From 39e1178350ade05d75c2d13232f85b8ae17690c1 Mon Sep 17 00:00:00 2001
From: Claude
Date: Mon, 31 Aug 2026 00:00:00 +0000
Subject: refactor(admin/users): replace authorised_for2 with
 can_create_or_delete_user

Use gn-libs' can_create_or_delete_user() + user_roles_on_system() for the
privilege check in delete_users(), matching the pattern already used by
create_user().

Removes the authorised_for2, system_resource, and AuthorisationError
imports that are no longer needed.

Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>
---
 gn_auth/auth/system/admin/users.py | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

(limited to 'gn_auth')

diff --git a/gn_auth/auth/system/admin/users.py b/gn_auth/auth/system/admin/users.py
index 63648d8..7dfc7ca 100644
--- a/gn_auth/auth/system/admin/users.py
+++ b/gn_auth/auth/system/admin/users.py
@@ -15,14 +15,10 @@ from gn_auth.auth.errors import (
     PasswordError,
     UsernameError,
     ForbiddenAccess,
-    AuthorisationError,
     UserRegistrationError)
 from gn_auth.auth.requests import request_json
 from gn_auth.auth.authentication.oauth2.resource_server import require_oauth
-from gn_auth.auth.authorisation.resources.checks import authorised_for2
-from gn_auth.auth.authorisation.resources.system.models import (
-    system_resource,
-    user_roles_on_system)
+from gn_auth.auth.authorisation.resources.system.models import user_roles_on_system
 from gn_auth.auth.authorisation.users.admin.models import create_verified_user
 from gn_auth.auth.authorisation.users.views import (
     validate_password,
@@ -131,11 +127,11 @@ def delete_users() -> Response:
     with (require_oauth.acquire("profile user role") as _token,
           db.connection(app.config["AUTH_DB"]) as conn,
           db.cursor(conn) as cursor):
-        if not authorised_for2(conn,
-                               _token.user,
-                               system_resource(conn),
-                               ("system:user:delete-user",)):
-            raise AuthorisationError(
+        u_roles = user_roles_on_system(conn, _token.user)
+        if not can_create_or_delete_user(tuple(
+                priv.privilege_id for role in u_roles
+                for priv in role.privileges)):
+            raise ForbiddenAccess(
                 "You need the `system:user:delete-user` privilege to delete "
                 "users from the system.")
 
-- 
cgit 1.4.1