History Collection

[luisa-beerboom]

See OpenSlides/openslides-meta#278
See OpenSlides/openslides-backend#3010

There are going to be two new collections history_position and history_entry, which need restriction. To preserve current functionality, for now, they should only be visible to superadmins.

Also: The /system/autoupdate/history_information route is not going to be used from now on, so it may just as well be removed

[ostcar]

To preserve current functionality, for now, they should only be visible to superadmins.
I implemented it this way. But this is not the old behavior.

The old permission code is here:

openslides-autoupdate-service/internal/autoupdate/autoupdate.go

Lines 360 to 390 in 095405f

	meetingID, hasMeeting, err := collection.Collection(ctx, coll).MeetingID(ctx, ds, id)
	if err != nil {
	var errNotExist dsfetch.DoesNotExistError
	if errors.As(err, &errNotExist) {
	// TODO Client Error
	return notExistError{dskey.Key(errNotExist)}
	}
	return fmt.Errorf("getting meeting id for collection %s id %d: %w", coll, id, err)
	}
	if !hasMeeting {
	hasOML, err := perm.HasOrganizationManagementLevel(ctx, ds, uid, perm.OMLCanManageOrganization)
	if err != nil {
	return fmt.Errorf("getting organization management level: %w", err)
	}
	if !hasOML {
	// TODO Client Error
	return permissionDeniedError{fmt.Errorf("you are not allowed to use history information on %s", fqid)}
	}
	} else {
	p, err := perm.New(ctx, ds, uid, meetingID)
	if err != nil {
	return fmt.Errorf("getting meeting permissions: %w", err)
	}
	if !p.Has(perm.MeetingCanSeeHistory) {
	// TODO Client Error
	return permissionDeniedError{fmt.Errorf("you are not allowed to use history information on %s", fqid)}
	}
	}

It checks, if the history belongs to a field, that is in a meeting (for example meeting_user but not user)

If it does not belong to a meeting, organization managers can see it.

If it belongs to a meeting, you need the permission meeting.can_see_history.