diff options
Diffstat (limited to 'gn_auth/auth/authorisation/resources/views.py')
| -rw-r--r-- | gn_auth/auth/authorisation/resources/views.py | 60 |
1 files changed, 29 insertions, 31 deletions
diff --git a/gn_auth/auth/authorisation/resources/views.py b/gn_auth/auth/authorisation/resources/views.py index fc9d90e..06645db 100644 --- a/gn_auth/auth/authorisation/resources/views.py +++ b/gn_auth/auth/authorisation/resources/views.py @@ -53,7 +53,7 @@ from .phenotypes.views import phenobp from .errors import MissingGroupError from .system.models import system_resource from .groups.models import Group, user_group -from .checks import can_delete, authorised_for +from .checks import can_delete, authorised_for_spec from .models import ( Resource, resource_data, resource_by_id, public_resources, resource_categories, assign_resource_user, link_data_to_resource, @@ -260,23 +260,18 @@ def resource_users(resource_id: UUID): # It resolves (albeit, temporarily) the bug introduced after a # refactor that made the system itself, and the groups into # resources. - grouplevelauth = authorised_for( + grouplevelauth = authorised_for_spec( conn, - the_token.user, - ("group:resource:view-resource",), - (resource_id,)) - systemlevelauth = authorised_for( + the_token.user.user_id, + resource_id, + "group:resource:view-resource") + systemlevelauth = authorised_for_spec( conn, - the_token.user, - ("system:user:list",), - (resource_id,)) - authorised = { - key: (grouplevelauth.get(key, False) - or systemlevelauth.get(key, False)) - for key in grouplevelauth.keys() | systemlevelauth.keys() - } + the_token.user.user_id, + resource_id, + "system:user:list") ########## END: HACK ########## - if authorised.get(resource_id, False): + if grouplevelauth or systemlevelauth: with db.cursor(conn) as cursor: def __organise_users_n_roles__(users_n_roles, row): user_id = UUID(row["user_id"]) @@ -340,11 +335,13 @@ def assign_role_to_user(resource_id: UUID) -> Response: assert bool(user_email), "The user email must be provided." def __assign__(conn: db.DbConnection) -> dict: - authorised_for( - conn, - _token.user, - ("resource:role:assign-role",), - (resource_id,)) + if not authorised_for_spec( + conn, + _token.user.user_id, + resource_id, + "resource:user:assign-role"): + raise AuthorisationError( + "You are not authorised to assign roles on this resource.") resource = resource_by_id(conn, _token.user, resource_id) user = user_by_email(conn, user_email) return assign_resource_user( @@ -381,11 +378,13 @@ def unassign_role_to_user(resource_id: UUID) -> Response: assert bool(user_id), "The user id must be provided." def __assign__(conn: db.DbConnection) -> dict: - authorised_for( - conn, - _token.user, - ("resource:role:assign-role",), - (resource_id,)) + if not authorised_for_spec( + conn, + _token.user.user_id, + resource_id, + "resource:user:assign-role"): + raise AuthorisationError( + "You are not authorised to assign roles on this resource.") resource = resource_by_id(conn, _token.user, resource_id) return unassign_resource_user( conn, resource, user_by_id(conn, UUID(user_id)), @@ -666,12 +665,11 @@ def unassign_resource_role_privilege(resource_id: UUID, role_id: UUID): db.cursor(conn) as cursor): _role = role_by_id(conn, role_id) - _authorised = authorised_for( - conn, - _token.user, - privileges=("resource:role:edit-role",), - resource_ids=(resource_id,)).get(resource_id) - if not _authorised: + if not authorised_for_spec( + conn, + _token.user.user_id, + resource_id, + "resource:role:edit-role"): raise AuthorisationError( "You are not authorised to edit/update this role.") |