Add required privileges to all endpoints

gns3server/db/models/acl.py

@@ -30,10 +30,10 @@ class ACE(BaseTable):
     __tablename__ = "acl"
 
     ace_id = Column(GUID, primary_key=True, default=generate_uuid)
+    ace_type: str = Column(String)
     path = Column(String)
     propagate = Column(Boolean, default=True)
     allowed = Column(Boolean, default=True)
-    type: str = Column(String)
     user_id = Column(GUID, ForeignKey('users.user_id', ondelete="CASCADE"))
     user = relationship("User", back_populates="acl_entries")
     group_id = Column(GUID, ForeignKey('user_groups.user_group_id', ondelete="CASCADE"))
@@ -42,5 +42,5 @@ class ACE(BaseTable):
     role = relationship("Role", back_populates="acl_entries")
 
     __table_args__ = (
-        CheckConstraint("(user_id IS NOT NULL AND type = 'user') OR (group_id IS NOT NULL AND type = 'group')"),
+        CheckConstraint("(user_id IS NOT NULL AND ace_type = 'user') OR (group_id IS NOT NULL AND ace_type = 'group')"),
     )

gns3server/db/models/privileges.py

@@ -71,6 +71,30 @@ def create_default_roles(target, connection, **kw):
             "description": "Update a group",
             "name": "Group.Modify"
         },
+        {
+            "description": "Create or delete a role",
+            "name": "Role.Allocate"
+        },
+        {
+            "description": "View a role",
+            "name": "Role.Audit"
+        },
+        {
+            "description": "Update a role",
+            "name": "Role.Modify"
+        },
+        {
+            "description": "Create or delete an ACE",
+            "name": "ACE.Allocate"
+        },
+        {
+            "description": "View an ACE",
+            "name": "ACE.Audit"
+        },
+        {
+            "description": "Update an ACE",
+            "name": "ACE.Modify"
+        },
         {
             "description": "Create or delete a template",
             "name": "Template.Allocate"
@@ -97,7 +121,15 @@ def create_default_roles(target, connection, **kw):
         },
         {
             "description": "Create or delete project snapshots",
-            "name": "Project.Snapshot"
+            "name": "Snapshot.Allocate"
+        },
+        {
+            "description": "Restore a snapshot",
+            "name": "Snapshot.Restore"
+        },
+        {
+            "description": "View a snapshot",
+            "name": "Snapshot.Audit"
         },
         {
             "description": "Create or delete a node",
@@ -167,6 +199,10 @@ def create_default_roles(target, connection, **kw):
             "description": "Create or delete a compute",
             "name": "Compute.Allocate"
         },
+        {
+            "description": "Update a compute",
+            "name": "Compute.Modify"
+        },
         {
             "description": "View a compute",
             "name": "Compute.Audit"
@@ -227,7 +263,9 @@ def add_privileges_to_default_roles(target, connection, **kw):
         "Project.Allocate",
         "Project.Audit",
         "Project.Modify",
-        "Project.Snapshot",
+        "Snapshot.Allocate",
+        "Snapshot.Audit",
+        "Snapshot.Restore",
         "Node.Allocate",
         "Node.Audit",
         "Node.Modify",
@@ -253,6 +291,7 @@ def add_privileges_to_default_roles(target, connection, **kw):
     # add required privileges to the "Auditor" role
     auditor_privileges = (
         "Project.Audit",
+        "Snapshot.Audit",
         "Node.Audit",
         "Link.Audit",
         "Drawing.Audit",

gns3server/db/repositories/rbac.py

@@ -276,22 +276,6 @@ class RbacRepository(BaseRepository):
         await self._db_session.commit()
         return result.rowcount > 0
 
-    # async def prune_permissions(self) -> int:
-    #     """
-    #     Prune orphaned permissions.
-    #     """
-    #
-    #     query = select(models.Permission).\
-    #         filter((~models.Permission.roles.any()) & (models.Permission.user_id == null()))
-    #     result = await self._db_session.execute(query)
-    #     permissions = result.scalars().all()
-    #     permissions_deleted = 0
-    #     for permission in permissions:
-    #         if await self.delete_permission(permission.permission_id):
-    #             permissions_deleted += 1
-    #     log.info(f"{permissions_deleted} orphaned permissions have been deleted")
-    #     return permissions_deleted
-
     async def delete_all_ace_starting_with_path(self, path: str) -> None:
         """
         Delete all ACEs starting with path.
@@ -304,7 +288,10 @@ class RbacRepository(BaseRepository):
         log.debug(f"{result.rowcount} ACE(s) have been deleted")
 
     @staticmethod
-    def _match_path_to_aces(path: str, aces) -> bool:
+    def _check_path_with_aces(path: str, aces) -> bool:
+        """
+        Compare path with existing ACEs to check if the user has the required privilege on that path.
+        """
 
         parsed_url = urlparse(path)
         original_path = path
@@ -347,7 +334,7 @@ class RbacRepository(BaseRepository):
         aces = result.all()
 
         try:
-            if self._match_path_to_aces(path, aces):
+            if self._check_path_with_aces(path, aces):
                 # the user has an ACE matching the path and privilege,there is no need to check group ACEs
                 return True
         except PermissionError:
@@ -366,6 +353,6 @@ class RbacRepository(BaseRepository):
         aces = result.all()
 
         try:
-            return self._match_path_to_aces(path, aces)
+            return self._check_path_with_aces(path, aces)
         except PermissionError:
             return False