Enable more roles for users on CLI commands.

Enable the "batch-editors", "systemwide-docs-editor", and/or
"systemwide-data-curator" roles.

1 files changed, 38 insertions, 8 deletions

diff --git a/gn_auth/wsgi.py b/gn_auth/wsgi.py
index d908831..b5c4499 100644
--- a/gn_auth/wsgi.py
+++ b/gn_auth/wsgi.py
@@ -27,6 +27,8 @@ from gn_auth.auth.authentication.oauth2.models.oauth2client import (
     OAuth2Client, save_client, delete_client,
     client as oauth2_client_by_id)
 from gn_auth.scripts import register_sys_admin as rsysadm# type: ignore[import]
+from gn_auth.auth.authorisation.roles.models import assign_user_role_by_name
+from gn_auth.auth.authorisation.resources.system.models import system_resource
 
 
 app = create_app()
@@ -137,7 +139,8 @@ def register_admin():
     rsysadm.register_admin(Path(app.config["AUTH_DB"]))
 
 
-_VALID_ROLES_ = ("system-admin", "none")
+_VALID_ROLES_ = ("system-admin", "none", "batch-editors",
+                 "systemwide-docs-editor", "systemwide-data-curator")
 
 _TEST_EMAIL_DOMAIN_ = "regression-tests.genenetwork.org"
 
@@ -147,13 +150,26 @@ def __normalise_name_for_email__(name: str) -> str:
     return re.sub(r"[^a-z0-9]", "", name.lower())
 
 
-def __create_one_user__(cursor, name: str, email: str, password: str, role: str) -> dict:
+def __create_one_user__(#pylint: disable=[too-many-arguments, too-many-positional-arguments]
+        cursor: db.DbCursor,
+        name: str,
+        email: str,
+        password: str,
+        role: str,
+        sys_resource_id: uuid.UUID
+) -> dict:
     """Create a single user in the DB and return their credential record."""
     user = save_user(cursor, email, name, verified=True)
     set_user_password(cursor, user, password)
     assign_default_roles(cursor, user)
-    if role == "system-admin":
-        grant_sysadmin_role(cursor, user)
+    match(role):
+        case "system-admin":
+            grant_sysadmin_role(cursor, user)
+        case "none":
+            pass
+        case _:
+            assign_user_role_by_name(cursor, user, sys_resource_id, role)
+
     return {
         "user_id": str(user.user_id),
         "name": user.name,
@@ -195,7 +211,8 @@ def create_users(user_specs, output_path):
     Each --user option takes a comma-separated key=value string with the
     following keys: name, email, password, role.
 
-    Valid roles: system-admin, none.
+    Valid roles: system-admin, none, batch-editors, systemwide-docs-editor,
+    systemwide-data-curator.
     """
     if not user_specs:
         print("No users specified.", file=sys.stderr)
@@ -203,6 +220,7 @@ def create_users(user_specs, output_path):
 
     records = []
     with db.connection(app.config["AUTH_DB"]) as conn, db.cursor(conn) as cursor:
+        sysresource = system_resource(conn)
         for spec_str in user_specs:
             spec = __parse_user_spec__(spec_str)
             name = spec.get("name", "").strip()
@@ -227,7 +245,12 @@ def create_users(user_specs, output_path):
                 sys.exit(1)
 
             records.append(
-                __create_one_user__(cursor, name, email, password, role))
+                __create_one_user__(cursor,
+                                    name,
+                                    email,
+                                    password,
+                                    role,
+                                    sysresource.resource_id))
 
     __write_output__({"users": records}, output_path)
 
@@ -266,7 +289,8 @@ def create_test_users(session_timestamp, user_specs, output_path):
     Email: <normalised-name><timestamp>@regression-tests.genenetwork.org
     Password: randomly generated.
 
-    Output is written with 0600 permissions. Valid roles: system-admin, none.
+    Output is written with 0644 permissions. Valid roles: system-admin, none,
+    batch-editors, systemwide-docs-editor, systemwide-data-curator.
     """
     if not user_specs:
         print("No users specified.", file=sys.stderr)
@@ -274,6 +298,7 @@ def create_test_users(session_timestamp, user_specs, output_path):
 
     records = []
     with db.connection(app.config["AUTH_DB"]) as conn, db.cursor(conn) as cursor:
+        sysresource = system_resource(conn)
         for spec_str in user_specs:
             spec = __parse_user_spec__(spec_str)
             name = spec.get("name", "").strip()
@@ -294,7 +319,12 @@ def create_test_users(session_timestamp, user_specs, output_path):
             password = secrets.token_urlsafe(32)
 
             records.append(
-                __create_one_user__(cursor, name, email, password, role))
+                __create_one_user__(cursor,
+                                    name,
+                                    email,
+                                    password,
+                                    role,
+                                    sysresource.resource_id))
 
     __write_output__(
         {"session_timestamp": session_timestamp, "users": records},