erp5_base: recalculate user group after closing the assignment

If user group are recalculated before changing the workflow state, it will only return the same security group
See nexedi/erp5@c00c3636

bt5/erp5_base/WorkflowTemplateItem/portal_workflow/assignment_workflow/transition_close.xml

@@ -23,9 +23,9 @@
             <value>
               <tuple>
                 <string>action_type/workflow</string>
-                <string>before_script/portal_workflow/assignment_workflow/script_Assignment_updateUserSecurityGroup</string>
-                <string>after_script/portal_workflow/assignment_workflow/script_Assignment_setStopDate</string>
                 <string>destination/portal_workflow/assignment_workflow/state_closed</string>
+                <string>after_script/portal_workflow/assignment_workflow/script_Assignment_setStopDate</string>
+                <string>after_script/portal_workflow/assignment_workflow/script_Assignment_updateUserSecurityGroup</string>
               </tuple>
             </value>
         </item>

[Romain Courteaud]

@jerome I'm so surprised of this. I feel I misunderstood something.

Do you agree that recalculating the user security group in the before script is useless (as the assignment list is still identical)?

Is there any side effect which will be triggered unexpectedly when calling this script after changing the assignment state?

[Jérome Perrin]

In nexedi/erp5@c00c3636 I changed the Assignment_updateUserSecurityGroup to be called "before", it was called "after" before this change... This looks accidental.

But do you remember NuxUserGroups ? it seems what this script does is https://lab.nexedi.com/romain/erp5/blob/639bb4617dcd3158795261c75ca14e04c66e57ec/bt5/erp5_base/WorkflowTemplateItem/portal_workflow/assignment_workflow/script_Assignment_updateUserSecurityGroup.py#L15 , ie. compute the groups of the person based on the assignment. So yes, this change looks correct, but it seems to me that Person_updateUserSecurityGroup is not doing anything since we switched from NuxuserGroups to PluggableAuthService, maybe 15 years ago. Do you think this is still used ?

[Romain Courteaud]

Is the clearCache still valid? I have some tests on the slapos master which fail randomly due to security group of the user not dropped after the assignment is closed.

But do you remember NuxUserGroups ?

Not at all. But I could try to drop Person_updateUserSecurityGroup to see if I break everything.

[Jérome Perrin]

Maybe the clear cache has some effect, because it's the same cache as used here. In real usage I guess we don't care, but if we change this maybe we'll have to update a few tests.

If you want to try to remove Person_updateUserSecurityGroup that seem a good clean up

[Romain Courteaud]

ok, I'll try.

Thanks for your answers.