Use an ACL table to check for privileges

gns3server/db/models/__init__.py

@@ -16,11 +16,10 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 from .base import Base
-from .acl import ACL
-from .resources import Resource
+from .acl import ACE
 from .users import User, UserGroup
 from .roles import Role
-from .permissions import Permission
+from .privileges import Privilege
 from .computes import Compute
 from .images import Image
 from .templates import (

gns3server/db/models/acl.py

@@ -15,7 +15,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-from sqlalchemy import Column, Boolean, ForeignKey
+from sqlalchemy import Column, String, Boolean, ForeignKey, CheckConstraint
 from sqlalchemy.orm import relationship
 
 from .base import BaseTable, generate_uuid, GUID
@@ -25,17 +25,22 @@ import logging
 log = logging.getLogger(__name__)
 
 
-class ACL(BaseTable):
+class ACE(BaseTable):
 
     __tablename__ = "acl"
 
-    acl_id = Column(GUID, primary_key=True, default=generate_uuid)
+    ace_id = Column(GUID, primary_key=True, default=generate_uuid)
+    path = Column(String)
+    propagate = Column(Boolean, default=True)
     allowed = Column(Boolean, default=True)
+    type: str = Column(String)
     user_id = Column(GUID, ForeignKey('users.user_id', ondelete="CASCADE"))
     user = relationship("User", back_populates="acl_entries")
     group_id = Column(GUID, ForeignKey('user_groups.user_group_id', ondelete="CASCADE"))
     group = relationship("UserGroup", back_populates="acl_entries")
-    resource_id = Column(GUID, ForeignKey('resources.resource_id', ondelete="CASCADE"))
-    resource = relationship("Resource", back_populates="acl_entries")
     role_id = Column(GUID, ForeignKey('roles.role_id', ondelete="CASCADE"))
     role = relationship("Role", back_populates="acl_entries")
+
+    __table_args__ = (
+        CheckConstraint("(user_id IS NOT NULL AND type = 'user') OR (group_id IS NOT NULL AND type = 'group')"),
+    )

gns3server/db/models/permissions.py

@@ -1,129 +0,0 @@
-#!/usr/bin/env python
-#
-# Copyright (C) 2021 GNS3 Technologies Inc.
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-from sqlalchemy import Table, Column, String, ForeignKey, event
-from sqlalchemy.orm import relationship
-
-from .base import Base, BaseTable, generate_uuid, GUID, ListType
-
-import logging
-
-log = logging.getLogger(__name__)
-
-
-permission_role_map = Table(
-    "permission_role_map",
-    Base.metadata,
-    Column("permission_id", GUID, ForeignKey("permissions.permission_id", ondelete="CASCADE")),
-    Column("role_id", GUID, ForeignKey("roles.role_id", ondelete="CASCADE"))
-
-)
-
-
-class Permission(BaseTable):
-
-    __tablename__ = "permissions"
-
-    permission_id = Column(GUID, primary_key=True, default=generate_uuid)
-    description = Column(String)
-    methods = Column(ListType)
-    path = Column(String)
-    action = Column(String)
-    user_id = Column(GUID, ForeignKey('users.user_id', ondelete="CASCADE"))
-    user = relationship("User", back_populates="permissions")
-    roles = relationship("Role", secondary=permission_role_map, back_populates="permissions")
-
-
-@event.listens_for(Permission.__table__, 'after_create')
-def create_default_roles(target, connection, **kw):
-
-    default_permissions = [
-        {
-            "description": "Allow access to all endpoints",
-            "methods": ["GET", "POST", "PUT", "DELETE"],
-            "path": "/",
-            "action": "ALLOW"
-        },
-        {
-            "description": "Allow to receive controller notifications",
-            "methods": ["GET"],
-            "path": "/notifications",
-            "action": "ALLOW"
-        },
-        {
-            "description": "Allow to create and list projects",
-            "methods": ["GET", "POST"],
-            "path": "/projects",
-            "action": "ALLOW"
-        },
-        {
-            "description": "Allow to create and list templates",
-            "methods": ["GET", "POST"],
-            "path": "/templates",
-            "action": "ALLOW"
-        },
-        {
-            "description": "Allow to list computes",
-            "methods": ["GET"],
-            "path": "/computes/*",
-            "action": "ALLOW"
-        },
-        {
-            "description": "Allow access to all symbol endpoints",
-            "methods": ["GET", "POST"],
-            "path": "/symbols/*",
-            "action": "ALLOW"
-        },
-    ]
-
-    stmt = target.insert().values(default_permissions)
-    connection.execute(stmt)
-    connection.commit()
-    log.debug("The default permissions have been created in the database")
-
-
-@event.listens_for(permission_role_map, 'after_create')
-def add_permissions_to_role(target, connection, **kw):
-
-    from .roles import Role
-    roles_table = Role.__table__
-    stmt = roles_table.select().where(roles_table.c.name == "Administrator")
-    result = connection.execute(stmt)
-    role_id = result.first().role_id
-
-    permissions_table = Permission.__table__
-    stmt = permissions_table.select().where(permissions_table.c.path == "/")
-    result = connection.execute(stmt)
-    permission_id = result.first().permission_id
-
-    # add root path to the "Administrator" role
-    stmt = target.insert().values(permission_id=permission_id, role_id=role_id)
-    connection.execute(stmt)
-
-    stmt = roles_table.select().where(roles_table.c.name == "User")
-    result = connection.execute(stmt)
-    role_id = result.first().role_id
-
-    # add minimum required paths to the "User" role
-    for path in ("/notifications", "/projects", "/templates", "/computes/*", "/symbols/*"):
-        stmt = permissions_table.select().where(permissions_table.c.path == path)
-        result = connection.execute(stmt)
-        permission_id = result.first().permission_id
-        stmt = target.insert().values(permission_id=permission_id, role_id=role_id)
-        connection.execute(stmt)
-
-    connection.commit()

gns3server/db/models/privileges.py

@@ -0,0 +1,258 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2023 GNS3 Technologies Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sqlalchemy import Table, Column, String, ForeignKey, event
+from sqlalchemy.orm import relationship
+
+from .base import Base, BaseTable, generate_uuid, GUID
+
+import logging
+
+log = logging.getLogger(__name__)
+
+
+privilege_role_map = Table(
+    "privilege_role_map",
+    Base.metadata,
+    Column("privilege_id", GUID, ForeignKey("privileges.privilege_id", ondelete="CASCADE")),
+    Column("role_id", GUID, ForeignKey("roles.role_id", ondelete="CASCADE"))
+)
+
+
+class Privilege(BaseTable):
+
+    __tablename__ = "privileges"
+
+    privilege_id = Column(GUID, primary_key=True, default=generate_uuid)
+    name = Column(String)
+    description = Column(String)
+    roles = relationship("Role", secondary=privilege_role_map, back_populates="privileges")
+
+
+@event.listens_for(Privilege.__table__, 'after_create')
+def create_default_roles(target, connection, **kw):
+
+    default_privileges = [
+        {
+            "description": "Create or delete a user",
+            "name": "User.Allocate"
+        },
+        {
+            "description": "View a user",
+            "name": "User.Audit"
+        },
+        {
+            "description": "Update a user",
+            "name": "User.Modify"
+        },
+        {
+            "description": "Create or delete a group",
+            "name": "Group.Allocate"
+        },
+        {
+            "description": "View a group",
+            "name": "Group.Audit"
+        },
+        {
+            "description": "Update a group",
+            "name": "Group.Modify"
+        },
+        {
+            "description": "Create or delete a template",
+            "name": "Template.Allocate"
+        },
+        {
+            "description": "View a template",
+            "name": "Template.Audit"
+        },
+        {
+            "description": "Update a template",
+            "name": "Template.Modify"
+        },
+        {
+            "description": "Create or delete a project",
+            "name": "Project.Allocate"
+        },
+        {
+            "description": "View a project",
+            "name": "Project.Audit"
+        },
+        {
+            "description": "Update a project",
+            "name": "Project.Modify"
+        },
+        {
+            "description": "Create or delete project snapshots",
+            "name": "Project.Snapshot"
+        },
+        {
+            "description": "Create or delete a node",
+            "name": "Node.Allocate"
+        },
+        {
+            "description": "View a node",
+            "name": "Node.Audit"
+        },
+        {
+            "description": "Update a node",
+            "name": "Node.Modify"
+        },
+        {
+            "description": "Console access to a node",
+            "name": "Node.Console"
+        },
+        {
+            "description": "Power management for a node",
+            "name": "Node.PowerMgmt"
+        },
+        {
+            "description": "Create or delete a link",
+            "name": "Link.Allocate"
+        },
+        {
+            "description": "View a link",
+            "name": "Link.Audit"
+        },
+        {
+            "description": "Update a link",
+            "name": "Link.Modify"
+        },
+        {
+            "description": "Capture packets on a link",
+            "name": "Link.Capture"
+        },
+        {
+            "description": "Create or delete a drawing",
+            "name": "Drawing.Allocate"
+        },
+        {
+            "description": "View a drawing",
+            "name": "Drawing.Audit"
+        },
+        {
+            "description": "Update a drawing",
+            "name": "Drawing.Modify"
+        },
+        {
+            "description": "Create or delete a symbol",
+            "name": "Symbol.Allocate"
+        },
+        {
+            "description": "View a symbol",
+            "name": "Symbol.Audit"
+        },
+        {
+            "description": "Create or delete an image",
+            "name": "Image.Allocate"
+        },
+        {
+            "description": "View an image",
+            "name": "Image.Audit"
+        },
+        {
+            "description": "Create or delete a compute",
+            "name": "Compute.Allocate"
+        },
+        {
+            "description": "View a compute",
+            "name": "Compute.Audit"
+        },
+    ]
+
+    stmt = target.insert().values(default_privileges)
+    connection.execute(stmt)
+    connection.commit()
+    log.debug("The default privileges have been created in the database")
+
+
+def add_privileges_to_role(target, connection, role, privileges):
+
+    from .roles import Role
+    roles_table = Role.__table__
+    privileges_table = Privilege.__table__
+
+    stmt = roles_table.select().where(roles_table.c.name == role)
+    result = connection.execute(stmt)
+    role_id = result.first().role_id
+    for privilege_name in privileges:
+        stmt = privileges_table.select().where(privileges_table.c.name == privilege_name)
+        result = connection.execute(stmt)
+        privilege_id = result.first().privilege_id
+        stmt = target.insert().values(privilege_id=privilege_id, role_id=role_id)
+        connection.execute(stmt)
+
+
+@event.listens_for(privilege_role_map, 'after_create')
+def add_privileges_to_default_roles(target, connection, **kw):
+
+    from .roles import Role
+    roles_table = Role.__table__
+    stmt = roles_table.select().where(roles_table.c.name == "Administrator")
+    result = connection.execute(stmt)
+    role_id = result.first().role_id
+
+    # add all privileges to the "Administrator" role
+    privileges_table = Privilege.__table__
+    stmt = privileges_table.select()
+    result = connection.execute(stmt)
+    for row in result:
+        privilege_id = row.privilege_id
+        stmt = target.insert().values(privilege_id=privilege_id, role_id=role_id)
+        connection.execute(stmt)
+
+    # add required privileges to the "User" role
+    user_privileges = (
+        "Project.Allocate",
+        "Project.Audit",
+        "Project.Modify",
+        "Project.Snapshot",
+        "Node.Allocate",
+        "Node.Audit",
+        "Node.Modify",
+        "Node.Console",
+        "Node.PowerMgmt",
+        "Link.Allocate",
+        "Link.Audit",
+        "Link.Modify",
+        "Link.Capture",
+        "Drawing.Allocate",
+        "Drawing.Audit",
+        "Drawing.Modify",
+        "Template.Audit",
+        "Symbol.Audit",
+        "Image.Audit",
+        "Compute.Audit"
+    )
+
+    add_privileges_to_role(target, connection, "User", user_privileges)
+
+    # add required privileges to the "Auditor" role
+    auditor_privileges = (
+        "Project.Audit",
+        "Node.Audit",
+        "Link.Audit",
+        "Drawing.Audit",
+        "Template.Audit",
+        "Symbol.Audit",
+        "Image.Audit",
+        "Compute.Audit"
+    )
+
+    add_privileges_to_role(target, connection, "Auditor", auditor_privileges)
+
+    connection.commit()
+    log.debug("Privileges have been added to the default roles in the database")

gns3server/db/models/resource_pools.py

@@ -25,21 +25,18 @@ import logging
 log = logging.getLogger(__name__)
 
 
-class Resource(BaseTable):
+class ResourcePool(BaseTable):
 
-    __tablename__ = "resources"
+    __tablename__ = "resource_pools"
 
-    resource_id = Column(GUID, primary_key=True, default=generate_uuid)
-    name = Column(String, unique=True, index=True)
-    description = Column(String)
-    propagate = Column(Boolean, default=True)
-    user_id = Column(GUID, ForeignKey('users.user_id', ondelete="CASCADE"))
-    user = relationship("User", back_populates="resources")
-    acl_entries = relationship("ACL")
-    parent_id = Column(GUID, ForeignKey("resources.resource_id", ondelete="CASCADE"))
-    children = relationship(
-        "Resource",
-        remote_side=[resource_id],
-        cascade="all, delete-orphan",
-        single_parent=True
-    )
+    resource_id = Column(GUID, primary_key=True)
+    resource_type = Column(String)
+
+    # # Create a self-referential relationship to represent a hierarchy of resources
+    # parent_id = Column(GUID, ForeignKey("resources.resource_id", ondelete="CASCADE"))
+    # children = relationship(
+    #     "Resource",
+    #     remote_side=[resource_id],
+    #     cascade="all, delete-orphan",
+    #     single_parent=True
+    # )

gns3server/db/models/roles.py

@@ -15,23 +15,16 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-from sqlalchemy import Table, Column, String, Boolean, ForeignKey, event
+from sqlalchemy import Column, String, Boolean, event
 from sqlalchemy.orm import relationship
 
-from .base import Base, BaseTable, generate_uuid, GUID
-from .permissions import permission_role_map
+from .base import BaseTable, generate_uuid, GUID
+from .privileges import privilege_role_map
 
 import logging
 
 log = logging.getLogger(__name__)
 
-role_group_map = Table(
-    "role_group_map",
-    Base.metadata,
-    Column("role_id", GUID, ForeignKey("roles.role_id", ondelete="CASCADE")),
-    Column("user_group_id", GUID, ForeignKey("user_groups.user_group_id", ondelete="CASCADE"))
-)
-
 
 class Role(BaseTable):
 
@@ -41,9 +34,8 @@ class Role(BaseTable):
     name = Column(String, unique=True, index=True)
     description = Column(String)
     is_builtin = Column(Boolean, default=False)
-    permissions = relationship("Permission", secondary=permission_role_map, back_populates="roles")
-    groups = relationship("UserGroup", secondary=role_group_map, back_populates="roles")
-    acl_entries = relationship("ACL")
+    privileges = relationship("Privilege", secondary=privilege_role_map, back_populates="roles")
+    acl_entries = relationship("ACE")
 
 
 @event.listens_for(Role.__table__, 'after_create')
@@ -52,31 +44,11 @@ def create_default_roles(target, connection, **kw):
     default_roles = [
         {"name": "Administrator", "description": "Administrator role", "is_builtin": True},
         {"name": "User", "description": "User role", "is_builtin": True},
+        {"name": "Auditor", "description": "Role with read only access", "is_builtin": True},
+        {"name": "No Access", "description": "Role with no privileges (used to forbid access)", "is_builtin": True}
     ]
 
     stmt = target.insert().values(default_roles)
     connection.execute(stmt)
     connection.commit()
     log.debug("The default roles have been created in the database")
-
-
-@event.listens_for(role_group_map, 'after_create')
-def add_admin_to_group(target, connection, **kw):
-
-    from .users import UserGroup
-    user_groups_table = UserGroup.__table__
-    roles_table = Role.__table__
-
-    # Add roles to built-in user groups
-    groups_to_roles = {"Administrators": "Administrator", "Users": "User"}
-    for user_group, role in groups_to_roles.items():
-        stmt = user_groups_table.select().where(user_groups_table.c.name == user_group)
-        result = connection.execute(stmt)
-        user_group_id = result.first().user_group_id
-        stmt = roles_table.select().where(roles_table.c.name == role)
-        result = connection.execute(stmt)
-        role_id = result.first().role_id
-        stmt = target.insert().values(role_id=role_id, user_group_id=user_group_id)
-        connection.execute(stmt)
-
-    connection.commit()

gns3server/db/models/users.py

@@ -19,7 +19,6 @@ from sqlalchemy import Table, Boolean, Column, String, DateTime, ForeignKey, eve
 from sqlalchemy.orm import relationship
 
 from .base import Base, BaseTable, generate_uuid, GUID
-from .roles import role_group_map
 
 from gns3server.config import Config
 from gns3server.services import auth_service
@@ -49,9 +48,7 @@ class User(BaseTable):
     is_active = Column(Boolean, default=True)
     is_superadmin = Column(Boolean, default=False)
     groups = relationship("UserGroup", secondary=user_group_map, back_populates="users")
-    resources = relationship("Resource")
-    permissions = relationship("Permission")
-    acl_entries = relationship("ACL")
+    acl_entries = relationship("ACE")
 
 
 @event.listens_for(User.__table__, 'after_create')
@@ -80,8 +77,7 @@ class UserGroup(BaseTable):
     name = Column(String, unique=True, index=True)
     is_builtin = Column(Boolean, default=False)
     users = relationship("User", secondary=user_group_map, back_populates="groups")
-    roles = relationship("Role", secondary=role_group_map, back_populates="groups")
-    acl_entries = relationship("ACL")
+    acl_entries = relationship("ACE")
 
 
 @event.listens_for(UserGroup.__table__, 'after_create')
@@ -96,21 +92,3 @@ def create_default_user_groups(target, connection, **kw):
     connection.execute(stmt)
     connection.commit()
     log.debug("The default user groups have been created in the database")
-
-
-# @event.listens_for(user_group_link, 'after_create')
-# def add_admin_to_group(target, connection, **kw):
-#
-#     user_groups_table = UserGroup.__table__
-#     stmt = user_groups_table.select().where(user_groups_table.c.name == "Administrators")
-#     result = connection.execute(stmt)
-#     user_group_id = result.first().user_group_id
-#
-#     users_table = User.__table__
-#     stmt = users_table.select().where(users_table.c.is_superadmin.is_(True))
-#     result = connection.execute(stmt)
-#     user_id = result.first().user_id
-#
-#     stmt = target.insert().values(user_id=user_id, user_group_id=user_group_id)
-#     connection.execute(stmt)
-#     connection.commit()