Forbid editing other orga’s public annotations

[fm3]

Issues:

• fixes allowUpdate should be false for annotations of other orgas, even if isPublic and editableByOthers are true #7914

Steps to test:

• create two orgas
• create an annotation for a public dataset, set it to public and to others-may-edit
• another user from the same organization should be able to edit it (respecting mutex)
• another user from a different organization should be able to view it but never edit it

---

• Updated changelog
• Considered common edge cases

[MichaelBuessemeyer]

Works, but the navbar shows a tag like the annotation is locked by a user (which was not the case while I tested). That might be confusing.

I'll give this a quick check whether I can hide this

[MichaelBuessemeyer]

I'll give this a quick check whether I can hide this

Ok this actually rather difficult to do. The frontend needs to know whether the current user belongs to the same orga as the annotation (owner). But currently that's not the case. And I do not want to remove this info to the user as when the user is know it is actually useful.

Cf.

webknossos/frontend/javascripts/navbar.tsx

Lines 889 to 897 in 9f2eb10

	if (othersMayEdit && !allowUpdate && !isLockedByOwner) {
	trailingNavItems.push(
	<AnnotationLockedByUserTag
	key="locked-by-user-tag"
	blockedByUser={blockedByUser}
	activeUser={activeUser}
	/>,
	);
	}

Let me check tomorrow, whether maybe blockedByUser == null can be used to detect this case and avoid the "Locked by unknown user" this way.

[MichaelBuessemeyer]

LGTM, My previous mentioned improvement is deferred to a new issue