Guest accounts feature (#11428)

* MM-14139: Creating permissions for invite/promote/demote guests (#10778)

* MM-14139: Creating permissions for invite/promote/demote guests

* Fixing tests

* Adding invite guest api endpoint (#10792)

* Adding invite guest api endpoint

* Adding i18n

* Adding some tests

* WIP

* Migrating Token.Extra info to bigger size (2048)

* Fixing tests

* Adding client function for invite guests

* Adding send guests invites tests

* Renaming file from guest to guest_invite

* Adding Promote/Demote users from/to guest endpoints (#10791)

* Adding Promote/Demote users from/to guest endpoints

* Adding i18n translations

* Adding the client functions

* Using getQueryBuilder function

* Addressing PR review comments

* Adding default channels to users on promte from guest (#10851)

* Adding default channels to users on promte from guest

* Addressing PR review comments

* Fixing merge problems

* Sending websockets events on promote/demote (#11403)

* Sending websockets events on promote/demote

* Fixing merge problems

* Fixing govet shadowing problem

* Fixing feature branch tests

* Avoiding leaking users data through websockets for guest accounts (#11489)

* Avoiding leaking users data through websockets for guest accounts

* Adding tests and fixing code error

* Fixing i18n

* Allow to enable/disable guests and other extra config settings (#11481)

* Allow to enable/disable guests and other extra config settings

* Fixing tests and moving license and config validation to api level

* Update api4/role_test.go

Co-Authored-By: George Goldberg <george@gberg.me>

* Update api4/role_test.go

Co-Authored-By: George Goldberg <george@gberg.me>

* Fixing typo

* fixing tests

* Managing correctly the guest channel leave behavior (#11578)

* MM-15134: Removing guests from teams or system on leave channels if needed

* WIP

* No deactivating the guest user when leave the last team

* Adding a couple of tests

* Fixing shadow variables

* Fixing tests

* fixing tests

* fixing shadow variables

* Adding guest counts for channel stats (#11646)

* Adding guest counts for channel stats

* Adding tests

* Fixing tests

* Fixing guest domain restrictions (#11660)

* Adding needed migration for the database

* Fixing migration

store/sqlstore/channel_store.go

@@ -32,6 +32,9 @@ const (
 	CHANNEL_MEMBERS_COUNTS_CACHE_SIZE = model.CHANNEL_CACHE_SIZE
 	CHANNEL_MEMBERS_COUNTS_CACHE_SEC  = 1800 // 30 mins
 
+	CHANNEL_GUESTS_COUNTS_CACHE_SIZE = model.CHANNEL_CACHE_SIZE
+	CHANNEL_GUESTS_COUNTS_CACHE_SEC  = 1800 // 30 mins
+
 	CHANNEL_CACHE_SEC = 900 // 15 mins
 )
 
@@ -278,6 +281,7 @@ type publicChannel struct {
 }
 
 var channelMemberCountsCache = utils.NewLru(CHANNEL_MEMBERS_COUNTS_CACHE_SIZE)
+var channelGuestCountsCache = utils.NewLru(CHANNEL_GUESTS_COUNTS_CACHE_SIZE)
 var allChannelMembersForUserCache = utils.NewLru(ALL_CHANNEL_MEMBERS_FOR_USER_CACHE_SIZE)
 var allChannelMembersNotifyPropsForChannelCache = utils.NewLru(ALL_CHANNEL_MEMBERS_NOTIFY_PROPS_FOR_CHANNEL_CACHE_SIZE)
 var channelCache = utils.NewLru(model.CHANNEL_CACHE_SIZE)
@@ -285,6 +289,7 @@ var channelByNameCache = utils.NewLru(model.CHANNEL_CACHE_SIZE)
 
 func (s SqlChannelStore) ClearCaches() {
 	channelMemberCountsCache.Purge()
+	channelGuestCountsCache.Purge()
 	allChannelMembersForUserCache.Purge()
 	allChannelMembersNotifyPropsForChannelCache.Purge()
 	channelCache.Purge()
@@ -1654,6 +1659,69 @@ func (s SqlChannelStore) GetMemberCount(channelId string, allowFromCache bool) (
 	return count, nil
 }
 
+func (s SqlChannelStore) InvalidateGuestCount(channelId string) {
+	channelGuestCountsCache.Remove(channelId)
+	if s.metrics != nil {
+		s.metrics.IncrementMemCacheInvalidationCounter("Channel Guest Counts - Remove by ChannelId")
+	}
+}
+
+func (s SqlChannelStore) GetGuestCountFromCache(channelId string) int64 {
+	if cacheItem, ok := channelGuestCountsCache.Get(channelId); ok {
+		if s.metrics != nil {
+			s.metrics.IncrementMemCacheHitCounter("Channel Guest Counts")
+		}
+		return cacheItem.(int64)
+	}
+
+	if s.metrics != nil {
+		s.metrics.IncrementMemCacheMissCounter("Channel Guest Counts")
+	}
+
+	count, err := s.GetGuestCount(channelId, true)
+	if err != nil {
+		return 0
+	}
+
+	return count
+}
+
+func (s SqlChannelStore) GetGuestCount(channelId string, allowFromCache bool) (int64, *model.AppError) {
+	if allowFromCache {
+		if cacheItem, ok := channelGuestCountsCache.Get(channelId); ok {
+			if s.metrics != nil {
+				s.metrics.IncrementMemCacheHitCounter("Channel Guest Counts")
+			}
+			return cacheItem.(int64), nil
+		}
+	}
+
+	if s.metrics != nil {
+		s.metrics.IncrementMemCacheMissCounter("Channel Guest Counts")
+	}
+
+	count, err := s.GetReplica().SelectInt(`
+		SELECT
+			count(*)
+		FROM
+			ChannelMembers,
+			Users
+		WHERE
+			ChannelMembers.UserId = Users.Id
+			AND ChannelMembers.ChannelId = :ChannelId
+			AND ChannelMembers.SchemeGuest = TRUE
+			AND Users.DeleteAt = 0`, map[string]interface{}{"ChannelId": channelId})
+	if err != nil {
+		return 0, model.NewAppError("SqlChannelStore.GetGuestCount", "store.sql_channel.get_member_count.app_error", nil, "channel_id="+channelId+", "+err.Error(), http.StatusInternalServerError)
+	}
+
+	if allowFromCache {
+		channelGuestCountsCache.AddWithExpiresInSecs(channelId, count, CHANNEL_GUESTS_COUNTS_CACHE_SEC)
+	}
+
+	return count, nil
+}
+
 func (s SqlChannelStore) RemoveMember(channelId string, userId string) *model.AppError {
 	_, err := s.GetMaster().Exec("DELETE FROM ChannelMembers WHERE ChannelId = :ChannelId AND UserId = :UserId", map[string]interface{}{"ChannelId": channelId, "UserId": userId})
 	if err != nil {
@@ -1871,8 +1939,7 @@ func (s SqlChannelStore) AnalyticsDeletedTypeCount(teamId string, channelType st
 
 func (s SqlChannelStore) GetMembersForUser(teamId string, userId string) (*model.ChannelMembers, *model.AppError) {
 	var dbMembers channelMemberWithSchemeRolesList
-	_, err := s.GetReplica().Select(&dbMembers, CHANNEL_MEMBERS_WITH_SCHEME_SELECT_QUERY+"WHERE ChannelMembers.UserId = :UserId", map[string]interface{}{"TeamId": teamId, "UserId": userId})
-
+	_, err := s.GetReplica().Select(&dbMembers, CHANNEL_MEMBERS_WITH_SCHEME_SELECT_QUERY+"WHERE ChannelMembers.UserId = :UserId AND Teams.Id = :TeamId", map[string]interface{}{"TeamId": teamId, "UserId": userId})
 	if err != nil {
 		return nil, model.NewAppError("SqlChannelStore.GetMembersForUser", "store.sql_channel.get_members.app_error", nil, "teamId="+teamId+", userId="+userId+", err="+err.Error(), http.StatusInternalServerError)
 	}

store/sqlstore/session_store.go

@@ -206,6 +206,23 @@ func (me SqlSessionStore) UpdateDeviceId(id string, deviceId string, expiresAt i
 	return deviceId, nil
 }
 
+func (me SqlSessionStore) UpdateProps(session *model.Session) *model.AppError {
+	oldSession, appErr := me.Get(session.Id)
+	if appErr != nil {
+		return appErr
+	}
+	oldSession.Props = session.Props
+
+	count, err := me.GetMaster().Update(oldSession)
+	if err != nil {
+		return model.NewAppError("SqlSessionStore.UpdateProps", "store.sql_session.update_props.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+	if count != 1 {
+		return model.NewAppError("SqlSessionStore.UpdateProps", "store.sql_session.update_props.app_error", nil, "", http.StatusInternalServerError)
+	}
+	return nil
+}
+
 func (me SqlSessionStore) AnalyticsSessionCount() (int64, *model.AppError) {
 	query :=
 		`SELECT

store/sqlstore/tokens_store.go

@@ -23,7 +23,7 @@ func NewSqlTokenStore(sqlStore SqlStore) store.TokenStore {
 		table := db.AddTableWithName(model.Token{}, "Tokens").SetKeys(false, "Token")
 		table.ColMap("Token").SetMaxSize(64)
 		table.ColMap("Type").SetMaxSize(64)
-		table.ColMap("Extra").SetMaxSize(128)
+		table.ColMap("Extra").SetMaxSize(2048)
 	}
 
 	return s

store/sqlstore/upgrade.go

@@ -710,6 +710,12 @@ func UpgradeDatabaseToVersion514(sqlStore SqlStore) {
 	// TODO: Uncomment following condition when version 5.14.0 is released
 	// if shouldPerformUpgrade(sqlStore, VERSION_5_13_0, VERSION_5_14_0) {
 
+	if sqlStore.DriverName() == model.DATABASE_DRIVER_POSTGRES {
+		sqlStore.GetMaster().Exec("ALTER TABLE Tokens ALTER COLUMN Extra TYPE varchar(2048)")
+	} else if sqlStore.DriverName() == model.DATABASE_DRIVER_MYSQL {
+		sqlStore.GetMaster().Exec("ALTER TABLE Tokens MODIFY Extra text")
+	}
+
 	// 	saveSchemaVersion(sqlStore, VERSION_5_14_0)
 	// }
 }

store/sqlstore/user_store.go

@@ -1066,7 +1066,7 @@ func (us SqlUserStore) PermanentDelete(userId string) *model.AppError {
 }
 
 func (us SqlUserStore) Count(options model.UserCountOptions) (int64, *model.AppError) {
-	query := sq.Select("COUNT(DISTINCT u.Id)").From("Users AS u")
+	query := us.getQueryBuilder().Select("COUNT(DISTINCT u.Id)").From("Users AS u")
 
 	if !options.IncludeDeleted {
 		query = query.Where("u.DeleteAt = 0")
@@ -1644,3 +1644,140 @@ func applyViewRestrictionsFilter(query sq.SelectBuilder, restrictions *model.Vie
 
 	return resultQuery
 }
+
+func (us SqlUserStore) PromoteGuestToUser(userId string) *model.AppError {
+	transaction, err := us.GetMaster().Begin()
+	if err != nil {
+		return model.NewAppError("SqlUserStore.PromoteGuestToUser", "store.sql_user.promote_guest.open_transaction.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+	defer finalizeTransaction(transaction)
+
+	user, appErr := us.Get(userId)
+	if appErr != nil {
+		return appErr
+	}
+
+	roles := user.GetRoles()
+
+	for idx, role := range roles {
+		if role == "system_guest" {
+			roles[idx] = "system_user"
+		}
+	}
+
+	query := us.getQueryBuilder().Update("Users").
+		Set("Roles", strings.Join(roles, " ")).
+		Where(sq.Eq{"Id": userId})
+
+	queryString, args, err := query.ToSql()
+	if err != nil {
+		return model.NewAppError("SqlUserStore.PromoteGuestToUser", "store.sql_user.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	if _, err = transaction.Exec(queryString, args...); err != nil {
+		return model.NewAppError("SqlUserStore.PromoteGuestToUser", "store.sql_user.promote_guest.user_update.app_error", nil, "user_id="+userId, http.StatusInternalServerError)
+	}
+
+	query = us.getQueryBuilder().Update("ChannelMembers").
+		Set("SchemeUser", true).
+		Set("SchemeGuest", false).
+		Where(sq.Eq{"UserId": userId})
+
+	queryString, args, err = query.ToSql()
+	if err != nil {
+		return model.NewAppError("SqlUserStore.PromoteGuestToUser", "store.sql_user.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	if _, err = transaction.Exec(queryString, args...); err != nil {
+		return model.NewAppError("SqlUserStore.PromoteGuestToUser", "store.sql_user.promote_guest.channel_members_update.app_error", nil, "user_id="+userId, http.StatusInternalServerError)
+	}
+
+	query = us.getQueryBuilder().Update("TeamMembers").
+		Set("SchemeUser", true).
+		Set("SchemeGuest", false).
+		Where(sq.Eq{"UserId": userId})
+
+	queryString, args, err = query.ToSql()
+	if err != nil {
+		return model.NewAppError("SqlUserStore.PromoteGuestToUser", "store.sql_user.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	if _, err := transaction.Exec(queryString, args...); err != nil {
+		return model.NewAppError("SqlUserStore.PromoteGuestToUser", "store.sql_user.promote_guest.team_members_update.app_error", nil, "user_id="+userId, http.StatusInternalServerError)
+	}
+
+	if err := transaction.Commit(); err != nil {
+		return model.NewAppError("SqlUserStore.PromoteGuestToUser", "store.sql_user.promote_guest.commit_transaction.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+	return nil
+}
+
+func (us SqlUserStore) DemoteUserToGuest(userId string) *model.AppError {
+	transaction, err := us.GetMaster().Begin()
+	if err != nil {
+		return model.NewAppError("SqlUserStore.DemoteUserToGuest", "store.sql_user.demote_user_to_guest.open_transaction.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+	defer finalizeTransaction(transaction)
+
+	user, appErr := us.Get(userId)
+	if appErr != nil {
+		return appErr
+	}
+
+	roles := user.GetRoles()
+
+	newRoles := []string{}
+	for _, role := range roles {
+		if role == "system_user" {
+			newRoles = append(newRoles, "system_guest")
+		} else if role != "system_admin" {
+			newRoles = append(newRoles, role)
+		}
+	}
+
+	query := us.getQueryBuilder().Update("Users").
+		Set("Roles", strings.Join(newRoles, " ")).
+		Where(sq.Eq{"Id": userId})
+
+	queryString, args, err := query.ToSql()
+	if err != nil {
+		return model.NewAppError("SqlUserStore.DemoteGuestToUser", "store.sql_user.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	if _, err = transaction.Exec(queryString, args...); err != nil {
+		return model.NewAppError("SqlUserStore.DemoteGuestToUser", "store.sql_user.demote_user_to_guest.user_update.app_error", nil, "user_id="+userId, http.StatusInternalServerError)
+	}
+
+	query = us.getQueryBuilder().Update("ChannelMembers").
+		Set("SchemeUser", false).
+		Set("SchemeGuest", true).
+		Where(sq.Eq{"UserId": userId})
+
+	queryString, args, err = query.ToSql()
+	if err != nil {
+		return model.NewAppError("SqlUserStore.DemoteGuestToUser", "store.sql_user.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	if _, err = transaction.Exec(queryString, args...); err != nil {
+		return model.NewAppError("SqlUserStore.DemoteGuestToUser", "store.sql_user.demote_user_to_guest.channel_members_update.app_error", nil, "user_id="+userId, http.StatusInternalServerError)
+	}
+
+	query = us.getQueryBuilder().Update("TeamMembers").
+		Set("SchemeUser", false).
+		Set("SchemeGuest", true).
+		Where(sq.Eq{"UserId": userId})
+
+	queryString, args, err = query.ToSql()
+	if err != nil {
+		return model.NewAppError("SqlUserStore.DemoteGuestToUser", "store.sql_user.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+
+	if _, err := transaction.Exec(queryString, args...); err != nil {
+		return model.NewAppError("SqlUserStore.DemoteGuestToUser", "store.sql_user.demote_user_to_guest.team_members_update.app_error", nil, "user_id="+userId, http.StatusInternalServerError)
+	}
+
+	if err := transaction.Commit(); err != nil {
+		return model.NewAppError("SqlUserStore.DemoteGuestToUser", "store.sql_user.demote_user_to_guest.commit_transaction.app_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+	return nil
+}

store/store.go

@@ -172,6 +172,9 @@ type ChannelStore interface {
 	InvalidateMemberCount(channelId string)
 	GetMemberCountFromCache(channelId string) int64
 	GetMemberCount(channelId string, allowFromCache bool) (int64, *model.AppError)
+	InvalidateGuestCount(channelId string)
+	GetGuestCountFromCache(channelId string) int64
+	GetGuestCount(channelId string, allowFromCache bool) (int64, *model.AppError)
 	GetPinnedPosts(channelId string) (*model.PostList, *model.AppError)
 	RemoveMember(channelId string, userId string) *model.AppError
 	PermanentDeleteMembersByUser(userId string) *model.AppError
@@ -307,6 +310,8 @@ type UserStore interface {
 	Count(options model.UserCountOptions) (int64, *model.AppError)
 	GetTeamGroupUsers(teamID string) ([]*model.User, *model.AppError)
 	GetChannelGroupUsers(channelID string) ([]*model.User, *model.AppError)
+	PromoteGuestToUser(userID string) *model.AppError
+	DemoteUserToGuest(userID string) *model.AppError
 }
 
 type BotStore interface {
@@ -328,6 +333,7 @@ type SessionStore interface {
 	UpdateLastActivityAt(sessionId string, time int64) *model.AppError
 	UpdateRoles(userId string, roles string) (string, *model.AppError)
 	UpdateDeviceId(id string, deviceId string, expiresAt int64) (string, *model.AppError)
+	UpdateProps(session *model.Session) *model.AppError
 	AnalyticsSessionCount() (int64, *model.AppError)
 	Cleanup(expiryTime int64, batchSize int64)
 }

store/storetest/channel_store.go

@@ -65,6 +65,7 @@ func TestChannelStore(t *testing.T, ss store.Store, s SqlSupplier) {
 	t.Run("GetMember", func(t *testing.T) { testGetMember(t, ss) })
 	t.Run("GetMemberForPost", func(t *testing.T) { testChannelStoreGetMemberForPost(t, ss) })
 	t.Run("GetMemberCount", func(t *testing.T) { testGetMemberCount(t, ss) })
+	t.Run("GetGuestCount", func(t *testing.T) { testGetGuestCount(t, ss) })
 	t.Run("SearchMore", func(t *testing.T) { testChannelStoreSearchMore(t, ss) })
 	t.Run("SearchInTeam", func(t *testing.T) { testChannelStoreSearchInTeam(t, ss) })
 	t.Run("SearchAllChannels", func(t *testing.T) { testChannelStoreSearchAllChannels(t, ss) })
@@ -2045,6 +2046,124 @@ func testGetMemberCount(t *testing.T, ss store.Store) {
 	}
 }
 
+func testGetGuestCount(t *testing.T, ss store.Store) {
+	teamId := model.NewId()
+
+	c1 := model.Channel{
+		TeamId:      teamId,
+		DisplayName: "Channel1",
+		Name:        "zz" + model.NewId() + "b",
+		Type:        model.CHANNEL_OPEN,
+	}
+	_, err := ss.Channel().Save(&c1, -1)
+	require.Nil(t, err)
+
+	c2 := model.Channel{
+		TeamId:      teamId,
+		DisplayName: "Channel2",
+		Name:        "zz" + model.NewId() + "b",
+		Type:        model.CHANNEL_OPEN,
+	}
+	_, err = ss.Channel().Save(&c2, -1)
+	require.Nil(t, err)
+
+	t.Run("Regular member doesn't count", func(t *testing.T) {
+		u1 := &model.User{
+			Email:    MakeEmail(),
+			DeleteAt: 0,
+			Roles:    model.SYSTEM_USER_ROLE_ID,
+		}
+		_, err = ss.User().Save(u1)
+		require.Nil(t, err)
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId, UserId: u1.Id}, -1))
+
+		m1 := model.ChannelMember{
+			ChannelId:   c1.Id,
+			UserId:      u1.Id,
+			NotifyProps: model.GetDefaultChannelNotifyProps(),
+			SchemeGuest: false,
+		}
+		_, err = ss.Channel().SaveMember(&m1)
+		require.Nil(t, err)
+
+		count, channelErr := ss.Channel().GetGuestCount(c1.Id, false)
+		require.Nil(t, channelErr)
+		require.Equal(t, count, int64(0))
+	})
+
+	t.Run("Guest member does count", func(t *testing.T) {
+		u2 := model.User{
+			Email:    MakeEmail(),
+			DeleteAt: 0,
+			Roles:    model.SYSTEM_GUEST_ROLE_ID,
+		}
+		_, err = ss.User().Save(&u2)
+		require.Nil(t, err)
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId, UserId: u2.Id}, -1))
+
+		m2 := model.ChannelMember{
+			ChannelId:   c1.Id,
+			UserId:      u2.Id,
+			NotifyProps: model.GetDefaultChannelNotifyProps(),
+			SchemeGuest: true,
+		}
+		_, err = ss.Channel().SaveMember(&m2)
+		require.Nil(t, err)
+
+		count, channelErr := ss.Channel().GetGuestCount(c1.Id, false)
+		require.Nil(t, channelErr)
+		require.Equal(t, count, int64(1))
+	})
+
+	t.Run("make sure members of other channels aren't counted", func(t *testing.T) {
+		u3 := model.User{
+			Email:    MakeEmail(),
+			DeleteAt: 0,
+			Roles:    model.SYSTEM_GUEST_ROLE_ID,
+		}
+		_, err = ss.User().Save(&u3)
+		require.Nil(t, err)
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId, UserId: u3.Id}, -1))
+
+		m3 := model.ChannelMember{
+			ChannelId:   c2.Id,
+			UserId:      u3.Id,
+			NotifyProps: model.GetDefaultChannelNotifyProps(),
+			SchemeGuest: true,
+		}
+		_, err = ss.Channel().SaveMember(&m3)
+		require.Nil(t, err)
+
+		count, channelErr := ss.Channel().GetGuestCount(c1.Id, false)
+		require.Nil(t, channelErr)
+		require.Equal(t, count, int64(1))
+	})
+
+	t.Run("make sure inactive users aren't counted", func(t *testing.T) {
+		u4 := &model.User{
+			Email:    MakeEmail(),
+			DeleteAt: 10000,
+			Roles:    model.SYSTEM_GUEST_ROLE_ID,
+		}
+		_, err = ss.User().Save(u4)
+		require.Nil(t, err)
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId, UserId: u4.Id}, -1))
+
+		m4 := model.ChannelMember{
+			ChannelId:   c1.Id,
+			UserId:      u4.Id,
+			NotifyProps: model.GetDefaultChannelNotifyProps(),
+			SchemeGuest: true,
+		}
+		_, err = ss.Channel().SaveMember(&m4)
+		require.Nil(t, err)
+
+		count, channelErr := ss.Channel().GetGuestCount(c1.Id, false)
+		require.Nil(t, channelErr)
+		require.Equal(t, count, int64(1))
+	})
+}
+
 func testChannelStoreSearchMore(t *testing.T, ss store.Store) {
 	teamId := model.NewId()
 	otherTeamId := model.NewId()

store/storetest/mocks/ChannelStore.go

@@ -744,6 +744,43 @@ func (_m *ChannelStore) GetFromMaster(id string) (*model.Channel, *model.AppErro
 	return r0, r1
 }
 
+// GetGuestCount provides a mock function with given fields: channelId, allowFromCache
+func (_m *ChannelStore) GetGuestCount(channelId string, allowFromCache bool) (int64, *model.AppError) {
+	ret := _m.Called(channelId, allowFromCache)
+
+	var r0 int64
+	if rf, ok := ret.Get(0).(func(string, bool) int64); ok {
+		r0 = rf(channelId, allowFromCache)
+	} else {
+		r0 = ret.Get(0).(int64)
+	}
+
+	var r1 *model.AppError
+	if rf, ok := ret.Get(1).(func(string, bool) *model.AppError); ok {
+		r1 = rf(channelId, allowFromCache)
+	} else {
+		if ret.Get(1) != nil {
+			r1 = ret.Get(1).(*model.AppError)
+		}
+	}
+
+	return r0, r1
+}
+
+// GetGuestCountFromCache provides a mock function with given fields: channelId
+func (_m *ChannelStore) GetGuestCountFromCache(channelId string) int64 {
+	ret := _m.Called(channelId)
+
+	var r0 int64
+	if rf, ok := ret.Get(0).(func(string) int64); ok {
+		r0 = rf(channelId)
+	} else {
+		r0 = ret.Get(0).(int64)
+	}
+
+	return r0
+}
+
 // GetMember provides a mock function with given fields: channelId, userId
 func (_m *ChannelStore) GetMember(channelId string, userId string) (*model.ChannelMember, *model.AppError) {
 	ret := _m.Called(channelId, userId)
@@ -1092,6 +1129,11 @@ func (_m *ChannelStore) InvalidateChannelByName(teamId string, name string) {
 	_m.Called(teamId, name)
 }
 
+// InvalidateGuestCount provides a mock function with given fields: channelId
+func (_m *ChannelStore) InvalidateGuestCount(channelId string) {
+	_m.Called(channelId)
+}
+
 // InvalidateMemberCount provides a mock function with given fields: channelId
 func (_m *ChannelStore) InvalidateMemberCount(channelId string) {
 	_m.Called(channelId)

store/storetest/mocks/SessionStore.go

@@ -227,6 +227,22 @@ func (_m *SessionStore) UpdateLastActivityAt(sessionId string, time int64) *mode
 	return r0
 }
 
+// UpdateProps provides a mock function with given fields: session
+func (_m *SessionStore) UpdateProps(session *model.Session) *model.AppError {
+	ret := _m.Called(session)
+
+	var r0 *model.AppError
+	if rf, ok := ret.Get(0).(func(*model.Session) *model.AppError); ok {
+		r0 = rf(session)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*model.AppError)
+		}
+	}
+
+	return r0
+}
+
 // UpdateRoles provides a mock function with given fields: userId, roles
 func (_m *SessionStore) UpdateRoles(userId string, roles string) (string, *model.AppError) {
 	ret := _m.Called(userId, roles)

store/storetest/mocks/UserStore.go

@@ -126,6 +126,22 @@ func (_m *UserStore) Count(options model.UserCountOptions) (int64, *model.AppErr
 	return r0, r1
 }
 
+// DemoteUserToGuest provides a mock function with given fields: userID
+func (_m *UserStore) DemoteUserToGuest(userID string) *model.AppError {
+	ret := _m.Called(userID)
+
+	var r0 *model.AppError
+	if rf, ok := ret.Get(0).(func(string) *model.AppError); ok {
+		r0 = rf(userID)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*model.AppError)
+		}
+	}
+
+	return r0
+}
+
 // Get provides a mock function with given fields: id
 func (_m *UserStore) Get(id string) (*model.User, *model.AppError) {
 	ret := _m.Called(id)
@@ -905,6 +921,22 @@ func (_m *UserStore) PermanentDelete(userId string) *model.AppError {
 	return r0
 }
 
+// PromoteGuestToUser provides a mock function with given fields: userID
+func (_m *UserStore) PromoteGuestToUser(userID string) *model.AppError {
+	ret := _m.Called(userID)
+
+	var r0 *model.AppError
+	if rf, ok := ret.Get(0).(func(string) *model.AppError); ok {
+		r0 = rf(userID)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*model.AppError)
+		}
+	}
+
+	return r0
+}
+
 // ResetLastPictureUpdate provides a mock function with given fields: userId
 func (_m *UserStore) ResetLastPictureUpdate(userId string) *model.AppError {
 	ret := _m.Called(userId)

store/storetest/user_store.go

@@ -78,6 +78,8 @@ func TestUserStore(t *testing.T, ss store.Store, s SqlSupplier) {
 	t.Run("GetUsersBatchForIndexing", func(t *testing.T) { testUserStoreGetUsersBatchForIndexing(t, ss) })
 	t.Run("GetTeamGroupUsers", func(t *testing.T) { testUserStoreGetTeamGroupUsers(t, ss) })
 	t.Run("GetChannelGroupUsers", func(t *testing.T) { testUserStoreGetChannelGroupUsers(t, ss) })
+	t.Run("PromoteGuestToUser", func(t *testing.T) { testUserStorePromoteGuestToUser(t, ss) })
+	t.Run("DemoteUserToGuest", func(t *testing.T) { testUserStoreDemoteUserToGuest(t, ss) })
 	t.Run("ResetLastPictureUpdate", func(t *testing.T) { testUserStoreResetLastPictureUpdate(t, ss) })
 }
 
@@ -4154,6 +4156,604 @@ func testUserStoreGetChannelGroupUsers(t *testing.T, ss store.Store) {
 	requireNUsers(2)
 }
 
+func testUserStorePromoteGuestToUser(t *testing.T, ss store.Store) {
+	// create users
+	t.Run("Must do nothing with regular user", func(t *testing.T) {
+		id := model.NewId()
+		user, err := ss.User().Save(&model.User{
+			Email:     id + "@test.com",
+			Username:  "un_" + id,
+			Nickname:  "nn_" + id,
+			FirstName: "f_" + id,
+			LastName:  "l_" + id,
+			Password:  "Password1",
+			Roles:     "system_user",
+		})
+		require.Nil(t, err)
+
+		teamId := model.NewId()
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId, UserId: user.Id, SchemeGuest: true, SchemeUser: false}, 999))
+
+		channel, err := ss.Channel().Save(&model.Channel{
+			TeamId:      teamId,
+			DisplayName: "Channel name",
+			Name:        "channel-" + model.NewId(),
+			Type:        model.CHANNEL_OPEN,
+		}, -1)
+		require.Nil(t, err)
+		_, err = ss.Channel().SaveMember(&model.ChannelMember{ChannelId: channel.Id, UserId: user.Id, SchemeGuest: true, SchemeUser: false, NotifyProps: model.GetDefaultChannelNotifyProps()})
+		require.Nil(t, err)
+
+		err = ss.User().PromoteGuestToUser(user.Id)
+		assert.Nil(t, err)
+		updatedUser, err := ss.User().Get(user.Id)
+		assert.Nil(t, err)
+		require.Equal(t, "system_user", updatedUser.Roles)
+
+		updatedTeamMember, err := ss.Team().GetMember(teamId, user.Id)
+		require.Nil(t, err)
+		require.False(t, updatedTeamMember.SchemeGuest)
+		require.True(t, updatedTeamMember.SchemeUser)
+
+		updatedChannelMember, err := ss.Channel().GetMember(channel.Id, user.Id)
+		require.Nil(t, err)
+		require.False(t, updatedChannelMember.SchemeGuest)
+		require.True(t, updatedChannelMember.SchemeUser)
+	})
+
+	t.Run("Must do nothing with admin user", func(t *testing.T) {
+		id := model.NewId()
+		user, err := ss.User().Save(&model.User{
+			Email:     id + "@test.com",
+			Username:  "un_" + id,
+			Nickname:  "nn_" + id,
+			FirstName: "f_" + id,
+			LastName:  "l_" + id,
+			Password:  "Password1",
+			Roles:     "system_user system_admin",
+		})
+		require.Nil(t, err)
+
+		teamId := model.NewId()
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId, UserId: user.Id, SchemeGuest: true, SchemeUser: false}, 999))
+
+		channel, err := ss.Channel().Save(&model.Channel{
+			TeamId:      teamId,
+			DisplayName: "Channel name",
+			Name:        "channel-" + model.NewId(),
+			Type:        model.CHANNEL_OPEN,
+		}, -1)
+		require.Nil(t, err)
+		_, err = ss.Channel().SaveMember(&model.ChannelMember{ChannelId: channel.Id, UserId: user.Id, SchemeGuest: true, SchemeUser: false, NotifyProps: model.GetDefaultChannelNotifyProps()})
+		require.Nil(t, err)
+
+		err = ss.User().PromoteGuestToUser(user.Id)
+		assert.Nil(t, err)
+		updatedUser, err := ss.User().Get(user.Id)
+		assert.Nil(t, err)
+		require.Equal(t, "system_user system_admin", updatedUser.Roles)
+
+		updatedTeamMember, err := ss.Team().GetMember(teamId, user.Id)
+		require.Nil(t, err)
+		require.False(t, updatedTeamMember.SchemeGuest)
+		require.True(t, updatedTeamMember.SchemeUser)
+
+		updatedChannelMember, err := ss.Channel().GetMember(channel.Id, user.Id)
+		require.Nil(t, err)
+		require.False(t, updatedChannelMember.SchemeGuest)
+		require.True(t, updatedChannelMember.SchemeUser)
+	})
+
+	t.Run("Must work with guest user without teams or channels", func(t *testing.T) {
+		id := model.NewId()
+		user, err := ss.User().Save(&model.User{
+			Email:     id + "@test.com",
+			Username:  "un_" + id,
+			Nickname:  "nn_" + id,
+			FirstName: "f_" + id,
+			LastName:  "l_" + id,
+			Password:  "Password1",
+			Roles:     "system_guest",
+		})
+		require.Nil(t, err)
+
+		err = ss.User().PromoteGuestToUser(user.Id)
+		assert.Nil(t, err)
+		updatedUser, err := ss.User().Get(user.Id)
+		assert.Nil(t, err)
+		require.Equal(t, "system_user", updatedUser.Roles)
+	})
+
+	t.Run("Must work with guest user with teams but no channels", func(t *testing.T) {
+		id := model.NewId()
+		user, err := ss.User().Save(&model.User{
+			Email:     id + "@test.com",
+			Username:  "un_" + id,
+			Nickname:  "nn_" + id,
+			FirstName: "f_" + id,
+			LastName:  "l_" + id,
+			Password:  "Password1",
+			Roles:     "system_guest",
+		})
+		require.Nil(t, err)
+
+		teamId := model.NewId()
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId, UserId: user.Id, SchemeGuest: true, SchemeUser: false}, 999))
+
+		err = ss.User().PromoteGuestToUser(user.Id)
+		assert.Nil(t, err)
+		updatedUser, err := ss.User().Get(user.Id)
+		assert.Nil(t, err)
+		require.Equal(t, "system_user", updatedUser.Roles)
+
+		updatedTeamMember, err := ss.Team().GetMember(teamId, user.Id)
+		require.Nil(t, err)
+		require.False(t, updatedTeamMember.SchemeGuest)
+		require.True(t, updatedTeamMember.SchemeUser)
+	})
+
+	t.Run("Must work with guest user with teams and channels", func(t *testing.T) {
+		id := model.NewId()
+		user, err := ss.User().Save(&model.User{
+			Email:     id + "@test.com",
+			Username:  "un_" + id,
+			Nickname:  "nn_" + id,
+			FirstName: "f_" + id,
+			LastName:  "l_" + id,
+			Password:  "Password1",
+			Roles:     "system_guest",
+		})
+		require.Nil(t, err)
+
+		teamId := model.NewId()
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId, UserId: user.Id, SchemeGuest: true, SchemeUser: false}, 999))
+
+		channel, err := ss.Channel().Save(&model.Channel{
+			TeamId:      teamId,
+			DisplayName: "Channel name",
+			Name:        "channel-" + model.NewId(),
+			Type:        model.CHANNEL_OPEN,
+		}, -1)
+		require.Nil(t, err)
+		_, err = ss.Channel().SaveMember(&model.ChannelMember{ChannelId: channel.Id, UserId: user.Id, SchemeGuest: true, SchemeUser: false, NotifyProps: model.GetDefaultChannelNotifyProps()})
+		require.Nil(t, err)
+
+		err = ss.User().PromoteGuestToUser(user.Id)
+		assert.Nil(t, err)
+		updatedUser, err := ss.User().Get(user.Id)
+		assert.Nil(t, err)
+		require.Equal(t, "system_user", updatedUser.Roles)
+
+		updatedTeamMember, err := ss.Team().GetMember(teamId, user.Id)
+		require.Nil(t, err)
+		require.False(t, updatedTeamMember.SchemeGuest)
+		require.True(t, updatedTeamMember.SchemeUser)
+
+		updatedChannelMember, err := ss.Channel().GetMember(channel.Id, user.Id)
+		require.Nil(t, err)
+		require.False(t, updatedChannelMember.SchemeGuest)
+		require.True(t, updatedChannelMember.SchemeUser)
+	})
+
+	t.Run("Must work with guest user with teams and channels and custom role", func(t *testing.T) {
+		id := model.NewId()
+		user, err := ss.User().Save(&model.User{
+			Email:     id + "@test.com",
+			Username:  "un_" + id,
+			Nickname:  "nn_" + id,
+			FirstName: "f_" + id,
+			LastName:  "l_" + id,
+			Password:  "Password1",
+			Roles:     "system_guest custom_role",
+		})
+		require.Nil(t, err)
+
+		teamId := model.NewId()
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId, UserId: user.Id, SchemeGuest: true, SchemeUser: false}, 999))
+
+		channel, err := ss.Channel().Save(&model.Channel{
+			TeamId:      teamId,
+			DisplayName: "Channel name",
+			Name:        "channel-" + model.NewId(),
+			Type:        model.CHANNEL_OPEN,
+		}, -1)
+		require.Nil(t, err)
+		_, err = ss.Channel().SaveMember(&model.ChannelMember{ChannelId: channel.Id, UserId: user.Id, SchemeGuest: true, SchemeUser: false, NotifyProps: model.GetDefaultChannelNotifyProps()})
+		require.Nil(t, err)
+
+		err = ss.User().PromoteGuestToUser(user.Id)
+		assert.Nil(t, err)
+		updatedUser, err := ss.User().Get(user.Id)
+		assert.Nil(t, err)
+		require.Equal(t, "system_user custom_role", updatedUser.Roles)
+
+		updatedTeamMember, err := ss.Team().GetMember(teamId, user.Id)
+		require.Nil(t, err)
+		require.False(t, updatedTeamMember.SchemeGuest)
+		require.True(t, updatedTeamMember.SchemeUser)
+
+		updatedChannelMember, err := ss.Channel().GetMember(channel.Id, user.Id)
+		require.Nil(t, err)
+		require.False(t, updatedChannelMember.SchemeGuest)
+		require.True(t, updatedChannelMember.SchemeUser)
+	})
+
+	t.Run("Must no change any other user guest role", func(t *testing.T) {
+		id := model.NewId()
+		user1, err := ss.User().Save(&model.User{
+			Email:     id + "@test.com",
+			Username:  "un_" + id,
+			Nickname:  "nn_" + id,
+			FirstName: "f_" + id,
+			LastName:  "l_" + id,
+			Password:  "Password1",
+			Roles:     "system_guest",
+		})
+		require.Nil(t, err)
+
+		teamId1 := model.NewId()
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId1, UserId: user1.Id, SchemeGuest: true, SchemeUser: false}, 999))
+
+		channel, err := ss.Channel().Save(&model.Channel{
+			TeamId:      teamId1,
+			DisplayName: "Channel name",
+			Name:        "channel-" + model.NewId(),
+			Type:        model.CHANNEL_OPEN,
+		}, -1)
+		require.Nil(t, err)
+
+		_, err = ss.Channel().SaveMember(&model.ChannelMember{ChannelId: channel.Id, UserId: user1.Id, SchemeGuest: true, SchemeUser: false, NotifyProps: model.GetDefaultChannelNotifyProps()})
+		require.Nil(t, err)
+
+		id = model.NewId()
+		user2, err := ss.User().Save(&model.User{
+			Email:     id + "@test.com",
+			Username:  "un_" + id,
+			Nickname:  "nn_" + id,
+			FirstName: "f_" + id,
+			LastName:  "l_" + id,
+			Password:  "Password1",
+			Roles:     "system_guest",
+		})
+		require.Nil(t, err)
+
+		teamId2 := model.NewId()
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId2, UserId: user2.Id, SchemeGuest: true, SchemeUser: false}, 999))
+
+		_, err = ss.Channel().SaveMember(&model.ChannelMember{ChannelId: channel.Id, UserId: user2.Id, SchemeGuest: true, SchemeUser: false, NotifyProps: model.GetDefaultChannelNotifyProps()})
+		require.Nil(t, err)
+
+		err = ss.User().PromoteGuestToUser(user1.Id)
+		assert.Nil(t, err)
+		updatedUser, err := ss.User().Get(user1.Id)
+		assert.Nil(t, err)
+		require.Equal(t, "system_user", updatedUser.Roles)
+
+		updatedTeamMember, err := ss.Team().GetMember(teamId1, user1.Id)
+		require.Nil(t, err)
+		require.False(t, updatedTeamMember.SchemeGuest)
+		require.True(t, updatedTeamMember.SchemeUser)
+
+		updatedChannelMember, err := ss.Channel().GetMember(channel.Id, user1.Id)
+		require.Nil(t, err)
+		require.False(t, updatedChannelMember.SchemeGuest)
+		require.True(t, updatedChannelMember.SchemeUser)
+
+		notUpdatedUser, err := ss.User().Get(user2.Id)
+		assert.Nil(t, err)
+		require.Equal(t, "system_guest", notUpdatedUser.Roles)
+
+		notUpdatedTeamMember, err := ss.Team().GetMember(teamId2, user2.Id)
+		require.Nil(t, err)
+		require.True(t, notUpdatedTeamMember.SchemeGuest)
+		require.False(t, notUpdatedTeamMember.SchemeUser)
+
+		notUpdatedChannelMember, err := ss.Channel().GetMember(channel.Id, user2.Id)
+		require.Nil(t, err)
+		require.True(t, notUpdatedChannelMember.SchemeGuest)
+		require.False(t, notUpdatedChannelMember.SchemeUser)
+	})
+}
+
+func testUserStoreDemoteUserToGuest(t *testing.T, ss store.Store) {
+	// create users
+	t.Run("Must do nothing with guest", func(t *testing.T) {
+		id := model.NewId()
+		user, err := ss.User().Save(&model.User{
+			Email:     id + "@test.com",
+			Username:  "un_" + id,
+			Nickname:  "nn_" + id,
+			FirstName: "f_" + id,
+			LastName:  "l_" + id,
+			Password:  "Password1",
+			Roles:     "system_guest",
+		})
+		require.Nil(t, err)
+
+		teamId := model.NewId()
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId, UserId: user.Id, SchemeGuest: false, SchemeUser: true}, 999))
+
+		channel, err := ss.Channel().Save(&model.Channel{
+			TeamId:      teamId,
+			DisplayName: "Channel name",
+			Name:        "channel-" + model.NewId(),
+			Type:        model.CHANNEL_OPEN,
+		}, -1)
+		require.Nil(t, err)
+		_, err = ss.Channel().SaveMember(&model.ChannelMember{ChannelId: channel.Id, UserId: user.Id, SchemeGuest: false, SchemeUser: true, NotifyProps: model.GetDefaultChannelNotifyProps()})
+		require.Nil(t, err)
+
+		err = ss.User().DemoteUserToGuest(user.Id)
+		assert.Nil(t, err)
+		updatedUser, err := ss.User().Get(user.Id)
+		assert.Nil(t, err)
+		require.Equal(t, "system_guest", updatedUser.Roles)
+
+		updatedTeamMember, err := ss.Team().GetMember(teamId, user.Id)
+		require.Nil(t, err)
+		require.True(t, updatedTeamMember.SchemeGuest)
+		require.False(t, updatedTeamMember.SchemeUser)
+
+		updatedChannelMember, err := ss.Channel().GetMember(channel.Id, user.Id)
+		require.Nil(t, err)
+		require.True(t, updatedChannelMember.SchemeGuest)
+		require.False(t, updatedChannelMember.SchemeUser)
+	})
+
+	t.Run("Must demote properly an admin user", func(t *testing.T) {
+		id := model.NewId()
+		user, err := ss.User().Save(&model.User{
+			Email:     id + "@test.com",
+			Username:  "un_" + id,
+			Nickname:  "nn_" + id,
+			FirstName: "f_" + id,
+			LastName:  "l_" + id,
+			Password:  "Password1",
+			Roles:     "system_user system_admin",
+		})
+		require.Nil(t, err)
+
+		teamId := model.NewId()
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId, UserId: user.Id, SchemeGuest: true, SchemeUser: false}, 999))
+
+		channel, err := ss.Channel().Save(&model.Channel{
+			TeamId:      teamId,
+			DisplayName: "Channel name",
+			Name:        "channel-" + model.NewId(),
+			Type:        model.CHANNEL_OPEN,
+		}, -1)
+		require.Nil(t, err)
+		_, err = ss.Channel().SaveMember(&model.ChannelMember{ChannelId: channel.Id, UserId: user.Id, SchemeGuest: true, SchemeUser: false, NotifyProps: model.GetDefaultChannelNotifyProps()})
+		require.Nil(t, err)
+
+		err = ss.User().DemoteUserToGuest(user.Id)
+		assert.Nil(t, err)
+		updatedUser, err := ss.User().Get(user.Id)
+		assert.Nil(t, err)
+		require.Equal(t, "system_guest", updatedUser.Roles)
+
+		updatedTeamMember, err := ss.Team().GetMember(teamId, user.Id)
+		require.Nil(t, err)
+		require.True(t, updatedTeamMember.SchemeGuest)
+		require.False(t, updatedTeamMember.SchemeUser)
+
+		updatedChannelMember, err := ss.Channel().GetMember(channel.Id, user.Id)
+		require.Nil(t, err)
+		require.True(t, updatedChannelMember.SchemeGuest)
+		require.False(t, updatedChannelMember.SchemeUser)
+	})
+
+	t.Run("Must work with user without teams or channels", func(t *testing.T) {
+		id := model.NewId()
+		user, err := ss.User().Save(&model.User{
+			Email:     id + "@test.com",
+			Username:  "un_" + id,
+			Nickname:  "nn_" + id,
+			FirstName: "f_" + id,
+			LastName:  "l_" + id,
+			Password:  "Password1",
+			Roles:     "system_user",
+		})
+		require.Nil(t, err)
+
+		err = ss.User().DemoteUserToGuest(user.Id)
+		assert.Nil(t, err)
+		updatedUser, err := ss.User().Get(user.Id)
+		assert.Nil(t, err)
+		require.Equal(t, "system_guest", updatedUser.Roles)
+	})
+
+	t.Run("Must work with user with teams but no channels", func(t *testing.T) {
+		id := model.NewId()
+		user, err := ss.User().Save(&model.User{
+			Email:     id + "@test.com",
+			Username:  "un_" + id,
+			Nickname:  "nn_" + id,
+			FirstName: "f_" + id,
+			LastName:  "l_" + id,
+			Password:  "Password1",
+			Roles:     "system_user",
+		})
+		require.Nil(t, err)
+
+		teamId := model.NewId()
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId, UserId: user.Id, SchemeGuest: false, SchemeUser: true}, 999))
+
+		err = ss.User().DemoteUserToGuest(user.Id)
+		assert.Nil(t, err)
+		updatedUser, err := ss.User().Get(user.Id)
+		assert.Nil(t, err)
+		require.Equal(t, "system_guest", updatedUser.Roles)
+
+		updatedTeamMember, err := ss.Team().GetMember(teamId, user.Id)
+		require.Nil(t, err)
+		require.True(t, updatedTeamMember.SchemeGuest)
+		require.False(t, updatedTeamMember.SchemeUser)
+	})
+
+	t.Run("Must work with user with teams and channels", func(t *testing.T) {
+		id := model.NewId()
+		user, err := ss.User().Save(&model.User{
+			Email:     id + "@test.com",
+			Username:  "un_" + id,
+			Nickname:  "nn_" + id,
+			FirstName: "f_" + id,
+			LastName:  "l_" + id,
+			Password:  "Password1",
+			Roles:     "system_user",
+		})
+		require.Nil(t, err)
+
+		teamId := model.NewId()
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId, UserId: user.Id, SchemeGuest: false, SchemeUser: true}, 999))
+
+		channel, err := ss.Channel().Save(&model.Channel{
+			TeamId:      teamId,
+			DisplayName: "Channel name",
+			Name:        "channel-" + model.NewId(),
+			Type:        model.CHANNEL_OPEN,
+		}, -1)
+		require.Nil(t, err)
+		_, err = ss.Channel().SaveMember(&model.ChannelMember{ChannelId: channel.Id, UserId: user.Id, SchemeGuest: false, SchemeUser: true, NotifyProps: model.GetDefaultChannelNotifyProps()})
+		require.Nil(t, err)
+
+		err = ss.User().DemoteUserToGuest(user.Id)
+		assert.Nil(t, err)
+		updatedUser, err := ss.User().Get(user.Id)
+		assert.Nil(t, err)
+		require.Equal(t, "system_guest", updatedUser.Roles)
+
+		updatedTeamMember, err := ss.Team().GetMember(teamId, user.Id)
+		require.Nil(t, err)
+		require.True(t, updatedTeamMember.SchemeGuest)
+		require.False(t, updatedTeamMember.SchemeUser)
+
+		updatedChannelMember, err := ss.Channel().GetMember(channel.Id, user.Id)
+		assert.Nil(t, err)
+		require.True(t, updatedChannelMember.SchemeGuest)
+		require.False(t, updatedChannelMember.SchemeUser)
+	})
+
+	t.Run("Must work with user with teams and channels and custom role", func(t *testing.T) {
+		id := model.NewId()
+		user, err := ss.User().Save(&model.User{
+			Email:     id + "@test.com",
+			Username:  "un_" + id,
+			Nickname:  "nn_" + id,
+			FirstName: "f_" + id,
+			LastName:  "l_" + id,
+			Password:  "Password1",
+			Roles:     "system_user custom_role",
+		})
+		require.Nil(t, err)
+
+		teamId := model.NewId()
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId, UserId: user.Id, SchemeGuest: false, SchemeUser: true}, 999))
+
+		channel, err := ss.Channel().Save(&model.Channel{
+			TeamId:      teamId,
+			DisplayName: "Channel name",
+			Name:        "channel-" + model.NewId(),
+			Type:        model.CHANNEL_OPEN,
+		}, -1)
+		require.Nil(t, err)
+		_, err = ss.Channel().SaveMember(&model.ChannelMember{ChannelId: channel.Id, UserId: user.Id, SchemeGuest: false, SchemeUser: true, NotifyProps: model.GetDefaultChannelNotifyProps()})
+		require.Nil(t, err)
+
+		err = ss.User().DemoteUserToGuest(user.Id)
+		assert.Nil(t, err)
+		updatedUser, err := ss.User().Get(user.Id)
+		assert.Nil(t, err)
+		require.Equal(t, "system_guest custom_role", updatedUser.Roles)
+
+		updatedTeamMember, err := ss.Team().GetMember(teamId, user.Id)
+		require.Nil(t, err)
+		require.True(t, updatedTeamMember.SchemeGuest)
+		require.False(t, updatedTeamMember.SchemeUser)
+
+		updatedChannelMember, err := ss.Channel().GetMember(channel.Id, user.Id)
+		assert.Nil(t, err)
+		require.True(t, updatedChannelMember.SchemeGuest)
+		require.False(t, updatedChannelMember.SchemeUser)
+	})
+
+	t.Run("Must no change any other user role", func(t *testing.T) {
+		id := model.NewId()
+		user1, err := ss.User().Save(&model.User{
+			Email:     id + "@test.com",
+			Username:  "un_" + id,
+			Nickname:  "nn_" + id,
+			FirstName: "f_" + id,
+			LastName:  "l_" + id,
+			Password:  "Password1",
+			Roles:     "system_user",
+		})
+		require.Nil(t, err)
+
+		teamId1 := model.NewId()
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId1, UserId: user1.Id, SchemeGuest: false, SchemeUser: true}, 999))
+
+		channel, err := ss.Channel().Save(&model.Channel{
+			TeamId:      teamId1,
+			DisplayName: "Channel name",
+			Name:        "channel-" + model.NewId(),
+			Type:        model.CHANNEL_OPEN,
+		}, -1)
+		require.Nil(t, err)
+
+		_, err = ss.Channel().SaveMember(&model.ChannelMember{ChannelId: channel.Id, UserId: user1.Id, SchemeGuest: false, SchemeUser: true, NotifyProps: model.GetDefaultChannelNotifyProps()})
+		require.Nil(t, err)
+
+		id = model.NewId()
+		user2, err := ss.User().Save(&model.User{
+			Email:     id + "@test.com",
+			Username:  "un_" + id,
+			Nickname:  "nn_" + id,
+			FirstName: "f_" + id,
+			LastName:  "l_" + id,
+			Password:  "Password1",
+			Roles:     "system_user",
+		})
+		require.Nil(t, err)
+
+		teamId2 := model.NewId()
+		store.Must(ss.Team().SaveMember(&model.TeamMember{TeamId: teamId2, UserId: user2.Id, SchemeGuest: false, SchemeUser: true}, 999))
+
+		_, err = ss.Channel().SaveMember(&model.ChannelMember{ChannelId: channel.Id, UserId: user2.Id, SchemeGuest: false, SchemeUser: true, NotifyProps: model.GetDefaultChannelNotifyProps()})
+		require.Nil(t, err)
+
+		err = ss.User().DemoteUserToGuest(user1.Id)
+		assert.Nil(t, err)
+		updatedUser, err := ss.User().Get(user1.Id)
+		assert.Nil(t, err)
+		require.Equal(t, "system_guest", updatedUser.Roles)
+
+		updatedTeamMember, err := ss.Team().GetMember(teamId1, user1.Id)
+		require.Nil(t, err)
+		require.True(t, updatedTeamMember.SchemeGuest)
+		require.False(t, updatedTeamMember.SchemeUser)
+
+		updatedChannelMember, err := ss.Channel().GetMember(channel.Id, user1.Id)
+		assert.Nil(t, err)
+		require.True(t, updatedChannelMember.SchemeGuest)
+		require.False(t, updatedChannelMember.SchemeUser)
+
+		notUpdatedUser, err := ss.User().Get(user2.Id)
+		assert.Nil(t, err)
+		require.Equal(t, "system_user", notUpdatedUser.Roles)
+
+		notUpdatedTeamMember, err := ss.Team().GetMember(teamId2, user2.Id)
+		require.Nil(t, err)
+		require.False(t, notUpdatedTeamMember.SchemeGuest)
+		require.True(t, notUpdatedTeamMember.SchemeUser)
+
+		notUpdatedChannelMember, err := ss.Channel().GetMember(channel.Id, user2.Id)
+		assert.Nil(t, err)
+		require.False(t, notUpdatedChannelMember.SchemeGuest)
+		require.True(t, notUpdatedChannelMember.SchemeUser)
+	})
+}
+
 func testUserStoreResetLastPictureUpdate(t *testing.T, ss store.Store) {
 	u1 := &model.User{}
 	u1.Email = MakeEmail()