From 968bacb5968eef5a272e1a6375f5f72a5c991c6b Mon Sep 17 00:00:00 2001
From: Frederick Muriuki Muriithi
Date: Tue, 31 Mar 2026 10:47:15 -0500
Subject: Enforce the following invariants for roles/privileges:

* "Creators" can ONLY create
* "Viewers" can ONLY view
* "Editors" can view AND edit
* "Deletors" Can view AND edit AND delete
---
 gn_libs/privileges/resources.py | 35 ++++++++++++++++++++++++++---------
 1 file changed, 26 insertions(+), 9 deletions(-)

(limited to 'gn_libs')

diff --git a/gn_libs/privileges/resources.py b/gn_libs/privileges/resources.py
index dea02f9..431ccd3 100644
--- a/gn_libs/privileges/resources.py
+++ b/gn_libs/privileges/resources.py
@@ -15,28 +15,45 @@ can_view = partial(
     privileges_fulfill_specs,
     resource_spec=(
         "(OR group:resource:view-resource system:resource:view "
-        "system:inbredset:view-case-attribute)"),
+        "    system:inbredset:view-case-attribute)"),
     system_spec="(OR system:system-wide:data:view system:resource:view)")
 
 
 can_edit = partial(
     privileges_fulfill_specs,
     resource_spec=(
-        "(OR group:resource:edit-resource system:resource:edit "
-        "system:inbredset:edit-case-attribute)"),
-    system_spec="(OR system:system-wide:data:edit system:resource:edit)")
+        "(OR "
+        "  (AND group:resource:view-resource group:resource:edit-resource) "
+        "  (AND system:resource:view system:resource:edit) "
+        "  (AND system:inbredset:view-case-attribute "
+        "       system:inbredset:edit-case-attribute))"),
+    system_spec=(
+        "(OR "
+        "  (AND system:system-wide:data:view system:system-wide:data:edit) "
+        "  (AND system:resource:view system:resource:edit))"))
 
 
 can_create = partial(
     privileges_fulfill_specs,
     resource_spec=("(OR group:resource:create-resource "
-                   "system:inbredset:create-case-attribute)"),
+                   "    system:inbredset:create-case-attribute)"),
     system_spec="(OR system:system-wide:data:create)")
 
 
 can_delete = partial(
     privileges_fulfill_specs,
-    resource_spec=("(OR group:resource:delete-resource "
-                   "system:inbredset:delete-case-attribute "
-                   "system:resource:delete)"),
-    system_spec="(OR system:system-wide:data:delete system:resource:delete)")
+    resource_spec=(
+        "(OR "
+        "  (AND group:resource:view-resource "
+        "       group:resource:edit-resource group:resource:delete-resource) "
+        "  (AND system:inbredset:view-case-attribute "
+        "       system:inbredset:edit-case-attribute "
+        "       system:inbredset:delete-case-attribute) "
+        "  (AND system:resource:view system:resource:edit "
+        "       system:resource:delete))"),
+    system_spec=(
+        "(OR "
+        "  (AND system:system-wide:data:view system:system-wide:data:edit "
+        "       system:system-wide:data:delete) "
+        "  (AND system:resource:view system:resource:edit "
+        "       system:resource:delete))"))
-- 
cgit 1.4.1