aboutsummaryrefslogtreecommitdiff
path: root/migrations/auth/20230111_01_Wd6IZ-remove-create-group-privilege-from-group-leader.py
diff options
context:
space:
mode:
authorFrederick Muriuki Muriithi2023-01-11 11:20:36 +0300
committerFrederick Muriuki Muriithi2023-01-11 11:20:36 +0300
commit53371fb668d1d18ba4696b3e4739f26edd677d8d (patch)
tree1bdc74e65ed1c49de6414949d0a02e5cb05f7d75 /migrations/auth/20230111_01_Wd6IZ-remove-create-group-privilege-from-group-leader.py
parent1b28c4043b4e1199920bc848d752bcc154314842 (diff)
downloadgenenetwork3-53371fb668d1d18ba4696b3e4739f26edd677d8d.tar.gz
auth: assign default role. separate group creation from group admin
A newly registered user will have the ability to create a group. Once a user is a member of a group, either by creating a new group, or being added to a group, they should not be able to create any more groups, i.e. they lose the 'create-group' (and/or equivalent) privileges. This means that the group-administration privileges should be separated from the group-creation privilege. * gn3/auth/authorisation/roles.py: assign default roles to user on registration * gn3/auth/authorisation/views.py: assign default roles to user on registration * migrations/auth/20230111_01_Wd6IZ-remove-create-group-privilege-from-group-leader.py: separate group-creation role from group-administration role. * tests/unit/auth/fixtures/user_fixtures.py: Add group-creation role to test user * tests/unit/auth/test_roles.py: Add the group-creation role explicitly in the expected results for the test
Diffstat (limited to 'migrations/auth/20230111_01_Wd6IZ-remove-create-group-privilege-from-group-leader.py')
-rw-r--r--migrations/auth/20230111_01_Wd6IZ-remove-create-group-privilege-from-group-leader.py40
1 files changed, 40 insertions, 0 deletions
diff --git a/migrations/auth/20230111_01_Wd6IZ-remove-create-group-privilege-from-group-leader.py b/migrations/auth/20230111_01_Wd6IZ-remove-create-group-privilege-from-group-leader.py
new file mode 100644
index 0000000..7e7fda2
--- /dev/null
+++ b/migrations/auth/20230111_01_Wd6IZ-remove-create-group-privilege-from-group-leader.py
@@ -0,0 +1,40 @@
+"""
+remove 'create-group' privilege from group-leader.
+"""
+
+from yoyo import step
+
+__depends__ = {'20221219_03_PcTrb-create-authorisation-code-table'}
+
+steps = [
+ step(
+ """
+ DELETE FROM role_privileges
+ WHERE role_id='a0e67630-d502-4b9f-b23f-6805d0f30e30'
+ AND privilege_id='4842e2aa-38b9-4349-805e-0a99a9cf8bff'
+ """,
+ """
+ INSERT INTO role_privileges VALUES
+ ('a0e67630-d502-4b9f-b23f-6805d0f30e30',
+ '4842e2aa-38b9-4349-805e-0a99a9cf8bff')
+ """),
+ step(
+ """
+ INSERT INTO roles(role_id, role_name, user_editable) VALUES
+ ('ade7e6b0-ba9c-4b51-87d0-2af7fe39a347', 'group-creator', '0')
+ """,
+ """
+ DELETE FROM roles WHERE role_id='ade7e6b0-ba9c-4b51-87d0-2af7fe39a347'
+ """),
+ step(
+ """
+ INSERT INTO role_privileges VALUES
+ ('ade7e6b0-ba9c-4b51-87d0-2af7fe39a347',
+ '4842e2aa-38b9-4349-805e-0a99a9cf8bff')
+ """,
+ """
+ DELETE FROM role_privileges
+ WHERE role_id='ade7e6b0-ba9c-4b51-87d0-2af7fe39a347'
+ AND privilege_id='4842e2aa-38b9-4349-805e-0a99a9cf8bff'
+ """)
+]