Add required privileges to all endpoints

gns3server/api/routes/controller/snapshots.py

@@ -23,14 +23,18 @@ import logging
 
 log = logging.getLogger()
 
-from fastapi import APIRouter, Depends, Response, status
+from fastapi import APIRouter, Depends, status
 from typing import List
 from uuid import UUID
 
 from gns3server.controller.project import Project
+from gns3server.db.repositories.rbac import RbacRepository
 from gns3server import schemas
 from gns3server.controller import Controller
 
+from .dependencies.database import get_repository
+from .dependencies.rbac import has_privilege
+
 responses = {404: {"model": schemas.ErrorMessage, "description": "Could not find project or snapshot"}}
 
 router = APIRouter(responses=responses)
@@ -45,42 +49,74 @@ def dep_project(project_id: UUID) -> Project:
     return project
 
 
-@router.post("", status_code=status.HTTP_201_CREATED, response_model=schemas.Snapshot)
+@router.post(
+    "",
+    status_code=status.HTTP_201_CREATED,
+    response_model=schemas.Snapshot,
+    dependencies=[Depends(has_privilege("Snapshot.Allocate"))]
+)
 async def create_snapshot(
         snapshot_data: schemas.SnapshotCreate,
         project: Project = Depends(dep_project)
 ) -> schemas.Snapshot:
     """
     Create a new snapshot of a project.
+
+    Required privilege: Snapshot.Allocate
     """
 
     snapshot = await project.snapshot(snapshot_data.name)
     return snapshot.asdict()
 
 
-@router.get("", response_model=List[schemas.Snapshot], response_model_exclude_unset=True)
+@router.get(
+    "",
+    response_model=List[schemas.Snapshot],
+    response_model_exclude_unset=True,
+    dependencies=[Depends(has_privilege("Snapshot.Audit"))]
+)
 def get_snapshots(project: Project = Depends(dep_project)) -> List[schemas.Snapshot]:
     """
     Return all snapshots belonging to a given project.
+
+    Required privilege: Snapshot.Audit
     """
 
     snapshots = [s for s in project.snapshots.values()]
     return [s.asdict() for s in sorted(snapshots, key=lambda s: (s.created_at, s.name))]
 
 
-@router.delete("/{snapshot_id}", status_code=status.HTTP_204_NO_CONTENT)
-async def delete_snapshot(snapshot_id: UUID, project: Project = Depends(dep_project)) -> None:
+@router.delete(
+    "/{snapshot_id}",
+    status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(has_privilege("Snapshot.Allocate"))]
+)
+async def delete_snapshot(
+        snapshot_id: UUID,
+        project: Project = Depends(dep_project),
+        rbac_repo=Depends(get_repository(RbacRepository))
+) -> None:
     """
     Delete a snapshot.
+
+    Required privilege: Snapshot.Allocate
     """
 
     await project.delete_snapshot(str(snapshot_id))
+    await rbac_repo.delete_all_ace_starting_with_path(f"/projects/{project.id}/snapshots/{snapshot_id}")
 
 
-@router.post("/{snapshot_id}/restore", status_code=status.HTTP_201_CREATED, response_model=schemas.Project)
+@router.post(
+    "/{snapshot_id}/restore",
+    status_code=status.HTTP_201_CREATED,
+    response_model=schemas.Project,
+    dependencies=[Depends(has_privilege("Snapshot.Restore"))]
+)
 async def restore_snapshot(snapshot_id: UUID, project: Project = Depends(dep_project)) -> schemas.Project:
     """
     Restore a snapshot.
+
+    Required privilege: Snapshot.Restore
     """
 
     snapshot = project.get_snapshot(str(snapshot_id))