aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorFrederick Muriuki Muriithi2023-02-10 10:16:48 +0300
committerFrederick Muriuki Muriithi2023-02-10 10:16:48 +0300
commit4230afacfcee6c5e8a92a7133732adc9ee61026b (patch)
treeb63bb500857c3aa559a25a5f4fef0cb5b2670eff
parent83430d7a3a853632eee880cbdd629f114e977757 (diff)
downloadgenenetwork3-4230afacfcee6c5e8a92a7133732adc9ee61026b.tar.gz
auth: migrations: new privilege and role
Add a new data distribution privilege Add a new system-administrator role
-rw-r--r--migrations/auth/20230210_01_8xMa1-system-admin-privileges-for-data-distribution.py22
-rw-r--r--migrations/auth/20230210_02_lDK14-create-system-admin-role.py38
2 files changed, 60 insertions, 0 deletions
diff --git a/migrations/auth/20230210_01_8xMa1-system-admin-privileges-for-data-distribution.py b/migrations/auth/20230210_01_8xMa1-system-admin-privileges-for-data-distribution.py
new file mode 100644
index 0000000..8b406a6
--- /dev/null
+++ b/migrations/auth/20230210_01_8xMa1-system-admin-privileges-for-data-distribution.py
@@ -0,0 +1,22 @@
+"""
+System admin privileges for data distribution
+
+These privileges are focussed on allowing the system administrator to link the
+datasets and traits in the main database to specific groups in the auth system.
+"""
+
+from yoyo import step
+
+__depends__ = {'20230207_01_r0bkZ-create-group-join-requests-table'}
+
+steps = [
+ step(
+ """
+ INSERT INTO privileges VALUES
+ ('system:data:link-to-group', 'Link a dataset or trait to a group.')
+ """,
+ """
+ DELETE FROM privileges WHERE privilege_id IN
+ ('system:data:link-to-group')
+ """)
+]
diff --git a/migrations/auth/20230210_02_lDK14-create-system-admin-role.py b/migrations/auth/20230210_02_lDK14-create-system-admin-role.py
new file mode 100644
index 0000000..9b3fc2b
--- /dev/null
+++ b/migrations/auth/20230210_02_lDK14-create-system-admin-role.py
@@ -0,0 +1,38 @@
+"""
+Create system-admin role
+"""
+import uuid
+from contextlib import closing
+
+from yoyo import step
+
+__depends__ = {'20230210_01_8xMa1-system-admin-privileges-for-data-distribution'}
+
+def create_sys_admin_role(conn):
+ with closing(conn.cursor()) as cursor:
+ role_id = uuid.uuid4()
+ cursor.execute(
+ "INSERT INTO roles VALUES (?, 'system-administrator', '0')",
+ (str(role_id),))
+
+ cursor.executemany(
+ "INSERT INTO role_privileges VALUES (:role_id, :privilege_id)",
+ ({"role_id": f"{role_id}", "privilege_id": priv}
+ for priv in (
+ "system:data:link-to-group",
+ "system:group:create-group",
+ "system:group:delete-group",
+ "system:group:edit-group",
+ "system:group:transfer-group-leader",
+ "system:group:view-group",
+ "system:user:assign-group-leader",
+ "system:user:delete-user",
+ "system:user:masquerade",
+ "system:user:reset-password")))
+
+def drop_sys_admin_role(conn):
+ pass
+
+steps = [
+ step(create_sys_admin_role, drop_sys_admin_role)
+]