Make WorkBench and Batch Edit transfer checks context aware

specifyweb/backend/workbench/views.py

@@ -937,6 +937,35 @@ def upload_results(request, ds) -> http.HttpResponse:
 
 @openapi(
     schema={
+        "get": {
+            "responses": {
+                "200": {
+                    "description": "Returns users the dataset may be transferred to.",
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "array",
+                                "items": {
+                                    "type": "object",
+                                    "properties": {
+                                        "id": {
+                                            "type": "number",
+                                            "description": "User ID of the transfer recipient",
+                                        },
+                                        "name": {
+                                            "type": "string",
+                                            "description": "User name of the transfer recipient",
+                                        },
+                                    },
+                                    "required": ["id", "name"],
+                                    "additionalProperties": False,
+                                },
+                            }
+                        }
+                    },
+                }
+            },
+        },
         "post": {
             "requestBody": {
                 "required": True,
@@ -1059,12 +1088,9 @@ def up_schema(request) -> http.HttpResponse:
     components=open_api_components,
 )
 @login_maybe_required
-@require_POST
+@require_http_methods(["GET", "POST"])
 def transfer(request, ds_id: int) -> http.HttpResponse:
-    """Transfer dataset's ownership to a different user."""
-    if "specifyuserid" not in request.POST:
-        return http.HttpResponseBadRequest("missing parameter: specifyuserid")
-
+    """List valid transfer recipients or transfer dataset ownership."""
     ds = get_object_or_404(models.Spdataset, id=ds_id)
     check_permission_targets(
         request.specify_collection.id,
@@ -1075,6 +1101,17 @@ def transfer(request, ds_id: int) -> http.HttpResponse:
     if ds.specifyuser != request.specify_user:
         return http.HttpResponseForbidden()
 
+    if request.method == "GET":
+        users = list(
+            Specifyuser.objects.exclude(id=request.specify_user.id)
+            .order_by("name", "id")
+            .values("id", "name")[:500]
+        )
+        return http.JsonResponse(users, safe=False)
+
+    if "specifyuserid" not in request.POST:
+        return http.HttpResponseBadRequest("missing parameter: specifyuserid")
+
     try:
         ds.specifyuser = Specifyuser.objects.get(id=request.POST["specifyuserid"])
     except Specifyuser.DoesNotExist:

specifyweb/frontend/js_src/lib/components/WbToolkit/ChangeOwner.tsx

@@ -5,17 +5,14 @@ import { useBooleanState } from '../../hooks/useBooleanState';
 import { useId } from '../../hooks/useId';
 import { commonText } from '../../localization/common';
 import { wbText } from '../../localization/workbench';
+import { ajax } from '../../utils/ajax';
 import { formData } from '../../utils/ajax/helpers';
 import { ping } from '../../utils/ajax/ping';
 import type { RA } from '../../utils/types';
 import { Button } from '../Atoms/Button';
 import { Form, Label, Select } from '../Atoms/Form';
 import { Submit } from '../Atoms/Submit';
 import { LoadingContext } from '../Core/Contexts';
-import { fetchCollection } from '../DataModel/collection';
-import type { SerializedResource } from '../DataModel/helperTypes';
-import type { SpecifyUser } from '../DataModel/types';
-import { userInformation } from '../InitialContext/userInformation';
 import { Dialog } from '../Molecules/Dialog';
 import { unsafeNavigate } from '../Router/Router';
 import type { Dataset } from '../WbPlanView/Wrapped';
@@ -47,12 +44,10 @@ export function WbChangeOwner({
   );
 }
 
-const fetchListOfUsers = async (): Promise<
-  RA<SerializedResource<SpecifyUser>>
-> =>
-  fetchCollection('SpecifyUser', { limit: 500, domainFilter: false }).then(
-    ({ records: users }) => users.filter(({ id }) => id !== userInformation.id)
-  );
+type TransferUser = {
+  readonly id: number;
+  readonly name: string;
+};
 
 function ChangeOwner({
   dataset,
@@ -61,8 +56,14 @@ function ChangeOwner({
   readonly dataset: Dataset;
   readonly onClose: () => void;
 }): JSX.Element | null {
-  const [users] = useAsyncState<RA<SerializedResource<SpecifyUser>>>(
-    fetchListOfUsers,
+  const [users] = useAsyncState<RA<TransferUser>>(
+    React.useCallback(
+      async () =>
+        ajax<RA<TransferUser>>(`/api/workbench/transfer/${dataset.id}/`, {
+          headers: { Accept: 'application/json' },
+        }).then(({ data }) => data),
+      [dataset.id]
+    ),
     true
   );
 

specifyweb/frontend/js_src/lib/components/WbToolkit/index.tsx

@@ -8,7 +8,6 @@ import type { RA } from '../../utils/types';
 import { Button } from '../Atoms/Button';
 import { raise } from '../Errors/Crash';
 import { ErrorBoundary } from '../Errors/ErrorBoundary';
-import { hasTablePermission } from '../Permissions/helpers';
 import { userPreferences } from '../Preferences/userPreferences';
 import type { Dataset } from '../WbPlanView/Wrapped';
 import { resolveVariantFromDataset } from '../WbUtils/datasetVariants';
@@ -94,7 +93,7 @@ export function WbToolkit({
       className="flex flex-wrap gap-x-1 gap-y-2"
       role="toolbar"
     >
-      {variant.canTransfer() && hasTablePermission('SpecifyUser', 'read') ? (
+      {variant.canTransfer() ? (
         <ErrorBoundary dismissible>
           <WbChangeOwner
             dataset={dataset}