auth: update privileges format

Save privileges with ids of the form <top-level>:<sub-level>:<privilege-name>
rather than using a UUID, to reduce indirection levels.

* migrations/auth/20230116_01_KwuJ3-rework-privileges-schema.py: new migration
  to change the schema and IDs for the privileges.
* Update code to use new privileges format
  * gn3/auth/authorisation/checks.py
  * gn3/auth/authorisation/groups.py
  * gn3/auth/authorisation/privileges.py
  * gn3/auth/authorisation/resources.py
  * gn3/auth/authorisation/roles.py
  * migrations/auth/20230116_01_KwuJ3-rework-privileges-schema.py
  * tests/unit/auth/fixtures/role_fixtures.py
  * tests/unit/auth/test_groups.py
  * tests/unit/auth/test_privileges.py
  * tests/unit/auth/test_roles.py

1 files changed, 5 insertions, 5 deletions

diff --git a/gn3/auth/authorisation/roles.py b/gn3/auth/authorisation/roles.py
index 6602c9f..606403e 100644
--- a/gn3/auth/authorisation/roles.py
+++ b/gn3/auth/authorisation/roles.py
@@ -17,7 +17,7 @@ class Role(NamedTuple):
     privileges: Iterable[Privilege]
 
 @authenticated_p
-@authorised_p(("create-role",), error_message="Could not create role")
+@authorised_p(("group:role:create-role",), error_message="Could not create role")
 def create_role(
         cursor: db.DbCursor, role_name: str,
         privileges: Iterable[Privilege]) -> Role:
@@ -55,8 +55,8 @@ def __organise_privileges__(roles_dict, privilege_row):
                 UUID(role_id_str),
                 privilege_row["role_name"],
                 roles_dict[role_id_str].privileges + (
-                    Privilege(UUID(privilege_row["privilege_id"]),
-                              privilege_row["privilege_name"]),))
+                    Privilege(privilege_row["privilege_id"],
+                              privilege_row["privilege_description"]),))
         }
 
     return {
@@ -64,8 +64,8 @@ def __organise_privileges__(roles_dict, privilege_row):
         role_id_str: Role(
             UUID(role_id_str),
             privilege_row["role_name"],
-            (Privilege(UUID(privilege_row["privilege_id"]),
-                       privilege_row["privilege_name"]),))
+            (Privilege(privilege_row["privilege_id"],
+                       privilege_row["privilege_description"]),))
     }
 
 def user_roles(conn: db.DbConnection, user: User):