auth: update privileges format

Save privileges with ids of the form <top-level>:<sub-level>:<privilege-name>
rather than using a UUID, to reduce indirection levels.

* migrations/auth/20230116_01_KwuJ3-rework-privileges-schema.py: new migration
  to change the schema and IDs for the privileges.
* Update code to use new privileges format
  * gn3/auth/authorisation/checks.py
  * gn3/auth/authorisation/groups.py
  * gn3/auth/authorisation/privileges.py
  * gn3/auth/authorisation/resources.py
  * gn3/auth/authorisation/roles.py
  * migrations/auth/20230116_01_KwuJ3-rework-privileges-schema.py
  * tests/unit/auth/fixtures/role_fixtures.py
  * tests/unit/auth/test_groups.py
  * tests/unit/auth/test_privileges.py
  * tests/unit/auth/test_roles.py

1 files changed, 37 insertions, 47 deletions

diff --git a/tests/unit/auth/test_roles.py b/tests/unit/auth/test_roles.py
index 21d8e86..56ad39e 100644
--- a/tests/unit/auth/test_roles.py
+++ b/tests/unit/auth/test_roles.py
@@ -18,10 +18,9 @@ create_role_failure = {
 uuid_fn = lambda : uuid.UUID("d32611e3-07fc-4564-b56c-786c6db6de2b")
 
 PRIVILEGES = (
-    Privilege(uuid.UUID("7f261757-3211-4f28-a43f-a09b800b164d"),
-              "view-resource"),
-    Privilege(uuid.UUID("2f980855-959b-4339-b80e-25d1ec286e21"),
-              "edit-resource"))
+    Privilege("group:resource:view-resource",
+              "view a resource and use it in computations"),
+    Privilege("group:resource:edit-resource", "edit/update a resource"))
 
 @pytest.mark.unit_test
 @pytest.mark.parametrize(
@@ -53,55 +52,46 @@ def test_create_role(# pylint: disable=[too-many-arguments]
              role_id=uuid.UUID('a0e67630-d502-4b9f-b23f-6805d0f30e30'),
              role_name='group-leader',
              privileges=(
+                 Privilege(privilege_id='group:resource:create-resource',
+                           privilege_description='Create a resource object'),
+                 Privilege(privilege_id='group:resource:delete-resource',
+                           privilege_description='Delete a resource'),
+                 Privilege(privilege_id='group:resource:edit-resource',
+                           privilege_description='edit/update a resource'),
                  Privilege(
-                     privilege_id=uuid.UUID('13ec2a94-4f1a-442d-aad2-936ad6dd5c57'),
-                     privilege_name='delete-group'),
+                     privilege_id='group:resource:view-resource',
+                     privilege_description=(
+                         'view a resource and use it in computations')),
+                 Privilege(privilege_id='group:role:create-role',
+                           privilege_description='Create a new role'),
+                 Privilege(privilege_id='group:role:delete-role',
+                           privilege_description='Delete an existing role'),
+                 Privilege(privilege_id='group:role:edit-role',
+                           privilege_description='edit/update an existing role'),
+                 Privilege(privilege_id='group:user:add-group-member',
+                           privilege_description='Add a user to a group'),
+                 Privilege(privilege_id='group:user:assign-role',
+                           privilege_description=(
+                               'Assign a role to an existing user')),
+                 Privilege(privilege_id='group:user:remove-group-member',
+                           privilege_description='Remove a user from a group'),
+                 Privilege(privilege_id='system:group:delete-group',
+                           privilege_description='Delete a group'),
+                 Privilege(privilege_id='system:group:edit-group',
+                           privilege_description='Edit the details of a group'),
                  Privilege(
-                     privilege_id=uuid.UUID('1c59eff5-9336-4ed2-a166-8f70d4cb012e'),
-                     privilege_name='delete-role'),
-                 Privilege(
-                     privilege_id=uuid.UUID('221660b1-df05-4be1-b639-f010269dbda9'),
-                     privilege_name='create-role'),
-                 Privilege(
-                     privilege_id=uuid.UUID('2f980855-959b-4339-b80e-25d1ec286e21'),
-                     privilege_name='edit-resource'),
-                 Privilege(
-                     privilege_id=uuid.UUID('3ebfe79c-d159-4629-8b38-772cf4bc2261'),
-                     privilege_name='view-group'),
-                 Privilege(
-                     privilege_id=uuid.UUID('5103cc68-96f8-4ebb-83a4-a31692402c9b'),
-                     privilege_name='assign-role'),
-                 Privilege(
-                     privilege_id=uuid.UUID('52576370-b3c7-4e6a-9f7e-90e9dbe24d8f'),
-                     privilege_name='edit-group'),
-                 Privilege(
-                     privilege_id=uuid.UUID('7bcca363-cba9-4169-9e31-26bdc6179b28'),
-                     privilege_name='edit-role'),
-                 Privilege(
-                     privilege_id=uuid.UUID('7f261757-3211-4f28-a43f-a09b800b164d'),
-                     privilege_name='view-resource'),
-                 Privilege(
-                     privilege_id=uuid.UUID('aa25b32a-bff2-418d-b0a2-e26b4a8f089b'),
-                     privilege_name='create-resource'),
-                 Privilege(
-                     privilege_id=uuid.UUID('ae4add8c-789a-4d11-a6e9-a306470d83d9'),
-                     privilege_name='add-group-member'),
-                 Privilege(
-                     privilege_id=uuid.UUID('d2a070fd-e031-42fb-ba41-d60cf19e5d6d'),
-                     privilege_name='delete-resource'),
-                 Privilege(
-                     privilege_id=uuid.UUID('d4afe2b3-4ca0-4edd-b37d-966535b5e5bd'),
-                     privilege_name='transfer-group-leadership'),
-             Privilege(
-                 privilege_id=uuid.UUID('f1bd3f42-567e-4965-9643-6d1a52ddee64'),
-                 privilege_name='remove-group-member'))),
+                     privilege_id='system:group:transfer-group-leader',
+                     privilege_description=(
+                         'Transfer leadership of the group to some other '
+                         'member')),
+                 Privilege(privilege_id='system:group:view-group',
+                           privilege_description='View the details of a group'))),
            Role(
                role_id=uuid.UUID("ade7e6b0-ba9c-4b51-87d0-2af7fe39a347"),
                role_name="group-creator",
                privileges=(
-                   Privilege(
-                       privilege_id=uuid.UUID('4842e2aa-38b9-4349-805e-0a99a9cf8bff'),
-                       privilege_name='create-group'),))),
+                   Privilege(privilege_id='system:group:create-group',
+                             privilege_description = "Create a group"),))),
           tuple(), tuple(), tuple()))))
 def test_user_roles(fxtr_group_user_roles, user, expected):
     """