stream_settings: Use can_remove_subscribers_group setting in webapp.

This commit updates the frontend to show or hide the "Unsubscribe"
button in subscribers list in stream settings as per the
can_remove_subscribers_group setting for the stream.

static/js/stream_data.js

@@ -8,6 +8,7 @@ import * as people from "./people";
 import * as settings_config from "./settings_config";
 import * as stream_topic_history from "./stream_topic_history";
 import * as sub_store from "./sub_store";
+import * as user_groups from "./user_groups";
 import {user_settings} from "./user_settings";
 import * as util from "./util";
 
@@ -556,6 +557,36 @@ export function can_subscribe_others(sub) {
     return !page_params.is_guest && (!sub.invite_only || sub.subscribed);
 }
 
+export function can_unsubscribe_others(sub) {
+    // Whether the current user has permission to remove other users
+    // from the stream. Organization administrators can remove users
+    // from any stream; additionally, users who can access the stream
+    // and are in the stream's can_remove_subscribers_group can do so
+    // as well.
+    //
+    // TODO: The API allows the current user to remove bots that it
+    // administers from streams; so we might need to refactor this
+    // logic to accept a target_user_id parameter in order to support
+    // that in the UI.
+
+    // A user must be able to view subscribers in a stream in order to
+    // remove them. This check may never fire in practice, since the
+    // UI for removing subscribers generally is a list of the stream's
+    // subscribers.
+    if (!can_view_subscribers(sub)) {
+        return false;
+    }
+
+    if (page_params.is_admin) {
+        return true;
+    }
+
+    return user_groups.is_user_in_group(
+        sub.can_remove_subscribers_group_id,
+        people.my_current_user_id(),
+    );
+}
+
 export function can_post_messages_in_stream(stream) {
     if (page_params.is_spectator) {
         return false;