permissions: refactroring patron transaction permissions policies

Co-Authored-by: Renaud Michotte <renaud.michotte@gmail.com>

data/role_policies.json

@@ -425,8 +425,23 @@
     "pro_catalog_manager",
     "pro_library_administrator"
   ],
-  "notif-search": [
-    "patron",
+  "notif-update": [
+    "pro_full_permissions",
+    "pro_library_administrator"
+  ],
+  "notif-create": [
+    "pro_full_permissions",
+    "pro_library_administrator"
+  ],
+  "notif-delete": [
+    "pro_full_permissions",
+    "pro_library_administrator"
+  ],
+  "oplg-read": [
+    "pro_full_permissions",
+    "pro_read_only"
+  ],
+  "org-search": [
     "pro_full_permissions",
     "pro_read_only",
     "pro_catalog_manager",
@@ -435,8 +450,7 @@
     "pro_acquisition_manager",
     "pro_library_administrator"
   ],
-  "notif-read": [
-    "patron",
+  "org-read": [
     "pro_full_permissions",
     "pro_read_only",
     "pro_catalog_manager",
@@ -445,17 +459,26 @@
     "pro_acquisition_manager",
     "pro_library_administrator"
   ],
-  "notif-update": [
+  "org-update": [
+    "pro_full_permissions"
+  ],
+  "pttr-update": [
     "pro_full_permissions",
-    "pro_library_administrator"
+    "pro_library_administrator",
+    "pro_user_manager",
+    "pro_circulation_manager"
   ],
-  "notif-create": [
+  "pttr-create": [
     "pro_full_permissions",
-    "pro_library_administrator"
+    "pro_library_administrator",
+    "pro_user_manager",
+    "pro_circulation_manager"
   ],
-  "notif-delete": [
+  "pttr-delete": [
     "pro_full_permissions",
-    "pro_library_administrator"
+    "pro_library_administrator",
+    "pro_user_manager",
+    "pro_circulation_manager"
   ],
   "ptty-search": [
     "pro_full_permissions",
@@ -484,30 +507,23 @@
   "ptty-delete": [
     "pro_full_permissions"
   ],
-  "oplg-read": [
+  "ptre-update": [
     "pro_full_permissions",
-    "pro_read_only"
+    "pro_library_administrator",
+    "pro_user_manager",
+    "pro_circulation_manager"
   ],
-  "org-search": [
+  "ptre-create": [
     "pro_full_permissions",
-    "pro_read_only",
-    "pro_catalog_manager",
-    "pro_circulation_manager",
+    "pro_library_administrator",
     "pro_user_manager",
-    "pro_acquisition_manager",
-    "pro_library_administrator"
+    "pro_circulation_manager"
   ],
-  "org-read": [
+  "ptre-delete": [
     "pro_full_permissions",
-    "pro_read_only",
-    "pro_catalog_manager",
-    "pro_circulation_manager",
+    "pro_library_administrator",
     "pro_user_manager",
-    "pro_acquisition_manager",
-    "pro_library_administrator"
-  ],
-  "org-update": [
-    "pro_full_permissions"
+    "pro_circulation_manager"
   ],
   "tmpl-search": [
     "pro_full_permissions",

data/system_role_policies.json

@@ -29,7 +29,25 @@
   "lofi-read": [
     "any_user"
   ],
+  "notif-search": [
+    "authenticated_user"
+  ],
+  "notif-read": [
+    "authenticated_user"
+  ],
   "oplg-search": [
     "authenticated_user"
+  ],
+  "pttr-search": [
+    "authenticated_user"
+  ],
+  "pttr-read": [
+    "authenticated_user"
+  ],
+  "ptre-search": [
+    "authenticated_user"
+  ],
+  "ptre-read": [
+    "authenticated_user"
   ]
 }

pyproject.toml

@@ -510,11 +510,21 @@ org_read = "rero_ils.modules.organisations.permissions:read_action"
 org_create = "rero_ils.modules.organisations.permissions:create_action"
 org_update = "rero_ils.modules.organisations.permissions:update_action"
 org_delete = "rero_ils.modules.organisations.permissions:delete_action"
+pttr_search = "rero_ils.modules.patron_transactions.permissions:search_action"
+pttr_read = "rero_ils.modules.patron_transactions.permissions:read_action"
+pttr_create = "rero_ils.modules.patron_transactions.permissions:create_action"
+pttr_update = "rero_ils.modules.patron_transactions.permissions:update_action"
+pttr_delete = "rero_ils.modules.patron_transactions.permissions:delete_action"
 ptty_search = "rero_ils.modules.patron_types.permissions:search_action"
 ptty_read = "rero_ils.modules.patron_types.permissions:read_action"
 ptty_create = "rero_ils.modules.patron_types.permissions:create_action"
 ptty_update = "rero_ils.modules.patron_types.permissions:update_action"
 ptty_delete = "rero_ils.modules.patron_types.permissions:delete_action"
+ptre_search = "rero_ils.modules.patron_transaction_events.permissions:search_action"
+ptre_read = "rero_ils.modules.patron_transaction_events.permissions:read_action"
+ptre_create = "rero_ils.modules.patron_transaction_events.permissions:create_action"
+ptre_update = "rero_ils.modules.patron_transaction_events.permissions:update_action"
+ptre_delete = "rero_ils.modules.patron_transaction_events.permissions:delete_action"
 tmpl_search = "rero_ils.modules.templates.permissions:search_action"
 tmpl_read = "rero_ils.modules.templates.permissions:read_action"
 tmpl_create = "rero_ils.modules.templates.permissions:create_action"

rero_ils/config.py

@@ -110,11 +110,11 @@
 from .modules.organisations.permissions import OrganisationPermissionPolicy
 from .modules.patron_transaction_events.api import PatronTransactionEvent
 from .modules.patron_transaction_events.permissions import \
-    PatronTransactionEventPermission
+    PatronTransactionEventPermissionPolicy
 from .modules.patron_transaction_events.utils import total_facet_filter_builder
 from .modules.patron_transactions.api import PatronTransaction
 from .modules.patron_transactions.permissions import \
-    PatronTransactionPermission
+    PatronTransactionPermissionPolicy
 from .modules.patron_types.api import PatronType
 from .modules.patron_types.permissions import PatronTypePermissionPolicy
 from .modules.patrons.api import Patron
@@ -953,25 +953,18 @@ def _(x):
         record_loaders={
             'application/json': lambda: PatronTransaction(request.get_json()),
         },
-        record_class=('rero_ils.modules.patron_transactions.api:'
-                      'PatronTransaction'),
+        record_class='rero_ils.modules.patron_transactions.api:PatronTransaction',
         list_route='/patron_transactions/',
-        item_route=('/patron_transactions/<pid(pttr, record_class='
-                    '"rero_ils.modules.patron_transactions.api:'
-                    'PatronTransaction"):pid_value>'),
+        item_route=('/patron_transactions/<pid(pttr, record_class="'
+                    'rero_ils.modules.patron_transactions.api:PatronTransaction"):pid_value>'),
         default_media_type='application/json',
         max_result_window=MAX_RESULT_WINDOW,
         search_factory_imp='rero_ils.query:patron_transactions_search_factory',
-        list_permission_factory_imp=lambda record: record_permission_factory(
-            action='list', record=record, cls=PatronTransactionPermission),
-        read_permission_factory_imp=lambda record: record_permission_factory(
-            action='read', record=record, cls=PatronTransactionPermission),
-        create_permission_factory_imp=lambda record: record_permission_factory(
-            action='create', record=record, cls=PatronTransactionPermission),
-        update_permission_factory_imp=lambda record: record_permission_factory(
-            action='update', record=record, cls=PatronTransactionPermission),
-        delete_permission_factory_imp=lambda record: record_permission_factory(
-            action='delete', record=record, cls=PatronTransactionPermission)
+        list_permission_factory_imp=lambda record: PatronTransactionPermissionPolicy('search', record=record),
+        read_permission_factory_imp=lambda record: PatronTransactionPermissionPolicy('read', record=record),
+        create_permission_factory_imp=lambda record: PatronTransactionPermissionPolicy('create', record=record),
+        update_permission_factory_imp=lambda record: PatronTransactionPermissionPolicy('update', record=record),
+        delete_permission_factory_imp=lambda record: PatronTransactionPermissionPolicy('delete', record=record)
     ),
     ptre=dict(
         pid_type='ptre',
@@ -981,8 +974,7 @@ def _(x):
                       'PatronTransactionEventsSearch'),
         search_index='patron_transaction_events',
         search_type=None,
-        indexer_class=('rero_ils.modules.patron_transaction_events.api:'
-                       'PatronTransactionEventsIndexer'),
+        indexer_class='rero_ils.modules.patron_transaction_events.api:PatronTransactionEventsIndexer',
         record_serializers={
             'application/json': 'rero_ils.modules.serializers:json_v1_response'
         },
@@ -998,43 +990,20 @@ def _(x):
             'rero': 'application/rero+json'
         },
         record_loaders={
-            'application/json': lambda: PatronTransactionEvent(
-                request.get_json()),
+            'application/json': lambda: PatronTransactionEvent(request.get_json()),
         },
-        record_class=('rero_ils.modules.patron_transaction_events.api:'
-                      'PatronTransactionEvent'),
+        record_class='rero_ils.modules.patron_transaction_events.api:PatronTransactionEvent',
         list_route='/patron_transaction_events/',
         item_route=('/patron_transaction_events/<pid(ptre, record_class='
-                    '"rero_ils.modules.patron_transaction_events.api:'
-                    'PatronTransactionEvent"):pid_value>'),
+                    '"rero_ils.modules.patron_transaction_events.api:PatronTransactionEvent"):pid_value>'),
         default_media_type='application/json',
         max_result_window=MAX_RESULT_WINDOW,
         search_factory_imp='rero_ils.query:patron_transactions_search_factory',
-        list_permission_factory_imp=lambda record: record_permission_factory(
-            action='list',
-            record=record,
-            cls=PatronTransactionEventPermission
-        ),
-        read_permission_factory_imp=lambda record: record_permission_factory(
-            action='read',
-            record=record,
-            cls=PatronTransactionEventPermission
-        ),
-        create_permission_factory_imp=lambda record: record_permission_factory(
-            action='create',
-            record=record,
-            cls=PatronTransactionEventPermission
-        ),
-        update_permission_factory_imp=lambda record: record_permission_factory(
-            action='update',
-            record=record,
-            cls=PatronTransactionEventPermission
-        ),
-        delete_permission_factory_imp=lambda record: record_permission_factory(
-            action='delete',
-            record=record,
-            cls=PatronTransactionEventPermission
-        )
+        list_permission_factory_imp=lambda record: PatronTransactionEventPermissionPolicy('search', record=record),
+        read_permission_factory_imp=lambda record: PatronTransactionEventPermissionPolicy('read', record=record),
+        create_permission_factory_imp=lambda record: PatronTransactionEventPermissionPolicy('create', record=record),
+        update_permission_factory_imp=lambda record: PatronTransactionEventPermissionPolicy('update', record=record),
+        delete_permission_factory_imp=lambda record: PatronTransactionEventPermissionPolicy('delete', record=record)
     ),
     ptty=dict(
         pid_type='ptty',

rero_ils/modules/patron_transaction_events/permissions.py

@@ -16,67 +16,26 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program. If not, see <http://www.gnu.org/licenses/>.
 
-"""Permissions for Patron event transaction."""
+"""Permissions for Patron transaction event."""
+from invenio_access import action_factory
 
-from rero_ils.modules.patron_transactions.permissions import \
-    PatronTransactionPermission
-from rero_ils.modules.permissions import RecordPermission
+from rero_ils.modules.permissions import AllowedByAction, \
+    AllowedByActionRestrictByOrganisation, \
+    AllowedByActionRestrictByOwnerOrOrganisation, RecordPermissionPolicy
 
+# Actions to control patron transaction event policies for CRUD operations
+search_action = action_factory('ptre-search')
+read_action = action_factory('ptre-read')
+create_action = action_factory('ptre-create')
+update_action = action_factory('ptre-update')
+delete_action = action_factory('ptre-delete')
 
-class PatronTransactionEventPermission(RecordPermission):
-    """Patron transaction event permissions."""
 
-    @classmethod
-    def list(cls, user, record=None):
-        """List permission check.
+class PatronTransactionEventPermissionPolicy(RecordPermissionPolicy):
+    """PatronTransactionEvent permission policy used by the CRUD operations."""
 
-        :param user: Logged user.
-        :param record: Record to check
-        :return: True is action can be done.
-        """
-        # same as PatronTransaction
-        return PatronTransactionPermission.list(user, record)
-
-    @classmethod
-    def read(cls, user, record):
-        """Read permission check.
-
-        :param user: Logged user.
-        :param record: Record to check.
-        :return: True is action can be done.
-        """
-        # same as PatronTransaction
-        return PatronTransactionPermission.read(user, record)
-
-    @classmethod
-    def create(cls, user, record=None):
-        """Create permission check.
-
-        :param user: Logged user.
-        :param record: Record to check.
-        :return: True is action can be done.
-        """
-        # same as PatronTransaction
-        return PatronTransactionPermission.create(user, record)
-
-    @classmethod
-    def update(cls, user, record):
-        """Update permission check.
-
-        :param user: Logged user.
-        :param record: Record to check.
-        :return: True is action can be done.
-        """
-        # same as PatronTransaction
-        return PatronTransactionPermission.update(user, record)
-
-    @classmethod
-    def delete(cls, user, record):
-        """Delete permission check.
-
-        :param user: Logged user.
-        :param record: Record to check.
-        :return: True if action can be done.
-        """
-        # same as PatronTransaction
-        return PatronTransactionPermission.delete(user, record)
+    can_search = [AllowedByAction(search_action)]
+    can_read = [AllowedByActionRestrictByOwnerOrOrganisation(read_action)]
+    can_create = [AllowedByActionRestrictByOrganisation(create_action)]
+    can_update = [AllowedByActionRestrictByOrganisation(update_action)]
+    can_delete = [AllowedByActionRestrictByOrganisation(delete_action)]