Fix MM-42270 (#19692)

* [MM-42270] - Fix MM-42270

* clean test code

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

api4/system.go

@@ -76,6 +76,11 @@ func generateSupportPacket(c *Context, w http.ResponseWriter, r *http.Request) {
 	const FileMime = "application/zip"
 	const OutputDirectory = "support_packet"
 
+	if *c.App.Config().ExperimentalSettings.RestrictSystemAdmin {
+		c.Err = model.NewAppError("generateSupportPacket", "api.restricted_system_admin", nil, "", http.StatusForbidden)
+		return
+	}
+
 	// Checking to see if the user is a admin of any sort or not
 	// If they are a admin, they should theoretically have access to one or more of the system console read permissions
 	if !c.App.SessionHasPermissionToAny(*c.AppContext.Session(), model.SysconsoleReadPermissions) {

api4/system_test.go

@@ -208,6 +208,20 @@ func TestGenerateSupportPacket(t *testing.T) {
 		require.NotZero(t, len(file))
 	})
 
+	t.Run("As a System Administrator but with RestrictSystemAdmin true", func(t *testing.T) {
+		originalRestrictSystemAdminVal := *th.App.Config().ExperimentalSettings.RestrictSystemAdmin
+		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ExperimentalSettings.RestrictSystemAdmin = true })
+		defer func() {
+			th.App.UpdateConfig(func(cfg *model.Config) {
+				*cfg.ExperimentalSettings.RestrictSystemAdmin = originalRestrictSystemAdminVal
+			})
+		}()
+
+		_, resp, err := th.SystemAdminClient.GenerateSupportPacket()
+		require.Error(t, err)
+		CheckForbiddenStatus(t, resp)
+	})
+
 	t.Run("As a Regular User", func(t *testing.T) {
 		_, resp, err := th.Client.GenerateSupportPacket()
 		require.Error(t, err)