Use TapDB 9 actor users for Bloom roles

Author: iamh2o

bloom_lims/auth/repositories/tapdb/users.py

@@ -38,9 +38,9 @@ class TapdbUserRecord:
         END AS is_active
     FROM generic_instance gi
     WHERE gi.polymorphic_discriminator = 'actor_instance'
-      AND gi.category = 'SYS'
-      AND gi.type = 'actor'
-      AND gi.subtype = 'system_user'
+      AND gi.category = 'actor'
+      AND gi.type = 'user'
+      AND gi.subtype = 'system'
       AND COALESCE(gi.is_deleted, FALSE) = FALSE
 """
 
@@ -56,7 +56,7 @@ def _normalize_stored_role(
     role_value: Any, *, default: str | None = None
 ) -> str | None:
     def _coerce(value: Any) -> str | None:
-        candidate = str(value or "").strip()
+        candidate = str(value or "").strip().upper()
         if not candidate:
             return None
         values = normalize_roles([candidate])
@@ -179,9 +179,9 @@ def set_user_role(session: Session, identifier: str | int, role: str) -> bool:
                     ),
                     modified_dt = NOW()
                 WHERE gi.polymorphic_discriminator = 'actor_instance'
-                  AND gi.category = 'SYS'
-                  AND gi.type = 'actor'
-                  AND gi.subtype = 'system_user'
+                  AND gi.category = 'actor'
+                  AND gi.type = 'user'
+                  AND gi.subtype = 'system'
                   AND COALESCE(gi.is_deleted, FALSE) = FALSE
                   AND gi.uid = :uid
                 RETURNING gi.uid
@@ -204,9 +204,9 @@ def set_user_role(session: Session, identifier: str | int, role: str) -> bool:
                 ),
                 modified_dt = NOW()
             WHERE gi.polymorphic_discriminator = 'actor_instance'
-              AND gi.category = 'SYS'
-              AND gi.type = 'actor'
-              AND gi.subtype = 'system_user'
+              AND gi.category = 'actor'
+              AND gi.type = 'user'
+              AND gi.subtype = 'system'
               AND COALESCE(gi.is_deleted, FALSE) = FALSE
               AND (
                     lower(COALESCE(gi.json_addl->>'login_identifier', '')) = :identifier

bloom_lims/gui/deps.py

@@ -59,9 +59,9 @@ def _load_shared_display_timezone(email: str) -> str:
                     FROM generic_instance gi
                     WHERE gi.is_deleted = FALSE
                       AND gi.polymorphic_discriminator = 'actor_instance'
-                      AND gi.category = 'generic'
-                      AND gi.type = 'actor'
-                      AND gi.subtype = 'system_user'
+                      AND gi.category = 'actor'
+                      AND gi.type = 'user'
+                      AND gi.subtype = 'system'
                       AND (
                             lower(COALESCE(gi.json_addl->>'login_identifier', '')) = :identifier
                          OR lower(COALESCE(gi.json_addl->>'email', '')) = :identifier
@@ -104,9 +104,9 @@ def persist_display_timezone(email: str, display_timezone: str | None) -> bool:
                         modified_dt = NOW()
                     WHERE gi.is_deleted = FALSE
                       AND gi.polymorphic_discriminator = 'actor_instance'
-                      AND gi.category = 'generic'
-                      AND gi.type = 'actor'
-                      AND gi.subtype = 'system_user'
+                      AND gi.category = 'actor'
+                      AND gi.type = 'user'
+                      AND gi.subtype = 'system'
                       AND (
                             lower(COALESCE(gi.json_addl->>'login_identifier', '')) = :identifier
                          OR lower(COALESCE(gi.json_addl->>'email', '')) = :identifier

tests/test_tapdb_user_repository.py

@@ -3,12 +3,14 @@
 from bloom_lims.auth.repositories.tapdb import users as repo
 
 
-def test_user_select_sql_targets_sys_actor_users() -> None:
-    assert "gi.category = 'SYS'" in repo._USER_SELECT_SQL
+def test_user_select_sql_targets_tapdb9_actor_users() -> None:
+    assert "gi.category = 'actor'" in repo._USER_SELECT_SQL
+    assert "gi.type = 'user'" in repo._USER_SELECT_SQL
+    assert "gi.subtype = 'system'" in repo._USER_SELECT_SQL
     assert "gi.category = 'generic'" not in repo._USER_SELECT_SQL
 
 
-def test_set_user_role_updates_sys_actor_user_by_uid() -> None:
+def test_set_user_role_updates_tapdb9_actor_user_by_uid() -> None:
     calls: list[dict[str, object]] = []
 
     class FakeResult:
@@ -22,5 +24,7 @@ def execute(self, statement, params):
             return FakeResult()
 
     assert repo.set_user_role(FakeSession(), 42, "ADMIN") is True
-    assert "gi.category = 'SYS'" in calls[0]["sql"]
+    assert "gi.category = 'actor'" in calls[0]["sql"]
+    assert "gi.type = 'user'" in calls[0]["sql"]
+    assert "gi.subtype = 'system'" in calls[0]["sql"]
     assert calls[0]["params"] == {"uid": 42, "role": "ADMIN"}