NgTech-LTD/gns3-server
2
0
Fork 0
mirror of https://github.com/GNS3/gns3-server.git synced 2026-09-02 08:05:14 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat: implement simple user isolation based on project ownership

Browse Source 
Users can only see projects they created (created_by field).
Super admins see all projects.
Resource pool projects continue to work as before.
This commit is contained in:
YueGuobin 2026-05-25 23:48:11 +08:00
parent e5636b0186
commit 7c0b465b74
No known key found for this signature in database
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
gns3server/api/routes/controller/projects.py
View File

@ -90,16 +90,16 @@ async def get_projects(
if current_user.is_superadmin:
# super admin sees all projects
return [p.asdict() for p in controller.projects.values()]
elif await rbac_repo.check_user_has_privilege(current_user.user_id, "/projects", "Project.Audit"):
# user with Project.Audit privilege on '/projects' sees all projects except those in resource pools
project_ids_in_pools = [str(r.resource_id) for r in await pools_repo.get_resources() if r.resource_type == "project"]
projects.extend([p.asdict() for p in controller.projects.values() if p.id not in project_ids_in_pools])
# user with Project.Audit privilege on resource pools sees the projects in these pools
user_pool_resources = await rbac_repo.get_user_pool_resources(current_user.user_id, "Project.Audit")
project_ids_in_pools = [str(r.resource_id) for r in user_pool_resources if r.resource_type == "project"]
projects.extend([p.asdict() for p in controller.projects.values() if p.id in project_ids_in_pools])
# simple user isolation: users see only their own projects
user_projects = [p.asdict() for p in controller.projects.values() if p.created_by == current_user.username]
projects.extend(user_projects)
return projects