Don't submit owner via API on document upload

[jonaswinkler]

Proposed change

Don't allow owner to be submitted via API, instead use currently logged in user for the new document.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Other (please explain)

Checklist:

• I have read & agree with the contributing guidelines.
• If applicable, I have tested my code for new features & regressions on both mobile & desktop devices, using the latest version of major browsers.
• If applicable, I have checked that all tests pass, see documentation.
• I have run all pre-commit hooks, see documentation.
• I have made corresponding changes to the documentation as needed.
• I have checked my modifications for any breaking changes.

[stumpylog]

Makes sense to me

[shamoon]

Hmm, but wouldn’t we want to sometimes be able to set the owner to the post documents view?

Currently this does the same thing (uses the logged in user) just that it comes from the frontend.

Sorry if I’m misunderstanding

[jonaswinkler]

It's more about user separation. You could use the API to add documents for another user, and I'd say that's a big no no.

[shamoon]

Fair enough, it doesn’t feel that “dangerous” to give a doc to someone else but I can see how separation is cleaner

[github-actions]

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new discussion or issue for related concerns.