backoffice: consider roles when displaying done/all forms in listing (#15818)

tests/test_backoffice_pages.py

@@ -2179,6 +2179,34 @@ def test_global_listing(pub):
     resp = resp.forms['listing-settings'].submit()
     assert resp.body[resp.body.index('<tbody'):].count('<tr') == 33
 
+    # change role handling a formdef, make sure they do not appear anylonger in
+    # the all/done views.
+    role = Role(name='whatever')
+    role.store()
+    formdef = FormDef.get_by_urlname('form-title')
+    formdef.workflow_roles = {'_receiver': role.id}
+    formdef.store()
+    formdef.data_class().rebuild_security()
+
+    resp = app.get('/backoffice/management/listing?limit=500')
+    resp.forms['listing-settings']['status'] = 'waiting'
+    resp = resp.forms['listing-settings'].submit()
+    assert resp.body[resp.body.index('<tbody'):].count('<tr') == 20
+    assert not 'form-title' in resp.body
+    resp.forms['listing-settings']['status'] = 'open'
+    resp = resp.forms['listing-settings'].submit()
+    assert resp.body[resp.body.index('<tbody'):].count('<tr') == 20
+    assert not 'form-title' in resp.body
+    resp.forms['listing-settings']['status'] = 'all'
+    resp = resp.forms['listing-settings'].submit()
+    assert resp.body[resp.body.index('<tbody'):].count('<tr') == 20
+    assert not 'form-title' in resp.body
+    resp.forms['listing-settings']['status'] = 'done'
+    resp = resp.forms['listing-settings'].submit()
+    assert resp.body[resp.body.index('<tbody'):].count('<tr') == 0
+    assert not 'form-title' in resp.body
+
+
 def test_global_listing_with_no_formdefs(pub):
     if not pub.is_using_postgresql():
         pytest.skip('this requires SQL')

wcs/backoffice/management.py

@@ -727,6 +727,9 @@ class ManagementDirectory(Directory):
             criterias.append(Intersects('concerned_roles_array', user_roles))
         elif status == 'done':
             criterias.append(Equal('is_at_endpoint', True))
+            criterias.append(Intersects('concerned_roles_array', user_roles))
+        elif status == 'all':
+            criterias.append(Intersects('concerned_roles_array', user_roles))
         if get_request().form.get('submission_channel'):
             if get_request().form.get('submission_channel') == 'web':
                 criterias.append(Null('submission_channel'))