Base API and tables for RBAC support.

gns3server/api/routes/controller/__init__.py

@@ -30,6 +30,8 @@ from . import symbols
 from . import templates
 from . import users
 from . import groups
+from . import roles
+from . import permissions
 
 from .dependencies.authentication import get_current_active_user
 
@@ -46,31 +48,36 @@ router.include_router(
 )
 
 router.include_router(
-    appliances.router,
+    roles.router,
     dependencies=[Depends(get_current_active_user)],
-    prefix="/appliances",
-    tags=["Appliances"]
+    prefix="/roles",
+    tags=["Roles"]
 )
 
 router.include_router(
-    computes.router,
+    roles.router,
     dependencies=[Depends(get_current_active_user)],
-    prefix="/computes",
-    tags=["Computes"]
+    prefix="/permissions",
+    tags=["Permissions"]
 )
 
 router.include_router(
-    drawings.router,
+    templates.router,
     dependencies=[Depends(get_current_active_user)],
-    prefix="/projects/{project_id}/drawings",
-    tags=["Drawings"])
+    tags=["Templates"]
+)
 
 router.include_router(
-    gns3vm.router,
-    deprecated=True,
+    projects.router,
     dependencies=[Depends(get_current_active_user)],
-    prefix="/gns3vm",
-    tags=["GNS3 VM"]
+    prefix="/projects",
+    tags=["Projects"])
+
+router.include_router(
+    nodes.router,
+    dependencies=[Depends(get_current_active_user)],
+    prefix="/projects/{project_id}/nodes",
+    tags=["Nodes"]
 )
 
 router.include_router(
@@ -81,10 +88,28 @@ router.include_router(
 )
 
 router.include_router(
-    nodes.router,
+    drawings.router,
     dependencies=[Depends(get_current_active_user)],
-    prefix="/projects/{project_id}/nodes",
-    tags=["Nodes"]
+    prefix="/projects/{project_id}/drawings",
+    tags=["Drawings"])
+
+router.include_router(
+    symbols.router,
+    dependencies=[Depends(get_current_active_user)],
+    prefix="/symbols", tags=["Symbols"]
+)
+
+router.include_router(
+    snapshots.router,
+    dependencies=[Depends(get_current_active_user)],
+    prefix="/projects/{project_id}/snapshots",
+    tags=["Snapshots"])
+
+router.include_router(
+    computes.router,
+    dependencies=[Depends(get_current_active_user)],
+    prefix="/computes",
+    tags=["Computes"]
 )
 
 router.include_router(
@@ -94,25 +119,16 @@ router.include_router(
     tags=["Notifications"])
 
 router.include_router(
-    projects.router,
+    appliances.router,
     dependencies=[Depends(get_current_active_user)],
-    prefix="/projects",
-    tags=["Projects"])
-
-router.include_router(
-    snapshots.router,
-    dependencies=[Depends(get_current_active_user)],
-    prefix="/projects/{project_id}/snapshots",
-    tags=["Snapshots"])
-
-router.include_router(
-    symbols.router,
-    dependencies=[Depends(get_current_active_user)],
-    prefix="/symbols", tags=["Symbols"]
+    prefix="/appliances",
+    tags=["Appliances"]
 )
 
 router.include_router(
-    templates.router,
+    gns3vm.router,
+    deprecated=True,
     dependencies=[Depends(get_current_active_user)],
-    tags=["Templates"]
+    prefix="/gns3vm",
+    tags=["GNS3 VM"]
 )

gns3server/api/routes/controller/groups.py

@@ -31,6 +31,7 @@ from gns3server.controller.controller_error import (
 )
 
 from gns3server.db.repositories.users import UsersRepository
+from gns3server.db.repositories.rbac import RbacRepository
 from .dependencies.database import get_repository
 
 import logging
@@ -182,3 +183,61 @@ async def remove_member_from_group(
     user_group = await users_repo.remove_member_from_user_group(user_group_id, user)
     if not user_group:
         raise ControllerNotFoundError(f"User group '{user_group_id}' not found")
+
+
+@router.get("/{user_group_id}/roles", response_model=List[schemas.Role])
+async def get_user_group_roles(
+        user_group_id: UUID,
+        users_repo: UsersRepository = Depends(get_repository(UsersRepository))
+) -> List[schemas.Role]:
+    """
+    Get all user group roles.
+    """
+
+    return await users_repo.get_user_group_roles(user_group_id)
+
+
+@router.put(
+    "/{user_group_id}/roles/{role_id}",
+    status_code=status.HTTP_204_NO_CONTENT
+)
+async def add_role_to_group(
+        user_group_id: UUID,
+        role_id: UUID,
+        users_repo: UsersRepository = Depends(get_repository(UsersRepository)),
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> None:
+    """
+    Add role to an user group.
+    """
+
+    role = await rbac_repo.get_role(role_id)
+    if not role:
+        raise ControllerNotFoundError(f"Role '{role_id}' not found")
+
+    user_group = await users_repo.add_role_to_user_group(user_group_id, role)
+    if not user_group:
+        raise ControllerNotFoundError(f"User group '{user_group_id}' not found")
+
+
+@router.delete(
+    "/{user_group_id}/roles/{role_id}",
+    status_code=status.HTTP_204_NO_CONTENT
+)
+async def remove_role_from_group(
+    user_group_id: UUID,
+    role_id: UUID,
+    users_repo: UsersRepository = Depends(get_repository(UsersRepository)),
+    rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> None:
+    """
+    Remove role from an user group.
+    """
+
+    role = await rbac_repo.get_role(role_id)
+    if not role:
+        raise ControllerNotFoundError(f"Role '{role_id}' not found")
+
+    user_group = await users_repo.remove_role_from_user_group(user_group_id, role)
+    if not user_group:
+        raise ControllerNotFoundError(f"User group '{user_group_id}' not found")

gns3server/api/routes/controller/permissions.py

@@ -0,0 +1,122 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2021 GNS3 Technologies Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+"""
+API routes for permissions.
+"""
+
+from fastapi import APIRouter, Depends, status
+from uuid import UUID
+from typing import List
+
+from gns3server import schemas
+from gns3server.controller.controller_error import (
+    ControllerBadRequestError,
+    ControllerNotFoundError,
+    ControllerForbiddenError,
+)
+
+from gns3server.db.repositories.rbac import RbacRepository
+from .dependencies.database import get_repository
+
+import logging
+
+log = logging.getLogger(__name__)
+
+router = APIRouter()
+
+
+@router.get("", response_model=List[schemas.Permission])
+async def get_permissions(
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> List[schemas.Permission]:
+    """
+    Get all permissions.
+    """
+
+    return await rbac_repo.get_permissions()
+
+
+@router.post("", response_model=schemas.Permission, status_code=status.HTTP_201_CREATED)
+async def create_permission(
+        permission_create: schemas.PermissionCreate,
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> schemas.Permission:
+    """
+    Create a new permission.
+    """
+
+    # if await rbac_repo.get_role_by_path(role_create.name):
+    #     raise ControllerBadRequestError(f"Role '{role_create.name}' already exists")
+
+    return await rbac_repo.create_permission(permission_create)
+
+
+@router.get("/{permission_id}", response_model=schemas.Permission)
+async def get_permission(
+        permission_id: UUID,
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)),
+) -> schemas.Permission:
+    """
+    Get a permission.
+    """
+
+    permission = await rbac_repo.get_permission(permission_id)
+    if not permission:
+        raise ControllerNotFoundError(f"Permission '{permission_id}' not found")
+    return permission
+
+
+@router.put("/{permission_id}", response_model=schemas.Permission)
+async def update_permission(
+        permission_id: UUID,
+        permission_update: schemas.PermissionUpdate,
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> schemas.Permission:
+    """
+    Update a permission.
+    """
+
+    permission = await rbac_repo.get_permission(permission_id)
+    if not permission:
+        raise ControllerNotFoundError(f"Permission '{permission_id}' not found")
+
+    #if not user_group.is_updatable:
+    #    raise ControllerForbiddenError(f"User group '{user_group_id}' cannot be updated")
+
+    return await rbac_repo.update_permission(permission_id, permission_update)
+
+
+@router.delete("/{permission_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_permission(
+    permission_id: UUID,
+    rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)),
+) -> None:
+    """
+    Delete a permission.
+    """
+
+    permission = await rbac_repo.get_permission(permission_id)
+    if not permission:
+        raise ControllerNotFoundError(f"Permission '{permission_id}' not found")
+
+    #if not user_group.is_updatable:
+    #    raise ControllerForbiddenError(f"User group '{user_group_id}' cannot be deleted")
+
+    success = await rbac_repo.delete_permission(permission_id)
+    if not success:
+        raise ControllerNotFoundError(f"Permission '{permission_id}' could not be deleted")

gns3server/api/routes/controller/roles.py

@@ -0,0 +1,178 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2021 GNS3 Technologies Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+"""
+API routes for roles.
+"""
+
+from fastapi import APIRouter, Depends, status
+from uuid import UUID
+from typing import List
+
+from gns3server import schemas
+from gns3server.controller.controller_error import (
+    ControllerBadRequestError,
+    ControllerNotFoundError,
+    ControllerForbiddenError,
+)
+
+from gns3server.db.repositories.rbac import RbacRepository
+from .dependencies.database import get_repository
+
+import logging
+
+log = logging.getLogger(__name__)
+
+router = APIRouter()
+
+
+@router.get("", response_model=List[schemas.Role])
+async def get_roles(
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> List[schemas.Role]:
+    """
+    Get all roles.
+    """
+
+    return await rbac_repo.get_roles()
+
+
+@router.post("", response_model=schemas.Role, status_code=status.HTTP_201_CREATED)
+async def create_role(
+        role_create: schemas.RoleCreate,
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> schemas.Role:
+    """
+    Create a new role.
+    """
+
+    if await rbac_repo.get_role_by_name(role_create.name):
+        raise ControllerBadRequestError(f"Role '{role_create.name}' already exists")
+
+    return await rbac_repo.create_role(role_create)
+
+
+@router.get("/{role_id}", response_model=schemas.Role)
+async def get_role(
+        role_id: UUID,
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)),
+) -> schemas.Role:
+    """
+    Get a role.
+    """
+
+    role = await rbac_repo.get_role(role_id)
+    if not role:
+        raise ControllerNotFoundError(f"Role '{role_id}' not found")
+    return role
+
+
+@router.put("/{role_id}", response_model=schemas.Role)
+async def update_role(
+        role_id: UUID,
+        role_update: schemas.RoleUpdate,
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> schemas.Role:
+    """
+    Update a role.
+    """
+
+    role = await rbac_repo.get_role(role_id)
+    if not role:
+        raise ControllerNotFoundError(f"Role '{role_id}' not found")
+
+    #if not user_group.is_updatable:
+    #    raise ControllerForbiddenError(f"User group '{user_group_id}' cannot be updated")
+
+    return await rbac_repo.update_role(role_id, role_update)
+
+
+@router.delete("/{role_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_role(
+    role_id: UUID,
+    rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)),
+) -> None:
+    """
+    Delete a role.
+    """
+
+    role = await rbac_repo.get_role(role_id)
+    if not role:
+        raise ControllerNotFoundError(f"Role '{role_id}' not found")
+
+    #if not user_group.is_updatable:
+    #    raise ControllerForbiddenError(f"User group '{user_group_id}' cannot be deleted")
+
+    success = await rbac_repo.delete_role(role_id)
+    if not success:
+        raise ControllerNotFoundError(f"Role '{role_id}' could not be deleted")
+
+
+@router.get("/{role_id}/permissions", response_model=List[schemas.Permission])
+async def get_role_permissions(
+        role_id: UUID,
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> List[schemas.Permission]:
+    """
+    Get all role permissions.
+    """
+
+    return await rbac_repo.get_role_permissions(role_id)
+
+
+@router.put(
+    "/{role_id}/permissions/{permission_id}",
+    status_code=status.HTTP_204_NO_CONTENT
+)
+async def add_permission_to_role(
+        role_id: UUID,
+        permission_id: UUID,
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> None:
+    """
+    Add a permission to a role.
+    """
+
+    permission = await rbac_repo.get_permission(permission_id)
+    if not permission:
+        raise ControllerNotFoundError(f"Permission '{permission_id}' not found")
+
+    role = await rbac_repo.add_permission_to_role(role_id, permission)
+    if not role:
+        raise ControllerNotFoundError(f"Role '{role_id}' not found")
+
+
+@router.delete(
+    "/{role_id}/permissions/{permission_id}",
+    status_code=status.HTTP_204_NO_CONTENT
+)
+async def remove_permission_from_role(
+    role_id: UUID,
+    permission_id: UUID,
+    rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)),
+) -> None:
+    """
+    Remove member from an user group.
+    """
+
+    permission = await rbac_repo.get_permission(permission_id)
+    if not permission:
+        raise ControllerNotFoundError(f"Permission '{permission_id}' not found")
+
+    role = await rbac_repo.remove_permission_from_role(role_id, permission)
+    if not role:
+        raise ControllerNotFoundError(f"Role '{role_id}' not found")