The permission default_to_body doesn't affect updates

[joesiltberg]

Describe the bug
The description for the permission default_to_body is "Default to creating reports/updates as the council", but it only seems to be used when creating reports, not when posting updates.

When looking at the implementation for creating reports, I noticed that it defaults to creating as the council if the user is a staff user and has either planned_reports ("Manage shortlist") or default_to_body. This doesn't make sense to me, but I'll do the same for updates in my PR with a suggested fix. But shouldn't it be possible to let a user manage their shortlist and also default to creating reports/updates as themselves?

To Reproduce
Steps to reproduce the behavior:

1. Give a staff user permission to create reports/updates as the council
2. Give the same staff user permission to "Default to creating reports/updates as the council"
3. Login as that staff user and start to create an update, note that posting as "myself" is the selected default.

[joesiltberg]

See PR #3318 for a suggested fix based on the implementation for creating reports (the expressions added to report/update/form_user_loggedin.html were taken from report/new/form_user_loggedin.html).

I would prefer to remove planned_reports from both places and just check default_to_body, but I'm guessing there's a reason it's there :-)

[dracos]

"But shouldn't it be possible to let a user manage their shortlist and also default to creating reports/updates as themselves?" - yes, I guess this dates from before the second permission existed and everyone who had manage shortlist was also defaulting to that. I agree it would be better if they were independent; I'll do an audit of our staff data and see if that throws up any issues, but I assume we can manually fix if so.

[dracos]

Looks like in our database we have 51 users with both planned_reports and default_to_body permissions, 122 users with default_to_body and not planned_reports, and 17 users with planned_reports and not default_to_body. And 3 roles with planned_reports and not default_to_body. So we can give those 17 users/3 roles the default_to_body permission and then decouple the permission logic.

[joesiltberg]

Thanks @dracos !

So I can update the PR to remove the check of planned_reports, both for creating reports and updates?

[dracos]

Yeah, why not! Do add a changelog entry too to show the change.