| Age | Commit message (Collapse) | Author |
|---|
|
The /auth/system/roles endpoint has no active blueprint registration —
the system Blueprint is only reachable via /auth/resource/system/roles.
The `if "/resource/" not in request.path` branch could never fire, so
remove it along with _SUCCESSOR, and the warnings import.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
These bugs were introduced by Claude, and I missed them during review.
|
|
The HACK block in resource_users() was checking the system:user:list
privilege against the requested resource_id rather than the system
resource. This made the sysadmin branch a dead leg: sysadmins hold
system:user:list on the system resource, not on individual data resources.
Fix: pass system_resource(conn).resource_id for the system-level check.
Also restructure to early-return on auth failure (cleaner control flow).
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
All callers have been migrated to authorised_for_spec (previous commit).
Remove the two deprecated functions and their now-orphaned helpers:
- authorised_for() and authorised_for2() deleted
- __organise_privileges_by_resource_id__() deleted (only used by authorised_for)
- Orphaned imports removed: reduce, Sequence, Resource, User,
db_row_to_privilege
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
Replace all uses of the deprecated authorised_for() and authorised_for2()
helpers with authorised_for_spec() across resources/views.py and
data/phenotypes.py.
- resources/views.py (resource_users HACK block): two authorised_for()
calls replaced; the intermediate dict merge collapsed into a plain
boolean since authorised_for_spec returns bool directly.
- resources/views.py (assign_role_to_user, unassign_role_to_user):
authorised_for() was called but its return value was discarded, making
the check a silent no-op. Now replaced with authorised_for_spec() and
a proper if/raise guard. Also fixes a typo: the privilege string was
"resource:role:assign-role" (non-existent); corrected to the real
privilege "resource:user:assign-role".
- resources/views.py (unassign_resource_role_privilege): direct
replacement; intermediate _authorised variable removed.
- data/phenotypes.py (link_phenotype_data): two authorised_for2() calls
replaced; .resource_id extracted from the Resource objects to satisfy
authorised_for_spec's UUID argument. User type annotation added.
Reivewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
All consumers have been updated to use /auth/resource/system/roles.
Remove the legacy oauth2.register_blueprint(system, url_prefix="/system")
registration and its accompanying import from views.py.
The /auth/resource/system/roles path remains live via the existing
resources.register_blueprint(system, ...) in resources/views.py.
|
|
|
|
Use gn-libs' can_create_or_delete_user() + user_roles_on_system() for the
privilege check in delete_users(), matching the pattern already used by
create_user().
Removes the authorised_for2, system_resource, and AuthorisationError
imports that are no longer needed.
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
Move POST /auth/user/delete to POST /auth/system/administration/users/delete,
consistent with the create endpoint already living there.
gn_auth/auth/system/admin/users.py:
- Add imports for sqlite3, reduce, Sequence, AuthorisationError,
authorised_for2, and system_resource.
- Move __delete_users_individually__, __fetch_non_deletable_users__,
__non_deletable_with_reason__, and delete_users() from users/views.py.
gn_auth/auth/authorisation/users/views.py:
- Remove the four functions moved to admin/users.py.
The sole known caller (GN2 wqflask/oauth2/users.py) is updated in the
accompanying genenetwork2 patch.
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
GET /auth/system/roles is superseded by GET /auth/resource/system/roles,
which has been live since the system Blueprint was registered under the
resources Blueprint. Add Deprecation: true and a Link successor-version
header when the endpoint is reached via the old path, so callers can
discover the new URL.
The old registration in auth/views.py already carries a TODO noting it
should be removed once consumers are updated. Callers to migrate:
- GN2: wqflask/views.py, metadata_edits.py (×3), flask_extensions.py,
oauth2/ui.py, oauth2/request_utils.py, oauth2/resources.py (×2)
- GN3: gn3/api/metadata.py, gn3/api/case_attributes.py
- gn-integration-tests: tests/test_gn_auth_smoke.py
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
|
|
Move the user-creation endpoint from gn_auth/auth/authorisation/users/views.py
into the new sysadmin package at gn_auth/auth/system/admin/users.py.
New URL: POST /auth/system/administration/users/create
Old URL: POST /auth/user/create now issues a 308 Permanent Redirect.
The admin blueprint is updated to register the new users blueprint at /users.
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
The system-administrator role carries system:resource:assign-owner
(migration 20250729_02), but no endpoint used it. Sysadmins had no API
path to bootstrap ownership on a resource that has no owner yet.
Implement two endpoints in gn_auth/auth/system/admin/resources.py
(the blueprint skeleton was already wired in a preceding commit):
POST /auth/system/administration/resources/<resource_id>/assign-owner
Body: {"user_id": "<uuid>"}
Assigns the resource-owner role to the named user on the resource.
POST /auth/system/administration/resources/<resource_id>/revoke-owner
Body: {"user_id": "<uuid>"}
Revokes the resource-owner role from the named user on the resource.
Both check system:resource:assign-owner on the *system* resource, so a
sysadmin can grant/revoke ownership without being resource-owner
themselves.
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
|
|
JWTBearerToken.__init__ was calling with_db_connection with
app.config["SQL_URI"] (the GeneNetwork MariaDB URI) to look up the
authenticated user and OAuth2 client. gn_libs.sqlite3.with_db_connection
expects a SQLite file path, so passing a MySQL URI causes an
OperationalError: unable to open database file every time a JWT is
validated through require_oauth.acquire().
Use app.config["AUTH_DB"] (the gn-auth SQLite database) for both
lookups. Also normalise the whitespace in the user lookup lambda while
here.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
The gn_auth.auth.db.sqlite3 module is deprecated and should be
removed. This cleanup goes a ways towards that goal.
|
|
Prefer the endpoint `/auth/users/<uuid:user_id/roles/revoke` that
conforms to the Subject-Verb-Object paradigm, i.e. Revoke from a
user (subject), the specified role acting on the specified
resource (object) -- revoke a role would be the 'Verb'.
|
|
Adds unassign_user_role_by_name to roles/models.py — mirrors
assign_user_role_by_name but issues a resource-scoped DELETE,
resolving the TODO on the older revoke_user_role_by_name which
lacked the resource_id filter.
The new revoke_user_role endpoint checks resource:user:assign-role
(same privilege as assign) via can_assign_role, then calls
unassign_user_role_by_name.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
|
|
Checks resource:user:assign-role via can_assign_role (gn_libs.privileges.resources)
on the caller's roles for the request's resource_id — caller must hold
resource-owner (or masquerade as one) on that resource.
Updates test setup to grant resource-owner on SYSTEM_RESOURCE instead of
system-administrator, matching the actual privilege model.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
|
|
Parses email/name/password from the JSON body, calls create_verified_user,
and returns 201 with the new user's user_id, email, and name.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
Added input validation.
|
|
Adds @require_oauth("profile") for 401 on unauthenticated requests and
an authorised_for2 check for the system:user:create-user privilege,
raising ForbiddenAccess (403) for non-admin callers.
Returns 501 for the success path until the body logic is implemented.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
Two TDD tests that define the expected auth behaviour of the new
create-user endpoint before it is implemented:
- No Authorization header → 401
- Valid token for a non-admin user → 403
Both tests fail (404) until the endpoint exists.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
Add's aso a dummy endpoint.
|
|
Replaces the dummy stub with a real implementation that:
- calls save_user(cursor, email, name, verified=True) to create the user
with the verified flag set, bypassing the email verification flow
- calls set_user_password to store the hashed credential in user_credentials
- returns the newly created User with no roles assigned
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
Two unit tests for the (not yet implemented) create_verified_user function
in gn_auth.auth.authorisation.users.admin.models:
* test_create_verified_user_sets_verified_flag — asserts user.verified is
True and the flag is persisted in the DB
* test_create_verified_user_has_no_roles — asserts no roles are assigned
to the newly created user
Both tests use conn_after_auth_migrations to run against a fully migrated
SQLite test database.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
|
|
|
|
|
|
dataset list in query
Previously the full list of datasets (currently over 900) was included in the query. This commit instead handles the exclusion at the Python level, dramatically speeding up the query
|
|
The "system-administrator" role acts at the system level and should
not be granted against a non-system resource. This function is
therefore a bug in its entirety and thus needed to go.
|
|
|
|
|
|
While we do not actually use the password-flow for authentication on
the system, it is useful for getting tokens when running (integration)
tests against the system. This commit allows the test harness to make
use of the simpler password-flow authentication to get tokens.
|
|
|
|
ever allowing them
This commit allows the auth system to handle Temp traits (by just treating them as public traits)
|
|
|
|
Add a low-level delete_users_by_id function that removes users and all
their dependent data unconditionally, bypassing the policy checks in the
'/auth/users/delete' HTTP endpoint (which refuses to delete privileged
users).
This is intended for use by CLI test-teardown commands and the
sudo-wrapped CI cleanup script. It might also find utility in other
places where we do actually need to delete a user and their data
unconditionally.
Co-authored-by: Frederick Muriuki Muriithi <fredmanglis@gmail.com>
|
|
|
|
In preparation for migrating to pyproject.toml (from setup.py and
friends) we need to have only one top-level package. This will also
help in improving testing and checks down the line, since everything
will be relative to one single top-level directory.
|
|
The `gn_auth.auth.authorisation.resources.checks.can_[edit/delete]`
functions duplicate the utility provided by similar named functions in
the `gn_libs.privileges.resources` package. These ones are, thus,
deprecated in favour of the gn-libs ones.
|
|
The `gn_auth.auth.authorisation.resources.checks.can_view` function is
no longer used in this code base. It can be safely removed.
|
|
|
|
|
|
To avoid failures later due to missing keys, we initialise the initial
value used in reduce to a dict with empty tuples for every key.
|
|
Fetch resources using the dataset names (and trait names where
relevant) to simplify the code, and make it clearer what the endpoint
actually does.
|
|
|
|
|
|
|
|
|
|
Replace the functions and classes in `gn_auth.auth.db.sqlite3` with
those in `gn_libs.sqlite3` to reduce duplications.
Deprecate the `gn_auth.auth.db.sqlite3` module and the remaining
function(s) within in preparation for removal.
|
