diff options
Diffstat (limited to 'gn_auth/auth/system')
| -rw-r--r-- | gn_auth/auth/system/admin/users.py | 16 |
1 files changed, 6 insertions, 10 deletions
diff --git a/gn_auth/auth/system/admin/users.py b/gn_auth/auth/system/admin/users.py index 63648d8..7dfc7ca 100644 --- a/gn_auth/auth/system/admin/users.py +++ b/gn_auth/auth/system/admin/users.py @@ -15,14 +15,10 @@ from gn_auth.auth.errors import ( PasswordError, UsernameError, ForbiddenAccess, - AuthorisationError, UserRegistrationError) from gn_auth.auth.requests import request_json from gn_auth.auth.authentication.oauth2.resource_server import require_oauth -from gn_auth.auth.authorisation.resources.checks import authorised_for2 -from gn_auth.auth.authorisation.resources.system.models import ( - system_resource, - user_roles_on_system) +from gn_auth.auth.authorisation.resources.system.models import user_roles_on_system from gn_auth.auth.authorisation.users.admin.models import create_verified_user from gn_auth.auth.authorisation.users.views import ( validate_password, @@ -131,11 +127,11 @@ def delete_users() -> Response: with (require_oauth.acquire("profile user role") as _token, db.connection(app.config["AUTH_DB"]) as conn, db.cursor(conn) as cursor): - if not authorised_for2(conn, - _token.user, - system_resource(conn), - ("system:user:delete-user",)): - raise AuthorisationError( + u_roles = user_roles_on_system(conn, _token.user) + if not can_create_or_delete_user(tuple( + priv.privilege_id for role in u_roles + for priv in role.privileges)): + raise ForbiddenAccess( "You need the `system:user:delete-user` privilege to delete " "users from the system.") |