Non-owners able to transfer to Google Drive

[calculuschild]

It is possible for the document owner to lose editor access to their own documents if a co-author transfers the file into their Google Drive.

1. Owner A creates a file and saves it.
2. Owner A invites Coauthor B to the brew.
3. B makes an edit, saves, and becomes a full Author on the brew.
4. B transfers the file into their own Google Drive:

• If it was in A's Google Drive, B can still transfer it into Homebrewery storage
• From Homebrewery storage, B then transfers into their own Google Drive

6. All co-authors and guests can still see the file, but Owner A can no longer open the Edit or Share page

• If Owner A does not have Google Drive, they get a 401 "Not logged in", as we attempt to use Oauth credentials that don't exist
• If Owner A does have Google Drive, they get a 404 "File not found", as they do have OAuth credentials but not to B's drive
• Guests and other coauthors can open the file, because the Service account is used if you are not the owner

[calculuschild]

I would suggest that only the document owner (first author) be allowed to change the storage location between Homebrewery and Google.

[5e-Cleric]

LMAO, how come we've never gotten this?