| Age | Commit message (Collapse) | Author |
|---|
|
Move POST /auth/user/delete to POST /auth/system/administration/users/delete,
consistent with the create endpoint already living there.
gn_auth/auth/system/admin/users.py:
- Add imports for sqlite3, reduce, Sequence, AuthorisationError,
authorised_for2, and system_resource.
- Move __delete_users_individually__, __fetch_non_deletable_users__,
__non_deletable_with_reason__, and delete_users() from users/views.py.
gn_auth/auth/authorisation/users/views.py:
- Remove the four functions moved to admin/users.py.
The sole known caller (GN2 wqflask/oauth2/users.py) is updated in the
accompanying genenetwork2 patch.
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
Move the user-creation endpoint from gn_auth/auth/authorisation/users/views.py
into the new sysadmin package at gn_auth/auth/system/admin/users.py.
New URL: POST /auth/system/administration/users/create
Old URL: POST /auth/user/create now issues a 308 Permanent Redirect.
The admin blueprint is updated to register the new users blueprint at /users.
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
The gn_auth.auth.db.sqlite3 module is deprecated and should be
removed. This cleanup goes a ways towards that goal.
|
|
Adds unassign_user_role_by_name to roles/models.py — mirrors
assign_user_role_by_name but issues a resource-scoped DELETE,
resolving the TODO on the older revoke_user_role_by_name which
lacked the resource_id filter.
The new revoke_user_role endpoint checks resource:user:assign-role
(same privilege as assign) via can_assign_role, then calls
unassign_user_role_by_name.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
Checks resource:user:assign-role via can_assign_role (gn_libs.privileges.resources)
on the caller's roles for the request's resource_id — caller must hold
resource-owner (or masquerade as one) on that resource.
Updates test setup to grant resource-owner on SYSTEM_RESOURCE instead of
system-administrator, matching the actual privilege model.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
Parses email/name/password from the JSON body, calls create_verified_user,
and returns 201 with the new user's user_id, email, and name.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
Added input validation.
|
|
Adds @require_oauth("profile") for 401 on unauthenticated requests and
an authorised_for2 check for the system:user:create-user privilege,
raising ForbiddenAccess (403) for non-admin callers.
Returns 501 for the success path until the body logic is implemented.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
Two TDD tests that define the expected auth behaviour of the new
create-user endpoint before it is implemented:
- No Authorization header → 401
- Valid token for a non-admin user → 403
Both tests fail (404) until the endpoint exists.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
Add's aso a dummy endpoint.
|
|
Replaces the dummy stub with a real implementation that:
- calls save_user(cursor, email, name, verified=True) to create the user
with the verified flag set, bypassing the email verification flow
- calls set_user_password to store the hashed credential in user_credentials
- returns the newly created User with no roles assigned
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
Two unit tests for the (not yet implemented) create_verified_user function
in gn_auth.auth.authorisation.users.admin.models:
* test_create_verified_user_sets_verified_flag — asserts user.verified is
True and the flag is persisted in the DB
* test_create_verified_user_has_no_roles — asserts no roles are assigned
to the newly created user
Both tests use conn_after_auth_migrations to run against a fully migrated
SQLite test database.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
|
|
Add a low-level delete_users_by_id function that removes users and all
their dependent data unconditionally, bypassing the policy checks in the
'/auth/users/delete' HTTP endpoint (which refuses to delete privileged
users).
This is intended for use by CLI test-teardown commands and the
sudo-wrapped CI cleanup script. It might also find utility in other
places where we do actually need to delete a user and their data
unconditionally.
Co-authored-by: Frederick Muriuki Muriithi <fredmanglis@gmail.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
During promotion of a user to system admin, grant the user
`system-administrator` role on all resources in the system.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Add a note for considerations to make regarding recovery from error
trying to delete users, so we can respond with more informative
messages.
Here, "improvement" is in quotes, because the priority leans more
towards collecting more information for better feedback, which might
be at the expense of speed of code.
|
|
|
|
|
|
|
|
|
|
Have the email and name checked with "OR" where both are present.
|
|
|
|
|
|
|
|
|
|
|
|
Signed-off-by: Munyoki Kilyungi <me@bonfacemunyoki.com>
|
|
Signed-off-by: Munyoki Kilyungi <me@bonfacemunyoki.com>
|
|
|
|
|
|
To ease setting up of value without changing code, move the value out
into a configuration variable.
|
|
|
|
|
|
Update the code to actually use JWT bearer tokens that the older plain
authorisation tokens that were previously used.
|
|
Use the OAUTH2_SCOPES_SUPPORTED application configuration variable,
that is used by the flask integration for the Authlib library to set
up the supported scopes.
|
