From 7c0b465b74c78ac7222db00c4d4f616f4b5e6cef Mon Sep 17 00:00:00 2001 From: YueGuobin Date: Mon, 25 May 2026 23:48:11 +0800 Subject: [PATCH] feat: implement simple user isolation based on project ownership Users can only see projects they created (created_by field). Super admins see all projects. Resource pool projects continue to work as before. --- gns3server/api/routes/controller/projects.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/gns3server/api/routes/controller/projects.py b/gns3server/api/routes/controller/projects.py index 99861230c..d58b1a8c6 100644 --- a/gns3server/api/routes/controller/projects.py +++ b/gns3server/api/routes/controller/projects.py @@ -90,16 +90,16 @@ async def get_projects( if current_user.is_superadmin: # super admin sees all projects return [p.asdict() for p in controller.projects.values()] - elif await rbac_repo.check_user_has_privilege(current_user.user_id, "/projects", "Project.Audit"): - # user with Project.Audit privilege on '/projects' sees all projects except those in resource pools - project_ids_in_pools = [str(r.resource_id) for r in await pools_repo.get_resources() if r.resource_type == "project"] - projects.extend([p.asdict() for p in controller.projects.values() if p.id not in project_ids_in_pools]) # user with Project.Audit privilege on resource pools sees the projects in these pools user_pool_resources = await rbac_repo.get_user_pool_resources(current_user.user_id, "Project.Audit") project_ids_in_pools = [str(r.resource_id) for r in user_pool_resources if r.resource_type == "project"] projects.extend([p.asdict() for p in controller.projects.values() if p.id in project_ids_in_pools]) + # simple user isolation: users see only their own projects + user_projects = [p.asdict() for p in controller.projects.values() if p.created_by == current_user.username] + projects.extend(user_projects) + return projects