Add user permissions + RBAC tests.

tests/api/routes/controller/test_permissions.py

@@ -50,7 +50,7 @@ class TestPermissionRoutes:
 
         response = await client.get(app.url_path_for("get_permissions"))
         assert response.status_code == status.HTTP_200_OK
-        assert len(response.json()) == 5  # 4 default permissions + 1 custom permission
+        assert len(response.json()) == 6  # 5 default permissions + 1 custom permission
 
     async def test_update_permission(self, app: FastAPI, client: AsyncClient, db_session: AsyncSession) -> None:
 

tests/api/routes/controller/test_roles.py

@@ -64,21 +64,21 @@ class TestRolesRoutes:
         updated_role_in_db = await rbac_repo.get_role(role_in_db.role_id)
         assert updated_role_in_db.name == "role42"
 
-    # async def test_cannot_update_admin_group(
-    #         self,
-    #         app: FastAPI,
-    #         client: AsyncClient,
-    #         db_session: AsyncSession
-    # ) -> None:
-    #
-    #     user_repo = UsersRepository(db_session)
-    #     group_in_db = await user_repo.get_user_group_by_name("Administrators")
-    #     update_group = {"name": "Hackers"}
-    #     response = await client.put(
-    #         app.url_path_for("update_user_group", user_group_id=group_in_db.user_group_id),
-    #         json=update_group
-    #     )
-    #     assert response.status_code == status.HTTP_403_FORBIDDEN
+    async def test_cannot_update_builtin_user_role(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            db_session: AsyncSession
+    ) -> None:
+
+        rbac_repo = RbacRepository(db_session)
+        role_in_db = await rbac_repo.get_role_by_name("User")
+        update_role = {"name": "Hackers"}
+        response = await client.put(
+            app.url_path_for("update_role", role_id=role_in_db.role_id),
+            json=update_role
+        )
+        assert response.status_code == status.HTTP_403_FORBIDDEN
 
     async def test_delete_role(
             self,
@@ -92,29 +92,29 @@ class TestRolesRoutes:
         response = await client.delete(app.url_path_for("delete_role", role_id=role_in_db.role_id))
         assert response.status_code == status.HTTP_204_NO_CONTENT
 
-    # async def test_cannot_delete_admin_group(
-    #         self,
-    #         app: FastAPI,
-    #         client: AsyncClient,
-    #         db_session: AsyncSession
-    # ) -> None:
-    #
-    #     user_repo = UsersRepository(db_session)
-    #     group_in_db = await user_repo.get_user_group_by_name("Administrators")
-    #     response = await client.delete(app.url_path_for("delete_user_group", user_group_id=group_in_db.user_group_id))
-    #     assert response.status_code == status.HTTP_403_FORBIDDEN
+    async def test_cannot_delete_builtin_administrator_role(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            db_session: AsyncSession
+    ) -> None:
+
+        rbac_repo = RbacRepository(db_session)
+        role_in_db = await rbac_repo.get_role_by_name("Administrator")
+        response = await client.delete(app.url_path_for("delete_role", role_id=role_in_db.role_id))
+        assert response.status_code == status.HTTP_403_FORBIDDEN
 
 
 @pytest.fixture
 async def test_permission(db_session: AsyncSession) -> Permission:
 
     new_permission = schemas.PermissionCreate(
-        methods=[HTTPMethods.get, HTTPMethods.post],
-        path="/templates",
+        methods=[HTTPMethods.get],
+        path="/statistics",
         action=PermissionAction.allow
     )
     rbac_repo = RbacRepository(db_session)
-    existing_permission = await rbac_repo.get_permission_by_path("/templates")
+    existing_permission = await rbac_repo.get_permission_by_path("/statistics")
     if existing_permission:
         return existing_permission
     return await rbac_repo.create_permission(new_permission)
@@ -142,7 +142,7 @@ class TestRolesPermissionsRoutes:
         )
         assert response.status_code == status.HTTP_204_NO_CONTENT
         permissions = await rbac_repo.get_role_permissions(role_in_db.role_id)
-        assert len(permissions) == 4  # 3 default + 1 custom permissions
+        assert len(permissions) == 5  # 4 default permissions + 1 custom permission
 
     async def test_get_role_permissions(
             self,
@@ -160,7 +160,7 @@ class TestRolesPermissionsRoutes:
                 role_id=role_in_db.role_id)
         )
         assert response.status_code == status.HTTP_200_OK
-        assert len(response.json()) == 4  # 3 default + 1 custom permissions
+        assert len(response.json()) == 5  # 4 default permissions + 1 custom permission
 
     async def test_remove_role_from_group(
             self,
@@ -182,4 +182,4 @@ class TestRolesPermissionsRoutes:
         )
         assert response.status_code == status.HTTP_204_NO_CONTENT
         permissions = await rbac_repo.get_role_permissions(role_in_db.role_id)
-        assert len(permissions) == 3  # 3 default permissions
+        assert len(permissions) == 4  # 4 default permissions

tests/api/routes/controller/test_users.py

@@ -25,9 +25,12 @@ from jose import jwt
 
 from sqlalchemy.ext.asyncio import AsyncSession
 from gns3server.db.repositories.users import UsersRepository
+from gns3server.db.repositories.rbac import RbacRepository
+from gns3server.schemas.controller.rbac import Permission, HTTPMethods, PermissionAction
 from gns3server.services import auth_service
 from gns3server.config import Config
 from gns3server.schemas.controller.users import User
+from gns3server import schemas
 import gns3server.db.models as models
 
 pytestmark = pytest.mark.asyncio
@@ -341,3 +344,79 @@ class TestSuperAdmin:
     #     response = await client.get(app.url_path_for("get_user_memberships", user_id=admin_in_db.user_id))
     #     assert response.status_code == status.HTTP_200_OK
     #     assert len(response.json()) == 1
+
+@pytest.fixture
+async def test_permission(db_session: AsyncSession) -> Permission:
+
+    new_permission = schemas.PermissionCreate(
+        methods=[HTTPMethods.get],
+        path="/statistics",
+        action=PermissionAction.allow
+    )
+    rbac_repo = RbacRepository(db_session)
+    existing_permission = await rbac_repo.get_permission_by_path("/statistics")
+    if existing_permission:
+        return existing_permission
+    return await rbac_repo.create_permission(new_permission)
+
+
+class TestUserPermissionsRoutes:
+
+    async def test_add_permission_to_user(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            test_user: User,
+            test_permission: Permission,
+            db_session: AsyncSession
+    ) -> None:
+
+        response = await client.put(
+            app.url_path_for(
+                "add_permission_to_user",
+                user_id=str(test_user.user_id),
+                permission_id=str(test_permission.permission_id)
+            )
+        )
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+        rbac_repo = RbacRepository(db_session)
+        permissions = await rbac_repo.get_user_permissions(test_user.user_id)
+        assert len(permissions) == 1
+        assert permissions[0].permission_id == test_permission.permission_id
+
+    async def test_get_user_permissions(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            test_user: User,
+            db_session: AsyncSession
+    ) -> None:
+
+        response = await client.get(
+            app.url_path_for(
+                "get_user_permissions",
+                user_id=str(test_user.user_id))
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()) == 1
+
+    async def test_remove_permission_from_user(
+            self,
+            app: FastAPI,
+            client: AsyncClient,
+            test_user: User,
+            test_permission: Permission,
+            db_session: AsyncSession
+    ) -> None:
+
+        response = await client.delete(
+            app.url_path_for(
+                "remove_permission_from_user",
+                user_id=str(test_user.user_id),
+                permission_id=str(test_permission.permission_id)
+            ),
+        )
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+        rbac_repo = RbacRepository(db_session)
+        permissions = await rbac_repo.get_user_permissions(test_user.user_id)
+        assert len(permissions) == 0