Skip to content

Conversation

@luisa-beerboom
Copy link
Member

@luisa-beerboom luisa-beerboom commented Nov 12, 2025

Closes #2111
Closes #3133
See OpenSlides/openslides-meta#347

  • user.update now deletes the meeting user when the group_ids are emptied. (Uses custom meeting_user.delete class bc using the actual one would cause circular dep exceptions)
  • motion.create doesn't automatically assign the calling user anymore. The chosen submitters now need to be given as meeting_user ids via the new field submitter_meeting_user_ids instead of how it was done before (as user ids via the field submitter_ids)
  • chat_message.create now only works if the user is in the meeting
  • same with personal notes

TODO:

  • Write migration
  • Take care of supporter after PR Implement motion_supporter model #3173 is merged
  • remaining tests in migration (see todos in code)
  • Write client issue for this (motion create should auto-fill submitter if possible)

@luisa-beerboom luisa-beerboom removed their assignment Dec 1, 2025
Copy link
Member

@hjanott hjanott left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With this change it will be impossible to remove a user from a meeting and rejoin him with all relations to meeting user submodels set in place again because the information is lost.
In general I'm against this change unless the user_id is stored in all meeting_user related models as well. However that's also not well designed.

Comment on lines 150 to 162
musers = self.reader.get_all(
"meeting_user",
list(COLLECTION_TO_MIGRATION_FIELDS["meeting_user"]) + ["group_ids"],
)
musers_to_delete = {
id_: {
field: val
for field, val in model.items()
if val and field in list(COLLECTION_TO_MIGRATION_FIELDS["meeting_user"])
}
for id_, model in musers.items()
if not model.get("group_ids")
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be more efficient to filter all meeting users where group_ids is empty list or None.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did that initially. Didn't work.

If you have an idea on how to improve

        filter_ = And(
            Or(
                FilterOperator("group_ids", "=", None),
                FilterOperator("group_ids", "=", []),
            ),
            FilterOperator("meta_deleted", "!=", True),
        )
        musers_to_delete = self.reader.filter(
            "meeting_user",
            filter_,
            list(COLLECTION_TO_MIGRATION_FIELDS["meeting_user"]),
        )

so it doesn't return an empty dict every time, feel free to tell me.

Copy link
Member

@hjanott hjanott Jan 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems to be an issue with psycopg 2 and/or the json formatting of our models. If you send the empty list as a string it should work.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

@Elblinator
Copy link
Member

Elblinator commented Dec 23, 2025

If a participant is allowed to create motions/amendments but cannot manage motions/ meta data the backend is stopping the participant from creating the motion/amenment:

Motion:

{
  "action": "motion.create",
  "data": [
    {
      "meeting_id": 1,
      "title": "we",
      "text": "<p>e</p>",
      "submitter_meeting_user_ids": [
        2
      ],
      "workflow_id": 1
    }
  ]
}

Response:

{
    "success": false,
    "message": "You are not allowed to perform action motion.create. Forbidden fields: submitter_meeting_user_ids with possibly needed permission(s): motion.can_manage, motion.can_manage_metadata"
}

Amendment:

payload: 
{
  "action": "motion.create",
  "data": [
    {
      "meeting_id": 1,
      "lead_motion_id": 11,
      "title": "Änderungsantrag zu 01",
      "submitter_meeting_user_ids": [
        2
      ],
      "workflow_id": 1,
      "reason": "",
      "amendment_paragraphs": {
        "0": "<p>s gxd.kui hg bvear ertg</p>"
      }
    }
  ]
}

response:

{
    "success": false,
    "message": "You are not allowed to perform action motion.create. Forbidden fields: submitter_meeting_user_ids with possibly needed permission(s): motion.can_manage, motion.can_manage_metadata"
}

Copy link
Member

@hjanott hjanott left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM and IMO can be merged once the docs got updated.
For documentation purposes: It was decided that we will deliberately take the information loss and irredeemably delete the connection between the user and all its remaining meeting_user submodels every time removing a user from a meeting.

- `workflow_id`: If it is given, the motion's state is set to the workflow's first state. The workflow must be from the same meeting. If the field is not given, one of the three default (`meeting/motions_default_workflow_id` or `meeting/motions_default_amendment_workflow_id`) workflows is used depending on the type of the motion to create.
- `additional_submitter` a text field where text-based submitter information may be entered. Cannot be set unless `meeting/motions_create_enable_additional_submitter_text` is `true`. Requires permissions `Motion.CAN_CREATE` and `Motion.CAN_MANAGE_METADATA`.
- `submitter_ids`: These are **user ids** and not ids of the `motion_submitter` model. If nothing is given (`[]`) and the field `additional_submitter` isn't filled, the request user's id is used. For each id in the list a `motion_submitter` model is created. The weight must be set to the order of the given list. Requires permissions `Motion.CAN_CREATE`, `Motion.CAN_MANAGE_METADATA` and `User.CAN_SEE`.
- `submitter_meeting_user_ids`: These are ids of the meeting users that should get a `motion_submitter` model. Can be left empty. The weight of the new submitters is set to the order of the given list. Requires permissions `Motion.CAN_CREATE`, `Motion.CAN_MANAGE_METADATA` and `User.CAN_SEE` (the latter two only if not setting oneself).
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Name needs to also be changed in the payload description.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

def test_create_no_motion_can_manage_metadata_submitter(self) -> None:
"""
Asserts that the requesting user needs at least Motion.CAN_CREATE,
Motion.CAN_MANAGE_METADATA and User.CAN_SEE when sending submitter_ids.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I saw this in other places too.

Suggested change
Motion.CAN_MANAGE_METADATA and User.CAN_SEE when sending submitter_ids.
Motion.CAN_MANAGE_METADATA and User.CAN_SEE when sending submitter_meeting_user_ids.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

@hjanott hjanott assigned luisa-beerboom and unassigned hjanott Jan 14, 2026
@luisa-beerboom luisa-beerboom enabled auto-merge (squash) January 14, 2026 16:01
@luisa-beerboom luisa-beerboom merged commit 01443a2 into OpenSlides:main Jan 14, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

3 participants