From fa2ebba48afc45385b73fec342afbc053b119c77 Mon Sep 17 00:00:00 2001 From: silentsudo-io <79569039+silentsudo-io@users.noreply.github.com> Date: Sun, 9 Aug 2026 01:38:15 -0500 Subject: [PATCH] Grant the project creator an owner role on creation A newly created project gets no project_member row at all, so it has no roles whatsoever. Two consequences: * it cannot be shared -- the Collaborators UI has no roles to work with, so the owner cannot add anyone, including themselves; * with GLOBAL_ADMIN=True, the creator cannot see their own project. GlobalWorkspaceHandler.get_user_role returns GUEST for non-superusers, and a GUEST reaches a project only via project_member or Project.public, so projects_query(ProjectPermissions.Read) filters it out before the flag=created creator test is ever reached. Both project creation paths are affected: add_project and clone_project. Neither called set_role. ProjectRole was already imported. Fixes #659 Co-Authored-By: Claude Opus 5 (1M context) --- LICENSES/CLA-signed-list.md | 1 + server/mergin/sync/public_api_controller.py | 7 +++++++ 2 files changed, 8 insertions(+) diff --git a/LICENSES/CLA-signed-list.md b/LICENSES/CLA-signed-list.md index 1f4c1cc9..00542ca6 100644 --- a/LICENSES/CLA-signed-list.md +++ b/LICENSES/CLA-signed-list.md @@ -5,6 +5,7 @@ A/ You have read and agree to the individual CLA: https://merginmaps.com/license * `alhirzel`, 20th December 2023 * `uprel`, 18th March 2024 * `enockseth`, 5th May 2025 +* `silentsudo-io`, 9th August 2026 B/ I have read and agree with entity CLA for my company: https://merginmaps.com/licenses/entity-cla diff --git a/server/mergin/sync/public_api_controller.py b/server/mergin/sync/public_api_controller.py index 34a2d28f..bda53a95 100644 --- a/server/mergin/sync/public_api_controller.py +++ b/server/mergin/sync/public_api_controller.py @@ -266,6 +266,10 @@ def add_project(namespace): # noqa: E501 db.session.add(p) db.session.add(version) + # Grant the creator ownership of the project they have just created. + # Without this the project has no roles at all, so it cannot be shared, + # and under GLOBAL_ADMIN=True its own creator cannot see it. + p.set_role(current_user.id, ProjectRole.OWNER) db.session.commit() project_version_created.send(version) return NoContent, 200 @@ -1296,6 +1300,9 @@ def clone_project(namespace, project_name): # noqa: E501 device_id, ) db.session.add(project_version) + # Same as in add_project: the creator of a cloned project must hold a role + # on it, otherwise the clone cannot be shared or, for a non-superuser, seen. + p.set_role(current_user.id, ProjectRole.OWNER) db.session.commit() project_version_created.send(project_version) return NoContent, 200