MM-11229: Fix invite people slash command and add test case. (#9074)

2 files changed, 44 insertions, 0 deletions

diff --git a/app/command_invite_people.go b/app/command_invite_people.go
index 9ced3c5a1..fe12a5684 100644
--- a/app/command_invite_people.go
+++ b/app/command_invite_people.go
@@ -41,6 +41,14 @@ func (me *InvitePeopleProvider) GetCommand(a *App, T goi18n.TranslateFunc) *mode
 }
 
 func (me *InvitePeopleProvider) DoCommand(a *App, args *model.CommandArgs, message string) *model.CommandResponse {
+	if !a.SessionHasPermissionToTeam(args.Session, args.TeamId, model.PERMISSION_INVITE_USER) {
+		return &model.CommandResponse{Text: args.T("api.command_invite_people.permission.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}
+	}
+
+	if !a.SessionHasPermissionToTeam(args.Session, args.TeamId, model.PERMISSION_ADD_USER_TO_TEAM) {
+		return &model.CommandResponse{Text: args.T("api.command_invite_people.permission.app_error"), ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL}
+	}
+
 	if !a.Config().EmailSettings.SendEmailNotifications {
 		return &model.CommandResponse{ResponseType: model.COMMAND_RESPONSE_TYPE_EPHEMERAL, Text: args.T("api.command.invite_people.email_off")}
 	}
diff --git a/app/command_invite_people_test.go b/app/command_invite_people_test.go
new file mode 100644
index 000000000..6e10235f4
--- /dev/null
+++ b/app/command_invite_people_test.go
@@ -0,0 +1,36 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See License.txt for license information.
+
+package app
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/mattermost/mattermost-server/model"
+)
+
+func TestInvitePeopleProvider(t *testing.T) {
+	th := Setup().InitBasic()
+	defer th.TearDown()
+
+	cmd := InvitePeopleProvider{}
+
+	// Test without required permissions
+	args := &model.CommandArgs{
+		T:         func(s string, args ...interface{}) string { return s },
+		ChannelId: th.BasicChannel.Id,
+		TeamId:    th.BasicTeam.Id,
+		UserId:    th.BasicUser.Id,
+		Session:   model.Session{UserId: th.BasicUser.Id, TeamMembers: []*model.TeamMember{{TeamId: th.BasicTeam.Id, Roles: ""}}},
+	}
+
+	actual := cmd.DoCommand(th.App, args, model.NewId()+"@simulator.amazonses.com")
+	assert.Equal(t, "api.command_invite_people.permission.app_error", actual.Text)
+
+	// Test with required permissions.
+	args.Session.TeamMembers[0].Roles = model.TEAM_USER_ROLE_ID
+	actual = cmd.DoCommand(th.App, args, model.NewId()+"@simulator.amazonses.com")
+	assert.Equal(t, "api.command.invite_people.sent", actual.Text)
+}