diff options
Diffstat (limited to 'gn3/auth/authorisation')
| -rw-r--r-- | gn3/auth/authorisation/resources/models.py | 30 | ||||
| -rw-r--r-- | gn3/auth/authorisation/resources/views.py | 38 | ||||
| -rw-r--r-- | gn3/auth/authorisation/users/models.py | 19 | ||||
| -rw-r--r-- | gn3/auth/authorisation/users/views.py | 9 |
4 files changed, 88 insertions, 8 deletions
diff --git a/gn3/auth/authorisation/resources/models.py b/gn3/auth/authorisation/resources/models.py index be1bc17..0a5b1ec 100644 --- a/gn3/auth/authorisation/resources/models.py +++ b/gn3/auth/authorisation/resources/models.py @@ -14,7 +14,8 @@ from .checks import authorised_for from ..checks import authorised_p from ..errors import NotFoundError, AuthorisationError -from ..groups.models import Group, user_group, group_by_id, is_group_leader +from ..groups.models import ( + Group, GroupRole, user_group, group_by_id, is_group_leader) class MissingGroupError(AuthorisationError): """Raised for any resource operation without a group.""" @@ -477,3 +478,30 @@ def attach_resources_data( cursor, rscs) for category, rscs in organised.items()) for resource in categories) + +@authorised_p( + ("group:user:assign-role",), + "You cannot assign roles to users for this group.", + oauth2_scope="profile group role resource") +def assign_resource_user( + conn: db.DbConnection, resource: Resource, user: User, + role: GroupRole) -> dict: + """Assign `role` to `user` for the specific `resource`.""" + with db.cursor(conn) as cursor: + cursor.execute( + "INSERT INTO " + "group_user_roles_on_resources(group_id, user_id, role_id, " + "resource_id) " + "VALUES (?, ?, ?, ?) " + "ON CONFLICT (group_id, user_id, role_id, resource_id) " + "DO NOTHING", + (str(resource.group.group_id), str(user.user_id), + str(role.role.role_id), str(resource.resource_id))) + return { + "resource": dictify(resource), + "user": dictify(user), + "role": dictify(role), + "description": ( + f"The user '{user.name}'({user.email}) was assigned the " + f"'{role.role.role_name}' role on resource with ID " + f"'{resource.resource_id}'.")} diff --git a/gn3/auth/authorisation/resources/views.py b/gn3/auth/authorisation/resources/views.py index e1386ab..6d4098a 100644 --- a/gn3/auth/authorisation/resources/views.py +++ b/gn3/auth/authorisation/resources/views.py @@ -9,17 +9,17 @@ from gn3.auth.db_utils import with_db_connection from .checks import authorised_for from .models import ( - resource_by_id, resource_categories, link_data_to_resource, - resource_category_by_id, unlink_data_from_resource, + resource_by_id, resource_categories, assign_resource_user, + link_data_to_resource, resource_category_by_id, unlink_data_from_resource, create_resource as _create_resource) from ..roles import Role -from ..groups.models import Group, GroupRole from ..errors import InvalidData, AuthorisationError +from ..groups.models import Group, GroupRole, group_role_by_id from ... import db from ...dictify import dictify -from ...authentication.users import User +from ...authentication.users import User, user_by_email from ...authentication.oauth2.resource_server import require_oauth resources = Blueprint("resources", __name__) @@ -101,7 +101,7 @@ def unlink_data(): except AssertionError as aserr: raise InvalidData(aserr.args[0]) from aserr -@resources.route("<uuid:resource_id>/users", methods=["GET"]) +@resources.route("<uuid:resource_id>/user/list", methods=["GET"]) @require_oauth("profile group resource") def resource_users(resource_id: uuid.UUID): """Retrieve all users with access to the given resource.""" @@ -115,8 +115,8 @@ def resource_users(resource_id: uuid.UUID): with db.cursor(conn) as cursor: def __organise_users_n_roles__(users_n_roles, row): user_id = uuid.UUID(row["user_id"]) - user = users_n_roles.get( - user_id, User(user_id, row["email"], row["name"])) + user = users_n_roles.get(user_id, {}).get( + "user", User(user_id, row["email"], row["name"])) role = GroupRole( uuid.UUID(row["group_role_id"]), resource.group, @@ -157,3 +157,27 @@ def resource_users(resource_id: uuid.UUID): user_row for user_id, user_row in with_db_connection(__the_users__).items())) return jsonify(tuple(results)) + +@resources.route("<uuid:resource_id>/user/assign", methods=["POST"]) +@require_oauth("profile group resource role") +def assign_role_to_user(resource_id: uuid.UUID) -> Response: + """Assign a role on the specified resource to a user.""" + with require_oauth.acquire("profile group resource role") as the_token: + try: + form = request.form + group_role_id = form.get("group_role_id", "") + user_email = form.get("user_email", "") + assert bool(group_role_id), "The role must be provided." + assert bool(user_email), "The user email must be provided." + + def __assign__(conn: db.DbConnection) -> dict: + resource = resource_by_id(conn, the_token.user, resource_id) + user = user_by_email(conn, user_email) + return assign_resource_user( + conn, resource, user, + group_role_by_id(conn, resource.group, + uuid.UUID(group_role_id))) + except AssertionError as aserr: + raise AuthorisationError(aserr.args[0]) from aserr + + return jsonify(with_db_connection(__assign__)) diff --git a/gn3/auth/authorisation/users/models.py b/gn3/auth/authorisation/users/models.py new file mode 100644 index 0000000..844a8a9 --- /dev/null +++ b/gn3/auth/authorisation/users/models.py @@ -0,0 +1,19 @@ +"""Functions for acting on users.""" +import uuid + +from gn3.auth import db +from gn3.auth.authorisation.checks import authorised_p + +from gn3.auth.authentication.users import User + +@authorised_p( + ("system:user:list",), + "You do not have the appropriate privileges to list users.", + oauth2_scope="profile user") +def list_users(conn: db.DbConnection) -> tuple[User, ...]: + """List out all users.""" + with db.cursor(conn) as cursor: + cursor.execute("SELECT * FROM users") + return tuple( + User(uuid.UUID(row["user_id"]), row["email"], row["name"]) + for row in cursor.fetchall()) diff --git a/gn3/auth/authorisation/users/views.py b/gn3/auth/authorisation/users/views.py index 2219440..5015cac 100644 --- a/gn3/auth/authorisation/users/views.py +++ b/gn3/auth/authorisation/users/views.py @@ -11,6 +11,7 @@ from gn3.auth import db from gn3.auth.dictify import dictify from gn3.auth.db_utils import with_db_connection +from ..users.models import list_users from ..groups.models import user_group as _user_group from ..resources.models import user_resources as _user_resources from ..roles.models import assign_default_roles, user_roles as _user_roles @@ -158,3 +159,11 @@ def user_join_request_exists(): with require_oauth.acquire("profile group") as the_token: return jsonify(with_db_connection(partial( __request_exists__, user=the_token.user))) + +@users.route("/list", methods=["GET"]) +@require_oauth("profile user") +def list_all_users() -> Response: + """List all the users.""" + with require_oauth.acquire("profile group") as _the_token: + return jsonify(tuple( + dictify(user) for user in with_db_connection(list_users))) |