Merge pull request #8194 from 4teamwork/ran/TI-2821/add-comment-memberships

Allow administrators to leave a note on Group Memberships

Author: Acrop146

changes/TI-2821.feature

@@ -0,0 +1 @@
+Allow admins to set a 'note' for every ogds membership. [ran]

docs/public/dev-manual/api/api_changelog.rst

@@ -12,6 +12,7 @@ Breaking Changes
 
 Other Changes
 ^^^^^^^^^^^^^
+- ``@membership-notes``: Add endpoint to update a note on a membership.
 
 
 2025.8.0 (2025-08-22)

docs/public/dev-manual/api/users.rst

@@ -427,3 +427,42 @@ Mit dem ``@kub`` Endpoint können Kontakte aus dem KuB geholt werden. Der Endpoi
         "title": "",
         "urls": []
       }
+
+
+Vermerk Mitgliedschaften
+========================
+
+Mit dem ``@membership-notes`` Endpoint können Vermerke bei den Mitgliedschaften editiert werden.
+Der Endpoint steht nur auf Stufe PloneSiteRoot zur Verfügung und erwartet als Pfad Parameter:
+
+- ID des Users
+- ID der Gruppe
+- Vermerk als String
+
+
+**Beispiel-Request**:
+
+   .. sourcecode:: http
+
+      POST /@membership-notes HTTP/1.1
+      Accept: application/json
+
+      {
+        "userid": "hugo.boss",
+        "groupid": "test_group",
+        "note": "Example Note"
+      }
+
+**Beispiel-Response**:
+
+
+   .. sourcecode:: http
+
+      HTTP/1.1 200 OK
+      Content-Type: application/json
+
+      {
+        "userid": "hugo.boss",
+        "groupid": "test_group",
+        "note": "Example Note"
+      }

opengever/activity/sources.py

@@ -3,7 +3,7 @@
 from opengever.ogds.base.sources import AllTeamsSource
 from opengever.ogds.base.sources import AssignedUsersSource
 from opengever.ogds.base.sources import BaseMultipleSourcesQuerySource
-from opengever.ogds.models.group import groups_users
+from opengever.ogds.models.group_membership import groups_users
 from opengever.ogds.models.service import ogds_service
 from opengever.ogds.models.user import User
 from opengever.workspace import is_workspace_feature_enabled

opengever/api/configure.zcml

@@ -1881,4 +1881,13 @@
       permission="zope.Public"
       />
 
+  <plone:service
+      method="POST"
+      name="@membership-notes"
+      for="Products.CMFCore.interfaces.ISiteRoot"
+      factory=".ogdsmembership_note.MembershipNotes"
+      permission="opengever.api.ManageGroups"
+      layer="opengever.base.interfaces.IOpengeverBaseLayer"
+      />
+
 </configure>

opengever/api/globalindex.py

@@ -5,7 +5,7 @@
 from opengever.globalindex.model.task import AVOID_DUPLICATES_STRATEGY_LOCAL
 from opengever.globalindex.model.task import Task
 from opengever.ogds.models.group import Group
-from opengever.ogds.models.group import groups_users
+from opengever.ogds.models.group_membership import groups_users
 from opengever.ogds.models.team import Team
 from opengever.task.helper import task_type_value_helper
 from plone.restapi.interfaces import ISerializeToJson

opengever/api/group.py

@@ -3,7 +3,7 @@
 from opengever.base.security import elevated_privileges
 from opengever.base.utils import check_group_plugin_configuration
 from opengever.ogds.models.group import Group
-from opengever.ogds.models.group import groups_users
+from opengever.ogds.models.group_membership import groups_users
 from opengever.ogds.models.service import ogds_service
 from opengever.ogds.models.user import User
 from plone import api

opengever/api/ogdsmembership_note.py

@@ -0,0 +1,43 @@
+from opengever.base.model import create_session
+from opengever.ogds.models.group_membership import GroupMembership
+from plone.restapi.deserializer import json_body
+from plone.restapi.services import Service
+from sqlalchemy import and_
+from zExceptions import BadRequest
+
+
+class MembershipNotes(Service):
+
+    def reply(self):
+        data = json_body(self.request) or {}
+
+        groupid = data.get('groupid')
+        userid = data.get('userid')
+        note = data.get('note', None)
+
+        if not groupid or not userid:
+            raise BadRequest("Groupid and Userid are required.")
+
+        if isinstance(note, basestring):
+            note = note.strip()
+            normalized = note or None
+        elif note is None:
+            normalized = None
+        else:
+            raise BadRequest("Note must be a string or null.")
+
+        session = create_session()
+        membership = (session.query(GroupMembership)
+                      .filter(and_(GroupMembership.groupid == groupid,
+                                   GroupMembership.userid == userid))
+                      .one())
+
+        membership.note = normalized
+        session.flush()
+
+        self.request.response.setStatus(200)
+        return {
+            "groupid": groupid,
+            "userid": userid,
+            "note": membership.note
+        }

opengever/api/ogdsuserlisting.py

@@ -1,7 +1,8 @@
 from datetime import datetime
 from opengever.api.ogdslistingbase import OGDSListingBaseService
 from opengever.base.visible_users_and_groups_filter import visible_users_and_groups_filter
-from opengever.ogds.models.group import groups_users
+from opengever.ogds.models.group_membership import GroupMembership
+from opengever.ogds.models.group_membership import groups_users
 from opengever.ogds.models.user import User
 import re
 
@@ -35,6 +36,13 @@ class OGDSUserListingGet(OGDSListingBaseService):
     default_state_filter = tuple()
     pattern = re.compile(r"^(\d{4}-\d{2}-\d{2}) TO (\d{4}-\d{2}-\d{2})")
 
+    def reply(self):
+        result = super(OGDSUserListingGet, self).reply()
+        filters = self.request.form.get('filters', {})
+
+        self._augment_items_with_membership_note(result, filters)
+        return result
+
     def needs_join_with_groups_users(self, filters):
         return bool(filters.get('groupid', False))
 
@@ -75,3 +83,31 @@ def extend_query_with_visible_users_and_groups_filter(self, query):
                 visible_users_and_groups_filter.get_whitelisted_principals()))
 
         return query
+
+    def _augment_items_with_membership_note(self, result, filters):
+        groupid = filters.get('groupid', None)
+        items = result.get('items') or []
+
+        userids = list({item.get('userid') for item in items})
+        if not userids:
+            return
+
+        rows = (
+            GroupMembership.query
+            .with_entities(GroupMembership.userid, GroupMembership.note)
+            .filter(
+                GroupMembership.groupid == groupid,
+                GroupMembership.userid.in_(userids),
+                GroupMembership.note.isnot(None),
+            )
+            .all()
+        )
+        notes_by_userid = dict(rows)
+
+        for item in items:
+            uid = item.get('userid')
+            if not uid:
+                continue
+            note = notes_by_userid.get(uid)
+            if note:
+                item['note'] = note

opengever/api/serializer.py

@@ -20,7 +20,8 @@
 from opengever.ogds.base.actor import Actor
 from opengever.ogds.models.admin_unit import AdminUnit
 from opengever.ogds.models.group import Group
-from opengever.ogds.models.group import groups_users
+from opengever.ogds.models.group_membership import GroupMembership
+from opengever.ogds.models.group_membership import groups_users
 from opengever.ogds.models.org_unit import OrgUnit
 from opengever.ogds.models.team import Team
 from opengever.ogds.models.user import User
@@ -411,6 +412,26 @@ def add_additional_metadata(self, data):
                 (team, self.request), ISerializeToJsonSummary)
             data['teams'].append(team_serializer())
 
+        groupids = [group.get('groupid') for group in data['groups']]
+
+        rows = (
+            GroupMembership.query
+            .with_entities(GroupMembership.groupid, GroupMembership.note)
+            .filter(
+                GroupMembership.userid == self.context.userid,
+                GroupMembership.groupid.in_(groupids),
+                GroupMembership.note.isnot(None),
+            )
+            .all()
+        )
+
+        notes_by_groupid = dict(rows)
+
+        for group in data['groups']:
+            note = notes_by_groupid.get(group.get("groupid"))
+            if note:
+                group["note"] = note
+
     def __call__(self, *args, **kwargs):
         data = super(SerializeUserModelToJson, self).__call__(*args, **kwargs)
         if not is_administrator():