Add user permissions + RBAC tests.

tests/api/routes/controller/test_permissions.py

@@ -50,7 +50,7 @@ class TestPermissionRoutes:
 
         response = await client.get(app.url_path_for("get_permissions"))
         assert response.status_code == status.HTTP_200_OK
-        assert len(response.json()) == 5  # 4 default permissions + 1 custom permission
+        assert len(response.json()) == 6  # 5 default permissions + 1 custom permission
 
     async def test_update_permission(self, app: FastAPI, client: AsyncClient, db_session: AsyncSession) -> None:
 

tests/api/routes/controller/test_roles.py

@@ -64,21 +64,21 @@ class TestRolesRoutes:
         updated_role_in_db = await rbac_repo.get_role(role_in_db.role_id)
         assert updated_role_in_db.name == "role42"
 
-    # async def test_cannot_update_admin_group(
-    #         self,
-    #         app: FastAPI,
-    #         client: AsyncClient,
-    #         db_session: AsyncSession
-    # ) -> None:
-    #
-    #     user_repo = UsersRepository(db_session)
-    #     group_in_db = await user_repo.get_user_group_by_name("Administrators")
-    #     update_group = {"name": "Hackers"}
-    #     response = await client.put(
-    #         app.url_path_for("update_user_group", user_group_id=group_in_db.user_group_id),
-    #         json=update_group
-    #     )
-    #     assert response.status_code == status.HTTP_403_FORBIDDEN
+    async def test_cannot_update_builtin_user_role(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            db_session: AsyncSession
+    ) -> None:
+
+        rbac_repo = RbacRepository(db_session)
+        role_in_db = await rbac_repo.get_role_by_name("User")
+        update_role = {"name": "Hackers"}
+        response = await client.put(
+            app.url_path_for("update_role", role_id=role_in_db.role_id),
+            json=update_role
+        )
+        assert response.status_code == status.HTTP_403_FORBIDDEN
 
     async def test_delete_role(
             self,
@@ -92,29 +92,29 @@ class TestRolesRoutes:
         response = await client.delete(app.url_path_for("delete_role", role_id=role_in_db.role_id))
         assert response.status_code == status.HTTP_204_NO_CONTENT
 
-    # async def test_cannot_delete_admin_group(
-    #         self,
-    #         app: FastAPI,
-    #         client: AsyncClient,
-    #         db_session: AsyncSession
-    # ) -> None:
-    #
-    #     user_repo = UsersRepository(db_session)
-    #     group_in_db = await user_repo.get_user_group_by_name("Administrators")
-    #     response = await client.delete(app.url_path_for("delete_user_group", user_group_id=group_in_db.user_group_id))
-    #     assert response.status_code == status.HTTP_403_FORBIDDEN
+    async def test_cannot_delete_builtin_administrator_role(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            db_session: AsyncSession
+    ) -> None:
+
+        rbac_repo = RbacRepository(db_session)
+        role_in_db = await rbac_repo.get_role_by_name("Administrator")
+        response = await client.delete(app.url_path_for("delete_role", role_id=role_in_db.role_id))
+        assert response.status_code == status.HTTP_403_FORBIDDEN
 
 
 @pytest.fixture
 async def test_permission(db_session: AsyncSession) -> Permission:
 
     new_permission = schemas.PermissionCreate(
-        methods=[HTTPMethods.get, HTTPMethods.post],
-        path="/templates",
+        methods=[HTTPMethods.get],
+        path="/statistics",
         action=PermissionAction.allow
     )
     rbac_repo = RbacRepository(db_session)
-    existing_permission = await rbac_repo.get_permission_by_path("/templates")
+    existing_permission = await rbac_repo.get_permission_by_path("/statistics")
     if existing_permission:
         return existing_permission
     return await rbac_repo.create_permission(new_permission)
@@ -142,7 +142,7 @@ class TestRolesPermissionsRoutes:
         )
         assert response.status_code == status.HTTP_204_NO_CONTENT
         permissions = await rbac_repo.get_role_permissions(role_in_db.role_id)
-        assert len(permissions) == 4  # 3 default + 1 custom permissions
+        assert len(permissions) == 5  # 4 default permissions + 1 custom permission
 
     async def test_get_role_permissions(
             self,
@@ -160,7 +160,7 @@ class TestRolesPermissionsRoutes:
                 role_id=role_in_db.role_id)
         )
         assert response.status_code == status.HTTP_200_OK
-        assert len(response.json()) == 4  # 3 default + 1 custom permissions
+        assert len(response.json()) == 5  # 4 default permissions + 1 custom permission
 
     async def test_remove_role_from_group(
             self,
@@ -182,4 +182,4 @@ class TestRolesPermissionsRoutes:
         )
         assert response.status_code == status.HTTP_204_NO_CONTENT
         permissions = await rbac_repo.get_role_permissions(role_in_db.role_id)
-        assert len(permissions) == 3  # 3 default permissions
+        assert len(permissions) == 4  # 4 default permissions

tests/api/routes/controller/test_users.py

@@ -25,9 +25,12 @@ from jose import jwt
 
 from sqlalchemy.ext.asyncio import AsyncSession
 from gns3server.db.repositories.users import UsersRepository
+from gns3server.db.repositories.rbac import RbacRepository
+from gns3server.schemas.controller.rbac import Permission, HTTPMethods, PermissionAction
 from gns3server.services import auth_service
 from gns3server.config import Config
 from gns3server.schemas.controller.users import User
+from gns3server import schemas
 import gns3server.db.models as models
 
 pytestmark = pytest.mark.asyncio
@@ -341,3 +344,79 @@ class TestSuperAdmin:
     #     response = await client.get(app.url_path_for("get_user_memberships", user_id=admin_in_db.user_id))
     #     assert response.status_code == status.HTTP_200_OK
     #     assert len(response.json()) == 1
+
+@pytest.fixture
+async def test_permission(db_session: AsyncSession) -> Permission:
+
+    new_permission = schemas.PermissionCreate(
+        methods=[HTTPMethods.get],
+        path="/statistics",
+        action=PermissionAction.allow
+    )
+    rbac_repo = RbacRepository(db_session)
+    existing_permission = await rbac_repo.get_permission_by_path("/statistics")
+    if existing_permission:
+        return existing_permission
+    return await rbac_repo.create_permission(new_permission)
+
+
+class TestUserPermissionsRoutes:
+
+    async def test_add_permission_to_user(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            test_user: User,
+            test_permission: Permission,
+            db_session: AsyncSession
+    ) -> None:
+
+        response = await client.put(
+            app.url_path_for(
+                "add_permission_to_user",
+                user_id=str(test_user.user_id),
+                permission_id=str(test_permission.permission_id)
+            )
+        )
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+        rbac_repo = RbacRepository(db_session)
+        permissions = await rbac_repo.get_user_permissions(test_user.user_id)
+        assert len(permissions) == 1
+        assert permissions[0].permission_id == test_permission.permission_id
+
+    async def test_get_user_permissions(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            test_user: User,
+            db_session: AsyncSession
+    ) -> None:
+
+        response = await client.get(
+            app.url_path_for(
+                "get_user_permissions",
+                user_id=str(test_user.user_id))
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()) == 1
+
+    async def test_remove_permission_from_user(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            test_user: User,
+            test_permission: Permission,
+            db_session: AsyncSession
+    ) -> None:
+
+        response = await client.delete(
+            app.url_path_for(
+                "remove_permission_from_user",
+                user_id=str(test_user.user_id),
+                permission_id=str(test_permission.permission_id)
+            ),
+        )
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+        rbac_repo = RbacRepository(db_session)
+        permissions = await rbac_repo.get_user_permissions(test_user.user_id)
+        assert len(permissions) == 0

tests/controller/test_rbac.py

@@ -0,0 +1,203 @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2021 GNS3 Technologies Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import pytest
+
+from fastapi import FastAPI, status
+from httpx import AsyncClient
+
+from sqlalchemy.ext.asyncio import AsyncSession
+from gns3server.db.repositories.rbac import RbacRepository
+from gns3server.db.models import User
+
+pytestmark = pytest.mark.asyncio
+
+
+class TestPermissions:
+
+    @pytest.mark.parametrize(
+        "method, path, result",
+        (
+            ("GET", "/users", False),
+            ("GET", "/projects", True),
+            ("GET", "/projects/e451ad73-2519-4f83-87fe-a8e821792d44", False),
+            ("POST", "/projects", True),
+            ("GET", "/templates", True),
+            ("GET", "/templates/62e92cf1-244a-4486-8dae-b95439b54da9", False),
+            ("POST", "/templates", True),
+            ("GET", "/computes", True),
+            ("GET", "/computes/local", True),
+            ("GET", "/symbols", True),
+            ("GET", "/symbols/default_symbols", True),
+        ),
+    )
+    async def test_default_permissions_user_group(
+            self,
+            app: FastAPI,
+            authorized_client: AsyncClient,
+            test_user: User,
+            db_session: AsyncSession,
+            method: str,
+            path: str,
+            result: bool
+    ) -> None:
+
+        rbac_repo = RbacRepository(db_session)
+        authorized = await rbac_repo.check_user_is_authorized(test_user.user_id, method, path)
+        assert authorized == result
+
+
+class TestProjectsWithRbac:
+
+    async def test_admin_create_project(self, app: FastAPI, client: AsyncClient):
+
+        params = {"name": "Admin project"}
+        response = await client.post(app.url_path_for("create_project"), json=params)
+        assert response.status_code == status.HTTP_201_CREATED
+
+    async def test_user_only_access_own_projects(
+            self,
+            app: FastAPI,
+            authorized_client: AsyncClient,
+            test_user: User,
+            db_session: AsyncSession
+    ) -> None:
+
+        params = {"name": "User project"}
+        response = await authorized_client.post(app.url_path_for("create_project"), json=params)
+        assert response.status_code == status.HTTP_201_CREATED
+        project_id = response.json()["project_id"]
+
+        rbac_repo = RbacRepository(db_session)
+        permissions_in_db = await rbac_repo.get_user_permissions(test_user.user_id)
+        assert len(permissions_in_db) == 1
+        assert permissions_in_db[0].path == f"/projects/{project_id}/*"
+
+        response = await authorized_client.get(app.url_path_for("get_projects"))
+        assert response.status_code == status.HTTP_200_OK
+        projects = response.json()
+        assert len(projects) == 1
+
+    async def test_admin_access_all_projects(self, app: FastAPI, client: AsyncClient):
+
+        response = await client.get(app.url_path_for("get_projects"))
+        assert response.status_code == status.HTTP_200_OK
+        projects = response.json()
+        assert len(projects) == 2
+
+    async def test_admin_user_give_permission_on_project(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            test_user: User
+    ):
+
+        response = await client.get(app.url_path_for("get_projects"))
+        assert response.status_code == status.HTTP_200_OK
+        projects = response.json()
+        project_id = None
+        for project in projects:
+            if project["name"] == "Admin project":
+                project_id = project["project_id"]
+                break
+
+        new_permission = {
+            "methods": ["GET"],
+            "path": f"/projects/{project_id}",
+            "action": "ALLOW"
+        }
+        response = await client.post(app.url_path_for("create_permission"), json=new_permission)
+        assert response.status_code == status.HTTP_201_CREATED
+        permission_id = response.json()["permission_id"]
+
+        response = await client.put(
+            app.url_path_for(
+                "add_permission_to_user",
+                user_id=test_user.user_id,
+                permission_id=permission_id
+            )
+        )
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+
+    async def test_user_access_admin_project(
+            self,
+            app: FastAPI,
+            authorized_client: AsyncClient,
+            test_user: User,
+            db_session: AsyncSession
+    ) -> None:
+
+        response = await authorized_client.get(app.url_path_for("get_projects"))
+        assert response.status_code == status.HTTP_200_OK
+        projects = response.json()
+        assert len(projects) == 2
+
+
+class TestTemplatesWithRbac:
+
+    async def test_admin_create_template(self, app: FastAPI, client: AsyncClient):
+
+        new_template = {"base_script_file": "vpcs_base_config.txt",
+                        "category": "guest",
+                        "console_auto_start": False,
+                        "console_type": "telnet",
+                        "default_name_format": "PC{0}",
+                        "name": "ADMIN_VPCS_TEMPLATE",
+                        "compute_id": "local",
+                        "symbol": ":/symbols/vpcs_guest.svg",
+                        "template_type": "vpcs"}
+
+        response = await client.post(app.url_path_for("create_template"), json=new_template)
+        assert response.status_code == status.HTTP_201_CREATED
+
+    async def test_user_only_access_own_templates(
+            self, app: FastAPI,
+            authorized_client: AsyncClient,
+            test_user: User,
+            db_session: AsyncSession
+    ) -> None:
+
+        new_template = {"base_script_file": "vpcs_base_config.txt",
+                        "category": "guest",
+                        "console_auto_start": False,
+                        "console_type": "telnet",
+                        "default_name_format": "PC{0}",
+                        "name": "USER_VPCS_TEMPLATE",
+                        "compute_id": "local",
+                        "symbol": ":/symbols/vpcs_guest.svg",
+                        "template_type": "vpcs"}
+
+        response = await authorized_client.post(app.url_path_for("create_template"), json=new_template)
+        assert response.status_code == status.HTTP_201_CREATED
+        template_id = response.json()["template_id"]
+
+        rbac_repo = RbacRepository(db_session)
+        permissions_in_db = await rbac_repo.get_user_permissions(test_user.user_id)
+        assert len(permissions_in_db) == 1
+        assert permissions_in_db[0].path == f"/templates/{template_id}/*"
+
+        response = await authorized_client.get(app.url_path_for("get_templates"))
+        assert response.status_code == status.HTTP_200_OK
+        templates = [template for template in response.json() if template["builtin"] is False]
+        assert len(templates) == 1
+
+    async def test_admin_access_all_templates(self, app: FastAPI, client: AsyncClient):
+
+        response = await client.get(app.url_path_for("get_templates"))
+        assert response.status_code == status.HTTP_200_OK
+        templates = [template for template in response.json() if template["builtin"] is False]
+        assert len(templates) == 2