Cherry pick of #13445 (#13557)

* [MM-21359] Add extra permission check when updating an OAuth app (#13445)

* Add permission check

* Add additional check in tests

(cherry picked from commit 7a6c0f607b)

* Fix tests

api4/oauth.go

@@ -111,6 +111,10 @@ func updateOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if !c.App.SessionHasPermissionTo(c.App.Session, model.PERMISSION_MANAGE_SYSTEM) {
+		oauthApp.IsTrusted = oldOauthApp.IsTrusted
+	}
+
 	updatedOauthApp, err := c.App.UpdateOauthApp(oldOauthApp, oauthApp)
 	if err != nil {
 		c.Err = err

api4/oauth_test.go

@@ -210,6 +210,37 @@ func TestUpdateOAuthApp(t *testing.T) {
 	oapp.Id = "junk"
 	_, resp = AdminClient.UpdateOAuthApp(oapp)
 	CheckBadRequestStatus(t, resp)
+
+	th.App.UpdateConfig(func(cfg *model.Config) { cfg.ServiceSettings.EnableOAuthServiceProvider = true })
+	th.AddPermissionToRole(model.PERMISSION_MANAGE_OAUTH.Id, model.SYSTEM_USER_ROLE_ID)
+	th.LoginBasic()
+
+	userOapp := &model.OAuthApp{
+		Name:         "useroapp",
+		IsTrusted:    false,
+		IconURL:      "https://nowhere.com/img",
+		Homepage:     "https://nowhere.com",
+		Description:  "test",
+		CallbackUrls: []string{"https://callback.com"},
+	}
+
+	userOapp, resp = Client.CreateOAuthApp(userOapp)
+	CheckNoError(t, resp)
+
+	userOapp.IsTrusted = true
+	userOapp, resp = Client.UpdateOAuthApp(userOapp)
+	CheckNoError(t, resp)
+	assert.False(t, userOapp.IsTrusted)
+
+	userOapp.IsTrusted = true
+	userOapp, resp = AdminClient.UpdateOAuthApp(userOapp)
+	CheckNoError(t, resp)
+	assert.True(t, userOapp.IsTrusted)
+
+	userOapp.IsTrusted = false
+	userOapp, resp = Client.UpdateOAuthApp(userOapp)
+	CheckNoError(t, resp)
+	assert.True(t, userOapp.IsTrusted)
 }
 
 func TestGetOAuthApps(t *testing.T) {