From 087a476fe37ec097196693abb5c0a0b12f8f38ae Mon Sep 17 00:00:00 2001
From: Frederick Muriuki Muriithi
Date: Wed, 13 May 2026 15:05:26 -0500
Subject: Remove administrative-specific privileges.

The `system:resource:[view/edit/delete]` privileges are administrative
and checking for them here is a bug. It exposes data publicly.
---
 gn_libs/privileges/resources.py | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/gn_libs/privileges/resources.py b/gn_libs/privileges/resources.py
index 4b66c59..217a57d 100644
--- a/gn_libs/privileges/resources.py
+++ b/gn_libs/privileges/resources.py
@@ -11,9 +11,9 @@ logger = logging.getLogger(__name__)
 can_view = partial(
     privileges_fulfill_specs,
     resource_spec=(
-        "(OR group:resource:view-resource system:resource:view "
-        "    system:inbredset:view-case-attribute)"),
-    system_spec="(OR system:system-wide:data:view system:resource:view)")
+        "(OR group:resource:view-resource system:inbredset:view-case-attribute "
+        "    system:resource:public-read)"),
+    system_spec="(OR system:system-wide:data:view)")
 
 
 can_edit = partial(
@@ -21,13 +21,11 @@ can_edit = partial(
     resource_spec=(
         "(OR "
         "  (AND group:resource:view-resource group:resource:edit-resource) "
-        "  (AND system:resource:view system:resource:edit) "
         "  (AND system:inbredset:view-case-attribute "
         "       system:inbredset:edit-case-attribute))"),
     system_spec=(
         "(OR "
-        "  (AND system:system-wide:data:view system:system-wide:data:edit) "
-        "  (AND system:resource:view system:resource:edit))"))
+        "  (AND system:system-wide:data:view system:system-wide:data:edit))"))
 
 
 def can_batch_edit(queried_privileges: tuple[str, ...]) -> bool:
@@ -53,15 +51,11 @@ can_delete = partial(
         "       group:resource:edit-resource group:resource:delete-resource) "
         "  (AND system:inbredset:view-case-attribute "
         "       system:inbredset:edit-case-attribute "
-        "       system:inbredset:delete-case-attribute) "
-        "  (AND system:resource:view system:resource:edit "
-        "       system:resource:delete))"),
+        "       system:inbredset:delete-case-attribute))"),
     system_spec=(
         "(OR "
         "  (AND system:system-wide:data:view system:system-wide:data:edit "
-        "       system:system-wide:data:delete) "
-        "  (AND system:resource:view system:resource:edit "
-        "       system:resource:delete))"))
+        "       system:system-wide:data:delete))"))
 
 
 can_apply_or_reject_edit = partial(
-- 
cgit 1.4.1