|
The system-administrator role carries system:resource:assign-owner
(migration 20250729_02), but no endpoint used it. Sysadmins had no API
path to bootstrap ownership on a resource that has no owner yet.
Implement two endpoints in gn_auth/auth/system/admin/resources.py
(the blueprint skeleton was already wired in a preceding commit):
POST /auth/system/administration/resources/<resource_id>/assign-owner
Body: {"user_id": "<uuid>"}
Assigns the resource-owner role to the named user on the resource.
POST /auth/system/administration/resources/<resource_id>/revoke-owner
Body: {"user_id": "<uuid>"}
Revokes the resource-owner role from the named user on the resource.
Both check system:resource:assign-owner on the *system* resource, so a
sysadmin can grant/revoke ownership without being resource-owner
themselves.
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
