Board ownership transfer to non-existent user

[DorraJaouad]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Describe the bug
The API endpoint responsible for transferring board ownership allows a user to specify a new owner via the newOwner parameter. However, the backend service does not validate whether the specified user actually exists in the system.

To Reproduce
Steps to reproduce the behavior:

1. Create a new Deck board.
2. Transfer ownership with /apps/deck/boards/26/transferOwner using wrong new owner.
3. The requests is successful

Expected behavior
It returns an error Invalid request

[jospoortvliet]

Wondering if it is possible to transfer ownership to a group or a team (circle). I tried, giving the circle ID, but that's not a username of course - but a long string like "dqNWvDvumqyrZwpeThsppmT2zrrAqmB". It did not work, sadly - would be great as that would ensure the board isn't owned by a single person.

EDIT: what did not work is that the circle I assigned ownership did not get ownership, from what I can tell - owner is now a question mark. But I had shared the board to a different circle earlier, with mgmt rights, which kind of takes are of the problem I tried to solve...

In that regard I see this as a feature - if you assign the board to a circle, even if it technically doesn't work, if the board was first shared to the circle and the circle has rights to share and manage the board, ownership is no longer with a single person - solving the "but what if that employee leaves" problem in a nicer way than only having the ownership transfer mechanism.

Similar to how Team folders are not owned by a person, nor Talk rooms...