Do not add project creator to direct project members

server/mergin/sync/models.py

@@ -90,7 +90,6 @@ def __init__(
         self.public = kwargs.get("public", False)
         latest_files = LatestProjectFiles(project=self)
         db.session.add(latest_files)
-        self.set_role(creator.id, ProjectRole.OWNER)
 
     @property
     def storage(self):

server/mergin/tests/test_celery.py

@@ -10,7 +10,7 @@
 
 from ..app import db
 from ..config import Configuration
-from ..sync.models import Project, AccessRequest, ProjectVersion
+from ..sync.models import Project, AccessRequest, ProjectRole, ProjectVersion
 from ..celery import send_email_async
 from ..sync.tasks import remove_temp_files, remove_projects_backups
 from ..sync.storages.disk import move_to_tmp
@@ -60,6 +60,7 @@ def test_send_email_from_flask(send_email_mock, client):
     user = User.query.filter(User.username == "mergin").first()
     test_workspace = create_workspace()
     p = create_project("testx", test_workspace, user)
+    p.set_role(user.id, ProjectRole.OWNER)
     user2 = add_user("test_user", "ilovemergin")
     login(client, "test_user", "ilovemergin")
     email_data = {

server/mergin/tests/test_project_controller.py

@@ -170,12 +170,15 @@ def test_get_paginated_projects(client):
     for i in range(14):
         create_project("foo" + str(i), test_workspace, user)
 
-    resp = client.get("/v1/project/paginated?page=1&per_page=10")
+    resp = client.get(
+        "/v1/project/paginated?page=1&per_page=10&order_params=created_asc"
+    )
     assert resp.status_code == 200
     resp_data = json.loads(resp.data)
     assert len(resp_data.get("projects")) == 10
     assert resp_data.get("count") == 15
-    assert "foo7" in resp_data.get("projects")[9]["name"]
+    names = [p["name"] for p in resp_data.get("projects")]
+    assert "foo8" in resp_data.get("projects")[9]["name"]
     assert "v0" == resp_data.get("projects")[9]["version"]
 
     resp = client.get(
@@ -194,11 +197,11 @@ def test_get_paginated_projects(client):
 
     # order by workspace name
     resp = client.get(
-        "/v1/project/paginated?page=2&per_page=10&order_params=workspace_asc"
+        "/v1/project/paginated?page=2&per_page=10&order_params=workspace_asc,created_asc"
     )
     resp_data = json.loads(resp.data)
     assert len(resp_data.get("projects")) == 5
-    assert "foo12" in resp_data.get("projects")[-1]["name"]
+    assert "foo13" in resp_data.get("projects")[-1]["name"]
     # tests backward compatibility sort
     resp_alt = client.get(
         "/v1/project/paginated?page=2&per_page=10&order_by=namespace&descending=false"
@@ -295,15 +298,15 @@ def test_get_paginated_projects(client):
     Configuration.GLOBAL_READ = False
     Configuration.GLOBAL_WRITE = False
     Configuration.GLOBAL_ADMIN = False
-    # add new user and let him create one project (total 15+1)
+    # add new user and pretend he created one project (total 15+1)
     user2 = add_user("user2", "ilovemergin")
-    assert not test_workspace.user_has_permissions(user2, "read")
     create_project("created", test_workspace, user2)
+    # without implicit and explicit permissions user should not see any private project (even not that he 'created')
+    assert not test_workspace.user_has_permissions(user2, "read")
     login(client, "user2", "ilovemergin")
     # check one project is 'created', none is 'shared'
     resp = client.get("/v1/project/paginated?page=1&per_page=10&flag=created")
-    assert resp.json["count"] == 1
-    assert resp.json["projects"][0]["name"] == "created"
+    assert resp.json["count"] == 0
     resp = client.get("/v1/project/paginated?page=1&per_page=10&flag=shared")
     assert resp.json["count"] == 0
     # share project explicitly
@@ -2133,7 +2136,8 @@ def test_orphan_project(client):
     test_workspace = create_workspace()
     project = create_project("orphan", test_workspace, user)
     assert project.creator_id == user_id
-    assert project.get_role(user_id) is ProjectRole.OWNER
+    # creator is not direct member by default
+    assert not project.get_role(user_id)
 
     # user is removed by superuser
     login_as_admin(client)

server/mergin/tests/utils.py

@@ -80,7 +80,6 @@ def create_project(name, workspace, user, **kwargs):
 
     p = Project(**project_params, **kwargs)
     p.updated = datetime.utcnow()
-    p.set_role(user.id, ProjectRole.OWNER)
     db.session.add(p)
     db.session.flush()
     changes = UploadChanges(added=[], updated=[], removed=[])