Merge pull request #13083 from overleaf/ds-jpa-project-ownership-change

[web] let invited admins transfer ownership of projects

GitOrigin-RevId: 49da7d42bec089f2278bde8942a63e5538fb5401

services/web/app/src/Features/Authorization/AuthorizationManager.js

@@ -98,6 +98,12 @@ async function getPrivilegeLevelForProjectWithUser(
   projectId,
   opts = {}
 ) {
+  if (!opts.ignoreSiteAdmin) {
+    if (await isUserSiteAdmin(userId)) {
+      return PrivilegeLevels.OWNER
+    }
+  }
+
   const privilegeLevel =
     await CollaboratorsGetter.promises.getMemberIdPrivilegeLevel(
       userId,
@@ -108,12 +114,6 @@ async function getPrivilegeLevelForProjectWithUser(
     return privilegeLevel
   }
 
-  if (!opts.ignoreSiteAdmin) {
-    if (await isUserSiteAdmin(userId)) {
-      return PrivilegeLevels.OWNER
-    }
-  }
-
   if (!opts.ignorePublicAccess) {
     // Legacy public-access system
     // User is present (not anonymous), but does not have direct access

services/web/test/acceptance/src/ProjectOwnershipTransferTests.js

@@ -7,6 +7,10 @@ describe('Project ownership transfer', function () {
     this.collaboratorSession = new User()
     this.strangerSession = new User()
     this.adminSession = new User()
+    this.invitedAdminSession = new User()
+    await this.invitedAdminSession.ensureUserExists()
+    await this.invitedAdminSession.ensureAdmin()
+    await this.invitedAdminSession.login()
     await this.adminSession.ensureUserExists()
     await this.adminSession.ensureAdmin()
     await this.ownerSession.login()
@@ -17,7 +21,13 @@ describe('Project ownership transfer', function () {
     this.collaborator = await this.collaboratorSession.get()
     this.stranger = await this.strangerSession.get()
     this.admin = await this.adminSession.get()
+    this.invitedAdmin = await this.invitedAdminSession.get()
     this.projectId = await this.ownerSession.createProject('Test project')
+    await this.ownerSession.addUserToProject(
+      this.projectId,
+      this.invitedAdmin,
+      'readAndWrite'
+    )
     await this.ownerSession.addUserToProject(
       this.projectId,
       this.collaborator,
@@ -44,6 +54,7 @@ describe('Project ownership transfer', function () {
       const project = await this.collaboratorSession.getProject(this.projectId)
       expect(project.collaberator_refs.map(x => x.toString())).to.have.members([
         this.owner._id.toString(),
+        this.invitedAdmin._id.toString(),
       ])
     })
 
@@ -56,6 +67,30 @@ describe('Project ownership transfer', function () {
     })
   })
 
+  describe('ownership change as admin', function () {
+    it('lets the invited admin transfer ownership', async function () {
+      await this.invitedAdminSession.transferProjectOwnership(
+        this.projectId,
+        this.collaborator._id
+      )
+      const project = await this.invitedAdminSession.getProject(this.projectId)
+      expect(project.owner_ref.toString()).to.equal(
+        this.collaborator._id.toString()
+      )
+    })
+
+    it('lets the non-invited admin transfer ownership', async function () {
+      await this.adminSession.transferProjectOwnership(
+        this.projectId,
+        this.collaborator._id
+      )
+      const project = await this.adminSession.getProject(this.projectId)
+      expect(project.owner_ref.toString()).to.equal(
+        this.collaborator._id.toString()
+      )
+    })
+  })
+
   describe('validation', function () {
     it('lets only the project owner transfer ownership', async function () {
       await expect(