Add required privileges to all endpoints

gns3server/db/models/acl.py

@@ -30,10 +30,10 @@ class ACE(BaseTable):
     __tablename__ = "acl"
 
     ace_id = Column(GUID, primary_key=True, default=generate_uuid)
+    ace_type: str = Column(String)
     path = Column(String)
     propagate = Column(Boolean, default=True)
     allowed = Column(Boolean, default=True)
-    type: str = Column(String)
     user_id = Column(GUID, ForeignKey('users.user_id', ondelete="CASCADE"))
     user = relationship("User", back_populates="acl_entries")
     group_id = Column(GUID, ForeignKey('user_groups.user_group_id', ondelete="CASCADE"))
@@ -42,5 +42,5 @@ class ACE(BaseTable):
     role = relationship("Role", back_populates="acl_entries")
 
     __table_args__ = (
-        CheckConstraint("(user_id IS NOT NULL AND type = 'user') OR (group_id IS NOT NULL AND type = 'group')"),
+        CheckConstraint("(user_id IS NOT NULL AND ace_type = 'user') OR (group_id IS NOT NULL AND ace_type = 'group')"),
     )

gns3server/db/models/privileges.py

@@ -71,6 +71,30 @@ def create_default_roles(target, connection, **kw):
             "description": "Update a group",
             "name": "Group.Modify"
         },
+        {
+            "description": "Create or delete a role",
+            "name": "Role.Allocate"
+        },
+        {
+            "description": "View a role",
+            "name": "Role.Audit"
+        },
+        {
+            "description": "Update a role",
+            "name": "Role.Modify"
+        },
+        {
+            "description": "Create or delete an ACE",
+            "name": "ACE.Allocate"
+        },
+        {
+            "description": "View an ACE",
+            "name": "ACE.Audit"
+        },
+        {
+            "description": "Update an ACE",
+            "name": "ACE.Modify"
+        },
         {
             "description": "Create or delete a template",
             "name": "Template.Allocate"
@@ -97,7 +121,15 @@ def create_default_roles(target, connection, **kw):
         },
         {
             "description": "Create or delete project snapshots",
-            "name": "Project.Snapshot"
+            "name": "Snapshot.Allocate"
+        },
+        {
+            "description": "Restore a snapshot",
+            "name": "Snapshot.Restore"
+        },
+        {
+            "description": "View a snapshot",
+            "name": "Snapshot.Audit"
         },
         {
             "description": "Create or delete a node",
@@ -167,6 +199,10 @@ def create_default_roles(target, connection, **kw):
             "description": "Create or delete a compute",
             "name": "Compute.Allocate"
         },
+        {
+            "description": "Update a compute",
+            "name": "Compute.Modify"
+        },
         {
             "description": "View a compute",
             "name": "Compute.Audit"
@@ -227,7 +263,9 @@ def add_privileges_to_default_roles(target, connection, **kw):
         "Project.Allocate",
         "Project.Audit",
         "Project.Modify",
-        "Project.Snapshot",
+        "Snapshot.Allocate",
+        "Snapshot.Audit",
+        "Snapshot.Restore",
         "Node.Allocate",
         "Node.Audit",
         "Node.Modify",
@@ -253,6 +291,7 @@ def add_privileges_to_default_roles(target, connection, **kw):
     # add required privileges to the "Auditor" role
     auditor_privileges = (
         "Project.Audit",
+        "Snapshot.Audit",
         "Node.Audit",
         "Link.Audit",
         "Drawing.Audit",