Use an ACL table to check for privileges

gns3server/api/routes/controller/dependencies/authentication.py

@@ -74,21 +74,6 @@ async def get_current_active_user(
             headers={"WWW-Authenticate": "Bearer"},
         )
 
-    # remove the prefix (e.g. "/v3") from URL path
-    path = re.sub(r"^/v[0-9]", "", request.url.path)
-
-    # special case: always authorize access to the "/users/me" endpoint
-    if path == "/users/me":
-        return current_user
-
-    authorized = await rbac_repo.check_user_is_authorized(current_user.user_id, request.method, path)
-    if not authorized:
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail=f"User is not authorized '{current_user.user_id}' on {request.method} '{path}'",
-            headers={"WWW-Authenticate": "Bearer"},
-        )
-
     return current_user
 
 
@@ -96,7 +81,6 @@ async def get_current_active_user_from_websocket(
         websocket: WebSocket,
         token: str = Query(...),
         user_repo: UsersRepository = Depends(get_repository(UsersRepository)),
-        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
 ) -> Optional[schemas.User]:
 
     await websocket.accept()
@@ -121,18 +105,6 @@ async def get_current_active_user_from_websocket(
                 detail=f"'{username}' is not an active user"
             )
 
-        # remove the prefix (e.g. "/v3") from URL path
-        path = re.sub(r"^/v[0-9]", "", websocket.url.path)
-
-        # there are no HTTP methods for web sockets, assuming "GET"...
-        authorized = await rbac_repo.check_user_is_authorized(user.user_id, "GET", path)
-        if not authorized:
-            raise HTTPException(
-                status_code=status.HTTP_401_UNAUTHORIZED,
-                detail=f"User is not authorized '{user.user_id}' on '{path}'",
-                headers={"WWW-Authenticate": "Bearer"},
-            )
-
         return user
 
     except HTTPException as e:

gns3server/api/routes/controller/dependencies/rbac.py

@@ -0,0 +1,78 @@
+#
+# Copyright (C) 2023 GNS3 Technologies Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import re
+
+from fastapi import Request, WebSocket, Depends, HTTPException
+from gns3server import schemas
+from gns3server.db.repositories.rbac import RbacRepository
+from .authentication import get_current_active_user, get_current_active_user_from_websocket
+from .database import get_repository
+
+import logging
+
+log = logging.getLogger()
+
+
+def has_privilege(
+        privilege_name: str
+):
+    async def get_user_and_check_privilege(
+            request: Request,
+            current_user: schemas.User = Depends(get_current_active_user),
+            rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+    ):
+        if not current_user.is_superadmin:
+            path = re.sub(r"^/v[0-9]", "", request.url.path)  # remove the prefix (e.g. "/v3") from URL path
+            print(f"Checking user {current_user.username} has privilege {privilege_name} on '{path}'")
+            if not await rbac_repo.check_user_has_privilege(current_user.user_id, path, privilege_name):
+                raise HTTPException(status_code=403, detail=f"Permission denied (privilege {privilege_name} is required)")
+            return current_user
+    return get_user_and_check_privilege
+
+
+def has_privilege_on_websocket(
+        privilege_name: str
+):
+    async def get_user_and_check_privilege(
+            websocket: WebSocket,
+            current_user: schemas.User = Depends(get_current_active_user_from_websocket),
+            rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+    ):
+        if not current_user.is_superadmin:
+            path = re.sub(r"^/v[0-9]", "", websocket.url.path)  # remove the prefix (e.g. "/v3") from URL path
+            log.debug(f"Checking user {current_user.username} has privilege {privilege_name} on '{path}'")
+            if not await rbac_repo.check_user_has_privilege(current_user.user_id, path, privilege_name):
+                raise HTTPException(status_code=403, detail=f"Permission denied (privilege {privilege_name} is required)")
+            return current_user
+    return get_user_and_check_privilege
+
+# class PrivilegeChecker:
+#
+#     def __init__(self, required_privilege: str) -> None:
+#         self._required_privilege = required_privilege
+#
+#     async def __call__(
+#             self,
+#             current_user: schemas.User = Depends(get_current_active_user),
+#             rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+#     ) -> bool:
+#
+#         if not await rbac_repo.check_user_has_privilege(current_user.user_id, "/projects", self._required_privilege):
+#             raise HTTPException(status_code=403, detail=f"Permission denied (privilege {self._required_privilege} is required)")
+#         return True
+
+# Depends(PrivilegeChecker("Project.Audit"))