2 files changed, 27 insertions, 41 deletions
diff --git a/gn_auth/auth/authorisation/resources/checks.py b/gn_auth/auth/authorisation/resources/checks.py
index 004c780..252df2f 100644
--- a/gn_auth/auth/authorisation/resources/checks.py
+++ b/gn_auth/auth/authorisation/resources/checks.py
@@ -135,6 +135,11 @@ def can_delete(
         resource_id: uuid.UUID
 ) -> bool:
     """Check whether user is allowed delete a resource and/or its data."""
+    warnings.warn(
+        (f"Function '{__name__}.can_delete' is deprecated. "
+         "Use `gn_libs.privileges.resources.can_delete` instead."),
+        category=DeprecationWarning,
+        stacklevel=2)
     return (
         authorised_for_spec(# resource-level delete access
             conn,
@@ -149,42 +154,17 @@ def can_delete(
             "(AND system:system-wide:data:delete)"))
 
 
-def can_view(
-        conn: authdb.DbConnection,
-        user_id: uuid.UUID,
-        resource_id: uuid.UUID
-) -> bool:
-    """Check whether user is allowed view a resource and/or its data."""
-    with authdb.cursor(conn) as cursor:
-        cursor.execute("SELECT public FROM resources WHERE resource_id=?",
-                       (str(resource_id),))
-        row = cursor.fetchone()
-        is_public = bool(row) and bool(int(row["public"]))
-
-    return (
-        is_public# The resource is public, everyone can view!
-        or
-        authorised_for_spec(
-            # resource-level view access: user has view access to his resource.
-            conn,
-            user_id,
-            resource_id,
-            "(OR group:resource:view-resource system:resource:view)")
-        or
-        authorised_for_spec(
-            # system-wide view access: user can view any/all resource(s).
-            conn,
-            user_id,
-            system_resource(conn).resource_id,
-            "(OR system:system-wide:data:view system:resource:view)"))
-
-
 def can_edit(
         conn: authdb.DbConnection,
         user_id: uuid.UUID,
         resource_id: uuid.UUID
 ) -> bool:
     """Check whether user is allowed edit a resource and/or its data."""
+    warnings.warn(
+        (f"Function '{__name__}.can_edit' is deprecated. "
+         "Use `gn_libs.privileges.resources.can_edit` instead."),
+        category=DeprecationWarning,
+        stacklevel=2)
     return (
         authorised_for_spec(
             # resource-level edit access: user has edit access to his resource.
diff --git a/gn_auth/auth/authorisation/resources/views.py b/gn_auth/auth/authorisation/resources/views.py
index f7f2ee3..f114476 100644
--- a/gn_auth/auth/authorisation/resources/views.py
+++ b/gn_auth/auth/authorisation/resources/views.py
@@ -127,17 +127,23 @@ def edit_resource(resource_id: UUID) -> Response:
     db_uri = app.config["AUTH_DB"]
     with (require_oauth.acquire("profile group resource") as _token,
           db.connection(db_uri) as conn):
-        _privileges = tuple(
-            privilege.privilege_id
-            for role in (
-                    role for resource in user_roles_on_resources(
-                        conn,
-                        _token.user,
-                        (resource_id, system_resource(conn).resource_id)
-                    ).values()
-                    for role in resource.get("roles", tuple()))
-            for privilege in role.privileges)
-        if not gn_libs.privileges.resources.can_edit(_privileges):
+        def __extract_privileges__(roles: tuple[Role, ...]) -> tuple[str, ...]:
+            return tuple(
+                priv.privilege_id for role in roles
+                for priv in role.privileges)
+
+        _sys_resource = system_resource(conn)
+        _privileges = {
+            ("system_privileges"
+             if _rid == _sys_resource.resource_id
+             else "resource_privileges"): __extract_privileges__(_rroles)
+            for _rid, _rroles in user_roles_on_resources(
+                conn,
+                _token.user,
+                (resource_id, _sys_resource.resource_id)
+            ).items()
+        }
+        if not gn_libs.privileges.resources.can_edit(**_privileges):
             return make_response(jsonify({
                 "error": "AuthorisationError",
                 "error_description": "You are not allowed to edit this resource."