diff --git a/zerver/tests/test_auth_backends.py b/zerver/tests/test_auth_backends.py index 10c3844986..99b3950aa2 100644 --- a/zerver/tests/test_auth_backends.py +++ b/zerver/tests/test_auth_backends.py @@ -4711,7 +4711,7 @@ class TestAdminSetBackends(ZulipTestCase): self.login('iago') result = self.client_patch("/json/realm", { 'authentication_methods': ujson.dumps({'Email': False, 'Dev': True})}) - self.assert_json_error(result, 'Only organization owners can configure authentication methods.') + self.assert_json_error(result, 'Must be an organization owner') self.login('desdemona') result = self.client_patch("/json/realm", { diff --git a/zerver/tests/test_realm.py b/zerver/tests/test_realm.py index 6eee9f1f1b..a9d3b6cee8 100644 --- a/zerver/tests/test_realm.py +++ b/zerver/tests/test_realm.py @@ -636,7 +636,7 @@ class RealmTest(ZulipTestCase): req = dict(message_retention_days=ujson.dumps(10)) result = self.client_patch('/json/realm', req) - self.assert_json_error(result, "Only organization owners can change message retention period.") + self.assert_json_error(result, "Must be an organization owner") self.login('desdemona') diff --git a/zerver/tests/test_users.py b/zerver/tests/test_users.py index 2d87089baa..e8cbe9b3be 100644 --- a/zerver/tests/test_users.py +++ b/zerver/tests/test_users.py @@ -183,7 +183,7 @@ class PermissionTest(ZulipTestCase): self.login('iago') with tornado_redirected_to_list([]): result = self.client_patch(f'/json/users/{desdemona.id}', req) - self.assert_json_error(result, 'Only organization owners can add or remove the owner permission.') + self.assert_json_error(result, 'Must be an organization owner') def test_admin_api(self) -> None: self.login('desdemona') @@ -1160,7 +1160,7 @@ class ActivateTest(ZulipTestCase): # Organization Administrator cannot deactivate organization owner. result = self.client_delete(f'/json/users/{self.example_user("desdemona").id}') - self.assert_json_error(result, 'Only owners can deactivate other organization owners.') + self.assert_json_error(result, 'Must be an organization owner') iago = self.example_user('iago') desdemona = self.example_user('desdemona') diff --git a/zerver/views/realm.py b/zerver/views/realm.py index 657d09dc58..4297549310 100644 --- a/zerver/views/realm.py +++ b/zerver/views/realm.py @@ -20,6 +20,7 @@ from zerver.lib.actions import ( do_set_realm_signup_notifications_stream, ) from zerver.lib.domains import validate_domain +from zerver.lib.exceptions import OrganizationOwnerRequired from zerver.lib.i18n import get_available_language_codes from zerver.lib.request import REQ, JsonableError, has_request_variables from zerver.lib.response import json_error, json_success @@ -100,7 +101,7 @@ def update_realm( return json_error(_("Organization name is too long.")) if authentication_methods is not None: if not user_profile.is_realm_owner: - return json_error(_("Only organization owners can configure authentication methods.")) + raise OrganizationOwnerRequired() if True not in list(authentication_methods.values()): return json_error(_("At least one authentication method must be enabled.")) if (video_chat_provider is not None and @@ -114,7 +115,7 @@ def update_realm( if message_retention_days is not None: if not user_profile.is_realm_owner: - return json_error(_("Only organization owners can change message retention period.")) + raise OrganizationOwnerRequired() realm.ensure_not_on_limited_plan() # The user of `locals()` here is a bit of a code smell, but it's diff --git a/zerver/views/users.py b/zerver/views/users.py index b720b77fa5..2b88c66661 100644 --- a/zerver/views/users.py +++ b/zerver/views/users.py @@ -29,7 +29,7 @@ from zerver.lib.actions import ( from zerver.lib.avatar import avatar_url, get_gravatar_url from zerver.lib.bot_config import set_bot_config from zerver.lib.email_validation import email_allowed_for_realm -from zerver.lib.exceptions import CannotDeactivateLastUserError +from zerver.lib.exceptions import CannotDeactivateLastUserError, OrganizationOwnerRequired from zerver.lib.integrations import EMBEDDED_BOTS from zerver.lib.request import REQ, has_request_variables from zerver.lib.response import json_error, json_success @@ -87,7 +87,7 @@ def deactivate_user_backend(request: HttpRequest, user_profile: UserProfile, user_id: int) -> HttpResponse: target = access_user_by_id(user_profile, user_id) if target.is_realm_owner and not user_profile.is_realm_owner: - return json_error(_('Only owners can deactivate other organization owners.')) + raise OrganizationOwnerRequired() if check_last_owner(target): return json_error(_('Cannot deactivate the only organization owner')) return _deactivate_user_profile_backend(request, user_profile, target) @@ -134,7 +134,7 @@ def update_user_backend(request: HttpRequest, user_profile: UserProfile, user_id if target.role == UserProfile.ROLE_REALM_OWNER and check_last_owner(user_profile): return json_error(_('The owner permission cannot be removed from the only organization owner.')) if UserProfile.ROLE_REALM_OWNER in [role, target.role] and not user_profile.is_realm_owner: - return json_error(_('Only organization owners can add or remove the owner permission.')) + raise OrganizationOwnerRequired() do_change_user_role(target, role) if (full_name is not None and target.full_name != full_name and