backoffice: account for selected user in /live endpoint (#50533)

tests/backoffice_pages/test_submission.py

@@ -1407,3 +1407,54 @@ def test_backoffice_submission_user_selection(pub):
     resp = resp.form.submit('submit')  # -> validation page
     assert 'Check values then click submit.' in resp
     assert '<p>%s</p>' % random_user.name in resp
+
+
+def test_backoffice_submission_user_selection_then_live(pub):
+    user = create_user(pub)
+
+    for i in range(10):
+        random_user = pub.user_class()
+        random_user.name = 'random user %s' % i
+        random_user.email = 'test%s@invalid' % i
+        random_user.store()
+
+    FormDef.wipe()
+    formdef = FormDef()
+    formdef.name = 'form title'
+    formdef.fields = [
+        fields.PageField(id='0', label='1st page', type='page'),
+        fields.StringField(id='1', label='Field on 1st page', type='string'),
+        fields.PageField(id='2', label='2nd page', type='page'),
+        fields.StringField(id='3', label='Field on 2nd page', type='string',
+            varname='plop',
+            prefill={'type': 'user', 'value': 'email'}),
+        fields.StringField(id='4', label='2nd field on 2nd page', type='string',
+            prefill={'type': 'string', 'value': '{{form_user_email}}', 'locked': True}),
+        fields.StringField(id='5', label='field with condition', type='string',
+            condition={'type': 'django', 'value': 'form_var_plop == "bye"'}),
+    ]
+    formdef.backoffice_submission_roles = user.roles[:]
+    formdef.workflow_roles = {'_receiver': 1}
+    formdef.store()
+
+    app = login(get_app(pub))
+    resp = app.get('/backoffice/submission/')
+    resp = resp.click(formdef.name)
+
+    assert resp.form['submission_channel'].attrs['type'] == 'hidden'
+    assert resp.pyquery('.submit-user-selection')
+    resp.form['user_id'] = str(random_user.id)  # happens via javascript
+    resp.form['f1'] = 'test submission'
+    resp = resp.form.submit('submit')  # -> 2nd page
+    assert resp.form['f3'].value == random_user.email
+    assert resp.form['f4'].value == random_user.email
+
+    live_url = resp.html.find('form').attrs['data-live-url']
+    live_resp = app.post(live_url, params=resp.form.submit_fields())
+    assert live_resp.json['result']['4']['content'] == random_user.email
+
+    resp.form['f4'] = 'altered value'  # alter value
+
+    resp = resp.form.submit('submit')  # -> validation page
+    assert 'Check values then click submit.' in resp
+    assert 'altered value' not in resp

wcs/backoffice/submission.py

@@ -144,6 +144,9 @@ class FormFillPage(PublicFormFillPage):
         formdata = super().get_transient_formdata(magictoken=magictoken)
         if self.selected_user_id:
             formdata.user_id = self.selected_user_id
+        elif get_request().form.get('user_id'):
+            # when used via /live endpoint
+            formdata.user_id = get_request().form['user_id']
         return formdata
 
     def html_top(self, *args, **kwargs):