From 2c6024e07f81d8aa181a3bf4ec666c2f99a1dc92 Mon Sep 17 00:00:00 2001
From: Julian Lam <julian@nodebb.org>
Date: Fri, 1 Dec 2023 13:04:32 -0500
Subject: [PATCH] feat: update groups.leave to allow global mods to kick users
 out of groups

---
 src/api/groups.js |  7 +++----
 test/groups.js    | 13 +++++++++++--
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/src/api/groups.js b/src/api/groups.js
index 5372f386be..5aa9c04f64 100644
--- a/src/api/groups.js
+++ b/src/api/groups.js
@@ -201,10 +201,9 @@ groupsAPI.leave = async function (caller, data) {
 		throw new Error('[[error:cant-remove-self-as-admin]]');
 	}
 
-	const [groupData, isCallerAdmin, isCallerOwner, userExists, isMember] = await Promise.all([
+	const [groupData, isCallerOwner, userExists, isMember] = await Promise.all([
 		groups.getGroupData(groupName),
-		user.isAdministrator(caller.uid),
-		groups.ownership.isOwner(caller.uid, groupName),
+		isOwner(caller, groupName, false),
 		user.exists(data.uid),
 		groups.isMember(data.uid, groupName),
 	]);
@@ -221,7 +220,7 @@ groupsAPI.leave = async function (caller, data) {
 		throw new Error('[[error:group-leave-disabled]]');
 	}
 
-	if (isSelf || isCallerAdmin || isCallerOwner) {
+	if (isSelf || isCallerOwner) {
 		await groups.leave(groupName, data.uid);
 	} else {
 		throw new Error('[[error:no-privileges]]');
diff --git a/test/groups.js b/test/groups.js
index 10ff138639..00bd044e85 100644
--- a/test/groups.js
+++ b/test/groups.js
@@ -759,7 +759,7 @@ describe('Groups', () => {
 		});
 	});
 
-	describe('socket methods', () => {
+	describe('socket/api methods', () => {
 		it('should error if data is null', (done) => {
 			socketGroups.before({ uid: 0 }, 'groups.join', null, (err) => {
 				assert.equal(err.message, '[[error:invalid-data]]');
@@ -1166,12 +1166,21 @@ describe('Groups', () => {
 			);
 		});
 
-		it('should remove user from group', async () => {
+		it('should remove user from group if caller is admin', async () => {
 			await apiGroups.leave({ uid: adminUid }, { uid: testUid, slug: 'newgroup' });
 			const isMember = await Groups.isMember(testUid, 'newgroup');
 			assert(!isMember);
 		});
 
+		it('should remove user from group if caller is a global moderator', async () => {
+			const globalModUid = await User.getUidByUsername('glomod');
+			await apiGroups.join({ uid: adminUid }, { uid: testUid, slug: 'newgroup' });
+
+			await apiGroups.leave({ uid: globalModUid }, { uid: testUid, slug: 'newgroup' });
+			const isMember = await Groups.isMember(testUid, 'newgroup');
+			assert(!isMember);
+		});
+
 		it('should fail with invalid data', async () => {
 			let err;
 			try {