From 63fa2a933878b4e6a4abfdf95df488fd43ed9e27 Mon Sep 17 00:00:00 2001
From: Sahil Batra <sahil@zulip.com>
Date: Wed, 28 Jul 2021 21:53:39 +0530
Subject: [PATCH] realm: Allow only owners to change invite_required in
 backend.

We allow only owners to change the invite_required setting.
This commit only adds the restriction in backend, frontend
changes will be done separately.

We also add a helper function in test_realm.py to avoid
writing same code repeatedly and this helper will also
be used in tests for other settings to be added in
further commits.
---
 zerver/tests/test_realm.py | 29 ++++++++++++++++++++++++-----
 zerver/views/realm.py      |  4 +++-
 2 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/zerver/tests/test_realm.py b/zerver/tests/test_realm.py
index cd5468ebf7..8bda4ee198 100644
--- a/zerver/tests/test_realm.py
+++ b/zerver/tests/test_realm.py
@@ -1372,17 +1372,36 @@ class RealmAPITest(ZulipTestCase):
             result, "Bad value for 'message_content_delete_limit_seconds': invalid"
         )
 
-    def test_change_invite_to_realm_policy_by_owners_only(self) -> None:
+    def do_test_changing_settings_by_owners_only(self, setting_name: str) -> None:
+        bool_tests: List[bool] = [False, True]
+        test_values: Dict[str, Any] = dict(
+            invite_to_realm_policy=[Realm.POLICY_MEMBERS_ONLY, Realm.POLICY_ADMINS_ONLY],
+        )
+
+        vals = test_values.get(setting_name)
+        if Realm.property_types[setting_name] is bool:
+            vals = bool_tests
+        assert vals is not None
+
+        self.set_up_db(setting_name, vals[0])
+        value = vals[1]
+
+        if not isinstance(value, str):
+            value = orjson.dumps(value).decode()
+
         self.login("iago")
-        req = {"invite_to_realm_policy": Realm.POLICY_ADMINS_ONLY}
-        result = self.client_patch("/json/realm", req)
+        result = self.client_patch("/json/realm", {setting_name: value})
         self.assert_json_error(result, "Must be an organization owner")
 
         self.login("desdemona")
-        result = self.client_patch("/json/realm", req)
+        result = self.client_patch("/json/realm", {setting_name: value})
         self.assert_json_success(result)
         realm = get_realm("zulip")
-        self.assertEqual(realm.invite_to_realm_policy, Realm.POLICY_ADMINS_ONLY)
+        self.assertEqual(getattr(realm, setting_name), vals[1])
+
+    def test_changing_user_joining_settings_require_owners(self) -> None:
+        self.do_test_changing_settings_by_owners_only("invite_to_realm_policy")
+        self.do_test_changing_settings_by_owners_only("invite_required")
 
     def test_enable_spectator_access_for_limited_plan_realms(self) -> None:
         self.login("iago")
diff --git a/zerver/views/realm.py b/zerver/views/realm.py
index cbc93b2ff3..7375994b57 100644
--- a/zerver/views/realm.py
+++ b/zerver/views/realm.py
@@ -177,7 +177,9 @@ def update_realm(
             message_retention_days_raw, Realm.MESSAGE_RETENTION_SPECIAL_VALUES_MAP
         )
 
-    if invite_to_realm_policy is not None and not user_profile.is_realm_owner:
+    if (
+        invite_to_realm_policy is not None or invite_required is not None
+    ) and not user_profile.is_realm_owner:
         raise OrganizationOwnerRequired()
 
     if enable_spectator_access: