInvite{
+		Emails:   []string{"guest@example.com"},
+		Channels: []string{channel.Id},
+		Message:  "test message",
+	}
+
+	// Call the function we want to test
+	_, _, _, appErr := th.App.prepareInviteGuestsToChannels(th.BasicTeam.Id, guestsInvite, th.BasicUser.Id)
+
+	// Verify that the appropriate error is returned
+	require.NotNil(t, appErr)
+	require.Equal(t, "api.team.invite_guests.policy_enforced_channel.app_error", appErr.Id)
+}
+
 func TestTeamSendEvents(t *testing.T) {
 	mainHelper.Parallel(t)
 	th := Setup(t).InitBasic()

server/i18n/en.json

@@ -3230,6 +3230,10 @@
     "id": "api.team.invite_guests.channel_in_invalid_team.app_error",
     "translation": "The channels of the invite must be part of the team of the invite."
   },
+  {
+    "id": "api.team.invite_guests.policy_enforced_channel.app_error",
+    "translation": "Cannot invite guests users to this channel because it has access restrictions based on user attributes."
+  },
   {
     "id": "api.team.invite_guests_to_channels.disabled.error",
     "translation": "Guest accounts are disabled"