Merge pull request #4836 from FinnStutzenstein/agendaPermissions

Requires agenda.can_manage for settings agenda item information

client/src/app/shared/components/agenda-content-object-form/agenda-content-object-form.component.html

@@ -1,32 +1,34 @@
-<ng-container *ngIf="showForm">
-    <div [formGroup]="form">
-        <mat-checkbox formControlName="agenda_create">
-            <span translate>Add to agenda</span>
-        </mat-checkbox>
-    </div>
-
-    <ng-container *ngIf="!!checkbox.value">
-        <!-- Visibility -->
-        <div>
-            <mat-form-field [formGroup]="form">
-                <mat-select formControlName="agenda_type" placeholder="{{ 'Agenda visibility' | translate }}">
-                    <mat-option *ngFor="let type of ItemVisibilityChoices" [value]="type.key">
-                        <span>{{ type.name | translate }}</span>
-                    </mat-option>
-                </mat-select>
-            </mat-form-field>
+<ng-container *osPerms="'agenda.can_manage'">
+    <ng-container *ngIf="showForm">
+        <div [formGroup]="form">
+            <mat-checkbox formControlName="agenda_create">
+                <span translate>Add to agenda</span>
+            </mat-checkbox>
         </div>
 
-        <!-- Parent item -->
-        <div *ngIf="itemObserver.value.length > 0">
-            <os-search-value-selector
-                ngDefaultControl
-                [formControl]="form.get('agenda_parent_id')"
-                [multiple]="false"
-                [includeNone]="true"
-                listname="{{ 'Parent agenda item' | translate }}"
-                [InputListValues]="itemObserver"
-            ></os-search-value-selector>
-        </div>
+        <ng-container *ngIf="!!checkbox.value">
+            <!-- Visibility -->
+            <div>
+                <mat-form-field [formGroup]="form">
+                    <mat-select formControlName="agenda_type" placeholder="{{ 'Agenda visibility' | translate }}">
+                        <mat-option *ngFor="let type of ItemVisibilityChoices" [value]="type.key">
+                            <span>{{ type.name | translate }}</span>
+                        </mat-option>
+                    </mat-select>
+                </mat-form-field>
+            </div>
+
+            <!-- Parent item -->
+            <div *ngIf="itemObserver.value.length > 0">
+                <os-search-value-selector
+                    ngDefaultControl
+                    [formControl]="form.get('agenda_parent_id')"
+                    [multiple]="false"
+                    [includeNone]="true"
+                    listname="{{ 'Parent agenda item' | translate }}"
+                    [InputListValues]="itemObserver"
+                ></os-search-value-selector>
+            </div>
+        </ng-container>
     </ng-container>
 </ng-container>

openslides/assignments/serializers.py

@@ -2,6 +2,7 @@ from django.db import transaction
 
 from openslides.poll.serializers import default_votes_validator
 from openslides.utils.rest_api import (
+    BooleanField,
     DecimalField,
     DictField,
     IntegerField,
@@ -11,6 +12,7 @@ from openslides.utils.rest_api import (
     ValidationError,
 )
 
+from ..utils.auth import has_perm
 from ..utils.autoupdate import inform_changed_data
 from ..utils.validate import validate_html
 from .models import (
@@ -186,8 +188,9 @@ class AssignmentFullSerializer(ModelSerializer):
         many=True, read_only=True
     )
     polls = AssignmentAllPollSerializer(many=True, read_only=True)
+    agenda_create = BooleanField(write_only=True, required=False, allow_null=True)
     agenda_type = IntegerField(
-        write_only=True, required=False, min_value=1, max_value=3
+        write_only=True, required=False, min_value=1, max_value=3, allow_null=True
     )
     agenda_parent_id = IntegerField(write_only=True, required=False, min_value=1)
 
@@ -204,6 +207,7 @@ class AssignmentFullSerializer(ModelSerializer):
             "polls",
             "agenda_item_id",
             "list_of_speakers_id",
+            "agenda_create",
             "agenda_type",
             "agenda_parent_id",
             "tags",
@@ -221,13 +225,19 @@ class AssignmentFullSerializer(ModelSerializer):
         Customized create method. Set information about related agenda item
         into agenda_item_update_information container.
         """
-        agenda_type = validated_data.pop("agenda_type", None)
-        agenda_parent_id = validated_data.pop("agenda_parent_id", None)
         tags = validated_data.pop("tags", [])
         attachments = validated_data.pop("attachments", [])
+        request_user = validated_data.pop("request_user")  # this should always be there
+        agenda_create = validated_data.pop("agenda_create", None)
+        agenda_type = validated_data.pop("agenda_type", None)
+        agenda_parent_id = validated_data.pop("agenda_parent_id", None)
+
         assignment = Assignment(**validated_data)
-        assignment.agenda_item_update_information["type"] = agenda_type
-        assignment.agenda_item_update_information["parent_id"] = agenda_parent_id
+        if has_perm(request_user, "agenda.can_manage"):
+            assignment.agenda_item_update_information["create"] = agenda_create
+            assignment.agenda_item_update_information["type"] = agenda_type
+            assignment.agenda_item_update_information["parent_id"] = agenda_parent_id
+
         assignment.save()
         assignment.tags.add(*tags)
         assignment.attachments.add(*attachments)

openslides/assignments/views.py

@@ -66,6 +66,9 @@ class AssignmentViewSet(ModelViewSet):
             result = False
         return result
 
+    def perform_create(self, serializer):
+        serializer.save(request_user=self.request.user)
+
     @detail_route(methods=["post", "delete"])
     def candidature_self(self, request, pk=None):
         """

openslides/motions/serializers.py

@@ -5,7 +5,7 @@ from django.db import transaction
 
 from ..core.config import config
 from ..poll.serializers import default_votes_validator
-from ..utils.auth import get_group_model
+from ..utils.auth import get_group_model, has_perm
 from ..utils.autoupdate import inform_changed_data
 from ..utils.rest_api import (
     BooleanField,
@@ -97,10 +97,12 @@ class MotionBlockSerializer(ModelSerializer):
         agenda_create = validated_data.pop("agenda_create", None)
         agenda_type = validated_data.pop("agenda_type", None)
         agenda_parent_id = validated_data.pop("agenda_parent_id", None)
+        request_user = validated_data.pop("request_user")  # this should always be there
         motion_block = MotionBlock(**validated_data)
-        motion_block.agenda_item_update_information["create"] = agenda_create
-        motion_block.agenda_item_update_information["type"] = agenda_type
-        motion_block.agenda_item_update_information["parent_id"] = agenda_parent_id
+        if has_perm(request_user, "agenda.can_manage"):
+            motion_block.agenda_item_update_information["create"] = agenda_create
+            motion_block.agenda_item_update_information["type"] = agenda_type
+            motion_block.agenda_item_update_information["parent_id"] = agenda_parent_id
         motion_block.save()
         return motion_block
 
@@ -535,15 +537,16 @@ class MotionSerializer(ModelSerializer):
         motion.parent = validated_data.get("parent")
         motion.statute_paragraph = validated_data.get("statute_paragraph")
         motion.reset_state(validated_data.get("workflow_id"))
-        motion.agenda_item_update_information["create"] = validated_data.get(
-            "agenda_create"
-        )
-        motion.agenda_item_update_information["type"] = validated_data.get(
-            "agenda_type"
-        )
-        motion.agenda_item_update_information["parent_id"] = validated_data.get(
-            "agenda_parent_id"
-        )
+        if has_perm(validated_data["request_user"], "agenda.can_manage"):
+            motion.agenda_item_update_information["create"] = validated_data.get(
+                "agenda_create"
+            )
+            motion.agenda_item_update_information["type"] = validated_data.get(
+                "agenda_type"
+            )
+            motion.agenda_item_update_information["parent_id"] = validated_data.get(
+                "agenda_parent_id"
+            )
         motion.save()
         motion.supporters.add(*validated_data.get("supporters", []))
         motion.attachments.add(*validated_data.get("attachments", []))

openslides/motions/views.py

@@ -1444,6 +1444,9 @@ class MotionBlockViewSet(ModelViewSet):
             result = False
         return result
 
+    def perform_create(self, serializer):
+        serializer.save(request_user=self.request.user)
+
     @detail_route(methods=["post"])
     def follow_recommendations(self, request, pk=None):
         """