From f45f774ecebe0070d264efbba377f35fd1a3af6c Mon Sep 17 00:00:00 2001
From: Scott Bishel <scott.bishel@mattermost.com>
Date: Tue, 11 Jul 2023 16:10:44 -0600
Subject: [PATCH] update for guest demotion and sysadmin edits (#23920)

* update for guest demotion and sysadmin edits

* update unit test

* update unit test

* use existing disabled flag

* remove commented line

---------

Co-authored-by: Mattermost Build <build@mattermost.com>
---
 server/channels/store/sqlstore/user_store.go      | 14 ++------------
 server/channels/store/storetest/user_store.go     |  2 +-
 .../system_users_dropdown.tsx                     | 15 +++++++++++++--
 3 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/server/channels/store/sqlstore/user_store.go b/server/channels/store/sqlstore/user_store.go
index a1f733b9ac..b709fdd9d5 100644
--- a/server/channels/store/sqlstore/user_store.go
+++ b/server/channels/store/sqlstore/user_store.go
@@ -2023,19 +2023,9 @@ func (us SqlUserStore) DemoteUserToGuest(userID string) (_ *model.User, err erro
 		return nil, err
 	}
 
-	roles := user.GetRoles()
-
-	newRoles := []string{}
-	for _, role := range roles {
-		if role == model.SystemUserRoleId {
-			newRoles = append(newRoles, model.SystemGuestRoleId)
-		} else if role != model.SystemAdminRoleId {
-			newRoles = append(newRoles, role)
-		}
-	}
-
 	curTime := model.GetMillis()
-	newRolesDBStr := strings.Join(newRoles, " ")
+	newRolesDBStr := model.SystemGuestRoleId
+
 	query := us.getQueryBuilder().Update("Users").
 		Set("Roles", newRolesDBStr).
 		Set("UpdateAt", curTime).
diff --git a/server/channels/store/storetest/user_store.go b/server/channels/store/storetest/user_store.go
index 471391d72d..66212f47b9 100644
--- a/server/channels/store/storetest/user_store.go
+++ b/server/channels/store/storetest/user_store.go
@@ -5699,7 +5699,7 @@ func testUserStoreDemoteUserToGuest(t *testing.T, ss store.Store) {
 
 		updatedUser, err := ss.User().DemoteUserToGuest(user.Id)
 		require.NoError(t, err)
-		require.Equal(t, "system_guest custom_role", updatedUser.Roles)
+		require.Equal(t, "system_guest", updatedUser.Roles)
 
 		updatedTeamMember, nErr := ss.Team().GetMember(context.Background(), teamId, user.Id)
 		require.NoError(t, nErr)
diff --git a/webapp/channels/src/components/admin_console/system_users/system_users_dropdown/system_users_dropdown.tsx b/webapp/channels/src/components/admin_console/system_users/system_users_dropdown/system_users_dropdown.tsx
index fabc10f3d3..59a4084955 100644
--- a/webapp/channels/src/components/admin_console/system_users/system_users_dropdown/system_users_dropdown.tsx
+++ b/webapp/channels/src/components/admin_console/system_users/system_users_dropdown/system_users_dropdown.tsx
@@ -565,6 +565,15 @@ export default class SystemUsersDropdown extends React.PureComponent<Props, Stat
 
     render() {
         const {currentUser, user, isLicensed, config} = this.props;
+
+        let isDisabled = this.props.isDisabled;
+        if (!isDisabled) {
+            // if not already disabled,
+            // disable if SystemAdmin being edited by non SystemAdmin
+            // ie, userManager with EditOtherUsers permissions
+            isDisabled = UserUtils.isSystemAdmin(user.roles) && !UserUtils.isSystemAdmin(currentUser.roles);
+        }
+
         const isGuest = UserUtils.isGuest(user.roles);
         if (!user) {
             return <div/>;
@@ -635,12 +644,14 @@ export default class SystemUsersDropdown extends React.PureComponent<Props, Stat
                 {demoteToGuestModal}
                 {createGroupSyncablesMembershipsModal}
                 <MenuWrapper
-                    isDisabled={this.props.isDisabled}
+                    isDisabled={isDisabled}
                 >
                     <div className='text-right'>
                         <a>
                             <span>{currentRoles} </span>
-                            <span className='caret'/>
+                            {!isDisabled &&
+                                <span className='caret'/>
+                            }
                         </a>
                         {this.renderAccessToken()}
                     </div>