demo-orgs: Disable allowing users to join until owner email set.

Until a demo organization creator sets an email address, we want to
restrict other users from joining the organization. Therefore, we
disable changing the "invite_required" setting for the organization
until they set their email address. Otherwise, the owner could
share the demo organization URL with someone and they could create
an account via the homepage.

Checks the demo organization owner delivery email address state
on the server-side.

Disables updating the organization setting in the web app UI.

web/src/tippyjs.ts

@@ -449,7 +449,10 @@ export function initialize(): void {
     });
 
     tippy.delegate("body", {
-        target: "#user_email_address_dropdown_container.disabled_setting_tooltip",
+        target: [
+            "#user_email_address_dropdown_container.disabled_setting_tooltip",
+            "#realm_invite_required_container.disabled_setting_tooltip",
+        ].join(","),
         content: $t({
             defaultMessage: "Configure your email to access this feature.",
         }),

web/templates/settings/organization_permissions_admin.hbs

@@ -10,12 +10,14 @@
                 {{> settings_save_discard_widget section_name="join-settings" }}
             </div>
             <div class="m-10 inline-block organization-permissions-parent">
-                {{> settings_checkbox
-                  setting_name="realm_invite_required"
-                  prefix="id_"
-                  is_checked=realm_invite_required
-                  label=admin_settings_label.realm_invite_required}}
-
+                <div id="realm_invite_required_container" {{#unless user_has_email_set}}class="disabled_setting_tooltip"{{/unless}}>
+                    {{> settings_checkbox
+                      setting_name="realm_invite_required"
+                      prefix="id_"
+                      is_checked=realm_invite_required
+                      is_disabled=(not user_has_email_set)
+                      label=admin_settings_label.realm_invite_required}}
+                </div>
                 {{> group_setting_value_pill_input
                   setting_name="realm_can_invite_users_group"
                   label=group_setting_labels.can_invite_users_group}}

zerver/tests/test_realm.py

@@ -244,6 +244,37 @@ class RealmTest(ZulipTestCase):
         realm = get_realm("zulip")
         self.assertNotEqual(realm.description, new_description)
 
+    def test_demo_organization_invite_required(self) -> None:
+        realm = get_realm("zulip")
+        self.assertFalse(realm.invite_required)
+
+        self.login("desdemona")
+        data = dict(invite_required="true")
+        result = self.client_patch("/json/realm", data)
+        self.assert_json_success(result)
+        realm.refresh_from_db()
+        self.assertTrue(realm.invite_required)
+
+        # Update realm to be a demo organization
+        realm.demo_organization_scheduled_deletion_date = timezone_now() + timedelta(days=30)
+        realm.save()
+
+        # Demo organization owner's don't have an email address set initially
+        desdemona = self.example_user("desdemona")
+        desdemona.delivery_email = ""
+        desdemona.save()
+
+        data = dict(invite_required="false")
+        result = self.client_patch("/json/realm", data)
+        self.assert_json_error(result, "Configure owner account email address.")
+
+        desdemona.delivery_email = "desdemona@zulip.com"
+        desdemona.save()
+        result = self.client_patch("/json/realm", data)
+        self.assert_json_success(result)
+        realm.refresh_from_db()
+        self.assertFalse(realm.invite_required)
+
     def test_realm_convert_demo_realm(self) -> None:
         data = dict(string_id="coolrealm")
 

zerver/views/realm.py

@@ -254,6 +254,9 @@ def update_realm(
     if waiting_period_threshold is not None and not user_profile.is_realm_owner:
         raise OrganizationOwnerRequiredError
 
+    if realm.demo_organization_scheduled_deletion_date is not None and invite_required is not None:
+        check_demo_organization_has_set_email(realm)
+
     if enable_spectator_access:
         realm.ensure_not_on_limited_plan()