Base API and tables for RBAC support.

gns3server/db/models/__init__.py

@@ -17,6 +17,8 @@
 
 from .base import Base
 from .users import User, UserGroup
+from .roles import Role
+from .permissions import Permission
 from .computes import Compute
 from .templates import (
     Template,

gns3server/db/models/base.py

@@ -19,7 +19,7 @@ import uuid
 
 from fastapi.encoders import jsonable_encoder
 from sqlalchemy import Column, DateTime, func, inspect
-from sqlalchemy.types import TypeDecorator, CHAR
+from sqlalchemy.types import TypeDecorator, CHAR, VARCHAR
 from sqlalchemy.dialects.postgresql import UUID
 from sqlalchemy.ext.declarative import as_declarative
 
@@ -72,6 +72,37 @@ class GUID(TypeDecorator):
             return value
 
 
+class ListException(Exception):
+    pass
+
+
+class ListType(TypeDecorator):
+    """
+    Save/restore a Python list to/from a database column.
+    """
+
+    impl = VARCHAR
+    cache_ok = True
+
+    def __init__(self, separator=',', *args, **kwargs):
+
+        self._separator = separator
+        super().__init__(*args, **kwargs)
+
+    def process_bind_param(self, value, dialect):
+        if value is not None:
+            if any(self._separator in str(item) for item in value):
+                raise ListException(f"List values cannot contain '{self._separator}'"
+                                    f"Please use a different separator.")
+            return self._separator.join(map(str, value))
+
+    def process_result_value(self, value, dialect):
+        if value is None:
+            return []
+        else:
+            return list(map(str, value.split(self._separator)))
+
+
 class BaseTable(Base):
 
     __abstract__ = True
@@ -79,6 +110,8 @@ class BaseTable(Base):
     created_at = Column(DateTime, server_default=func.current_timestamp())
     updated_at = Column(DateTime, server_default=func.current_timestamp(), onupdate=func.current_timestamp())
 
+    __mapper_args__ = {"eager_defaults": True}
+
 
 def generate_uuid():
     return str(uuid.uuid4())

gns3server/db/models/permissions.py

@@ -0,0 +1,45 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2021 GNS3 Technologies Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sqlalchemy import Table, Column, String, ForeignKey, Boolean
+from sqlalchemy.orm import relationship
+
+from .base import Base, BaseTable, generate_uuid, GUID, ListType
+
+import logging
+
+log = logging.getLogger(__name__)
+
+
+permission_role_link = Table(
+    "permissions_roles_link",
+    Base.metadata,
+    Column("permission_id", GUID, ForeignKey("permissions.permission_id", ondelete="CASCADE")),
+    Column("role_id", GUID, ForeignKey("roles.role_id", ondelete="CASCADE"))
+
+)
+
+
+class Permission(BaseTable):
+
+    __tablename__ = "permissions"
+
+    permission_id = Column(GUID, primary_key=True, default=generate_uuid)
+    methods = Column(ListType)
+    path = Column(String)
+    action = Column(String)
+    roles = relationship("Role", secondary=permission_role_link, back_populates="permissions")

gns3server/db/models/roles.py

@@ -0,0 +1,59 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2021 GNS3 Technologies Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sqlalchemy import Table, Column, String, Boolean, ForeignKey, event
+from sqlalchemy.orm import relationship
+
+from .base import Base, BaseTable, generate_uuid, GUID
+from .permissions import permission_role_link
+
+import logging
+
+log = logging.getLogger(__name__)
+
+role_group_link = Table(
+    "roles_groups_link",
+    Base.metadata,
+    Column("role_id", GUID, ForeignKey("roles.role_id", ondelete="CASCADE")),
+    Column("user_group_id", GUID, ForeignKey("user_groups.user_group_id", ondelete="CASCADE"))
+)
+
+
+class Role(BaseTable):
+
+    __tablename__ = "roles"
+
+    role_id = Column(GUID, primary_key=True, default=generate_uuid)
+    name = Column(String)
+    description = Column(String)
+    is_updatable = Column(Boolean, default=True)
+    permissions = relationship("Permission", secondary=permission_role_link, back_populates="roles")
+    groups = relationship("UserGroup", secondary=role_group_link, back_populates="roles")
+
+
+@event.listens_for(Role.__table__, 'after_create')
+def create_default_roles(target, connection, **kw):
+
+    default_roles = [
+        {"name": "Administrator", "description": "Administrator role", "is_updatable": False},
+        {"name": "User", "description": "User role", "is_updatable": False},
+    ]
+
+    stmt = target.insert().values(default_roles)
+    connection.execute(stmt)
+    connection.commit()
+    log.info("The default roles have been created in the database")

gns3server/db/models/users.py

@@ -19,6 +19,8 @@ from sqlalchemy import Table, Boolean, Column, String, ForeignKey, event
 from sqlalchemy.orm import relationship
 
 from .base import Base, BaseTable, generate_uuid, GUID
+from .roles import role_group_link
+
 from gns3server.config import Config
 from gns3server.services import auth_service
 
@@ -26,11 +28,11 @@ import logging
 
 log = logging.getLogger(__name__)
 
-users_group_members = Table(
-    "users_group_members",
+user_group_link = Table(
+    "users_groups_link",
     Base.metadata,
     Column("user_id", GUID, ForeignKey("users.user_id", ondelete="CASCADE")),
-    Column("user_group_id", GUID, ForeignKey("users_group.user_group_id", ondelete="CASCADE"))
+    Column("user_group_id", GUID, ForeignKey("user_groups.user_group_id", ondelete="CASCADE"))
 )
 
 
@@ -45,7 +47,9 @@ class User(BaseTable):
     hashed_password = Column(String)
     is_active = Column(Boolean, default=True)
     is_superadmin = Column(Boolean, default=False)
-    groups = relationship("UserGroup", secondary=users_group_members, back_populates="users")
+    groups = relationship("UserGroup", secondary=user_group_link, back_populates="users")
+    permission_id = Column(GUID, ForeignKey('permissions.permission_id', ondelete="CASCADE"))
+    permissions = relationship("Permission")
 
 
 @event.listens_for(User.__table__, 'after_create')
@@ -68,12 +72,13 @@ def create_default_super_admin(target, connection, **kw):
 
 class UserGroup(BaseTable):
 
-    __tablename__ = "users_group"
+    __tablename__ = "user_groups"
 
     user_group_id = Column(GUID, primary_key=True, default=generate_uuid)
     name = Column(String, unique=True, index=True)
     is_updatable = Column(Boolean, default=True)
-    users = relationship("User", secondary=users_group_members, back_populates="groups")
+    users = relationship("User", secondary=user_group_link, back_populates="groups")
+    roles = relationship("Role", secondary=role_group_link, back_populates="groups")
 
 
 @event.listens_for(UserGroup.__table__, 'after_create')
@@ -91,11 +96,11 @@ def create_default_user_groups(target, connection, **kw):
     log.info("The default user groups have been created in the database")
 
 
-@event.listens_for(users_group_members, 'after_create')
+@event.listens_for(user_group_link, 'after_create')
 def add_admin_to_group(target, connection, **kw):
 
-    users_group_table = UserGroup.__table__
-    stmt = users_group_table.select().where(users_group_table.c.name == "Administrators")
+    user_groups_table = UserGroup.__table__
+    stmt = user_groups_table.select().where(user_groups_table.c.name == "Administrators")
     result = connection.execute(stmt)
     user_group_id = result.first().user_group_id
 

gns3server/db/repositories/rbac.py

@@ -0,0 +1,196 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2020 GNS3 Technologies Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from uuid import UUID
+from typing import Optional, List, Union
+from sqlalchemy import select, update, delete
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import selectinload
+
+from .base import BaseRepository
+
+import gns3server.db.models as models
+from gns3server import schemas
+
+import logging
+
+log = logging.getLogger(__name__)
+
+
+class RbacRepository(BaseRepository):
+
+    def __init__(self, db_session: AsyncSession) -> None:
+
+        super().__init__(db_session)
+
+    async def get_role(self, role_id: UUID) -> Optional[models.Role]:
+
+        query = select(models.Role).\
+            options(selectinload(models.Role.permissions)).\
+            where(models.Role.role_id == role_id)
+        result = await self._db_session.execute(query)
+        return result.scalars().first()
+
+    async def get_role_by_name(self, name: str) -> Optional[models.Role]:
+
+        query = select(models.Role).\
+            options(selectinload(models.Role.permissions)).\
+            where(models.Role.name == name)
+        #query = select(models.Role).where(models.Role.name == name)
+        result = await self._db_session.execute(query)
+        return result.scalars().first()
+
+    async def get_roles(self) -> List[models.Role]:
+
+        query = select(models.Role).options(selectinload(models.Role.permissions))
+        result = await self._db_session.execute(query)
+        return result.scalars().all()
+
+    async def create_role(self, role_create: schemas.RoleCreate) -> models.Role:
+
+        db_role = models.Role(
+            name=role_create.name,
+            description=role_create.description,
+        )
+        self._db_session.add(db_role)
+        await self._db_session.commit()
+        #await self._db_session.refresh(db_role)
+        return await self.get_role(db_role.role_id)
+
+    async def update_role(
+            self,
+            role_id: UUID,
+            role_update: schemas.RoleUpdate
+    ) -> Optional[models.Role]:
+
+        update_values = role_update.dict(exclude_unset=True)
+        query = update(models.Role).where(models.Role.role_id == role_id).values(update_values)
+
+        await self._db_session.execute(query)
+        await self._db_session.commit()
+        return await self.get_role(role_id)
+
+    async def delete_role(self, role_id: UUID) -> bool:
+
+        query = delete(models.Role).where(models.Role.role_id == role_id)
+        result = await self._db_session.execute(query)
+        await self._db_session.commit()
+        return result.rowcount > 0
+
+    async def add_permission_to_role(
+            self,
+            role_id: UUID,
+            permission: models.Permission
+    ) -> Union[None, models.Role]:
+
+        query = select(models.Role).\
+            options(selectinload(models.Role.permissions)).\
+            where(models.Role.role_id == role_id)
+        result = await self._db_session.execute(query)
+        role_db = result.scalars().first()
+        if not role_db:
+            return None
+
+        role_db.permissions.append(permission)
+        await self._db_session.commit()
+        await self._db_session.refresh(role_db)
+        return role_db
+
+    async def remove_permission_from_role(
+            self,
+            role_id: UUID,
+            permission: models.Permission
+    ) -> Union[None, models.Role]:
+
+        query = select(models.Role).\
+            options(selectinload(models.Role.permissions)).\
+            where(models.Role.role_id == role_id)
+        result = await self._db_session.execute(query)
+        role_db = result.scalars().first()
+        if not role_db:
+            return None
+
+        role_db.permissions.remove(permission)
+        await self._db_session.commit()
+        await self._db_session.refresh(role_db)
+        return role_db
+
+    async def get_role_permissions(self, role_id: UUID) -> List[models.Permission]:
+
+        query = select(models.Permission).\
+            join(models.Permission.roles).\
+            filter(models.Role.role_id == role_id)
+
+        result = await self._db_session.execute(query)
+        return result.scalars().all()
+
+    async def get_permission(self, permission_id: UUID) -> Optional[models.Permission]:
+
+        query = select(models.Permission).where(models.Permission.permission_id == permission_id)
+        result = await self._db_session.execute(query)
+        return result.scalars().first()
+
+    async def get_permission_by_path(self, path: str) -> Optional[models.Permission]:
+
+        query = select(models.Permission).where(models.Permission.path == path)
+        result = await self._db_session.execute(query)
+        return result.scalars().first()
+
+    async def get_permissions(self) -> List[models.Permission]:
+
+        query = select(models.Permission)
+        result = await self._db_session.execute(query)
+        return result.scalars().all()
+
+    async def create_permission(self, permission_create: schemas.PermissionCreate) -> models.Permission:
+
+        create_values = permission_create.dict(exclude_unset=True)
+        # action = create_values.pop("action", "deny")
+        # is_allowed = False
+        # if action == "allow":
+        #     is_allowed = True
+
+        db_permission = models.Permission(
+            methods=permission_create.methods,
+            path=permission_create.path,
+            action=permission_create.action,
+        )
+        self._db_session.add(db_permission)
+
+        await self._db_session.commit()
+        await self._db_session.refresh(db_permission)
+        return db_permission
+
+    async def update_permission(
+            self,
+            permission_id: UUID,
+            permission_update: schemas.PermissionUpdate
+    ) -> Optional[models.Permission]:
+
+        update_values = permission_update.dict(exclude_unset=True)
+        query = update(models.Permission).where(models.Permission.permission_id == permission_id).values(update_values)
+
+        await self._db_session.execute(query)
+        await self._db_session.commit()
+        return await self.get_permission(permission_id)
+
+    async def delete_permission(self, permission_id: UUID) -> bool:
+
+        query = delete(models.Permission).where(models.Permission.permission_id == permission_id)
+        result = await self._db_session.execute(query)
+        await self._db_session.commit()
+        return result.rowcount > 0

gns3server/db/repositories/users.py

@@ -210,3 +210,51 @@ class UsersRepository(BaseRepository):
 
         result = await self._db_session.execute(query)
         return result.scalars().all()
+
+    async def add_role_to_user_group(
+            self,
+            user_group_id: UUID,
+            role: models.Role
+    ) -> Union[None, models.UserGroup]:
+
+        query = select(models.UserGroup).\
+            options(selectinload(models.UserGroup.roles)).\
+            where(models.UserGroup.user_group_id == user_group_id)
+        result = await self._db_session.execute(query)
+        user_group_db = result.scalars().first()
+        if not user_group_db:
+            return None
+
+        user_group_db.roles.append(role)
+        await self._db_session.commit()
+        await self._db_session.refresh(user_group_db)
+        return user_group_db
+
+    async def remove_role_from_user_group(
+            self,
+            user_group_id: UUID,
+            role: models.Role
+    ) -> Union[None, models.UserGroup]:
+
+        query = select(models.UserGroup).\
+            options(selectinload(models.UserGroup.roles)).\
+            where(models.UserGroup.user_group_id == user_group_id)
+        result = await self._db_session.execute(query)
+        user_group_db = result.scalars().first()
+        if not user_group_db:
+            return None
+
+        user_group_db.roles.remove(role)
+        await self._db_session.commit()
+        await self._db_session.refresh(user_group_db)
+        return user_group_db
+
+    async def get_user_group_roles(self, user_group_id: UUID) -> List[models.Role]:
+
+        query = select(models.Role). \
+            options(selectinload(models.Role.permissions)). \
+            join(models.UserGroup.roles). \
+            filter(models.UserGroup.user_group_id == user_group_id)
+
+        result = await self._db_session.execute(query)
+        return result.scalars().all()