[MM-57988] Fix move thread logic to not block channel admins (#27061)

* mm-57988: Allowing for channel admins to move thread

* Fix the MoveThread team admin unit test that was introduced

* Renaming the hasPermittedRole function to hasPermittedWranglerRole

---------

Co-authored-by: Mattermost Build <build@mattermost.com>

server/channels/api4/post.go

@@ -1160,15 +1160,20 @@ func moveThread(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// If there are no configured PermittedWranglerRoles, skip the check
-	userHasRole := len(c.App.Config().WranglerSettings.PermittedWranglerRoles) == 0
-	for _, role := range c.App.Config().WranglerSettings.PermittedWranglerRoles {
-		if user.IsInRole(role) {
-			userHasRole = true
-			break
-		}
+	posts, _, err := c.App.GetPostsByIds([]string{c.Params.PostId})
+	if err != nil {
+		c.Err = err
+		return
 	}
 
+	channelMember, err := c.App.GetChannelMember(c.AppContext, posts[0].ChannelId, user.Id)
+	if err != nil {
+		c.Err = err
+		return
+	}
+
+	userHasRole := hasPermittedWranglerRole(c, user, channelMember)
+
 	// Sysadmins are always permitted
 	if !userHasRole && !user.IsSystemAdmin() {
 		c.Err = model.NewAppError("moveThread", "api.post.move_thread.no_permission", nil, "", http.StatusForbidden)
@@ -1267,3 +1272,19 @@ func getPostInfo(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	w.Write(js)
 }
+
+func hasPermittedWranglerRole(c *Context, user *model.User, channelMember *model.ChannelMember) bool {
+	// If there are no configured PermittedWranglerRoles, skip the check
+	if len(c.App.Config().WranglerSettings.PermittedWranglerRoles) == 0 {
+		return true
+	}
+
+	userRoles := user.Roles + " " + channelMember.Roles
+	for _, role := range c.App.Config().WranglerSettings.PermittedWranglerRoles {
+		if model.IsInRole(userRoles, role) {
+			return true
+		}
+	}
+
+	return false
+}