| Age | Commit message (Collapse) | Author |
|---|
|
The /auth/system/roles endpoint has no active blueprint registration —
the system Blueprint is only reachable via /auth/resource/system/roles.
The `if "/resource/" not in request.path` branch could never fire, so
remove it along with _SUCCESSOR, and the warnings import.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
These bugs were introduced by Claude, and I missed them during review.
|
|
The HACK block in resource_users() was checking the system:user:list
privilege against the requested resource_id rather than the system
resource. This made the sysadmin branch a dead leg: sysadmins hold
system:user:list on the system resource, not on individual data resources.
Fix: pass system_resource(conn).resource_id for the system-level check.
Also restructure to early-return on auth failure (cleaner control flow).
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
All callers have been migrated to authorised_for_spec (previous commit).
Remove the two deprecated functions and their now-orphaned helpers:
- authorised_for() and authorised_for2() deleted
- __organise_privileges_by_resource_id__() deleted (only used by authorised_for)
- Orphaned imports removed: reduce, Sequence, Resource, User,
db_row_to_privilege
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
Replace all uses of the deprecated authorised_for() and authorised_for2()
helpers with authorised_for_spec() across resources/views.py and
data/phenotypes.py.
- resources/views.py (resource_users HACK block): two authorised_for()
calls replaced; the intermediate dict merge collapsed into a plain
boolean since authorised_for_spec returns bool directly.
- resources/views.py (assign_role_to_user, unassign_role_to_user):
authorised_for() was called but its return value was discarded, making
the check a silent no-op. Now replaced with authorised_for_spec() and
a proper if/raise guard. Also fixes a typo: the privilege string was
"resource:role:assign-role" (non-existent); corrected to the real
privilege "resource:user:assign-role".
- resources/views.py (unassign_resource_role_privilege): direct
replacement; intermediate _authorised variable removed.
- data/phenotypes.py (link_phenotype_data): two authorised_for2() calls
replaced; .resource_id extracted from the Resource objects to satisfy
authorised_for_spec's UUID argument. User type annotation added.
Reivewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
|
|
GET /auth/system/roles is superseded by GET /auth/resource/system/roles,
which has been live since the system Blueprint was registered under the
resources Blueprint. Add Deprecation: true and a Link successor-version
header when the endpoint is reached via the old path, so callers can
discover the new URL.
The old registration in auth/views.py already carries a TODO noting it
should be removed once consumers are updated. Callers to migrate:
- GN2: wqflask/views.py, metadata_edits.py (×3), flask_extensions.py,
oauth2/ui.py, oauth2/request_utils.py, oauth2/resources.py (×2)
- GN3: gn3/api/metadata.py, gn3/api/case_attributes.py
- gn-integration-tests: tests/test_gn_auth_smoke.py
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
|
|
The gn_auth.auth.db.sqlite3 module is deprecated and should be
removed. This cleanup goes a ways towards that goal.
|
|
Prefer the endpoint `/auth/users/<uuid:user_id/roles/revoke` that
conforms to the Subject-Verb-Object paradigm, i.e. Revoke from a
user (subject), the specified role acting on the specified
resource (object) -- revoke a role would be the 'Verb'.
|
|
|
|
|
|
The "system-administrator" role acts at the system level and should
not be granted against a non-system resource. This function is
therefore a bug in its entirety and thus needed to go.
|
|
The `gn_auth.auth.authorisation.resources.checks.can_[edit/delete]`
functions duplicate the utility provided by similar named functions in
the `gn_libs.privileges.resources` package. These ones are, thus,
deprecated in favour of the gn-libs ones.
|
|
The `gn_auth.auth.authorisation.resources.checks.can_view` function is
no longer used in this code base. It can be safely removed.
|
|
|
|
|
|
|
|
|
|
|
|
The default system-level privilege is the "public-view", i.e. the
users can view basic details about the Genenetwork system. If no
authorisation is provided when accessing the /auth/system/roles
endpoint, return the default role/privilege.
|
|
|
|
|
|
|
|
|
|
Return a count of the total number of resources that the user has
access to even if we are only interested in a few of the records.
|
|
|
|
|
|
Add the creator of the resource and the time the resource was created.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Fix the check: rather than using a hard-coded email to check for
authorisation, we instead check against the privileges the user has on
the resource, or whether they have global privileges allowing them to
act on any data.
|
|
Refactor to allow the
`gn_auth.auth.authorisation.resources.system.models.system_resource`
function to take either a database connection or cursor and use that
to retrieve the "system resource".
|
|
Refactor to allow the
`gn_auth.auth.authorisation.resources.models.create_resource` function
to take either a database connection or cursor to perform its tasks.
|
|
|
|
|
|
|
|
|
|
|
|
In case any sysadmin user has access to the resource, we do not want
the query failing for other sysadmins.
|
|
|
|
|
|
|
|
|
|
|
|
|
