Use an ACL table to check for privileges

gns3server/api/routes/controller/__init__.py

@@ -32,7 +32,7 @@ from . import images
 from . import users
 from . import groups
 from . import roles
-from . import permissions
+from . import acl
 
 from .dependencies.authentication import get_current_active_user
 
@@ -56,10 +56,10 @@ router.include_router(
 )
 
 router.include_router(
-    permissions.router,
+    acl.router,
     dependencies=[Depends(get_current_active_user)],
-    prefix="/permissions",
-    tags=["Permissions"]
+    prefix="/acl",
+    tags=["ACL"]
 )
 
 router.include_router(

gns3server/api/routes/controller/acl.py

@@ -0,0 +1,145 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2023 GNS3 Technologies Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+"""
+API routes for ACL.
+"""
+
+import re
+
+from fastapi import APIRouter, Depends, Request, status
+from fastapi.routing import APIRoute
+from uuid import UUID
+from typing import List
+
+
+from gns3server import schemas
+from gns3server.controller.controller_error import (
+    ControllerBadRequestError,
+    ControllerNotFoundError,
+    ControllerForbiddenError,
+)
+
+from gns3server.db.repositories.rbac import RbacRepository
+from .dependencies.database import get_repository
+from .dependencies.authentication import get_current_active_user
+
+import logging
+
+log = logging.getLogger(__name__)
+
+router = APIRouter()
+
+
+@router.get("", response_model=List[schemas.ACE])
+async def get_aces(
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> List[schemas.ACE]:
+    """
+    Get all ACL entries.
+    """
+
+    return await rbac_repo.get_aces()
+
+
+@router.post("", response_model=schemas.ACE, status_code=status.HTTP_201_CREATED)
+async def create_ace(
+        request: Request,
+        ace_create: schemas.ACECreate,
+        current_user: schemas.User = Depends(get_current_active_user),
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> schemas.ACE:
+    """
+    Create a new ACL entry.
+    """
+
+    for route in request.app.routes:
+        if isinstance(route, APIRoute):
+
+            # remove the prefix (e.g. "/v3") from the route path
+            route_path = re.sub(r"^/v[0-9]", "", route.path)
+            # replace route path ID parameters by a UUID regex
+            route_path = re.sub(r"{\w+_id}", "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}", route_path)
+            # replace remaining route path parameters by a word matching regex
+            route_path = re.sub(r"/{[\w:]+}", r"/\\w+", route_path)
+
+            if re.fullmatch(route_path, ace_create.path):
+                log.info("Creating ACE for route path", ace_create.path, route_path)
+                return await rbac_repo.create_ace(ace_create)
+
+    raise ControllerBadRequestError(f"Path '{ace_create.path}' doesn't match any existing endpoint")
+
+
+@router.get("/{ace_id}", response_model=schemas.ACE)
+async def get_ace(
+        ace_id: UUID,
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)),
+) -> schemas.ACE:
+    """
+    Get an ACL entry.
+    """
+
+    ace = await rbac_repo.get_ace(ace_id)
+    if not ace:
+        raise ControllerNotFoundError(f"ACL entry '{ace_id}' not found")
+    return ace
+
+
+@router.put("/{ace_id}", response_model=schemas.ACE)
+async def update_ace(
+        ace_id: UUID,
+        ace_update: schemas.ACEUpdate,
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> schemas.ACE:
+    """
+    Update an ACL entry.
+    """
+
+    ace = await rbac_repo.get_ace(ace_id)
+    if not ace:
+        raise ControllerNotFoundError(f"ACL entry '{ace_id}' not found")
+
+    return await rbac_repo.update_ace(ace_id, ace_update)
+
+
+@router.delete("/{ace_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_ace(
+    ace_id: UUID,
+    rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)),
+) -> None:
+    """
+    Delete an ACL entry.
+    """
+
+    ace = await rbac_repo.get_ace(ace_id)
+    if not ace:
+        raise ControllerNotFoundError(f"ACL entry '{ace_id}' not found")
+
+    success = await rbac_repo.delete_ace(ace_id)
+    if not success:
+        raise ControllerNotFoundError(f"ACL entry '{ace_id}' could not be deleted")
+
+
+# @router.post("/prune", status_code=status.HTTP_204_NO_CONTENT)
+# async def prune_permissions(
+#         rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+# ) -> None:
+#     """
+#     Prune orphaned permissions.
+#     """
+#
+#     await rbac_repo.prune_permissions()

gns3server/api/routes/controller/dependencies/authentication.py

@@ -74,21 +74,6 @@ async def get_current_active_user(
             headers={"WWW-Authenticate": "Bearer"},
         )
 
-    # remove the prefix (e.g. "/v3") from URL path
-    path = re.sub(r"^/v[0-9]", "", request.url.path)
-
-    # special case: always authorize access to the "/users/me" endpoint
-    if path == "/users/me":
-        return current_user
-
-    authorized = await rbac_repo.check_user_is_authorized(current_user.user_id, request.method, path)
-    if not authorized:
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail=f"User is not authorized '{current_user.user_id}' on {request.method} '{path}'",
-            headers={"WWW-Authenticate": "Bearer"},
-        )
-
     return current_user
 
 
@@ -96,7 +81,6 @@ async def get_current_active_user_from_websocket(
         websocket: WebSocket,
         token: str = Query(...),
         user_repo: UsersRepository = Depends(get_repository(UsersRepository)),
-        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
 ) -> Optional[schemas.User]:
 
     await websocket.accept()
@@ -121,18 +105,6 @@ async def get_current_active_user_from_websocket(
                 detail=f"'{username}' is not an active user"
             )
 
-        # remove the prefix (e.g. "/v3") from URL path
-        path = re.sub(r"^/v[0-9]", "", websocket.url.path)
-
-        # there are no HTTP methods for web sockets, assuming "GET"...
-        authorized = await rbac_repo.check_user_is_authorized(user.user_id, "GET", path)
-        if not authorized:
-            raise HTTPException(
-                status_code=status.HTTP_401_UNAUTHORIZED,
-                detail=f"User is not authorized '{user.user_id}' on '{path}'",
-                headers={"WWW-Authenticate": "Bearer"},
-            )
-
         return user
 
     except HTTPException as e:

gns3server/api/routes/controller/dependencies/rbac.py

@@ -0,0 +1,78 @@
+#
+# Copyright (C) 2023 GNS3 Technologies Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import re
+
+from fastapi import Request, WebSocket, Depends, HTTPException
+from gns3server import schemas
+from gns3server.db.repositories.rbac import RbacRepository
+from .authentication import get_current_active_user, get_current_active_user_from_websocket
+from .database import get_repository
+
+import logging
+
+log = logging.getLogger()
+
+
+def has_privilege(
+        privilege_name: str
+):
+    async def get_user_and_check_privilege(
+            request: Request,
+            current_user: schemas.User = Depends(get_current_active_user),
+            rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+    ):
+        if not current_user.is_superadmin:
+            path = re.sub(r"^/v[0-9]", "", request.url.path)  # remove the prefix (e.g. "/v3") from URL path
+            print(f"Checking user {current_user.username} has privilege {privilege_name} on '{path}'")
+            if not await rbac_repo.check_user_has_privilege(current_user.user_id, path, privilege_name):
+                raise HTTPException(status_code=403, detail=f"Permission denied (privilege {privilege_name} is required)")
+            return current_user
+    return get_user_and_check_privilege
+
+
+def has_privilege_on_websocket(
+        privilege_name: str
+):
+    async def get_user_and_check_privilege(
+            websocket: WebSocket,
+            current_user: schemas.User = Depends(get_current_active_user_from_websocket),
+            rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+    ):
+        if not current_user.is_superadmin:
+            path = re.sub(r"^/v[0-9]", "", websocket.url.path)  # remove the prefix (e.g. "/v3") from URL path
+            log.debug(f"Checking user {current_user.username} has privilege {privilege_name} on '{path}'")
+            if not await rbac_repo.check_user_has_privilege(current_user.user_id, path, privilege_name):
+                raise HTTPException(status_code=403, detail=f"Permission denied (privilege {privilege_name} is required)")
+            return current_user
+    return get_user_and_check_privilege
+
+# class PrivilegeChecker:
+#
+#     def __init__(self, required_privilege: str) -> None:
+#         self._required_privilege = required_privilege
+#
+#     async def __call__(
+#             self,
+#             current_user: schemas.User = Depends(get_current_active_user),
+#             rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+#     ) -> bool:
+#
+#         if not await rbac_repo.check_user_has_privilege(current_user.user_id, "/projects", self._required_privilege):
+#             raise HTTPException(status_code=403, detail=f"Permission denied (privilege {self._required_privilege} is required)")
+#         return True
+
+# Depends(PrivilegeChecker("Project.Audit"))

gns3server/api/routes/controller/groups.py

@@ -78,7 +78,7 @@ async def get_user_group(
         users_repo: UsersRepository = Depends(get_repository(UsersRepository)),
 ) -> schemas.UserGroup:
     """
-    Get an user group.
+    Get a user group.
     """
 
     user_group = await users_repo.get_user_group(user_group_id)
@@ -94,7 +94,7 @@ async def update_user_group(
         users_repo: UsersRepository = Depends(get_repository(UsersRepository))
 ) -> schemas.UserGroup:
     """
-    Update an user group.
+    Update a user group.
     """
     user_group = await users_repo.get_user_group(user_group_id)
     if not user_group:
@@ -115,7 +115,7 @@ async def delete_user_group(
     users_repo: UsersRepository = Depends(get_repository(UsersRepository)),
 ) -> None:
     """
-    Delete an user group
+    Delete a user group
     """
 
     user_group = await users_repo.get_user_group(user_group_id)
@@ -152,7 +152,7 @@ async def add_member_to_group(
         users_repo: UsersRepository = Depends(get_repository(UsersRepository))
 ) -> None:
     """
-    Add member to an user group.
+    Add member to a user group.
     """
 
     user = await users_repo.get_user(user_id)
@@ -174,7 +174,7 @@ async def remove_member_from_group(
     users_repo: UsersRepository = Depends(get_repository(UsersRepository)),
 ) -> None:
     """
-    Remove member from an user group.
+    Remove member from a user group.
     """
 
     user = await users_repo.get_user(user_id)
@@ -184,61 +184,3 @@ async def remove_member_from_group(
     user_group = await users_repo.remove_member_from_user_group(user_group_id, user)
     if not user_group:
         raise ControllerNotFoundError(f"User group '{user_group_id}' not found")
-
-
-@router.get("/{user_group_id}/roles", response_model=List[schemas.Role])
-async def get_user_group_roles(
-        user_group_id: UUID,
-        users_repo: UsersRepository = Depends(get_repository(UsersRepository))
-) -> List[schemas.Role]:
-    """
-    Get all user group roles.
-    """
-
-    return await users_repo.get_user_group_roles(user_group_id)
-
-
-@router.put(
-    "/{user_group_id}/roles/{role_id}",
-    status_code=status.HTTP_204_NO_CONTENT
-)
-async def add_role_to_group(
-        user_group_id: UUID,
-        role_id: UUID,
-        users_repo: UsersRepository = Depends(get_repository(UsersRepository)),
-        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
-) -> Response:
-    """
-    Add role to an user group.
-    """
-
-    role = await rbac_repo.get_role(role_id)
-    if not role:
-        raise ControllerNotFoundError(f"Role '{role_id}' not found")
-
-    user_group = await users_repo.add_role_to_user_group(user_group_id, role)
-    if not user_group:
-        raise ControllerNotFoundError(f"User group '{user_group_id}' not found")
-
-
-@router.delete(
-    "/{user_group_id}/roles/{role_id}",
-    status_code=status.HTTP_204_NO_CONTENT
-)
-async def remove_role_from_group(
-    user_group_id: UUID,
-    role_id: UUID,
-    users_repo: UsersRepository = Depends(get_repository(UsersRepository)),
-    rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
-) -> None:
-    """
-    Remove role from an user group.
-    """
-
-    role = await rbac_repo.get_role(role_id)
-    if not role:
-        raise ControllerNotFoundError(f"Role '{role_id}' not found")
-
-    user_group = await users_repo.remove_role_from_user_group(user_group_id, role)
-    if not user_group:
-        raise ControllerNotFoundError(f"User group '{user_group_id}' not found")

gns3server/api/routes/controller/permissions.py

@@ -1,161 +0,0 @@
-#!/usr/bin/env python
-#
-# Copyright (C) 2021 GNS3 Technologies Inc.
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-"""
-API routes for permissions.
-"""
-
-import re
-
-from fastapi import APIRouter, Depends, Response, Request, status
-from fastapi.routing import APIRoute
-from uuid import UUID
-from typing import List
-
-
-from gns3server import schemas
-from gns3server.controller.controller_error import (
-    ControllerBadRequestError,
-    ControllerNotFoundError,
-    ControllerForbiddenError,
-)
-
-from gns3server.db.repositories.rbac import RbacRepository
-from .dependencies.database import get_repository
-from .dependencies.authentication import get_current_active_user
-
-import logging
-
-log = logging.getLogger(__name__)
-
-router = APIRouter()
-
-
-@router.get("", response_model=List[schemas.Permission])
-async def get_permissions(
-        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
-) -> List[schemas.Permission]:
-    """
-    Get all permissions.
-    """
-
-    return await rbac_repo.get_permissions()
-
-
-@router.post("", response_model=schemas.Permission, status_code=status.HTTP_201_CREATED)
-async def create_permission(
-        request: Request,
-        permission_create: schemas.PermissionCreate,
-        current_user: schemas.User = Depends(get_current_active_user),
-        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
-) -> schemas.Permission:
-    """
-    Create a new permission.
-    """
-
-    # TODO: should we prevent having multiple permissions with same methods/path?
-    #if await rbac_repo.check_permission_exists(permission_create):
-    #    raise ControllerBadRequestError(f"Permission '{permission_create.methods} {permission_create.path} "
-    #                                    f"{permission_create.action}' already exists")
-
-    for route in request.app.routes:
-        if isinstance(route, APIRoute):
-
-            # remove the prefix (e.g. "/v3") from the route path
-            route_path = re.sub(r"^/v[0-9]", "", route.path)
-            # replace route path ID parameters by an UUID regex
-            route_path = re.sub(r"{\w+_id}", "[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}", route_path)
-            # replace remaining route path parameters by an word matching regex
-            route_path = re.sub(r"/{[\w:]+}", r"/\\w+", route_path)
-
-            # the permission can match multiple routes
-            if permission_create.path.endswith("/*"):
-                route_path += r"/.*"
-
-            if re.fullmatch(route_path, permission_create.path):
-                for method in permission_create.methods:
-                    if method in list(route.methods):
-                        # check user has the right to add the permission (i.e has already to right on the path)
-                        if not await rbac_repo.check_user_is_authorized(current_user.user_id, method, permission_create.path):
-                            raise ControllerForbiddenError(f"User '{current_user.username}' doesn't have the rights to "
-                                                           f"add a permission on {method} {permission_create.path} or "
-                                                           f"the endpoint doesn't exist")
-                        return await rbac_repo.create_permission(permission_create)
-
-    raise ControllerBadRequestError(f"Permission '{permission_create.methods} {permission_create.path}' "
-                                    f"doesn't match any existing endpoint")
-
-
-@router.get("/{permission_id}", response_model=schemas.Permission)
-async def get_permission(
-        permission_id: UUID,
-        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)),
-) -> schemas.Permission:
-    """
-    Get a permission.
-    """
-
-    permission = await rbac_repo.get_permission(permission_id)
-    if not permission:
-        raise ControllerNotFoundError(f"Permission '{permission_id}' not found")
-    return permission
-
-
-@router.put("/{permission_id}", response_model=schemas.Permission)
-async def update_permission(
-        permission_id: UUID,
-        permission_update: schemas.PermissionUpdate,
-        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
-) -> schemas.Permission:
-    """
-    Update a permission.
-    """
-
-    permission = await rbac_repo.get_permission(permission_id)
-    if not permission:
-        raise ControllerNotFoundError(f"Permission '{permission_id}' not found")
-
-    return await rbac_repo.update_permission(permission_id, permission_update)
-
-
-@router.delete("/{permission_id}", status_code=status.HTTP_204_NO_CONTENT)
-async def delete_permission(
-    permission_id: UUID,
-    rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)),
-) -> None:
-    """
-    Delete a permission.
-    """
-
-    permission = await rbac_repo.get_permission(permission_id)
-    if not permission:
-        raise ControllerNotFoundError(f"Permission '{permission_id}' not found")
-
-    success = await rbac_repo.delete_permission(permission_id)
-    if not success:
-        raise ControllerNotFoundError(f"Permission '{permission_id}' could not be deleted")
-
-
-@router.post("/prune", status_code=status.HTTP_204_NO_CONTENT)
-async def prune_permissions(
-        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
-) -> None:
-    """
-    Prune orphaned permissions.
-    """
-
-    await rbac_repo.prune_permissions()

gns3server/api/routes/controller/projects.py

@@ -49,7 +49,8 @@ from gns3server.db.repositories.rbac import RbacRepository
 from gns3server.db.repositories.templates import TemplatesRepository
 from gns3server.services.templates import TemplatesService
 
-from .dependencies.authentication import get_current_active_user, get_current_active_user_from_websocket
+from .dependencies.authentication import get_current_active_user
+from .dependencies.rbac import has_privilege, has_privilege_on_websocket
 from .dependencies.database import get_repository
 
 responses = {404: {"model": schemas.ErrorMessage, "description": "Could not find project"}}
@@ -84,9 +85,11 @@ async def get_projects(
     else:
         user_projects = []
         for project in controller.projects.values():
-            authorized = await rbac_repo.check_user_is_authorized(
-                current_user.user_id, "GET", f"/projects/{project.id}")
-            if authorized:
+            if await rbac_repo.check_user_has_privilege(
+                    current_user.user_id,
+                    f"/projects/{project.id}",
+                    "Project.Audit"
+            ):
                 user_projects.append(project.asdict())
     return user_projects
 
@@ -97,11 +100,10 @@ async def get_projects(
     response_model=schemas.Project,
     response_model_exclude_unset=True,
     responses={409: {"model": schemas.ErrorMessage, "description": "Could not create project"}},
+    dependencies=[Depends(has_privilege("Project.Allocate"))]
 )
 async def create_project(
         project_data: schemas.ProjectCreate,
-        current_user: schemas.User = Depends(get_current_active_user),
-        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
 ) -> schemas.Project:
     """
     Create a new project.
@@ -109,12 +111,11 @@ async def create_project(
 
     controller = Controller.instance()
     project = await controller.add_project(**jsonable_encoder(project_data, exclude_unset=True))
-    await rbac_repo.add_permission_to_user_with_path(current_user.user_id, f"/projects/{project.id}/*")
     return project.asdict()
 
 
-@router.get("/{project_id}", response_model=schemas.Project, dependencies=[Depends(get_current_active_user)])
-def get_project(project: Project = Depends(dep_project)) -> schemas.Project:
+@router.get("/{project_id}", response_model=schemas.Project, dependencies=[Depends(has_privilege("Project.Audit"))])
+async def get_project(project: Project = Depends(dep_project)) -> schemas.Project:
     """
     Return a project.
     """
@@ -126,7 +127,7 @@ def get_project(project: Project = Depends(dep_project)) -> schemas.Project:
     "/{project_id}",
     response_model=schemas.Project,
     response_model_exclude_unset=True,
-    dependencies=[Depends(get_current_active_user)]
+    dependencies=[Depends(has_privilege("Project.Modify"))]
 )
 async def update_project(
         project_data: schemas.ProjectUpdate,
@@ -143,11 +144,10 @@ async def update_project(
 @router.delete(
     "/{project_id}",
     status_code=status.HTTP_204_NO_CONTENT,
-    dependencies=[Depends(get_current_active_user)]
+    dependencies=[Depends(has_privilege("Project.Allocate"))]
 )
 async def delete_project(
-        project: Project = Depends(dep_project),
-        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+        project: Project = Depends(dep_project)
 ) -> None:
     """
     Delete a project.
@@ -156,10 +156,9 @@ async def delete_project(
     controller = Controller.instance()
     await project.delete()
     controller.remove_project(project)
-    await rbac_repo.delete_all_permissions_with_path(f"/projects/{project.id}")
 
 
-@router.get("/{project_id}/stats", dependencies=[Depends(get_current_active_user)])
+@router.get("/{project_id}/stats", dependencies=[Depends(has_privilege("Project.Audit"))])
 def get_project_stats(project: Project = Depends(dep_project)) -> dict:
     """
     Return a project statistics.
@@ -172,7 +171,7 @@ def get_project_stats(project: Project = Depends(dep_project)) -> dict:
     "/{project_id}/close",
     status_code=status.HTTP_204_NO_CONTENT,
     responses={**responses, 409: {"model": schemas.ErrorMessage, "description": "Could not close project"}},
-    dependencies=[Depends(get_current_active_user)]
+    dependencies=[Depends(has_privilege("Project.Allocate"))]
 )
 async def close_project(project: Project = Depends(dep_project)) -> None:
     """
@@ -187,7 +186,7 @@ async def close_project(project: Project = Depends(dep_project)) -> None:
     status_code=status.HTTP_201_CREATED,
     response_model=schemas.Project,
     responses={**responses, 409: {"model": schemas.ErrorMessage, "description": "Could not open project"}},
-    dependencies=[Depends(get_current_active_user)]
+    dependencies=[Depends(has_privilege("Project.Allocate"))]
 )
 async def open_project(project: Project = Depends(dep_project)) -> schemas.Project:
     """
@@ -203,7 +202,7 @@ async def open_project(project: Project = Depends(dep_project)) -> schemas.Proje
     status_code=status.HTTP_201_CREATED,
     response_model=schemas.Project,
     responses={**responses, 409: {"model": schemas.ErrorMessage, "description": "Could not load project"}},
-    dependencies=[Depends(get_current_active_user)]
+    dependencies=[Depends(has_privilege("Project.Allocate"))]
 )
 async def load_project(path: str = Body(..., embed=True)) -> schemas.Project:
     """
@@ -216,7 +215,7 @@ async def load_project(path: str = Body(..., embed=True)) -> schemas.Project:
     return project.asdict()
 
 
-@router.get("/{project_id}/notifications", dependencies=[Depends(get_current_active_user)])
+@router.get("/{project_id}/notifications", dependencies=[Depends(has_privilege("Project.Audit"))])
 async def project_http_notifications(project_id: UUID) -> StreamingResponse:
     """
     Receive project notifications about the controller from HTTP stream.
@@ -252,7 +251,7 @@ async def project_http_notifications(project_id: UUID) -> StreamingResponse:
 async def project_ws_notifications(
         project_id: UUID,
         websocket: WebSocket,
-        current_user: schemas.User = Depends(get_current_active_user_from_websocket)
+        current_user: schemas.User = Depends(has_privilege_on_websocket("Project.Audit"))
 ) -> None:
     """
     Receive project notifications about the controller from WebSocket.
@@ -288,7 +287,7 @@ async def project_ws_notifications(
                 await project.close()
 
 
-@router.get("/{project_id}/export", dependencies=[Depends(get_current_active_user)])
+@router.get("/{project_id}/export", dependencies=[Depends(has_privilege("Project.Audit"))])
 async def export_project(
     project: Project = Depends(dep_project),
     include_snapshots: bool = False,
@@ -345,7 +344,7 @@ async def export_project(
 
             log.info(f"Project '{project.name}' exported in {time.time() - begin:.4f} seconds")
 
-    # Will be raise if you have no space left or permission issue on your temporary directory
+    # Will be raised if you have no space left or permission issue on your temporary directory
     # RuntimeError: something was wrong during the zip process
     except (ValueError, OSError, RuntimeError) as e:
         raise ConnectionError(f"Cannot export project: {e}")
@@ -358,7 +357,7 @@ async def export_project(
     "/{project_id}/import",
     status_code=status.HTTP_201_CREATED,
     response_model=schemas.Project,
-    dependencies=[Depends(get_current_active_user)]
+    dependencies=[Depends(has_privilege("Project.Allocate"))]
 )
 async def import_project(
         project_id: UUID,
@@ -394,13 +393,11 @@ async def import_project(
     status_code=status.HTTP_201_CREATED,
     response_model=schemas.Project,
     responses={**responses, 409: {"model": schemas.ErrorMessage, "description": "Could not duplicate project"}},
-    dependencies=[Depends(get_current_active_user)]
+    dependencies=[Depends(has_privilege("Project.Allocate"))]
 )
 async def duplicate_project(
         project_data: schemas.ProjectDuplicate,
-        project: Project = Depends(dep_project),
-        current_user: schemas.User = Depends(get_current_active_user),
-        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+        project: Project = Depends(dep_project)
 ) -> schemas.Project:
     """
     Duplicate a project.
@@ -410,11 +407,10 @@ async def duplicate_project(
     new_project = await project.duplicate(
         name=project_data.name, reset_mac_addresses=reset_mac_addresses
     )
-    await rbac_repo.add_permission_to_user_with_path(current_user.user_id, f"/projects/{new_project.id}/*")
     return new_project.asdict()
 
 
-@router.get("/{project_id}/locked", dependencies=[Depends(get_current_active_user)])
+@router.get("/{project_id}/locked", dependencies=[Depends(has_privilege("Project.Audit"))])
 async def locked_project(project: Project = Depends(dep_project)) -> bool:
     """
     Returns whether a project is locked or not
@@ -426,7 +422,7 @@ async def locked_project(project: Project = Depends(dep_project)) -> bool:
 @router.post(
     "/{project_id}/lock",
     status_code=status.HTTP_204_NO_CONTENT,
-    dependencies=[Depends(get_current_active_user)]
+    dependencies=[Depends(has_privilege("Project.Modify"))]
 )
 async def lock_project(project: Project = Depends(dep_project)) -> None:
     """
@@ -439,7 +435,7 @@ async def lock_project(project: Project = Depends(dep_project)) -> None:
 @router.post(
     "/{project_id}/unlock",
     status_code=status.HTTP_204_NO_CONTENT,
-    dependencies=[Depends(get_current_active_user)]
+    dependencies=[Depends(has_privilege("Project.Modify"))]
 )
 async def unlock_project(project: Project = Depends(dep_project)) -> None:
     """
@@ -449,7 +445,7 @@ async def unlock_project(project: Project = Depends(dep_project)) -> None:
     project.unlock()
 
 
-@router.get("/{project_id}/files/{file_path:path}", dependencies=[Depends(get_current_active_user)])
+@router.get("/{project_id}/files/{file_path:path}", dependencies=[Depends(has_privilege("Project.Audit"))])
 async def get_file(file_path: str, project: Project = Depends(dep_project)) -> FileResponse:
     """
     Return a file from a project.
@@ -472,7 +468,7 @@ async def get_file(file_path: str, project: Project = Depends(dep_project)) -> F
 @router.post(
     "/{project_id}/files/{file_path:path}",
     status_code=status.HTTP_204_NO_CONTENT,
-    dependencies=[Depends(get_current_active_user)]
+    dependencies=[Depends(has_privilege("Project.Modify"))]
 )
 async def write_file(file_path: str, request: Request, project: Project = Depends(dep_project)) -> None:
     """
@@ -505,7 +501,7 @@ async def write_file(file_path: str, request: Request, project: Project = Depend
     response_model=schemas.Node,
     status_code=status.HTTP_201_CREATED,
     responses={404: {"model": schemas.ErrorMessage, "description": "Could not find project or template"}},
-    dependencies=[Depends(get_current_active_user)]
+    dependencies=[Depends(has_privilege("Node.Allocate"))]
 )
 async def create_node_from_template(
     project_id: UUID,

gns3server/api/routes/controller/roles.py

@@ -123,57 +123,57 @@ async def delete_role(
         raise ControllerError(f"Role '{role_id}' could not be deleted")
 
 
-@router.get("/{role_id}/permissions", response_model=List[schemas.Permission])
-async def get_role_permissions(
+@router.get("/{role_id}/privileges", response_model=List[schemas.Privilege])
+async def get_role_privileges(
         role_id: UUID,
         rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
-) -> List[schemas.Permission]:
+) -> List[schemas.Privilege]:
     """
-    Get all role permissions.
+    Get all role privileges.
     """
 
-    return await rbac_repo.get_role_permissions(role_id)
+    return await rbac_repo.get_role_privileges(role_id)
 
 
 @router.put(
-    "/{role_id}/permissions/{permission_id}",
+    "/{role_id}/privileges/{privilege_id}",
     status_code=status.HTTP_204_NO_CONTENT
 )
-async def add_permission_to_role(
+async def add_privilege_to_role(
         role_id: UUID,
-        permission_id: UUID,
+        privilege_id: UUID,
         rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
 ) -> None:
     """
-    Add a permission to a role.
+    Add a privilege to a role.
     """
 
-    permission = await rbac_repo.get_permission(permission_id)
-    if not permission:
-        raise ControllerNotFoundError(f"Permission '{permission_id}' not found")
+    privilege = await rbac_repo.get_privilege(privilege_id)
+    if not privilege:
+        raise ControllerNotFoundError(f"Privilege '{privilege_id}' not found")
 
-    role = await rbac_repo.add_permission_to_role(role_id, permission)
+    role = await rbac_repo.add_privilege_to_role(role_id, privilege)
     if not role:
         raise ControllerNotFoundError(f"Role '{role_id}' not found")
 
 
 @router.delete(
-    "/{role_id}/permissions/{permission_id}",
+    "/{role_id}/privileges/{privilege_id}",
     status_code=status.HTTP_204_NO_CONTENT
 )
-async def remove_permission_from_role(
+async def remove_privilege_from_role(
     role_id: UUID,
-    permission_id: UUID,
+    privilege_id: UUID,
     rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)),
 ) -> None:
     """
-    Remove member from an user group.
+    Remove privilege from a role.
     """
 
-    permission = await rbac_repo.get_permission(permission_id)
-    if not permission:
-        raise ControllerNotFoundError(f"Permission '{permission_id}' not found")
+    privilege = await rbac_repo.get_privilege(privilege_id)
+    if not privilege:
+        raise ControllerNotFoundError(f"Privilege '{privilege_id}' not found")
 
-    role = await rbac_repo.remove_permission_from_role(role_id, permission)
+    role = await rbac_repo.remove_privilege_from_role(role_id, privilege)
     if not role:
         raise ControllerNotFoundError(f"Role '{role_id}' not found")

gns3server/api/routes/controller/templates.py

@@ -46,17 +46,13 @@ router = APIRouter(responses=responses)
 @router.post("", response_model=schemas.Template, status_code=status.HTTP_201_CREATED)
 async def create_template(
     template_create: schemas.TemplateCreate,
-    templates_repo: TemplatesRepository = Depends(get_repository(TemplatesRepository)),
-    current_user: schemas.User = Depends(get_current_active_user),
-    rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+    templates_repo: TemplatesRepository = Depends(get_repository(TemplatesRepository))
 ) -> schemas.Template:
     """
     Create a new template.
     """
 
     template = await TemplatesService(templates_repo).create_template(template_create)
-    template_id = template.get("template_id")
-    await rbac_repo.add_permission_to_user_with_path(current_user.user_id, f"/templates/{template_id}/*")
     return template
 
 
@@ -108,7 +104,7 @@ async def delete_template(
     """
 
     await TemplatesService(templates_repo).delete_template(template_id)
-    await rbac_repo.delete_all_permissions_with_path(f"/templates/{template_id}")
+    #await rbac_repo.delete_all_permissions_with_path(f"/templates/{template_id}")
     if prune_images:
         await images_repo.prune_images()
 
@@ -129,27 +125,24 @@ async def get_templates(
     else:
         user_templates = []
         for template in templates:
-            if template.get("builtin") is True:
-                user_templates.append(template)
-                continue
-            template_id = template.get("template_id")
-            authorized = await rbac_repo.check_user_is_authorized(
-                current_user.user_id, "GET", f"/templates/{template_id}")
-            if authorized:
-                user_templates.append(template)
+            # if template.get("builtin") is True:
+            #     user_templates.append(template)
+            #     continue
+            # template_id = template.get("template_id")
+            # authorized = await rbac_repo.check_user_is_authorized(
+            #     current_user.user_id, "GET", f"/templates/{template_id}")
+            # if authorized:
+            user_templates.append(template)
     return user_templates
 
 
 @router.post("/{template_id}/duplicate", response_model=schemas.Template, status_code=status.HTTP_201_CREATED)
 async def duplicate_template(
-        template_id: UUID, templates_repo: TemplatesRepository = Depends(get_repository(TemplatesRepository)),
-        current_user: schemas.User = Depends(get_current_active_user),
-        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+        template_id: UUID, templates_repo: TemplatesRepository = Depends(get_repository(TemplatesRepository))
 ) -> schemas.Template:
     """
     Duplicate a template.
     """
 
     template = await TemplatesService(templates_repo).duplicate_template(template_id)
-    await rbac_repo.add_permission_to_user_with_path(current_user.user_id, f"/templates/{template_id}/*")
     return template

gns3server/api/routes/controller/users.py

@@ -155,7 +155,7 @@ async def get_user(
         users_repo: UsersRepository = Depends(get_repository(UsersRepository)),
 ) -> schemas.User:
     """
-    Get an user.
+    Get a user.
     """
 
     user = await users_repo.get_user(user_id)
@@ -171,7 +171,7 @@ async def update_user(
         users_repo: UsersRepository = Depends(get_repository(UsersRepository))
 ) -> schemas.User:
     """
-    Update an user.
+    Update a user.
     """
 
     if user_update.username and await users_repo.get_user_by_username(user_update.username):
@@ -196,7 +196,7 @@ async def delete_user(
     users_repo: UsersRepository = Depends(get_repository(UsersRepository)),
 ) -> None:
     """
-    Delete an user.
+    Delete a user.
     """
 
     user = await users_repo.get_user(user_id)
@@ -225,65 +225,3 @@ async def get_user_memberships(
     """
 
     return await users_repo.get_user_memberships(user_id)
-
-
-@router.get(
-    "/{user_id}/permissions",
-    dependencies=[Depends(get_current_active_user)],
-    response_model=List[schemas.Permission]
-)
-async def get_user_permissions(
-        user_id: UUID,
-        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
-) -> List[schemas.Permission]:
-    """
-    Get user permissions.
-    """
-
-    return await rbac_repo.get_user_permissions(user_id)
-
-
-@router.put(
-    "/{user_id}/permissions/{permission_id}",
-    dependencies=[Depends(get_current_active_user)],
-    status_code=status.HTTP_204_NO_CONTENT
-)
-async def add_permission_to_user(
-        user_id: UUID,
-        permission_id: UUID,
-        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
-) -> None:
-    """
-    Add a permission to an user.
-    """
-
-    permission = await rbac_repo.get_permission(permission_id)
-    if not permission:
-        raise ControllerNotFoundError(f"Permission '{permission_id}' not found")
-
-    user = await rbac_repo.add_permission_to_user(user_id, permission)
-    if not user:
-        raise ControllerNotFoundError(f"User '{user_id}' not found")
-
-
-@router.delete(
-    "/{user_id}/permissions/{permission_id}",
-    dependencies=[Depends(get_current_active_user)],
-    status_code=status.HTTP_204_NO_CONTENT
-)
-async def remove_permission_from_user(
-    user_id: UUID,
-    permission_id: UUID,
-    rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)),
-) -> None:
-    """
-    Remove permission from an user.
-    """
-
-    permission = await rbac_repo.get_permission(permission_id)
-    if not permission:
-        raise ControllerNotFoundError(f"Permission '{permission_id}' not found")
-
-    user = await rbac_repo.remove_permission_from_user(user_id, permission)
-    if not user:
-        raise ControllerNotFoundError(f"User '{user_id}' not found")