Fix image owner change when accepting membership with --project

When using 'openstack image set --project <project> --accept <image>',
the command incorrectly changed the image owner. The --project parameter
when used with membership flags should only identify which member's
status to update, not change ownership.

Closes-Bug: #2136795
Change-Id: I1044b51f38000fb5339740bc40c7f8645c794402
Signed-off-by: Abhishek Kekane <akekane@redhat.com>

openstackclient/image/v2/image.py

@@ -1393,7 +1393,10 @@ class SetImage(command.Command):
         if parsed_args.visibility is not None:
             kwargs['visibility'] = parsed_args.visibility
 
-        if parsed_args.project:
+        # Only set owner_id if --project is used WITHOUT membership flags
+        # When --project is used with --accept/--reject/--pending, it should
+        # only identify which member's status to update, not change ownership
+        if parsed_args.project and not parsed_args.membership:
             # We already did the project lookup above
             kwargs['owner_id'] = project_id
 

openstackclient/tests/unit/image/v2/test_image.py

@@ -1295,6 +1295,117 @@ class TestImageSet(TestImage):
         # the 'update membership' route.
         self.image_client.update_image.assert_called_with(self._image.id)
 
+    def test_image_set_membership_accept_with_project_no_owner_change(self):
+        """Test that --project with --accept doesn't change image owner."""
+        membership = image_fakes.create_one_image_member(
+            attrs={
+                'image_id': '0f41529e-7c12-4de8-be2d-181abb825b3c',
+                'member_id': self.project.id,
+            }
+        )
+        self.image_client.update_member.return_value = membership
+
+        arglist = [
+            '--project',
+            self.project.name,
+            '--accept',
+            self._image.id,
+        ]
+        verifylist = [
+            ('project', self.project.name),
+            ('membership', 'accepted'),
+            ('image', self._image.id),
+        ]
+
+        parsed_args = self.check_parser(self.cmd, arglist, verifylist)
+        self.cmd.take_action(parsed_args)
+
+        self.image_client.update_member.assert_called_once_with(
+            image=self._image.id,
+            member=self.project.id,
+            status='accepted',
+        )
+
+        self.image_client.update_image.assert_called()
+        call_args = self.image_client.update_image.call_args
+        if call_args:
+            args, kwargs = call_args
+            self.assertNotIn('owner_id', kwargs)
+
+    def test_image_set_membership_reject_with_project_no_owner_change(self):
+        """Test that --project with --reject doesn't change image owner."""
+        membership = image_fakes.create_one_image_member(
+            attrs={
+                'image_id': '0f41529e-7c12-4de8-be2d-181abb825b3c',
+                'member_id': self.project.id,
+            }
+        )
+        self.image_client.update_member.return_value = membership
+
+        arglist = [
+            '--project',
+            self.project.name,
+            '--reject',
+            self._image.id,
+        ]
+        verifylist = [
+            ('project', self.project.name),
+            ('membership', 'rejected'),
+            ('image', self._image.id),
+        ]
+
+        parsed_args = self.check_parser(self.cmd, arglist, verifylist)
+        self.cmd.take_action(parsed_args)
+
+        self.image_client.update_member.assert_called_once_with(
+            image=self._image.id,
+            member=self.project.id,
+            status='rejected',
+        )
+
+        self.image_client.update_image.assert_called()
+        call_args = self.image_client.update_image.call_args
+        if call_args:
+            args, kwargs = call_args
+            self.assertNotIn('owner_id', kwargs)
+
+    def test_image_set_membership_pending_with_project_no_owner_change(self):
+        """Test that --project with --pending doesn't change image owner."""
+        membership = image_fakes.create_one_image_member(
+            attrs={
+                'image_id': '0f41529e-7c12-4de8-be2d-181abb825b3c',
+                'member_id': self.project.id,
+            }
+        )
+        self.image_client.update_member.return_value = membership
+
+        arglist = [
+            '--project',
+            self.project.name,
+            '--pending',
+            self._image.id,
+        ]
+        verifylist = [
+            ('project', self.project.name),
+            ('membership', 'pending'),
+            ('image', self._image.id),
+        ]
+
+        parsed_args = self.check_parser(self.cmd, arglist, verifylist)
+        self.cmd.take_action(parsed_args)
+
+        self.image_client.update_member.assert_called_once_with(
+            image=self._image.id,
+            member=self.project.id,
+            status='pending',
+        )
+
+        self.image_client.update_image.assert_called()
+        call_args = self.image_client.update_image.call_args
+        if call_args:
+            args, kwargs = call_args
+            self.assertNotIn('owner_id', kwargs)
+
     def test_image_set_options(self):
         arglist = [
             '--name',

releasenotes/notes/fix-image-set-project-accept-owner-bug-2136795.yaml

@@ -0,0 +1,10 @@
+---
+fixes:
+  - |
+    Fix a bug where using ``openstack image set --project <project>
+    --accept <image>`` incorrectly changed the image owner to the specified
+    project instead of only updating the member status. The ``--project``
+    parameter when used with ``--accept``, ``--reject``, or ``--pending``
+    should only identify which member's status to update, not change the
+    image ownership.
+    [Bug `2136795 <https://bugs.launchpad.net/python-openstackclient/+bug/2136795>`_]