Add required privileges to all endpoints

gns3server/api/routes/controller/links.py

@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2016 GNS3 Technologies Inc.
+# Copyright (C) 2023 GNS3 Technologies Inc.
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -21,7 +21,7 @@ API routes for links.
 import multidict
 import aiohttp
 
-from fastapi import APIRouter, Depends, Request, Response, status
+from fastapi import APIRouter, Depends, Request, status
 from fastapi.responses import StreamingResponse
 from fastapi.encoders import jsonable_encoder
 from typing import List
@@ -29,10 +29,14 @@ from uuid import UUID
 
 from gns3server.controller import Controller
 from gns3server.controller.controller_error import ControllerError
+from gns3server.db.repositories.rbac import RbacRepository
 from gns3server.controller.link import Link
 from gns3server.utils.http_client import HTTPClient
 from gns3server import schemas
 
+from .dependencies.database import get_repository
+from .dependencies.rbac import has_privilege
+
 import logging
 
 log = logging.getLogger(__name__)
@@ -52,10 +56,17 @@ async def dep_link(project_id: UUID, link_id: UUID) -> Link:
     return link
 
 
-@router.get("", response_model=List[schemas.Link], response_model_exclude_unset=True)
+@router.get(
+    "",
+    response_model=List[schemas.Link],
+    response_model_exclude_unset=True,
+    dependencies=[Depends(has_privilege("Link.Audit"))]
+)
 async def get_links(project_id: UUID) -> List[schemas.Link]:
     """
     Return all links for a given project.
+
+    Required privilege: Link.Audit
     """
 
     project = await Controller.instance().get_loaded_project(str(project_id))
@@ -70,10 +81,13 @@ async def get_links(project_id: UUID) -> List[schemas.Link]:
         404: {"model": schemas.ErrorMessage, "description": "Could not find project"},
         409: {"model": schemas.ErrorMessage, "description": "Could not create link"},
     },
+    dependencies=[Depends(has_privilege("Link.Allocate"))]
 )
 async def create_link(project_id: UUID, link_data: schemas.LinkCreate) -> schemas.Link:
     """
     Create a new link.
+
+    Required privilege: Link.Allocate
     """
 
     project = await Controller.instance().get_loaded_project(str(project_id))
@@ -99,28 +113,47 @@ async def create_link(project_id: UUID, link_data: schemas.LinkCreate) -> schema
     return link.asdict()
 
 
-@router.get("/{link_id}/available_filters")
+@router.get(
+    "/{link_id}/available_filters",
+    dependencies=[Depends(has_privilege("Link.Audit"))]
+)
 async def get_filters(link: Link = Depends(dep_link)) -> List[dict]:
     """
     Return all filters available for a given link.
+
+    Required privilege: Link.Audit
     """
 
     return link.available_filters()
 
 
-@router.get("/{link_id}", response_model=schemas.Link, response_model_exclude_unset=True)
+@router.get(
+    "/{link_id}",
+    response_model=schemas.Link,
+    response_model_exclude_unset=True,
+    dependencies=[Depends(has_privilege("Link.Audit"))]
+)
 async def get_link(link: Link = Depends(dep_link)) -> schemas.Link:
     """
     Return a link.
+
+    Required privilege: Link.Audit
     """
 
     return link.asdict()
 
 
-@router.put("/{link_id}", response_model=schemas.Link, response_model_exclude_unset=True)
+@router.put(
+    "/{link_id}",
+    response_model=schemas.Link,
+    response_model_exclude_unset=True,
+    dependencies=[Depends(has_privilege("Link.Modify"))]
+)
 async def update_link(link_data: schemas.LinkUpdate, link: Link = Depends(dep_link)) -> schemas.Link:
     """
     Update a link.
+
+    Required privilege: Link.Modify
     """
 
     link_data = jsonable_encoder(link_data, exclude_unset=True)
@@ -135,30 +168,54 @@ async def update_link(link_data: schemas.LinkUpdate, link: Link = Depends(dep_li
     return link.asdict()
 
 
-@router.delete("/{link_id}", status_code=status.HTTP_204_NO_CONTENT)
-async def delete_link(project_id: UUID, link: Link = Depends(dep_link)) -> None:
+@router.delete(
+    "/{link_id}",
+    status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(has_privilege("Link.Allocate"))]
+)
+async def delete_link(
+        project_id: UUID,
+        link: Link = Depends(dep_link),
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> None:
     """
     Delete a link.
+
+    Required privilege: Link.Allocate
     """
 
     project = await Controller.instance().get_loaded_project(str(project_id))
     await project.delete_link(link.id)
+    await rbac_repo.delete_all_ace_starting_with_path(f"/links/{link.id}")
 
 
-@router.post("/{link_id}/reset", response_model=schemas.Link)
+@router.post(
+    "/{link_id}/reset",
+    response_model=schemas.Link,
+    dependencies=[Depends(has_privilege("Link.Modify"))]
+)
 async def reset_link(link: Link = Depends(dep_link)) -> schemas.Link:
     """
     Reset a link.
+
+    Required privilege: Link.Modify
     """
 
     await link.reset()
     return link.asdict()
 
 
-@router.post("/{link_id}/capture/start", status_code=status.HTTP_201_CREATED, response_model=schemas.Link)
+@router.post(
+    "/{link_id}/capture/start",
+    status_code=status.HTTP_201_CREATED,
+    response_model=schemas.Link,
+    dependencies=[Depends(has_privilege("Link.Capture"))]
+)
 async def start_capture(capture_data: dict, link: Link = Depends(dep_link)) -> schemas.Link:
     """
     Start packet capture on the link.
+
+    Required privilege: Link.Capture
     """
 
     await link.start_capture(
@@ -168,19 +225,30 @@ async def start_capture(capture_data: dict, link: Link = Depends(dep_link)) -> s
     return link.asdict()
 
 
-@router.post("/{link_id}/capture/stop", status_code=status.HTTP_204_NO_CONTENT)
+@router.post(
+    "/{link_id}/capture/stop",
+    status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(has_privilege("Link.Capture"))]
+)
 async def stop_capture(link: Link = Depends(dep_link)) -> None:
     """
     Stop packet capture on the link.
+
+    Required privilege: Link.Capture
     """
 
     await link.stop_capture()
 
 
-@router.get("/{link_id}/capture/stream")
+@router.get(
+    "/{link_id}/capture/stream",
+    dependencies=[Depends(has_privilege("Link.Capture"))]
+)
 async def stream_pcap(request: Request, link: Link = Depends(dep_link)) -> StreamingResponse:
     """
     Stream the PCAP capture file from compute.
+
+    Required privilege: Link.Capture
     """
 
     if not link.capturing: