store: guests will only receive results of which channels they are in (#20295)

* store: guests will only receive results of which channels they are in

* api4/channel_test: add test case for guest accounts channel autocomplete

* apply to searchengine and also for AutocompleteInTeam

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

services/searchengine/bleveengine/search.go

@@ -314,7 +314,7 @@ func (b *BleveEngine) IndexChannel(channel *model.Channel, userIDs, teamMemberID
 	return nil
 }
 
-func (b *BleveEngine) SearchChannels(teamId, userID, term string) ([]string, *model.AppError) {
+func (b *BleveEngine) SearchChannels(teamId, userID, term string, isGuest bool) ([]string, *model.AppError) {
 	// This query essentially boils down to (if teamID is passed):
 	// match teamID == <>
 	// AND
@@ -329,6 +329,13 @@ func (b *BleveEngine) SearchChannels(teamId, userID, term string) ([]string, *mo
 	// AND
 	// match (channelType != 'P' || (<> in userIDs && channelType == 'P'))
 
+	// (or if isGuest is true)
+	// <> in teamMemberIds
+	// AND
+	// match term == <>
+	// AND
+	// match (<> in userIDs)
+
 	queries := []query.Query{}
 	if teamId != "" {
 		teamIdQ := bleve.NewTermQuery(teamId)
@@ -340,22 +347,29 @@ func (b *BleveEngine) SearchChannels(teamId, userID, term string) ([]string, *mo
 		queries = append(queries, teamMemberQ)
 	}
 
-	boolNotPrivate := bleve.NewBooleanQuery()
-	privateQ := bleve.NewTermQuery(string(model.ChannelTypePrivate))
-	privateQ.SetField("Type")
-	boolNotPrivate.AddMustNot(privateQ)
+	if isGuest {
+		userQ := bleve.NewBooleanQuery()
+		userIDQ := bleve.NewTermQuery(userID)
+		userIDQ.SetField("UserIDs")
+		userQ.AddMust(userIDQ)
+		queries = append(queries, userIDQ)
+	} else {
+		boolNotPrivate := bleve.NewBooleanQuery()
+		privateQ := bleve.NewTermQuery(string(model.ChannelTypePrivate))
+		privateQ.SetField("Type")
+		boolNotPrivate.AddMustNot(privateQ)
 
-	userQ := bleve.NewBooleanQuery()
-	userIDQ := bleve.NewTermQuery(userID)
-	userIDQ.SetField("UserIDs")
-	userQ.AddMust(userIDQ)
-	userQ.AddMust(privateQ)
+		userQ := bleve.NewBooleanQuery()
+		userIDQ := bleve.NewTermQuery(userID)
+		userIDQ.SetField("UserIDs")
+		userQ.AddMust(userIDQ)
+		userQ.AddMust(privateQ)
 
-	channelTypeQ := bleve.NewDisjunctionQuery()
-	channelTypeQ.AddQuery(boolNotPrivate)
-	channelTypeQ.AddQuery(userQ) // userID && 'p'
-
-	queries = append(queries, channelTypeQ)
+		channelTypeQ := bleve.NewDisjunctionQuery()
+		channelTypeQ.AddQuery(boolNotPrivate)
+		channelTypeQ.AddQuery(userQ) // userID && 'p'
+		queries = append(queries, channelTypeQ)
+	}
 
 	if term != "" {
 		nameSuggestQ := bleve.NewPrefixQuery(strings.ToLower(term))

services/searchengine/interface.go

@@ -30,7 +30,7 @@ type SearchEngineInterface interface {
 	// IndexChannel indexes a given channel. The userIDs are only populated
 	// for private channels.
 	IndexChannel(channel *model.Channel, userIDs, teamMemberIDs []string) *model.AppError
-	SearchChannels(teamId, userID, term string) ([]string, *model.AppError)
+	SearchChannels(teamId, userID, term string, isGuest bool) ([]string, *model.AppError)
 	DeleteChannel(channel *model.Channel) *model.AppError
 	IndexUser(user *model.User, teamsIds, channelsIds []string) *model.AppError
 	SearchUsersInChannel(teamId, channelId string, restrictedToChannels []string, term string, options *model.UserSearchOptions) ([]string, []string, *model.AppError)

services/searchengine/mocks/SearchEngineInterface.go

@@ -400,13 +400,13 @@ func (_m *SearchEngineInterface) RefreshIndexes() *model.AppError {
 	return r0
 }
 
-// SearchChannels provides a mock function with given fields: teamId, userID, term
-func (_m *SearchEngineInterface) SearchChannels(teamId string, userID string, term string) ([]string, *model.AppError) {
-	ret := _m.Called(teamId, userID, term)
+// SearchChannels provides a mock function with given fields: teamId, userID, term, isGuest
+func (_m *SearchEngineInterface) SearchChannels(teamId string, userID string, term string, isGuest bool) ([]string, *model.AppError) {
+	ret := _m.Called(teamId, userID, term, isGuest)
 
 	var r0 []string
-	if rf, ok := ret.Get(0).(func(string, string, string) []string); ok {
-		r0 = rf(teamId, userID, term)
+	if rf, ok := ret.Get(0).(func(string, string, string, bool) []string); ok {
+		r0 = rf(teamId, userID, term, isGuest)
 	} else {
 		if ret.Get(0) != nil {
 			r0 = ret.Get(0).([]string)
@@ -414,8 +414,8 @@ func (_m *SearchEngineInterface) SearchChannels(teamId string, userID string, te
 	}
 
 	var r1 *model.AppError
-	if rf, ok := ret.Get(1).(func(string, string, string) *model.AppError); ok {
-		r1 = rf(teamId, userID, term)
+	if rf, ok := ret.Get(1).(func(string, string, string, bool) *model.AppError); ok {
+		r1 = rf(teamId, userID, term, isGuest)
 	} else {
 		if ret.Get(1) != nil {
 			r1 = ret.Get(1).(*model.AppError)