Merge pull request #4236 from normanjaeckel/SetStateAllowSubmitterEdit

Allow set state for submitters in some states.

CHANGELOG.rst

@@ -34,6 +34,8 @@ Motions:
    follow recommendation, manage submitters and supporters, change motion
    category, motion block and origin and manage motion polls [#3913].
  - Added new permission to create amendments [#4128].
+ - Allowed submitters to set state of new motions in complex and customized
+   workflow [#4236].
  - Added multi select action to manage submitters, tags, states and
    recommendations [#4037, #4132].
  - Added timestampes for motions [#4134].

client/src/app/site/motions/components/motion-detail/motion-detail.component.html

@@ -222,12 +222,14 @@
                 <button *ngFor="let state of motion.nextStates" mat-menu-item (click)="setState(state.id)">
                     {{ state.name | translate }} <span *ngIf="state.show_state_extension_field">&nbsp;...</span>
                 </button>
-                <mat-divider></mat-divider>
-                <button mat-menu-item (click)="setState(null)" *ngIf="perms.isAllowed('change_metadata', motion)">
-                    <mat-icon>replay</mat-icon> {{ 'Reset state' | translate }}
-                </button>
+                <div *ngIf="perms.isAllowed('change_metadata', motion)">
+                    <mat-divider *ngIf="motion.nextStates.length > 0"></mat-divider>
+                    <button mat-menu-item (click)="setState(null)">
+                        <mat-icon>replay</mat-icon> {{ 'Reset state' | translate }}
+                    </button>
+                </div>
             </mat-menu>
-            <div *ngIf="perms.isAllowed('change_metadata', motion)">
+            <div *ngIf="perms.isAllowed('change_state', motion)">
                 <mat-basic-chip [matMenuTriggerFor]="stateMenu" [ngClass]="getStateCssColor()">
                     {{ stateLabel }}
                 </mat-basic-chip>
@@ -238,7 +240,7 @@
                     <button mat-icon-button (click)="setStateExtension()"><mat-icon>check</mat-icon></button>
                 </div>
             </div>
-            <div *ngIf="!perms.isAllowed('change_metadata', motion)">
+            <div *ngIf="!perms.isAllowed('change_state', motion)">
                 <mat-basic-chip [ngClass]="getStateCssColor()"> {{ stateLabel }} </mat-basic-chip>
             </div>
         </div>

client/src/app/site/motions/services/local-permissions.service.ts

@@ -108,6 +108,20 @@ export class LocalPermissionsService {
                     motion.state.allow_submitter_edit &&
                     motion.submitters.some(submitter => submitter.id === this.operator.user.id)
                 );
+            case 'change_state':
+                // check also for empty ViewMotion object (e.g. if motion.id is null)
+                // important for creating new motion as normal user
+                if (!motion || !motion.id) {
+                    return false;
+                }
+                return (
+                    this.operator.hasPerms('motions.can_manage') ||
+                    this.operator.hasPerms('motions.can_manage_metadata') ||
+                    (motion.state &&
+                        motion.state.allow_submitter_edit &&
+                        motion.submitters &&
+                        motion.submitters.some(submitter => submitter.id === this.operator.user.id))
+                );
             case 'change_metadata':
                 return (
                     this.operator.hasPerms('motions.can_manage') ||

openslides/motions/views.py

@@ -75,11 +75,10 @@ class MotionViewSet(ModelViewSet):
             result = has_perm(self.request.user, "motions.can_see")
             # For partial_update, update and destroy requests the rest of the check is
             # done in the update method. See below.
-        elif self.action == "create":
+        elif self.action in ("create", "set_state"):
             result = has_perm(self.request.user, "motions.can_see")
-            # For create the rest of the check is done in the create method. See below.
+            # For create the rest of the check is done in the respective method. See below.
         elif self.action in (
-            "set_state",
             "manage_multiple_state",
             "set_recommendation",
             "manage_multiple_recommendation",
@@ -561,6 +560,10 @@ class MotionViewSet(ModelViewSet):
         # Set or reset state.
         if state is not None:
             # Check data and set state.
+            if not has_perm(request.user, "motions.can_manage_metadata") and not (
+                motion.is_submitter(request.user) and motion.state.allow_submitter_edit
+            ):
+                self.permission_denied(request)
             try:
                 state_id = int(state)
             except ValueError:
@@ -574,6 +577,8 @@ class MotionViewSet(ModelViewSet):
             motion.set_state(state_id)
         else:
             # Reset state.
+            if not has_perm(self.request.user, "motions.can_manage_metadata"):
+                self.permission_denied(request)
             motion.reset_state()
 
         # Save motion.