project/collaborators: implement ownership management

[haraldschilly]

• ref improve project collaborator management #7718
• as mentioned in the ticket, optionally tighten security via project setting
  • ⚠️ this requires updating the DB schema
• above project setting can be enforce this via admin site settings for all projects
• testing: I noticed more than 100 projects are started when I run my tests locally. Adding noFirstProject:true to many create account calls to avoid that. Also, in one tests was a delay with a cryptic note – copying that to several more placed, also account creation related. This makes more tests pass for me locally.

screenshots

The panels below are from the perspective of a collaborator, with and without owner-only management of collaborators (adding/removing). In all situations, though, someone is able to remove oneself.

site setting, enforcing this setting for all projects

changing role

if there is just one owner left, the owner can't demote oneself

[haraldschilly]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

cocalc/src/packages/server/projects/collab.ts

Lines 76 to 80 in ecc4be4

	try {
	// Ensure user is allowed to modify project(s)
	//
	await verify_write_access_to_projects(db, account_id, projects);
	} catch (err) {

Owner-only removal bypassed via REST endpoint

The new manage_users_owner_only/strict_collaborator_management enforcement is only applied in server/projects/collaborators.ts, but the public REST endpoint /api/v2/projects/collaborators/remove still calls remove_collaborators_from_projects, which only checks generic write access and never consults the owner-only flag. A collaborator can therefore POST to that endpoint and remove other collaborators even when the project or site setting is supposed to limit collaborator management to owners. This leaves the new restriction ineffective for clients using the REST API.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[haraldschilly]

@codex review latest change

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[haraldschilly]

@codex do another review of the last commit

[chatgpt-codex-connector]

💡 Codex Review

cocalc/src/packages/frontend/projects/actions.ts

Lines 643 to 647 in 549595f

	await this.redux
	.getProjectActions(project_id)
	.async_log({ event: "remove_collaborator", removed_name });
	await webapp_client.project_collaborators.remove({
	project_id,

Log collaborator removals only after backend succeeds

The project history entry for remove_collaborator is written before the backend call is made. With the new ownership checks (e.g., owner-only management or blocking owner removals), the server can now reject the removal, yet the log entry will already have been persisted, leaving an audit trail that claims a user was removed when nothing changed. Logging after a successful project_collaborators.remove call (as done for change_user_type below) would keep the history accurate.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".