Remove `grant_access_to_sysadmins()` function.

The "system-administrator" role acts at the system level and should
not be granted against a non-system resource. This function is
therefore a bug in its entirety and thus needed to go.

2 files changed, 0 insertions, 32 deletions

diff --git a/gn_auth/auth/authorisation/resources/common.py b/gn_auth/auth/authorisation/resources/common.py
index fd358f1..0c12fe1 100644
--- a/gn_auth/auth/authorisation/resources/common.py
+++ b/gn_auth/auth/authorisation/resources/common.py
@@ -22,27 +22,3 @@ def assign_resource_owner_role(
         "ON CONFLICT (user_id, role_id, resource_id) DO NOTHING",
         params)
     return params
-
-
-def grant_access_to_sysadmins(
-        cursor: db.DbCursor,
-        resource_id: uuid.UUID,
-        system_resource_id: uuid.UUID
-):
-    """Grant sysadmins access to resource identified by `resource_id`."""
-    cursor.execute(
-        "SELECT role_id FROM roles WHERE role_name='system-administrator'")
-    sysadminroleid = cursor.fetchone()[0]
-
-    cursor.execute(# Fetch sysadmin IDs.
-        "SELECT user_roles.user_id FROM roles INNER JOIN user_roles "
-        "ON roles.role_id=user_roles.role_id "
-        "WHERE role_name='system-administrator' AND resource_id=?",
-        (str(system_resource_id),))
-
-    cursor.executemany(
-        "INSERT INTO user_roles(user_id, role_id, resource_id) "
-        "VALUES (?, ?, ?) "
-        "ON CONFLICT (user_id, role_id, resource_id) DO NOTHING",
-        tuple((row["user_id"], sysadminroleid, str(resource_id))
-              for row in cursor.fetchall()))
diff --git a/gn_auth/auth/authorisation/resources/groups/models.py b/gn_auth/auth/authorisation/resources/groups/models.py
index 07e6dbe..68f4ea0 100644
--- a/gn_auth/auth/authorisation/resources/groups/models.py
+++ b/gn_auth/auth/authorisation/resources/groups/models.py
@@ -19,8 +19,6 @@ from gn_auth.auth.authorisation.checks import authorised_p
 from gn_auth.auth.authorisation.privileges import Privilege
 from gn_auth.auth.authorisation.resources.errors import MissingGroupError
 from gn_auth.auth.authorisation.resources.system.models import system_resource
-from gn_auth.auth.authorisation.resources.common import (
-    grant_access_to_sysadmins)
 from gn_auth.auth.authorisation.resources.base import (
     Resource,
     resource_from_dbrow)
@@ -153,9 +151,6 @@ def create_group(
             "INSERT INTO group_resources(resource_id, group_id) "
             "VALUES(:resource_id, :group_id)",
             _group_resource)
-        grant_access_to_sysadmins(cursor,
-                                  _group_resource_id,
-                                  system_resource(conn).resource_id)
         add_user_to_group(cursor, new_group, group_leader)
         revoke_user_role_by_name(cursor, group_leader, "group-creator")
         assign_user_role_by_name(cursor,
@@ -375,9 +370,6 @@ def remove_user_from_group(
                                  user,
                                  grp_resource.resource_id,
                                  "group-creator")
-        grant_access_to_sysadmins(cursor,
-                                  grp_resource.resource_id,
-                                  system_resource(conn).resource_id)
 
 
 @authorised_p(