Add container ownership transfer by cmyers-mieweb · Pull Request #492 · mieweb/opensource-server

cmyers-mieweb · 2026-10-02T19:09:37Z

This pull request adds support for transferring container ownership from the frontend UI and backend API, allowing an owner or admin to hand a container to another active user. It includes UI components, backend logic, API documentation updates, and comprehensive tests to ensure correct behavior and access control. The most important changes are grouped below.

Frontend: Ownership Transfer UI

Added a new TransferOwnership component to the container edit page, allowing owners and admins to transfer ownership to another user; this includes confirmation dialogs and error handling. [1] [2] [3]

Backend: API and Logic

Updated the PUT /api/v1/sites/:siteId/containers/:id endpoint to allow ownership transfer by owner or admin, with validation for user existence and activity, and logic to move resource requests and remove sharing grants. [1] [2] [3] [4] [5]
Added a new query method in queries.ts for initiating ownership transfer from the frontend.

Testing

Added comprehensive backend tests for ownership transfer, covering success, permission checks, user validation, resource migration, and sharing grant removal.

Documentation and API Contract

Updated OpenAPI spec to document ownership transfer, error cases, and clarify permissions and side effects. [1] [2]
Added user documentation describing ownership transfer, its effects, and the API usage.Allow container owners and admins to transfer ownership to another active user from the edit page. The API now validates transfer targets, removes any collaborator grant for the new owner, moves resource requests to the new owner, and returns clearer ownership-specific responses. Also adds UI support, API docs updates, admin docs, and coverage for owner/admin/collaborator transfer behavior.

Allow container owners and admins to transfer ownership to another active user from the edit page. The API now validates transfer targets, removes any collaborator grant for the new owner, moves resource requests to the new owner, and returns clearer ownership-specific responses. Also adds UI support, API docs updates, admin docs, and coverage for owner/admin/collaborator transfer behavior.

runleveldev · 2026-10-02T20:09:14Z


-    // Admins may reassign the container to another user by passing `username`.
-    // Non-admins may not pass a different username — that is a 403.
+    // The owner or an admin (requireManage above) may transfer ownership to


Owners shouldn't be able to reassign their containers. Similar limitation exists in linux, only root can chown the owner of a file.

Made a commit 83a6ea3 container ownership reassignment is now admin-only across the API, UI, tests, OpenAPI spec, and admin docs. The ownership transfer card now only appears for admins, non-admin transfer attempts return 403, and related messaging/docs were updated to reflect that previous owners lose access after a transfer.

Make container ownership reassignment admin-only across the API, UI, tests, OpenAPI spec, and admin docs. The ownership transfer card now only appears for admins, non-admin transfer attempts return 403, and related messaging/docs were updated to reflect that previous owners lose access after a transfer.

Copilot

Copilot review overview

🟡 Changes recommended

Authorization contradicts the stated owner workflow, and transfer consistency and data-exposure issues remain.

Review effort: Balanced
Findings: 1 · 2 · 1

Open (4)

Restrict request transfers to approved and pending statuses · New
Owner transfer is incorrectly restricted to admins · New
Ensure Proxmox owner tags update reliably after transfer · New
Localize ownership transfer labels and confirmation text · New

What changed in this PR

Adds an admin-facing container ownership transfer workflow across the API, UI, documentation, and tests.

Changes:

Validates transfer targets and migrates collaborators/resource requests.
Adds transfer UI and client query support.
Documents the API behavior and access rules.

File	Description
`containers.md`	Documents ownership transfer effects.
`containers.js`	Implements transfer validation and migration.
`containers.owner.test.js`	Tests transfer permissions and side effects.
`openapi.v1.yaml`	Documents the API contract.
`ContainerFormPage.tsx`	Adds the ownership panel.
`queries.ts`	Adds the transfer request helper.
`TransferOwnership.tsx`	Implements transfer confirmation UI.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+  test('the owner cannot transfer ownership', async () => {
+    const res = await put(ownerKey, { username: other.uid });
+    expect(res.status).toBe(403);


+
+| Moves to the new owner | Not changed |
+|---|---|
+| Container record and Proxmox owner tag | Running container (no restart) |


+      <p className="text-sm">
+        Current owner: <strong>{owner}</strong>
+      </p>
+      <div className="flex items-end gap-2">
+        <div className="flex-1">
+          <Input
+            label="New owner"
+            placeholder="Enter a username"


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Copilot review overview

🟡 Changes recommended

Authorization requirements conflict with the PR description, and concurrent or partially failed transfers can leave ownership metadata inconsistent.

Review effort: Balanced
Findings: 1 · 2 · 1

Open (4)

Concurrent transfers can migrate resources to the wrong owner · New
Ensure Proxmox owner tags update reliably after transfer
Owner transfer is incorrectly restricted to admins
Localize ownership transfer labels and confirmation text

Resolved since last review (1)

Restrict request transfers to approved and pending statuses

Previously missed (3)

In code that hasn't changed since last review

Owner transfer authorization conflicts with the PR contract

create-a-container/routers/api/v1/containers.js:816

The PR description promises ownership transfer for both the current owner and admins, but this check rejects every non-admin owner; the UI also hides the control from owners. Either authorize the current owner and expose the control to owner/admin sessions, or update the PR contract to state that transfers are admin-only.

Confirmation misstates access revocation and volume movement

create-a-container/client/src/components/containers/TransferOwnership.tsx:105

The confirmation incorrectly says the previous owner loses access, although ldapusers retain SSH access to every container. Distinguish management/UI access from cluster-wide SSH access so admins do not treat this operation as access revocation; also avoid saying the volume data physically moves because its host path remains fixed.

Ownership transfer does not revoke cluster-wide SSH access

mie-opensource-landing/docs/admins/core-concepts/containers.md:29

“Loses access” is inaccurate: this page already states that every ldapusers member can SSH into any container. Ownership transfer removes management and UI/API visibility, but it does not revoke cluster-wide SSH access, so the current wording can create a false security expectation.

+    const previousOwner = container.username;
+    const ownerChanged = newOwnerUsername !== null && newOwnerUsername !== previousOwner;


cmyers-mieweb requested review from runleveldev and a balanced review from Copilot and removed request for Copilot October 2, 2026 19:09

Copilot started reviewing on behalf of cmyers-mieweb October 2, 2026 19:10 View session

runleveldev requested changes Oct 2, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings October 2, 2026 22:46

Copilot started reviewing on behalf of cmyers-mieweb October 2, 2026 22:47 View session

Copilot AI reviewed Oct 2, 2026

View reviewed changes

Update ResourceRequest query to include status filter

dbe5fb1

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings October 2, 2026 22:53

Copilot started reviewing on behalf of cmyers-mieweb October 2, 2026 22:53 View session

Copilot AI reviewed Oct 2, 2026

View reviewed changes

Comment thread create-a-container/routers/api/v1/containers.js

Comment on lines +842 to +843

const previousOwner = container.username;

const ownerChanged = newOwnerUsername !== null && newOwnerUsername !== previousOwner;

Navigation Menu

Add container ownership transfer - #492

Add container ownership transfer#492
cmyers-mieweb wants to merge 3 commits into
mainfrom
cmyers_ownership

cmyers-mieweb commented Oct 2, 2026

Uh oh!

runleveldev Oct 2, 2026

Uh oh!

cmyers-mieweb Oct 2, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		const previousOwner = container.username;
		const ownerChanged = newOwnerUsername !== null && newOwnerUsername !== previousOwner;

Conversation

cmyers-mieweb commented Oct 2, 2026

Uh oh!

runleveldev Oct 2, 2026

Choose a reason for hiding this comment

Uh oh!

cmyers-mieweb Oct 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants