aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--gn_auth/auth/authorisation/resources/models.py37
-rw-r--r--gn_auth/auth/authorisation/resources/views.py34
-rw-r--r--tests/unit/auth/test_groups.py37
-rw-r--r--tests/unit/auth/test_resources_roles.py90
-rw-r--r--tests/unit/auth/test_roles.py34
5 files changed, 128 insertions, 104 deletions
diff --git a/gn_auth/auth/authorisation/resources/models.py b/gn_auth/auth/authorisation/resources/models.py
index 94e817d..c7c8352 100644
--- a/gn_auth/auth/authorisation/resources/models.py
+++ b/gn_auth/auth/authorisation/resources/models.py
@@ -17,7 +17,7 @@ from gn_auth.auth.errors import NotFoundError, AuthorisationError
from .checks import authorised_for
from .base import Resource, ResourceCategory
-from .groups.models import Group, GroupRole, user_group, is_group_leader
+from .groups.models import Group, user_group, is_group_leader
from .mrna import (
resource_data as mrna_resource_data,
attach_resources_data as mrna_attach_resources_data,
@@ -293,13 +293,13 @@ def attach_resources_data(
for category, rscs in organised.items())
for resource in categories)
-@authorised_p(
- ("group:user:assign-role",),
- "You cannot assign roles to users for this group.",
- oauth2_scope="profile group role resource")
+
def assign_resource_user(
- conn: db.DbConnection, resource: Resource, user: User,
- role: GroupRole) -> dict:
+ conn: db.DbConnection,
+ resource: Resource,
+ user: User,
+ role: Role
+) -> dict:
"""Assign `role` to `user` for the specific `resource`."""
with db.cursor(conn) as cursor:
cursor.execute(
@@ -307,39 +307,36 @@ def assign_resource_user(
"VALUES (?, ?, ?) "
"ON CONFLICT (user_id, role_id, resource_id) "
"DO NOTHING",
- (str(user.user_id), str(role.role.role_id),
- str(resource.resource_id)))
+ (str(user.user_id), str(role.role_id), str(resource.resource_id)))
return {
"resource": asdict(resource),
"user": asdict(user),
"role": asdict(role),
"description": (
f"The user '{user.name}'({user.email}) was assigned the "
- f"'{role.role.role_name}' role on resource with ID "
+ f"'{role.role_name}' role on resource with ID "
f"'{resource.resource_id}'.")}
-@authorised_p(
- ("group:user:assign-role",),
- "You cannot assign roles to users for this group.",
- oauth2_scope="profile group role resource")
+
def unassign_resource_user(
- conn: db.DbConnection, resource: Resource, user: User,
- role: GroupRole) -> dict:
+ conn: db.DbConnection,
+ resource: Resource,
+ user: User,
+ role: Role
+) -> dict:
"""Assign `role` to `user` for the specific `resource`."""
with db.cursor(conn) as cursor:
cursor.execute(
"DELETE FROM user_roles "
"WHERE user_id=? AND role_id=? AND resource_id=?",
- (str(user.user_id),
- str(role.role.role_id),
- str(resource.resource_id)))
+ (str(user.user_id), str(role.role_id), str(resource.resource_id)))
return {
"resource": asdict(resource),
"user": asdict(user),
"role": asdict(role),
"description": (
f"The user '{user.name}'({user.email}) had the "
- f"'{role.role.role_name}' role on resource with ID "
+ f"'{role.role_name}' role on resource with ID "
f"'{resource.resource_id}' taken away.")}
def save_resource(
diff --git a/gn_auth/auth/authorisation/resources/views.py b/gn_auth/auth/authorisation/resources/views.py
index cf9ebc4..2eda72b 100644
--- a/gn_auth/auth/authorisation/resources/views.py
+++ b/gn_auth/auth/authorisation/resources/views.py
@@ -247,22 +247,25 @@ def resource_users(resource_id: UUID):
@require_oauth("profile group resource role")
def assign_role_to_user(resource_id: UUID) -> Response:
"""Assign a role on the specified resource to a user."""
- with require_oauth.acquire("profile group resource role") as the_token:
+ with require_oauth.acquire("profile group resource role") as _token:
try:
form = request_json()
- group_role_id = form.get("group_role_id", "")
+ role_id = form.get("role_id", "")
user_email = form.get("user_email", "")
- assert bool(group_role_id), "The role must be provided."
+ assert bool(role_id), "The role must be provided."
assert bool(user_email), "The user email must be provided."
def __assign__(conn: db.DbConnection) -> dict:
- resource = resource_by_id(conn, the_token.user, resource_id)
+ authorised_for(
+ conn,
+ _token.user,
+ ("resource:role:assign-role",),
+ (resource_id,))
+ resource = resource_by_id(conn, _token.user, resource_id)
user = user_by_email(conn, user_email)
return assign_resource_user(
conn, resource, user,
- group_role_by_id(conn,
- resource_owner(conn, resource),
- UUID(group_role_id)))
+ role_by_id(conn, UUID(role_id)))
except AssertionError as aserr:
raise AuthorisationError(aserr.args[0]) from aserr
@@ -272,21 +275,24 @@ def assign_role_to_user(resource_id: UUID) -> Response:
@require_oauth("profile group resource role")
def unassign_role_to_user(resource_id: UUID) -> Response:
"""Unassign a role on the specified resource from a user."""
- with require_oauth.acquire("profile group resource role") as the_token:
+ with require_oauth.acquire("profile group resource role") as _token:
try:
form = request_json()
- group_role_id = form.get("group_role_id", "")
+ role_id = form.get("role_id", "")
user_id = form.get("user_id", "")
- assert bool(group_role_id), "The role must be provided."
+ assert bool(role_id), "The role must be provided."
assert bool(user_id), "The user id must be provided."
def __assign__(conn: db.DbConnection) -> dict:
- resource = resource_by_id(conn, the_token.user, resource_id)
+ authorised_for(
+ conn,
+ _token.user,
+ ("resource:role:assign-role",),
+ (resource_id,))
+ resource = resource_by_id(conn, _token.user, resource_id)
return unassign_resource_user(
conn, resource, user_by_id(conn, UUID(user_id)),
- group_role_by_id(conn,
- resource_owner(conn, resource),
- UUID(group_role_id)))
+ role_by_id(conn, UUID(role_id)))
except AssertionError as aserr:
raise AuthorisationError(aserr.args[0]) from aserr
diff --git a/tests/unit/auth/test_groups.py b/tests/unit/auth/test_groups.py
index f22a8cf..16df56e 100644
--- a/tests/unit/auth/test_groups.py
+++ b/tests/unit/auth/test_groups.py
@@ -6,10 +6,9 @@ from pymonad.maybe import Nothing
from gn_auth.auth.db import sqlite3 as db
from gn_auth.auth.errors import AuthorisationError
-from gn_auth.auth.authorisation.roles import Role
from gn_auth.auth.authorisation.privileges import Privilege
from gn_auth.auth.authorisation.resources.groups.models import (
- Group, GroupRole, user_group, create_group, create_group_role)
+ Group, user_group, create_group, create_group_role)
from tests.unit.auth import conftest
@@ -126,40 +125,6 @@ create_role_failure = {
"message": "Unauthorised: Could not create the group role"
}
-@pytest.mark.skip("Keep as placeholder until we implement test for creating "
- "a resource role.")
-@pytest.mark.unit_test
-@pytest.mark.parametrize(
- "user,expected", tuple(zip(conftest.TEST_USERS[0:1], (
- GroupRole(
- UUID("d32611e3-07fc-4564-b56c-786c6db6de2b"),
- GROUP,
- Role(UUID("d32611e3-07fc-4564-b56c-786c6db6de2b"),
- "ResourceEditor", True, PRIVILEGES)),))))
-def test_create_group_role(mocker, fxtr_users_in_group, fxtr_oauth2_clients, user, expected):
- """
- GIVEN: an authenticated user
- WHEN: the user attempts to create a role, attached to a group
- THEN: verify they are only able to create the role if they have the
- appropriate privileges and that the role is attached to the given group
- """
- _conn, clients = fxtr_oauth2_clients
- mocker.patch("gn_auth.auth.authorisation.resources.groups.models.uuid4", conftest.uuid_fn)
- mocker.patch("gn_auth.auth.authorisation.roles.models.uuid4", conftest.uuid_fn)
- mocker.patch(
- "gn_auth.auth.authorisation.checks.require_oauth.acquire",
- conftest.get_tokeniser(
- user,
- tuple(client for client in clients if client.user == user)[0]))
- conn, _group, _users = fxtr_users_in_group
- with db.cursor(conn) as cursor:
- assert create_group_role(
- conn, GROUP, "ResourceEditor", PRIVILEGES) == expected
- # cleanup
- cursor.execute(
- ("DELETE FROM group_roles "
- "WHERE group_role_id=? AND group_id=? AND role_id=?"),
- (str(conftest.uuid_fn()), str(GROUP.group_id), str(conftest.uuid_fn())))
@pytest.mark.unit_test
@pytest.mark.parametrize(
diff --git a/tests/unit/auth/test_resources_roles.py b/tests/unit/auth/test_resources_roles.py
new file mode 100644
index 0000000..39a198f
--- /dev/null
+++ b/tests/unit/auth/test_resources_roles.py
@@ -0,0 +1,90 @@
+"""Tests for roles for a specific resource."""
+from uuid import UUID
+
+import pytest
+
+from gn_auth.auth.db import sqlite3 as db
+from gn_auth.auth.authorisation.privileges import Privilege
+from gn_auth.auth.authorisation.roles.models import Role, create_role
+from gn_auth.auth.authorisation.resources.groups.models import (
+ GroupRole,
+ create_group_role)
+
+from tests.unit.auth import conftest
+
+
+GROUP = conftest.TEST_GROUP_01
+PRIVILEGES = (
+ Privilege("group:resource:view-resource",
+ "view a resource and use it in computations"),
+ Privilege("group:resource:edit-resource", "edit/update a resource"))
+
+
+@pytest.mark.skip("Keep as placeholder until we implement test for creating "
+ "a resource role.")
+@pytest.mark.unit_test
+@pytest.mark.parametrize(
+ "user,expected", tuple(zip(conftest.TEST_USERS[0:1], (
+ GroupRole(
+ UUID("d32611e3-07fc-4564-b56c-786c6db6de2b"),
+ GROUP,
+ Role(UUID("d32611e3-07fc-4564-b56c-786c6db6de2b"),
+ "ResourceEditor", True, PRIVILEGES)),))))
+def test_create_group_role(mocker, fxtr_users_in_group, fxtr_oauth2_clients, user, expected):
+ """
+ GIVEN: an authenticated user
+ WHEN: the user attempts to create a role, attached to a group
+ THEN: verify they are only able to create the role if they have the
+ appropriate privileges and that the role is attached to the given group
+ """
+ _conn, clients = fxtr_oauth2_clients
+ mocker.patch("gn_auth.auth.authorisation.resources.groups.models.uuid4", conftest.uuid_fn)
+ mocker.patch("gn_auth.auth.authorisation.roles.models.uuid4", conftest.uuid_fn)
+ mocker.patch(
+ "gn_auth.auth.authorisation.checks.require_oauth.acquire",
+ conftest.get_tokeniser(
+ user,
+ tuple(client for client in clients if client.user == user)[0]))
+ conn, _group, _users = fxtr_users_in_group
+ with db.cursor(conn) as cursor:
+ assert create_group_role(
+ conn, GROUP, "ResourceEditor", PRIVILEGES) == expected
+ # cleanup
+ cursor.execute(
+ ("DELETE FROM group_roles "
+ "WHERE group_role_id=? AND group_id=? AND role_id=?"),
+ (str(conftest.uuid_fn()), str(GROUP.group_id), str(conftest.uuid_fn())))
+
+
+@pytest.mark.skip(
+ "This needs to be replaced by tests for creation of resource roles.")
+@pytest.mark.unit_test
+@pytest.mark.parametrize(
+ "user,expected", tuple(zip(conftest.TEST_USERS[0:1], (
+ Role(UUID("d32611e3-07fc-4564-b56c-786c6db6de2b"), "a_test_role",
+ True, PRIVILEGES),))))
+def test_create_role(# pylint: disable=[too-many-arguments, unused-argument]
+ fxtr_app,
+ auth_testdb_path,
+ mocker,
+ fxtr_users,
+ fxtr_oauth2_clients,
+ user,
+ expected
+):
+ """
+ GIVEN: an authenticated user
+ WHEN: the user attempts to create a role
+ THEN: verify they are only able to create the role if they have the
+ appropriate privileges
+ """
+ _conn, clients = fxtr_oauth2_clients
+ mocker.patch("gn_auth.auth.authorisation.roles.models.uuid4", conftest.uuid_fn)
+ mocker.patch(
+ "gn_auth.auth.authorisation.checks.require_oauth.acquire",
+ conftest.get_tokeniser(
+ user,
+ tuple(client for client in clients if client.user == user)[0]))
+ with db.connection(auth_testdb_path) as conn, db.cursor(conn) as cursor:
+ the_role = create_role(cursor, "a_test_role", PRIVILEGES)
+ assert the_role == expected
diff --git a/tests/unit/auth/test_roles.py b/tests/unit/auth/test_roles.py
index b9d1183..251defb 100644
--- a/tests/unit/auth/test_roles.py
+++ b/tests/unit/auth/test_roles.py
@@ -22,40 +22,6 @@ PRIVILEGES = (
Privilege("group:resource:edit-resource", "edit/update a resource"))
-@pytest.mark.skip(
- "This needs to be replaced by tests for creation of resource roles.")
-@pytest.mark.unit_test
-@pytest.mark.parametrize(
- "user,expected", tuple(zip(conftest.TEST_USERS[0:1], (
- Role(UUID("d32611e3-07fc-4564-b56c-786c6db6de2b"), "a_test_role",
- True, PRIVILEGES),))))
-def test_create_role(# pylint: disable=[too-many-arguments, unused-argument]
- fxtr_app,
- auth_testdb_path,
- mocker,
- fxtr_users,
- fxtr_oauth2_clients,
- user,
- expected
-):
- """
- GIVEN: an authenticated user
- WHEN: the user attempts to create a role
- THEN: verify they are only able to create the role if they have the
- appropriate privileges
- """
- _conn, clients = fxtr_oauth2_clients
- mocker.patch("gn_auth.auth.authorisation.roles.models.uuid4", conftest.uuid_fn)
- mocker.patch(
- "gn_auth.auth.authorisation.checks.require_oauth.acquire",
- conftest.get_tokeniser(
- user,
- tuple(client for client in clients if client.user == user)[0]))
- with db.connection(auth_testdb_path) as conn, db.cursor(conn) as cursor:
- the_role = create_role(cursor, "a_test_role", PRIVILEGES)
- assert the_role == expected
-
-
@pytest.mark.unit_test
@pytest.mark.parametrize(
"user,expected", tuple(zip(conftest.TEST_USERS[1:], (
generated by cgit v1.2.3 (git 2.25.4) at 2024-06-30 21:30:26 +0000