Tests.

test/test_view/test_project_transferownership.py

@@ -109,3 +109,18 @@ def test_transfer_auth_admin_post(self):
 
         err_msg = "The project owner id should be different"
         assert project.owner_id == user.id, err_msg
+
+    @with_context
+    def test_transfer_auth_user_post(self):
+        """Test transfer ownership page post is forbidden for not owner."""
+        admin, owner, user = UserFactory.create_batch(3)
+        project = ProjectFactory.create(owner=owner)
+        url = '/project/%s/transferownership?api_key=%s' % (project.short_name,
+                                                            user.api_key)
+
+        assert project.owner_id == owner.id
+        payload = dict(email_addr=user.email_addr)
+        res = self.app_post_json(url, data=payload,
+                                 follow_redirects=True)
+        data = json.loads(res.data)
+        assert data['code'] == 403, data