From f39ff35feee1a9f39149241c053ce2d003d3bfee Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 1 Sep 2026 15:12:40 +0000 Subject: refactor(auth): migrate authorised_for/2 -> authorised_for_spec Replace all uses of the deprecated authorised_for() and authorised_for2() helpers with authorised_for_spec() across resources/views.py and data/phenotypes.py. - resources/views.py (resource_users HACK block): two authorised_for() calls replaced; the intermediate dict merge collapsed into a plain boolean since authorised_for_spec returns bool directly. - resources/views.py (assign_role_to_user, unassign_role_to_user): authorised_for() was called but its return value was discarded, making the check a silent no-op. Now replaced with authorised_for_spec() and a proper if/raise guard. Also fixes a typo: the privilege string was "resource:role:assign-role" (non-existent); corrected to the real privilege "resource:user:assign-role". - resources/views.py (unassign_resource_role_privilege): direct replacement; intermediate _authorised variable removed. - data/phenotypes.py (link_phenotype_data): two authorised_for2() calls replaced; .resource_id extracted from the Resource objects to satisfy authorised_for_spec's UUID argument. User type annotation added. Reivewed-By: Frederick M. Muriithi --- gn_auth/auth/authorisation/data/phenotypes.py | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) (limited to 'gn_auth/auth/authorisation/data') diff --git a/gn_auth/auth/authorisation/data/phenotypes.py b/gn_auth/auth/authorisation/data/phenotypes.py index 92cbe89..08d225d 100644 --- a/gn_auth/auth/authorisation/data/phenotypes.py +++ b/gn_auth/auth/authorisation/data/phenotypes.py @@ -18,8 +18,9 @@ from gn_auth.auth.authorisation.resources.system.models import system_resource from gn_auth.auth.authorisation.resources.groups.models import Group, group_resource +from gn_auth.auth.authentication.users import User from gn_auth.auth.authorisation.checks import require_json -from gn_auth.auth.authorisation.resources.checks import authorised_for2 +from gn_auth.auth.authorisation.resources.checks import authorised_for_spec logger = logging.getLogger(__name__) phenosbp = Blueprint("phenotypes", __name__) @@ -92,20 +93,22 @@ def pheno_traits_from_db(gn3conn: gn3db.Connection, params: tuple[dict, ...]) -> def link_phenotype_data( authconn: authdb.DbConnection, - user, + user: User, group: Group, traits: tuple[dict, ...] ) -> dict: """Link phenotype traits to a user group.""" - if not (authorised_for2(authconn, - user, - system_resource(authconn), - ("system:data:link-to-group",)) + if not (authorised_for_spec( + authconn, + user.user_id, + system_resource(authconn).resource_id, + "system:data:link-to-group") or - authorised_for2(authconn, - user, - group_resource(authconn, group.group_id), - ("group:data:link-to-group",)) + authorised_for_spec( + authconn, + user.user_id, + group_resource(authconn, group.group_id).resource_id, + "group:data:link-to-group") ): raise AuthorisationError( "You do not have sufficient privileges to link data to group " -- cgit 1.4.1