Task list should only show tasks one can administrate

[youri-k]

URL of deployed dev instance (used for testing):

• https://___.webknossos.xyz

Steps to test:

• open task list if you are a team manager in one team and a user in another one
• task list should only show task from the team where you're team manager

Issues:

• fixes Team Manager can't access tasks' annotations #4041

---

• Updated changelog
• Ready for review

[youri-k]

This is a pretty naive solution but it works and doesn't change the sql query, so I thought this would fix the problem 🙂

[jstriebel]

I think this condition should rather be part of the SQL query. The current version probably breaks pagination, as this is handled on top of the SQL query, leading to possibly fewer results per page. Also this version is slower, probably not a bottleneck, though.

If this is urgent and/or the SQL variant too complex, we can also use this version. But I'd assume that in SQL this should just be a left join on the administrable task types.

[youri-k]

The current version probably breaks pagination, as this is handled on top of the SQL query, leading to possibly fewer results per page.

Good catch! I forgot about that. I now added a listAccessQ that is similar to the deleteAccessQ because it adds the needed extra condition 🙂

[jstriebel]

I now added a listAccessQ that is similar to the deleteAccessQ because it adds the needed extra condition

Nice! That's actually even simpler than before. Just rename the whole access query to administrateAccessQ, that fits both cases. The setup to test this is quite complex, so I'd skip this if you tested this thoroughly.

[youri-k]

I don't think this works because the deleteAccessQ is a member of the base class and is used in deleteOne for instance. We could think about using the deleteAccessQ in the list query and adding a comment but I'm not sure if this is really better

[jstriebel]

I agree, the current version is fine! Code LGTM, did not test it myself.