auth: update privileges format

Save privileges with ids of the form <top-level>:<sub-level>:<privilege-name>
rather than using a UUID, to reduce indirection levels.

* migrations/auth/20230116_01_KwuJ3-rework-privileges-schema.py: new migration
  to change the schema and IDs for the privileges.
* Update code to use new privileges format
  * gn3/auth/authorisation/checks.py
  * gn3/auth/authorisation/groups.py
  * gn3/auth/authorisation/privileges.py
  * gn3/auth/authorisation/resources.py
  * gn3/auth/authorisation/roles.py
  * migrations/auth/20230116_01_KwuJ3-rework-privileges-schema.py
  * tests/unit/auth/fixtures/role_fixtures.py
  * tests/unit/auth/test_groups.py
  * tests/unit/auth/test_privileges.py
  * tests/unit/auth/test_roles.py

1 files changed, 20 insertions, 23 deletions

diff --git a/tests/unit/auth/test_privileges.py b/tests/unit/auth/test_privileges.py
index 1c2ba24..e6c86d8 100644
--- a/tests/unit/auth/test_privileges.py
+++ b/tests/unit/auth/test_privileges.py
@@ -1,6 +1,4 @@
 """Test the privileges module"""
-from uuid import UUID
-
 import pytest
 
 from gn3.auth import db
@@ -8,29 +6,28 @@ from gn3.auth.authorisation.privileges import Privilege, user_privileges
 
 from tests.unit.auth import conftest
 
-SORT_KEY = lambda x: x.privilege_name
+SORT_KEY = lambda x: x.privilege_id
 
 PRIVILEGES = sorted(
-    (Privilege(UUID("4842e2aa-38b9-4349-805e-0a99a9cf8bff"), "create-group"),
-     Privilege(UUID("3ebfe79c-d159-4629-8b38-772cf4bc2261"), "view-group"),
-     Privilege(UUID("52576370-b3c7-4e6a-9f7e-90e9dbe24d8f"), "edit-group"),
-     Privilege(UUID("13ec2a94-4f1a-442d-aad2-936ad6dd5c57"), "delete-group"),
-     Privilege(UUID("ae4add8c-789a-4d11-a6e9-a306470d83d9"),
-               "add-group-member"),
-     Privilege(UUID("f1bd3f42-567e-4965-9643-6d1a52ddee64"),
-               "remove-group-member"),
-     Privilege(UUID("d4afe2b3-4ca0-4edd-b37d-966535b5e5bd"),
-               "transfer-group-leadership"),
-
-     Privilege(UUID("aa25b32a-bff2-418d-b0a2-e26b4a8f089b"), "create-resource"),
-     Privilege(UUID("7f261757-3211-4f28-a43f-a09b800b164d"), "view-resource"),
-     Privilege(UUID("2f980855-959b-4339-b80e-25d1ec286e21"), "edit-resource"),
-     Privilege(UUID("d2a070fd-e031-42fb-ba41-d60cf19e5d6d"), "delete-resource"),
-
-     Privilege(UUID("221660b1-df05-4be1-b639-f010269dbda9"), "create-role"),
-     Privilege(UUID("7bcca363-cba9-4169-9e31-26bdc6179b28"), "edit-role"),
-     Privilege(UUID("5103cc68-96f8-4ebb-83a4-a31692402c9b"), "assign-role"),
-     Privilege(UUID("1c59eff5-9336-4ed2-a166-8f70d4cb012e"), "delete-role")),
+    (Privilege("system:group:create-group", "Create a group"),
+     Privilege("system:group:view-group", "View the details of a group"),
+     Privilege("system:group:edit-group", "Edit the details of a group"),
+     Privilege("system:group:delete-group", "Delete a group"),
+     Privilege("group:user:add-group-member", "Add a user to a group"),
+     Privilege("group:user:remove-group-member", "Remove a user from a group"),
+     Privilege("system:group:transfer-group-leader",
+               "Transfer leadership of the group to some other member"),
+
+     Privilege("group:resource:create-resource", "Create a resource object"),
+     Privilege("group:resource:view-resource",
+               "view a resource and use it in computations"),
+     Privilege("group:resource:edit-resource", "edit/update a resource"),
+     Privilege("group:resource:delete-resource", "Delete a resource"),
+
+     Privilege("group:role:create-role", "Create a new role"),
+     Privilege("group:role:edit-role", "edit/update an existing role"),
+     Privilege("group:user:assign-role", "Assign a role to an existing user"),
+     Privilege("group:role:delete-role", "Delete an existing role")),
     key=SORT_KEY)
 
 @pytest.mark.unit_test