store: guests will only receive results of which channels they are in (#20295)

* store: guests will only receive results of which channels they are in

* api4/channel_test: add test case for guest accounts channel autocomplete

* apply to searchengine and also for AutocompleteInTeam

Co-authored-by: Mattermod <mattermod@users.noreply.github.com>

store/sqlstore/channel_store.go

@@ -2921,7 +2921,7 @@ func (s SqlChannelStore) GetTeamMembersForChannel(channelID string) ([]string, e
 	return teamMemberIDs, nil
 }
 
-func (s SqlChannelStore) Autocomplete(userID, term string, includeDeleted bool) (model.ChannelListWithTeamData, error) {
+func (s SqlChannelStore) Autocomplete(userID, term string, includeDeleted, isGuest bool) (model.ChannelListWithTeamData, error) {
 	query := s.getQueryBuilder().Select("c.*",
 		"t.DisplayName AS TeamDisplayName",
 		"t.Name AS TeamName",
@@ -2931,15 +2931,6 @@ func (s SqlChannelStore) Autocomplete(userID, term string, includeDeleted bool)
 			sq.Expr("c.TeamId = t.id"),
 			sq.Expr("t.id = tm.TeamId"),
 			sq.Eq{"tm.UserId": userID},
-			sq.Or{
-				sq.NotEq{"c.Type": model.ChannelTypePrivate},
-				sq.And{
-					sq.Eq{"c.Type": model.ChannelTypePrivate},
-					sq.Expr("c.Id IN (?)", sq.Select("ChannelId").
-						From("ChannelMembers").
-						Where(sq.Eq{"UserId": userID})),
-				},
-			},
 		}).
 		OrderBy("c.DisplayName")
 
@@ -2949,6 +2940,23 @@ func (s SqlChannelStore) Autocomplete(userID, term string, includeDeleted bool)
 			sq.Eq{"tm.DeleteAt": 0},
 		})
 	}
+
+	if isGuest {
+		query = query.Where(sq.Expr("c.Id IN (?)", sq.Select("ChannelId").
+			From("ChannelMembers").
+			Where(sq.Eq{"UserId": userID})))
+	} else {
+		query = query.Where(sq.Or{
+			sq.NotEq{"c.Type": model.ChannelTypePrivate},
+			sq.And{
+				sq.Eq{"c.Type": model.ChannelTypePrivate},
+				sq.Expr("c.Id IN (?)", sq.Select("ChannelId").
+					From("ChannelMembers").
+					Where(sq.Eq{"UserId": userID})),
+			},
+		})
+	}
+
 	searchClause := s.searchClause(term)
 	if searchClause != nil {
 		query = query.Where(searchClause)
@@ -2967,21 +2975,10 @@ func (s SqlChannelStore) Autocomplete(userID, term string, includeDeleted bool)
 	return channels, nil
 }
 
-func (s SqlChannelStore) AutocompleteInTeam(teamID, userID, term string, includeDeleted bool) (model.ChannelList, error) {
+func (s SqlChannelStore) AutocompleteInTeam(teamID, userID, term string, includeDeleted, isGuest bool) (model.ChannelList, error) {
 	query := s.getQueryBuilder().Select("*").
 		From("Channels c").
-		Where(sq.And{
-			sq.Eq{"c.TeamId": teamID},
-			sq.Or{
-				sq.NotEq{"c.Type": model.ChannelTypePrivate},
-				sq.And{
-					sq.Eq{"c.Type": model.ChannelTypePrivate},
-					sq.Expr("c.Id IN (?)", sq.Select("ChannelId").
-						From("ChannelMembers").
-						Where(sq.Eq{"UserId": userID})),
-				},
-			},
-		}).
+		Where(sq.Eq{"c.TeamId": teamID}).
 		OrderBy("c.DisplayName").
 		Limit(model.ChannelSearchDefaultLimit)
 
@@ -2989,6 +2986,22 @@ func (s SqlChannelStore) AutocompleteInTeam(teamID, userID, term string, include
 		query = query.Where(sq.Eq{"c.DeleteAt": 0})
 	}
 
+	if isGuest {
+		query = query.Where(sq.Expr("c.Id IN (?)", sq.Select("ChannelId").
+			From("ChannelMembers").
+			Where(sq.Eq{"UserId": userID})))
+	} else {
+		query = query.Where(sq.Or{
+			sq.NotEq{"c.Type": model.ChannelTypePrivate},
+			sq.And{
+				sq.Eq{"c.Type": model.ChannelTypePrivate},
+				sq.Expr("c.Id IN (?)", sq.Select("ChannelId").
+					From("ChannelMembers").
+					Where(sq.Eq{"UserId": userID})),
+			},
+		})
+	}
+
 	searchClause := s.searchClause(term)
 	if searchClause != nil {
 		query = query.Where(searchClause)