FIX: Serialize uploaded_avatars_allowed_groups check on current user (#25515)

Checking group permissions on the client does not work,
since not all groups are serialized to the client all
the time. We can check `uploaded_avatars_allowed_groups`
on the server side and serialize to the current user
instead.

spec/system/page_objects/modals/avatar_selector.rb

@@ -4,6 +4,7 @@ module PageObjects
     class AvatarSelector < PageObjects::Modals::Base
       BODY_SELECTOR = ".avatar-selector"
       MODAL_SELECTOR = ".avatar-selector-modal"
+      AVATAR_UPLOAD_BUTTON_SELECTOR = ".avatar-uploader__button"
 
       def select_avatar_upload_option
         body.choose("avatar", option: "custom")
@@ -14,7 +15,15 @@ module PageObjects
       end
 
       def click_avatar_upload_button
-        body.find_button(I18n.t("js.user.change_avatar.upload_title")).click
+        body.find(AVATAR_UPLOAD_BUTTON_SELECTOR).click
+      end
+
+      def has_avatar_upload_button?
+        has_css?(AVATAR_UPLOAD_BUTTON_SELECTOR)
+      end
+
+      def has_no_avatar_upload_button?
+        has_no_css?(AVATAR_UPLOAD_BUTTON_SELECTOR)
       end
 
       def has_user_avatar_image_uploaded?

spec/system/user_page/user_preferences_account_spec.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-describe "User preferences for Account", type: :system do
+describe "User preferences | Avatar", type: :system do
   fab!(:user) { Fabricate(:user, refresh_auto_groups: true) }
   let(:user_account_preferences_page) { PageObjects::Pages::UserPreferencesAccount.new }
   let(:avatar_selector_modal) { PageObjects::Modals::AvatarSelector.new }
@@ -25,5 +25,12 @@ describe "User preferences for Account", type: :system do
       expect(avatar_selector_modal).to be_closed
       expect(user_account_preferences_page).to have_system_avatar_image
     end
+
+    it "does not allow for custom pictures when the user is not in uploaded_avatars_allowed_groups" do
+      SiteSetting.uploaded_avatars_allowed_groups = Group::AUTO_GROUPS[:admins]
+      user_account_preferences_page.open_avatar_selector_modal(user)
+      expect(avatar_selector_modal).to be_open
+      expect(avatar_selector_modal).to have_no_avatar_upload_button
+    end
   end
 end

spec/system/user_page/user_preferences_interface_spec.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-describe "User preferences for Interface", type: :system do
+describe "User preferences | Interface", type: :system do
   fab!(:user)
   let(:user_preferences_page) { PageObjects::Pages::UserPreferences.new }
   let(:user_preferences_interface_page) { PageObjects::Pages::UserPreferencesInterface.new }

spec/system/user_page/user_preferences_navigation_spec.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-describe "User page navigation menu", type: :system do
+describe "User preferences | Navigation menu", type: :system do
   fab!(:user)
   let(:everyone_group) { Group[:everyone] }
   let(:user_preferences_page) { PageObjects::Pages::UserPreferences.new }

spec/system/user_page/user_preferences_security_spec.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-describe "User preferences for Security", type: :system do
+describe "User preferences | Security", type: :system do
   fab!(:password) { "kungfukenny" }
   fab!(:email) { "email@user.com" }
   fab!(:user) { Fabricate(:user, email: email, password: password) }