dev/user-search-custom-url-and-user-ids ← fix/assign-search-for-non-staff
merged 09:34AM - 14 Oct 26 UTC
Previously, the assign modal searched `/u/search/users` with the assign-allowed …groups as `groups[]`. Core rejects that with a 403 when the searching user can't see one of those groups' members, and the chooser silently showed the 403 as "No matches found". Admins were unaffected. The first search sometimes worked because it ran before the suggestions, and their groups, had loaded.
This change adds an `/assign/search` endpoint. It searches the users and groups the current user can actually assign on the target, using the same `AssignmentPermissions` rules that `Assigner` enforces. The modal now uses the core `EmailGroupUserChooser` pointed at that endpoint, replacing the custom `AssignmentChooser`. The duplicated assignable-user scopes are merged into `AssignmentPermissions.assignable_user_ids`.
`/assign/suggestions` now returns `groups: [{ name, full_name }]` instead of `assign_allowed_on_groups`/`assign_allowed_for_groups`.
Stacked on #44563.
https://meta.discourse.org/t/414310