Add required privileges to all endpoints

gns3server/api/routes/controller/users.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python
 #
-# Copyright (C) 2020 GNS3 Technologies Inc.
+# Copyright (C) 2023 GNS3 Technologies Inc.
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -38,6 +38,7 @@ from gns3server.services import auth_service
 
 from .dependencies.authentication import get_current_active_user
 from .dependencies.database import get_repository
+from .dependencies.rbac import has_privilege
 
 import logging
 
@@ -115,12 +116,18 @@ async def update_logged_in_user(
     return await users_repo.update_user(current_user.user_id, user_update)
 
 
-@router.get("", response_model=List[schemas.User], dependencies=[Depends(get_current_active_user)])
+@router.get(
+    "",
+    response_model=List[schemas.User],
+    dependencies=[Depends(has_privilege("User.Audit"))]
+)
 async def get_users(
         users_repo: UsersRepository = Depends(get_repository(UsersRepository))
 ) -> List[schemas.User]:
     """
     Get all users.
+
+    Required privilege: User.Audit
     """
 
     return await users_repo.get_users()
@@ -129,8 +136,8 @@ async def get_users(
 @router.post(
     "",
     response_model=schemas.User,
-    dependencies=[Depends(get_current_active_user)],
-    status_code=status.HTTP_201_CREATED
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(has_privilege("User.Allocate"))]
 )
 async def create_user(
         user_create: schemas.UserCreate,
@@ -138,6 +145,8 @@ async def create_user(
 ) -> schemas.User:
     """
     Create a new user.
+
+    Required privilege: User.Allocate
     """
 
     if await users_repo.get_user_by_username(user_create.username):
@@ -149,13 +158,19 @@ async def create_user(
     return await users_repo.create_user(user_create)
 
 
-@router.get("/{user_id}", dependencies=[Depends(get_current_active_user)], response_model=schemas.User)
+@router.get(
+    "/{user_id}",
+    response_model=schemas.User,
+    dependencies=[Depends(has_privilege("User.Audit"))]
+)
 async def get_user(
         user_id: UUID,
         users_repo: UsersRepository = Depends(get_repository(UsersRepository)),
 ) -> schemas.User:
     """
     Get a user.
+
+    Required privilege: User.Audit
     """
 
     user = await users_repo.get_user(user_id)
@@ -164,7 +179,11 @@ async def get_user(
     return user
 
 
-@router.put("/{user_id}", dependencies=[Depends(get_current_active_user)], response_model=schemas.User)
+@router.put(
+    "/{user_id}",
+    response_model=schemas.User,
+    dependencies=[Depends(has_privilege("User.Modify"))]
+)
 async def update_user(
         user_id: UUID,
         user_update: schemas.UserUpdate,
@@ -172,6 +191,8 @@ async def update_user(
 ) -> schemas.User:
     """
     Update a user.
+
+    Required privilege: User.Modify
     """
 
     if user_update.username and await users_repo.get_user_by_username(user_update.username):
@@ -188,15 +209,18 @@ async def update_user(
 
 @router.delete(
     "/{user_id}",
-    dependencies=[Depends(get_current_active_user)],
-    status_code=status.HTTP_204_NO_CONTENT
+    status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(has_privilege("User.Allocate"))]
 )
 async def delete_user(
-    user_id: UUID,
-    users_repo: UsersRepository = Depends(get_repository(UsersRepository)),
+        user_id: UUID,
+        users_repo: UsersRepository = Depends(get_repository(UsersRepository)),
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
 ) -> None:
     """
     Delete a user.
+
+    Required privilege: User.Allocate
     """
 
     user = await users_repo.get_user(user_id)
@@ -209,12 +233,13 @@ async def delete_user(
     success = await users_repo.delete_user(user_id)
     if not success:
         raise ControllerError(f"User '{user_id}' could not be deleted")
+    await rbac_repo.delete_all_ace_starting_with_path(f"/users/{user_id}")
 
 
 @router.get(
     "/{user_id}/groups",
-    dependencies=[Depends(get_current_active_user)],
-    response_model=List[schemas.UserGroup]
+    response_model=List[schemas.UserGroup],
+    dependencies=[Depends(has_privilege("Group.Audit"))]
 )
 async def get_user_memberships(
         user_id: UUID,
@@ -222,6 +247,8 @@ async def get_user_memberships(
 ) -> List[schemas.UserGroup]:
     """
     Get user memberships.
+
+    Required privilege: Group.Audit
     """
 
     return await users_repo.get_user_memberships(user_id)