refactor(auth): migrate authorised_for/2 -> authorised_for_spec

Replace all uses of the deprecated authorised_for() and authorised_for2()
helpers with authorised_for_spec() across resources/views.py and
data/phenotypes.py.

- resources/views.py (resource_users HACK block): two authorised_for()
  calls replaced; the intermediate dict merge collapsed into a plain
  boolean since authorised_for_spec returns bool directly.
- resources/views.py (assign_role_to_user, unassign_role_to_user):
  authorised_for() was called but its return value was discarded, making
  the check a silent no-op. Now replaced with authorised_for_spec() and
  a proper if/raise guard. Also fixes a typo: the privilege string was
  "resource:role:assign-role" (non-existent); corrected to the real
  privilege "resource:user:assign-role".
- resources/views.py (unassign_resource_role_privilege): direct
  replacement; intermediate _authorised variable removed.
- data/phenotypes.py (link_phenotype_data): two authorised_for2() calls
  replaced; .resource_id extracted from the Resource objects to satisfy
  authorised_for_spec's UUID argument. User type annotation added.

Reivewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

2 files changed, 42 insertions, 41 deletions

diff --git a/gn_auth/auth/authorisation/data/phenotypes.py b/gn_auth/auth/authorisation/data/phenotypes.py
index 92cbe89..08d225d 100644
--- a/gn_auth/auth/authorisation/data/phenotypes.py
+++ b/gn_auth/auth/authorisation/data/phenotypes.py
@@ -18,8 +18,9 @@ from gn_auth.auth.authorisation.resources.system.models import system_resource
 from gn_auth.auth.authorisation.resources.groups.models import Group, group_resource
 
 
+from gn_auth.auth.authentication.users import User
 from gn_auth.auth.authorisation.checks import require_json
-from gn_auth.auth.authorisation.resources.checks import authorised_for2
+from gn_auth.auth.authorisation.resources.checks import authorised_for_spec
 
 logger = logging.getLogger(__name__)
 phenosbp = Blueprint("phenotypes", __name__)
@@ -92,20 +93,22 @@ def pheno_traits_from_db(gn3conn: gn3db.Connection, params: tuple[dict, ...]) ->
 
 def link_phenotype_data(
         authconn: authdb.DbConnection,
-        user,
+        user: User,
         group: Group,
         traits: tuple[dict, ...]
 ) -> dict:
     """Link phenotype traits to a user group."""
-    if not (authorised_for2(authconn,
-                            user,
-                            system_resource(authconn),
-                            ("system:data:link-to-group",))
+    if not (authorised_for_spec(
+                authconn,
+                user.user_id,
+                system_resource(authconn).resource_id,
+                "system:data:link-to-group")
             or
-            authorised_for2(authconn,
-                            user,
-                            group_resource(authconn, group.group_id),
-                            ("group:data:link-to-group",))
+            authorised_for_spec(
+                authconn,
+                user.user_id,
+                group_resource(authconn, group.group_id).resource_id,
+                "group:data:link-to-group")
             ):
         raise AuthorisationError(
             "You do not have sufficient privileges to link data to group "
diff --git a/gn_auth/auth/authorisation/resources/views.py b/gn_auth/auth/authorisation/resources/views.py
index fc9d90e..06645db 100644
--- a/gn_auth/auth/authorisation/resources/views.py
+++ b/gn_auth/auth/authorisation/resources/views.py
@@ -53,7 +53,7 @@ from .phenotypes.views import phenobp
 from .errors import MissingGroupError
 from .system.models import system_resource
 from .groups.models import Group, user_group
-from .checks import can_delete, authorised_for
+from .checks import can_delete, authorised_for_spec
 from .models import (
     Resource, resource_data, resource_by_id, public_resources,
     resource_categories, assign_resource_user, link_data_to_resource,
@@ -260,23 +260,18 @@ def resource_users(resource_id: UUID):
             # It resolves (albeit, temporarily) the bug introduced after a
             # refactor that made the system itself, and the groups into
             # resources.
-            grouplevelauth = authorised_for(
+            grouplevelauth = authorised_for_spec(
                 conn,
-                the_token.user,
-                ("group:resource:view-resource",),
-                (resource_id,))
-            systemlevelauth = authorised_for(
+                the_token.user.user_id,
+                resource_id,
+                "group:resource:view-resource")
+            systemlevelauth = authorised_for_spec(
                 conn,
-                the_token.user,
-                ("system:user:list",),
-                (resource_id,))
-            authorised = {
-                key: (grouplevelauth.get(key, False)
-                      or systemlevelauth.get(key, False))
-                for key in grouplevelauth.keys() | systemlevelauth.keys()
-            }
+                the_token.user.user_id,
+                resource_id,
+                "system:user:list")
             ########## END: HACK ##########
-            if authorised.get(resource_id, False):
+            if grouplevelauth or systemlevelauth:
                 with db.cursor(conn) as cursor:
                     def __organise_users_n_roles__(users_n_roles, row):
                         user_id = UUID(row["user_id"])
@@ -340,11 +335,13 @@ def assign_role_to_user(resource_id: UUID) -> Response:
             assert bool(user_email), "The user email must be provided."
 
             def __assign__(conn: db.DbConnection) -> dict:
-                authorised_for(
-                    conn,
-                    _token.user,
-                    ("resource:role:assign-role",),
-                    (resource_id,))
+                if not authorised_for_spec(
+                        conn,
+                        _token.user.user_id,
+                        resource_id,
+                        "resource:user:assign-role"):
+                    raise AuthorisationError(
+                        "You are not authorised to assign roles on this resource.")
                 resource = resource_by_id(conn, _token.user, resource_id)
                 user = user_by_email(conn, user_email)
                 return assign_resource_user(
@@ -381,11 +378,13 @@ def unassign_role_to_user(resource_id: UUID) -> Response:
             assert bool(user_id), "The user id must be provided."
 
             def __assign__(conn: db.DbConnection) -> dict:
-                authorised_for(
-                    conn,
-                    _token.user,
-                    ("resource:role:assign-role",),
-                    (resource_id,))
+                if not authorised_for_spec(
+                        conn,
+                        _token.user.user_id,
+                        resource_id,
+                        "resource:user:assign-role"):
+                    raise AuthorisationError(
+                        "You are not authorised to assign roles on this resource.")
                 resource = resource_by_id(conn, _token.user, resource_id)
                 return unassign_resource_user(
                     conn, resource, user_by_id(conn, UUID(user_id)),
@@ -666,12 +665,11 @@ def unassign_resource_role_privilege(resource_id: UUID, role_id: UUID):
           db.cursor(conn) as cursor):
         _role = role_by_id(conn, role_id)
 
-        _authorised = authorised_for(
-            conn,
-            _token.user,
-            privileges=("resource:role:edit-role",),
-            resource_ids=(resource_id,)).get(resource_id)
-        if not _authorised:
+        if not authorised_for_spec(
+                conn,
+                _token.user.user_id,
+                resource_id,
+                "resource:role:edit-role"):
             raise AuthorisationError(
                 "You are not authorised to edit/update this role.")