PLT-4457 Added API to get multiple users by their usernames (#6218)

* Allow getting profiles by username without a team

* Changed UserStore.GetProfilesByUsernames to return an array

* PLT-4457 Added API to get multiple users by their usernames

* Changed users/names route to users/usernames

2 files changed, 51 insertions, 0 deletions

diff --git a/api4/user.go b/api4/user.go
index 70182c1ab..1c870f1c1 100644
--- a/api4/user.go
+++ b/api4/user.go
@@ -22,6 +22,7 @@ func InitUser() {
 	BaseRoutes.Users.Handle("", ApiHandler(createUser)).Methods("POST")
 	BaseRoutes.Users.Handle("", ApiSessionRequired(getUsers)).Methods("GET")
 	BaseRoutes.Users.Handle("/ids", ApiSessionRequired(getUsersByIds)).Methods("POST")
+	BaseRoutes.Users.Handle("/usernames", ApiSessionRequired(getUsersByNames)).Methods("POST")
 	BaseRoutes.Users.Handle("/search", ApiSessionRequired(searchUsers)).Methods("POST")
 	BaseRoutes.Users.Handle("/autocomplete", ApiSessionRequired(autocompleteUsers)).Methods("GET")
 
@@ -367,6 +368,24 @@ func getUsersByIds(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+func getUsersByNames(c *Context, w http.ResponseWriter, r *http.Request) {
+	usernames := model.ArrayFromJson(r.Body)
+
+	if len(usernames) == 0 {
+		c.SetInvalidParam("usernames")
+		return
+	}
+
+	// No permission check required
+
+	if users, err := app.GetUsersByUsernames(usernames, c.IsSystemAdmin()); err != nil {
+		c.Err = err
+		return
+	} else {
+		w.Write([]byte(model.UserListToJson(users)))
+	}
+}
+
 func searchUsers(c *Context, w http.ResponseWriter, r *http.Request) {
 	props := model.UserSearchFromJson(r.Body)
 	if props == nil {
diff --git a/api4/user_test.go b/api4/user_test.go
index 9a360c7e4..20def9a17 100644
--- a/api4/user_test.go
+++ b/api4/user_test.go
@@ -666,6 +666,38 @@ func TestGetUsersByIds(t *testing.T) {
 	CheckUnauthorizedStatus(t, resp)
 }
 
+func TestGetUsersByUsernames(t *testing.T) {
+	th := Setup().InitBasic()
+	Client := th.Client
+
+	users, resp := Client.GetUsersByUsernames([]string{th.BasicUser.Username})
+	CheckNoError(t, resp)
+
+	if users[0].Id != th.BasicUser.Id {
+		t.Fatal("returned wrong user")
+	}
+	CheckUserSanitization(t, users[0])
+
+	_, resp = Client.GetUsersByIds([]string{})
+	CheckBadRequestStatus(t, resp)
+
+	users, resp = Client.GetUsersByUsernames([]string{"junk"})
+	CheckNoError(t, resp)
+	if len(users) > 0 {
+		t.Fatal("no users should be returned")
+	}
+
+	users, resp = Client.GetUsersByUsernames([]string{"junk", th.BasicUser.Username})
+	CheckNoError(t, resp)
+	if len(users) != 1 {
+		t.Fatal("1 user should be returned")
+	}
+
+	Client.Logout()
+	_, resp = Client.GetUsersByUsernames([]string{th.BasicUser.Username})
+	CheckUnauthorizedStatus(t, resp)
+}
+
 func TestUpdateUser(t *testing.T) {
 	th := Setup().InitBasic().InitSystemAdmin()
 	defer TearDown()