WPB-16333 Fix: Prevent team creation by guests

changelog.d/3-bug-fixes/WPB-16333

@@ -0,0 +1 @@
+Prevent guest users from migrating to teams

integration/test/SetupHelpers.hs

@@ -47,6 +47,14 @@ randomUser domain cu = bindResponse (createUser domain cu) $ \resp -> do
   resp.status `shouldMatchInt` 201
   resp.json
 
+ephemeralUser :: (HasCallStack, MakesValue domain) => domain -> App Value
+ephemeralUser domain = do
+  name <- randomName
+  req <- baseRequest domain Brig Versioned "/register"
+  bindResponse (submit "POST" $ req & addJSONObject ["name" .= name] & addHeader "X-Forwarded-For" "127.0.0.42") $ \resp -> do
+    resp.status `shouldMatchInt` 201
+    resp.json
+
 deleteUser :: (HasCallStack, MakesValue user) => user -> App ()
 deleteUser user = bindResponse (API.Brig.deleteUser user) $ \resp -> do
   resp.status `shouldMatchInt` 200

integration/test/Test/Teams.hs

@@ -456,3 +456,10 @@ testTeamMemberCsvExport = do
     unquote :: String -> String
     unquote ('\'' : x) = x
     unquote x = x
+
+testUpgradeGuestToTeamShouldFail :: (HasCallStack) => App ()
+testUpgradeGuestToTeamShouldFail = do
+  guest <- ephemeralUser OwnDomain
+
+  upgradePersonalToTeam guest "wonderland" `bindResponse` \resp -> do
+    resp.status `shouldMatchInt` 404

services/brig/src/Brig/API/User.hs

@@ -270,15 +270,7 @@ upgradePersonalToTeam ::
   BindingNewTeamUser ->
   ExceptT UpgradePersonalToTeamError (AppT r) CreateUserTeam
 upgradePersonalToTeam luid bNewTeam = do
-  -- check that the user is not part of a team
-  mSelfProfile <- lift $ liftSem $ getSelfProfile luid
-  user <-
-    maybe
-      (throwE UpgradePersonalToTeamErrorUserNotFound)
-      (pure . selfUser)
-      mSelfProfile
-  when (isJust user.userTeam) $
-    throwE UpgradePersonalToTeamErrorAlreadyInATeam
+  user <- guardUser
 
   lift $ do
     liftSem $
@@ -308,6 +300,18 @@ upgradePersonalToTeam luid bNewTeam = do
         user.userDisplayName
 
     pure $! createUserTeam
+  where
+    isActive :: SelfProfile -> Bool
+    isActive profile = profile.selfUser.userStatus == Active
+
+    guardUser :: ExceptT UpgradePersonalToTeamError (AppT r) User
+    guardUser = do
+      -- user must be active (not suspended, deleted, ephemeral etc.)
+      mSelfProfile <- (find isActive) <$> lift (liftSem $ getSelfProfile luid)
+      user <- maybe (throwE UpgradePersonalToTeamErrorUserNotFound) (pure . selfUser) mSelfProfile
+      -- check that the user is not part of a team
+      when (isJust user.userTeam) $ throwE UpgradePersonalToTeamErrorAlreadyInATeam
+      pure user
 
 -- docs/reference/user/registration.md {#RefRegistration}
 createUser ::