Fixes #2293 - Any user can be set as a replacement for out of office.

app/assets/javascripts/app/controllers/_profile/out_of_office.coffee

@@ -75,6 +75,13 @@ class ProfileOutOfOffice extends App.ControllerSubContent
             translate: false
             disableCreateObject: true
             value: @localData
+            source: "#{@apiPath}/users/search?full=true"
+            sourceType: 'POST'
+            queryCallback: (query) ->
+              return JSON.stringify(
+                query: query
+                permissions: ['ticket.agent']
+              )
           ]
       noFieldset: true
       params: @localData

app/assets/javascripts/app/lib/app_post/_object_organization_autocompletion.coffee

@@ -39,6 +39,8 @@ class App.ObjectOrganizationAutocompletion extends App.Controller
 
     @key = Math.floor( Math.random() * 999999 ).toString()
 
+    if !@attribute.sourceType
+      @attribute.sourceType = 'GET'
     if !@attribute.source
       @attribute.source = "#{@apiPath}/search/user-organization"
     @build()
@@ -345,38 +347,49 @@ class App.ObjectOrganizationAutocompletion extends App.Controller
       @lazySearch(query)
 
   searchObject: (query) =>
+    data =
+      query: query
+    if @attribute.queryCallback
+      data = @attribute.queryCallback(query)
+
     @ajax(
-      id:    "searchObject#{@key}"
+      id:          "searchObject#{@key}"
-      type:  'GET'
+      type:        @attribute.sourceType
-      url:   @attribute.source
+      url:         @attribute.source
-      data:
+      data:        data
-        query: query
       processData: true
-      success: (data, status, xhr) =>
+      success:     (data, status, xhr) =>
         @emptyResultList()
 
         # load assets
         App.Collection.loadAssets(data.assets)
 
-        # build markup
+        # user search endpoint
-        for item in data.result
+        if data.user_ids
-
+          for id in data.user_ids
-          # organization
+            object = App[@objectSingle].fullLocal(id)
-          if item.type is 'Organization'
-            organization = App.Organization.fullLocal(item.id)
-            @recipientList.append(@buildOrganizationItem(organization))
-
-            # objectss of organization
-            if organization[@referenceAttribute]
-              @$('.dropdown-menu').append(@buildOrganizationMembers(organization))
-
-          # objectss
-          if item.type is @objectSingle
-            object = App[@objectSingle].fullLocal(item.id)
             @recipientList.append(@buildObjectItem(object))
 
-        if !@attribute.disableCreateObject
+        # global search endpoint
-          @recipientList.append(@buildObjectNew())
+        else
+          for item in data.result
+
+            # organization
+            if item.type is 'Organization'
+              organization = App.Organization.fullLocal(item.id)
+              @recipientList.append(@buildOrganizationItem(organization))
+
+              # objectss of organization
+              if organization[@referenceAttribute]
+                @$('.dropdown-menu').append(@buildOrganizationMembers(organization))
+
+            # objectss
+            else if item.type is @objectSingle
+              object = App[@objectSingle].fullLocal(item.id)
+              @recipientList.append(@buildObjectItem(object))
+
+          if !@attribute.disableCreateObject
+            @recipientList.append(@buildObjectNew())
 
         @recipientList.find('.js-object').first().addClass('is-active')
     )

app/controllers/users_controller.rb

@@ -208,14 +208,15 @@ class UsersController < ApplicationController
   #                   The requester has to be in the role 'Admin' or 'Agent' to
   #                   be able to search for User records.
   #
-  # @parameter        query             [String]                             The search query.
+  # @parameter        query              [String]                               The search query.
-  # @parameter        limit             [Integer]                            The limit of search results.
+  # @parameter        limit              [Integer]                              The limit of search results.
-  # @parameter        ids(multi)        [Array<Integer>]                     A list of User IDs which should be returned
+  # @parameter        ids(multi)         [Array<Integer>]                       A list of User IDs which should be returned
-  # @parameter        role_ids(multi)   [Array<String>]                      A list of Role identifiers to which the Users have to be allocated to.
+  # @parameter        role_ids(multi)    [Array<Integer>]                       A list of Role identifiers to which the Users have to be allocated to.
-  # @parameter        group_ids(multi)  [Hash<String=>String,Array<String>>] A list of Group identifiers to which the Users have to be allocated to.
+  # @parameter        group_ids(multi)   [Hash<String=>Integer,Array<Integer>>] A list of Group identifiers to which the Users have to be allocated to.
-  # @parameter        full              [Boolean]                            Defines if the result should be
+  # @parameter        permissions(multi) [Array<String>]                        A list of Permission identifiers to which the Users have to be allocated to.
-  #                                                                         true: { user_ids => [1,2,...], assets => {...} }
+  # @parameter        full               [Boolean]                              Defines if the result should be
-  #                                                                         or false: [{:id => user.id, :label => "firstname lastname <email>", :value => "firstname lastname <email>"},...].
+  #                                                                             true: { user_ids => [1,2,...], assets => {...} }
+  #                                                                             or false: [{:id => user.id, :label => "firstname lastname <email>", :value => "firstname lastname <email>"},...].
   #
   # @response_message 200 [Array<User>] A list of User records matching the search term.
   # @response_message 403               Forbidden / Invalid session.

spec/system/profile/out_of_office_spec.rb

@@ -0,0 +1,20 @@
+# Copyright (C) 2012-2021 Zammad Foundation, http://zammad-foundation.org/
+
+require 'rails_helper'
+
+RSpec.describe 'Profile > Out of Office', type: :system do
+  before do
+    visit 'profile/out_of_office'
+    sleep 3 # wait for popover killer to pass
+  end
+
+  it 'does find agents' do
+    find(:css, '.js-objectSelect').send_keys('Agent')
+    expect(page).to have_text('Agent 1 Test', wait: 20)
+  end
+
+  it 'does not find customers' do
+    find(:css, '.js-objectSelect').send_keys('Nicole')
+    expect(page).to have_no_text('Nicole Braun', wait: 20)
+  end
+end