MM-68702: Reject demoting bot accounts to guest (#36487) (#36634)

Automatic Merge

server/channels/app/user.go

@@ -2570,6 +2570,10 @@ func (a *App) PromoteGuestToUser(c request.CTX, user *model.User, requestorId st
 // DemoteUserToGuest Convert user's roles and all his membership's roles from
 // regular user roles to guest roles.
 func (a *App) DemoteUserToGuest(c request.CTX, user *model.User) *model.AppError {
+	if user.IsBot {
+		return model.NewAppError("DemoteUserToGuest", "api.user.demote_user_to_guest.bot_not_allowed.app_error", nil, "", http.StatusBadRequest)
+	}
+
 	demotedUser, nErr := a.ch.srv.userService.DemoteUserToGuest(user)
 	a.InvalidateCacheForUser(user.Id)
 	if nErr != nil {