[snyaggarwal]

Closes OpenConceptLab/ocl_online#477
Source and collection create merged the request body into the serializer data, so `organization`/`organization_id`/`user`/`user_id` in the body could name an owner other than the authorized URL parent.

• `ConceptDictionaryCreateMixin.set_owner_from_parent` drops those four body fields and sets the owner from the URL parent.
• Source, collection and map project create all use it (map project previously had its own copy).
• Tests: POST to the caller's own `/users//sources/` and `/collections/` with each owner field naming another org or user; the repo is owned by the caller.

A body naming a different owner is ignored rather than refused, matching the map project behaviour.

Not done: the read-only production check for repositories already created this way.

🤖 Generated with Claude Code

[snyaggarwal]

Verdict: changes needed.

The ownership override is closed, but the implementation intentionally returns 201 for conflicting body-owner fields. The linked ticket requires those requests to be rejected with 400 or 403. I also left one non-blocking documentation nit.

Verification: focused ownership tests passed (6 tests); pylint passed at 10.00/10; diff check passed.

[snyaggarwal]

Re-review verdict: functionally clean; two lint fixes remain.

The previous P2 is addressed: conflicting source/collection body owners now return 400, omitted or matching owners are accepted, and map-project ownership behavior is preserved. The ownership helper is also documented.

I found no new functional or security findings. The required Pylint check currently fails on two violations, both posted inline.

Verification: 8 focused ownership tests passed; git diff --check passed; local Pylint reproduced only the two posted violations.

[snyaggarwal]

Final re-review: no findings or nits.

Both previously reported lint violations are fixed. The ownership behavior remains correct: conflicting source/collection body owners return 400, omitted or matching owners are accepted, and map-project behavior is preserved.

Verification: 8 focused ownership tests passed; Pylint passed at 10.00/10; git diff --check passed. The latest GitHub Pylint job was still pending when reviewed.