Leave notes for tasks that need doing.

1 files changed, 13 insertions, 1 deletions

diff --git a/gn_auth/auth/authorisation/data/phenotypes.py b/gn_auth/auth/authorisation/data/phenotypes.py
index b1fefec..d484c44 100644
--- a/gn_auth/auth/authorisation/data/phenotypes.py
+++ b/gn_auth/auth/authorisation/data/phenotypes.py
@@ -167,6 +167,7 @@ def unlink_from_resources(
         data_link_ids: tuple[uuid.UUID, ...]
 ) -> tuple[uuid.UUID, ...]:
     """Unlink phenotypes from resources."""
+    # TODO: Delete in batches
     cursor.executemany("DELETE FROM phenotype_resources "
                        "WHERE data_link_id=? RETURNING resource_id",
                        tuple((str(_id),) for _id in data_link_ids))
@@ -178,6 +179,7 @@ def delete_resources(
         resource_ids: tuple[uuid.UUID, ...]
 ) -> tuple[uuid.UUID, ...]:
     """Delete the specified phenotype resources."""
+    # TODO: Delete in batches
     cursor.executemany("DELETE FROM resources "
                        "WHERE resource_id=? RETURNING resource_id",
                        tuple((str(_id),) for _id in resource_ids))
@@ -209,6 +211,7 @@ def delete_linked_data(
         data_link_ids: tuple[uuid.UUID, ...]
 ) -> int:
     """Delete the actual linked data."""
+    # TODO: Delete in batches
     cursor.executemany("DELETE FROM linked_phenotype_data "
                        "WHERE data_link_id=?",
                        tuple((str(_id),) for _id in data_link_ids))
@@ -228,10 +231,17 @@ def delete_linked_phenotypes_data(
     with (require_oauth.acquire("profile group resource") as _token,
           authdb.connection(db_uri) as auth_conn,
           authdb.cursor(auth_conn) as cursor):
+        # TODO: Check for user privileges here.
+        # - Does user have DELETE privilege on system (i.e. is data curator)?
+        #   YES: go ahead and delete data as below.
+        # - Does user have DELETE privilege on resource(s)?
+        #   YES: Delete phenotypes by resource, checking privileges for each
+        #        resource.
+        # - Neither: Raise `AuthorisationError` and bail!
         _deleted = 0
         xref_ids = tuple(request.json.get("xref_ids", []))#type: ignore[union-attr]
         if len(xref_ids) > 0:
-            # TOD0: Introduce background jobs for this.
+            # TODO: Use background job, for huge number of xref_ids
             data_link_ids = fetch_data_link_ids(
                 cursor, species_id, population_id, dataset_id, xref_ids)
             _resources_ids = unlink_from_resources(cursor, data_link_ids)
@@ -239,6 +249,8 @@ def delete_linked_phenotypes_data(
             _deleted = delete_linked_data(cursor, data_link_ids)
 
         return jsonify({
+            # TODO: "status": "sent-to-background"/"completed"/"failed"
+            # TODO: "status-url": <status-check-uri>
             "requested": len(xref_ids),
             "deleted": _deleted
         })