Add user permissions + RBAC tests.

gns3server/api/routes/controller/dependencies/authentication.py

@@ -14,6 +14,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import re
 
 from fastapi import Request, Depends, HTTPException, status
 from fastapi.security import OAuth2PasswordBearer
@@ -60,11 +61,16 @@ async def get_current_active_user(
         )
 
     # remove the prefix (e.g. "/v3") from URL path
-    if request.url.path.startswith("/v3"):
-        path = request.url.path[len("/v3"):]
+    match = re.search(r"^(/v[0-9]+).*", request.url.path)
+    if match:
+        path = request.url.path[len(match.group(1)):]
     else:
         path = request.url.path
 
+    # special case: always authorize access to the "/users/me" endpoint
+    if path == "/users/me":
+        return current_user
+
     authorized = await rbac_repo.check_user_is_authorized(current_user.user_id, request.method, path)
     if not authorized:
         raise HTTPException(

gns3server/api/routes/controller/groups.py

@@ -100,7 +100,7 @@ async def update_user_group(
         raise ControllerNotFoundError(f"User group '{user_group_id}' not found")
 
     if user_group.builtin:
-        raise ControllerForbiddenError(f"User group '{user_group_id}' cannot be updated")
+        raise ControllerForbiddenError(f"Built-in user group '{user_group_id}' cannot be updated")
 
     return await users_repo.update_user_group(user_group_id, user_group_update)
 
@@ -122,7 +122,7 @@ async def delete_user_group(
         raise ControllerNotFoundError(f"User group '{user_group_id}' not found")
 
     if user_group.builtin:
-        raise ControllerForbiddenError(f"User group '{user_group_id}' cannot be deleted")
+        raise ControllerForbiddenError(f"Built-in user group '{user_group_id}' cannot be deleted")
 
     success = await users_repo.delete_user_group(user_group_id)
     if not success:

gns3server/api/routes/controller/projects.py

@@ -70,13 +70,25 @@ CHUNK_SIZE = 1024 * 8  # 8KB
 
 
 @router.get("", response_model=List[schemas.Project], response_model_exclude_unset=True)
-def get_projects() -> List[schemas.Project]:
+async def get_projects(
+        current_user: schemas.User = Depends(get_current_active_user),
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> List[schemas.Project]:
     """
     Return all projects.
     """
 
     controller = Controller.instance()
-    return [p.asdict() for p in controller.projects.values()]
+    if current_user.is_superadmin:
+        return [p.asdict() for p in controller.projects.values()]
+    else:
+        user_projects = []
+        for project in controller.projects.values():
+            authorized = await rbac_repo.check_user_is_authorized(
+                current_user.user_id, "GET", f"/projects/{project.id}")
+            if authorized:
+                user_projects.append(project.asdict())
+    return user_projects
 
 
 @router.post(
@@ -97,7 +109,7 @@ async def create_project(
 
     controller = Controller.instance()
     project = await controller.add_project(**jsonable_encoder(project_data, exclude_unset=True))
-    await rbac_repo.add_permission_to_user(current_user.user_id, f"/projects/{project.id}/*")
+    await rbac_repo.add_permission_to_user_with_path(current_user.user_id, f"/projects/{project.id}/*")
     return project.asdict()
 
 
@@ -135,7 +147,7 @@ async def delete_project(
     controller = Controller.instance()
     await project.delete()
     controller.remove_project(project)
-    await rbac_repo.delete_all_permissions_matching_path(f"/projects/{project.id}")
+    await rbac_repo.delete_all_permissions_with_path(f"/projects/{project.id}")
 
 
 @router.get("/{project_id}/stats")
@@ -357,7 +369,9 @@ async def import_project(
 )
 async def duplicate_project(
         project_data: schemas.ProjectDuplicate,
-        project: Project = Depends(dep_project)
+        project: Project = Depends(dep_project),
+        current_user: schemas.User = Depends(get_current_active_user),
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
 ) -> schemas.Project:
     """
     Duplicate a project.
@@ -374,6 +388,7 @@ async def duplicate_project(
     new_project = await project.duplicate(
         name=project_data.name, location=location, reset_mac_addresses=reset_mac_addresses
     )
+    await rbac_repo.add_permission_to_user_with_path(current_user.user_id, f"/projects/{new_project.id}/*")
     return new_project.asdict()
 
 

gns3server/api/routes/controller/roles.py

@@ -96,7 +96,7 @@ async def update_role(
         raise ControllerNotFoundError(f"Role '{role_id}' not found")
 
     if role.builtin:
-        raise ControllerForbiddenError(f"Role '{role_id}' cannot be updated")
+        raise ControllerForbiddenError(f"Built-in role '{role_id}' cannot be updated")
 
     return await rbac_repo.update_role(role_id, role_update)
 
@@ -115,7 +115,7 @@ async def delete_role(
         raise ControllerNotFoundError(f"Role '{role_id}' not found")
 
     if role.builtin:
-        raise ControllerForbiddenError(f"Role '{role_id}' cannot be deleted")
+        raise ControllerForbiddenError(f"Built-in role '{role_id}' cannot be deleted")
 
     success = await rbac_repo.delete_role(role_id)
     if not success:

gns3server/api/routes/controller/templates.py

@@ -33,6 +33,9 @@ from gns3server import schemas
 from gns3server.controller import Controller
 from gns3server.db.repositories.templates import TemplatesRepository
 from gns3server.services.templates import TemplatesService
+from gns3server.db.repositories.rbac import RbacRepository
+
+from .dependencies.authentication import get_current_active_user
 from .dependencies.database import get_repository
 
 responses = {404: {"model": schemas.ErrorMessage, "description": "Could not find template"}}
@@ -44,12 +47,17 @@ router = APIRouter(responses=responses)
 async def create_template(
     template_create: schemas.TemplateCreate,
     templates_repo: TemplatesRepository = Depends(get_repository(TemplatesRepository)),
+    current_user: schemas.User = Depends(get_current_active_user),
+    rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
 ) -> schemas.Template:
     """
     Create a new template.
     """
 
-    return await TemplatesService(templates_repo).create_template(template_create)
+    template = await TemplatesService(templates_repo).create_template(template_create)
+    template_id = template.get("template_id")
+    await rbac_repo.add_permission_to_user_with_path(current_user.user_id, f"/templates/{template_id}/*")
+    return template
 
 
 @router.get("/templates/{template_id}", response_model=schemas.Template, response_model_exclude_unset=True)
@@ -92,35 +100,58 @@ async def update_template(
     status_code=status.HTTP_204_NO_CONTENT,
 )
 async def delete_template(
-    template_id: UUID, templates_repo: TemplatesRepository = Depends(get_repository(TemplatesRepository))
+        template_id: UUID,
+        templates_repo: TemplatesRepository = Depends(get_repository(TemplatesRepository)),
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
 ) -> None:
     """
     Delete a template.
     """
 
     await TemplatesService(templates_repo).delete_template(template_id)
+    await rbac_repo.delete_all_permissions_with_path(f"/templates/{template_id}")
 
 
 @router.get("/templates", response_model=List[schemas.Template], response_model_exclude_unset=True)
 async def get_templates(
-    templates_repo: TemplatesRepository = Depends(get_repository(TemplatesRepository)),
+        templates_repo: TemplatesRepository = Depends(get_repository(TemplatesRepository)),
+        current_user: schemas.User = Depends(get_current_active_user),
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
 ) -> List[schemas.Template]:
     """
     Return all templates.
     """
 
-    return await TemplatesService(templates_repo).get_templates()
+    templates = await TemplatesService(templates_repo).get_templates()
+    if current_user.is_superadmin:
+        return templates
+    else:
+        user_templates = []
+        for template in templates:
+            if template.get("builtin") is True:
+                user_templates.append(template)
+                continue
+            template_id = template.get("template_id")
+            authorized = await rbac_repo.check_user_is_authorized(
+                current_user.user_id, "GET", f"/templates/{template_id}")
+            if authorized:
+                user_templates.append(template)
+    return user_templates
 
 
 @router.post("/templates/{template_id}/duplicate", response_model=schemas.Template, status_code=status.HTTP_201_CREATED)
 async def duplicate_template(
-    template_id: UUID, templates_repo: TemplatesRepository = Depends(get_repository(TemplatesRepository))
+        template_id: UUID, templates_repo: TemplatesRepository = Depends(get_repository(TemplatesRepository)),
+        current_user: schemas.User = Depends(get_current_active_user),
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
 ) -> schemas.Template:
     """
     Duplicate a template.
     """
 
-    return await TemplatesService(templates_repo).duplicate_template(template_id)
+    template = await TemplatesService(templates_repo).duplicate_template(template_id)
+    await rbac_repo.add_permission_to_user_with_path(current_user.user_id, f"/templates/{template_id}/*")
+    return template
 
 
 @router.post(

gns3server/api/routes/controller/users.py

@@ -32,6 +32,7 @@ from gns3server.controller.controller_error import (
 )
 
 from gns3server.db.repositories.users import UsersRepository
+from gns3server.db.repositories.rbac import RbacRepository
 from gns3server.services import auth_service
 
 from .dependencies.authentication import get_current_active_user
@@ -210,3 +211,65 @@ async def get_user_memberships(
     """
 
     return await users_repo.get_user_memberships(user_id)
+
+
+@router.get(
+    "/{user_id}/permissions",
+    dependencies=[Depends(get_current_active_user)],
+    response_model=List[schemas.Permission]
+)
+async def get_user_permissions(
+        user_id: UUID,
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> List[schemas.Permission]:
+    """
+    Get user permissions.
+    """
+
+    return await rbac_repo.get_user_permissions(user_id)
+
+
+@router.put(
+    "/{user_id}/permissions/{permission_id}",
+    dependencies=[Depends(get_current_active_user)],
+    status_code=status.HTTP_204_NO_CONTENT
+)
+async def add_permission_to_user(
+        user_id: UUID,
+        permission_id: UUID,
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> None:
+    """
+    Add a permission to an user.
+    """
+
+    permission = await rbac_repo.get_permission(permission_id)
+    if not permission:
+        raise ControllerNotFoundError(f"Permission '{permission_id}' not found")
+
+    user = await rbac_repo.add_permission_to_user(user_id, permission)
+    if not user:
+        raise ControllerNotFoundError(f"User '{user_id}' not found")
+
+
+@router.delete(
+    "/{user_id}/permissions/{permission_id}",
+    dependencies=[Depends(get_current_active_user)],
+    status_code=status.HTTP_204_NO_CONTENT
+)
+async def remove_permission_from_user(
+    user_id: UUID,
+    permission_id: UUID,
+    rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)),
+) -> None:
+    """
+    Remove permission from an user.
+    """
+
+    permission = await rbac_repo.get_permission(permission_id)
+    if not permission:
+        raise ControllerNotFoundError(f"Permission '{permission_id}' not found")
+
+    user = await rbac_repo.remove_permission_from_user(user_id, permission)
+    if not user:
+        raise ControllerNotFoundError(f"User '{user_id}' not found")