From d53ef175f8b16842e28c46b379c6ea3de0f3215d Mon Sep 17 00:00:00 2001 From: grossmj Date: Thu, 7 Sep 2023 17:31:11 +0700 Subject: [PATCH 1/3] DB and API for resource pools --- gns3server/api/routes/controller/__init__.py | 7 + gns3server/api/routes/controller/pools.py | 228 ++++++++++++++++++ gns3server/db/models/__init__.py | 2 +- .../db/models/{resource_pools.py => pools.py} | 0 gns3server/db/models/privileges.py | 12 + gns3server/db/repositories/pools.py | 206 ++++++++++++++++ gns3server/db/repositories/rbac.py | 2 +- gns3server/schemas/__init__.py | 1 + gns3server/schemas/controller/pools.py | 81 +++++++ tests/api/routes/controller/test_pools.py | 183 ++++++++++++++ 10 files changed, 720 insertions(+), 2 deletions(-) create mode 100644 gns3server/api/routes/controller/pools.py rename gns3server/db/models/{resource_pools.py => pools.py} (100%) create mode 100644 gns3server/db/repositories/pools.py create mode 100644 gns3server/schemas/controller/pools.py create mode 100644 tests/api/routes/controller/test_pools.py diff --git a/gns3server/api/routes/controller/__init__.py b/gns3server/api/routes/controller/__init__.py index 28ad9b018..3f37e9203 100644 --- a/gns3server/api/routes/controller/__init__.py +++ b/gns3server/api/routes/controller/__init__.py @@ -32,6 +32,7 @@ from . import users from . import groups from . import roles from . import acl +from . import pools from .dependencies.authentication import get_current_active_user @@ -123,6 +124,12 @@ router.include_router( tags=["Appliances"] ) +router.include_router( + pools.router, + prefix="/pools", + tags=["Resource pools"] +) + router.include_router( gns3vm.router, dependencies=[Depends(get_current_active_user)], diff --git a/gns3server/api/routes/controller/pools.py b/gns3server/api/routes/controller/pools.py new file mode 100644 index 000000000..17e1c17cf --- /dev/null +++ b/gns3server/api/routes/controller/pools.py @@ -0,0 +1,228 @@ +#!/usr/bin/env python +# +# Copyright (C) 2023 GNS3 Technologies Inc. +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +""" +API routes for resource pools. +""" + +from fastapi import APIRouter, Depends, status +from uuid import UUID +from typing import List + +from gns3server import schemas +from gns3server.controller.controller_error import ( + ControllerError, + ControllerBadRequestError, + ControllerNotFoundError +) + +from gns3server.controller import Controller +from gns3server.db.repositories.rbac import RbacRepository +from gns3server.db.repositories.pools import ResourcePoolsRepository + +from .dependencies.rbac import has_privilege +from .dependencies.database import get_repository + +import logging + +log = logging.getLogger(__name__) + +router = APIRouter() + + +@router.get( + "", + response_model=List[schemas.ResourcePool], + dependencies=[Depends(has_privilege("Pool.Audit"))] +) +async def get_resource_pools( + pools_repo: ResourcePoolsRepository = Depends(get_repository(ResourcePoolsRepository)) +) -> List[schemas.ResourcePool]: + """ + Get all resource pools. + + Required privilege: Pool.Audit + """ + + return await pools_repo.get_resource_pools() + + +@router.post( + "", + response_model=schemas.ResourcePool, + status_code=status.HTTP_201_CREATED, + dependencies=[Depends(has_privilege("Pool.Allocate"))] +) +async def create_resource_pool( + resource_pool_create: schemas.ResourcePoolCreate, + pools_repo: ResourcePoolsRepository = Depends(get_repository(ResourcePoolsRepository)) +) -> schemas.ResourcePool: + """ + Create a new resource pool + + Required privilege: Pool.Allocate + """ + + if await pools_repo.get_resource_pool_by_name(resource_pool_create.name): + raise ControllerBadRequestError(f"Resource pool '{resource_pool_create.name}' already exists") + + return await pools_repo.create_resource_pool(resource_pool_create) + + +@router.get( + "/{resource_pool_id}", + response_model=schemas.ResourcePool, + dependencies=[Depends(has_privilege("Pool.Audit"))] +) +async def get_resource_pool( + resource_pool_id: UUID, + pools_repo: ResourcePoolsRepository = Depends(get_repository(ResourcePoolsRepository)) +) -> schemas.ResourcePool: + """ + Get a resource pool. + + Required privilege: Pool.Audit + """ + + resource_pool = await pools_repo.get_resource_pool(resource_pool_id) + if not resource_pool: + raise ControllerNotFoundError(f"Resource pool '{resource_pool_id}' not found") + return resource_pool + + +@router.put( + "/{resource_pool_id}", + response_model=schemas.ResourcePool, + dependencies=[Depends(has_privilege("Pool.Modify"))] +) +async def update_resource_pool( + resource_pool_id: UUID, + resource_pool_update: schemas.ResourcePoolUpdate, + pools_repo: ResourcePoolsRepository = Depends(get_repository(ResourcePoolsRepository)) +) -> schemas.ResourcePool: + """ + Update a resource pool. + + Required privilege: Pool.Modify + """ + + resource_pool = await pools_repo.get_resource_pool(resource_pool_id) + if not resource_pool: + raise ControllerNotFoundError(f"Resource pool '{resource_pool_id}' not found") + + return await pools_repo.update_resource_pool(resource_pool_id, resource_pool_update) + + +@router.delete( + "/{resource_pool_id}", + status_code=status.HTTP_204_NO_CONTENT, + dependencies=[Depends(has_privilege("Pool.Allocate"))] +) +async def delete_resource_pool( + resource_pool_id: UUID, + pools_repo: ResourcePoolsRepository = Depends(get_repository(ResourcePoolsRepository)), + rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)) +) -> None: + """ + Delete a resource pool. + + Required privilege: Pool.Allocate + """ + + resource_pool = await pools_repo.get_resource_pool(resource_pool_id) + if not resource_pool: + raise ControllerNotFoundError(f"Resource pool '{resource_pool_id}' not found") + + success = await pools_repo.delete_resource_pool(resource_pool_id) + if not success: + raise ControllerError(f"Resource pool '{resource_pool_id}' could not be deleted") + await rbac_repo.delete_all_ace_starting_with_path(f"/pools/{resource_pool_id}") + + +@router.get( + "/{resource_pool_id}/resources", + response_model=List[schemas.Resource], + dependencies=[Depends(has_privilege("Pool.Audit"))] +) +async def get_pool_resources( + resource_pool_id: UUID, + pools_repo: ResourcePoolsRepository = Depends(get_repository(ResourcePoolsRepository)), +) -> List[schemas.Resource]: + """ + Get all resource in a pool. + + Required privilege: Pool.Audit + """ + + return await pools_repo.get_pool_resources(resource_pool_id) + + +@router.put( + "/{resource_pool_id}/resources/{resource_id}", + status_code=status.HTTP_204_NO_CONTENT, + dependencies=[Depends(has_privilege("Pool.Modify"))] +) +async def add_resource_to_pool( + resource_pool_id: UUID, + resource_id: UUID, + pools_repo: ResourcePoolsRepository = Depends(get_repository(ResourcePoolsRepository)), +) -> None: + """ + Add resource to a resource pool. + + Required privilege: Pool.Modify + """ + + resource_pool = await pools_repo.get_resource_pool(resource_pool_id) + if not resource_pool: + raise ControllerNotFoundError(f"Resource pool '{resource_pool_id}' not found") + + resources = await pools_repo.get_pool_resources(resource_pool_id) + for resource in resources: + if resource.resource_id == resource_id: + raise ControllerBadRequestError(f"Resource '{resource_id}' is already in '{resource_pool.name}'") + + # we only support projects in resource pools for now + project = Controller.instance().get_project(str(resource_id)) + resource_create = schemas.ResourceCreate(resource_id=resource_id, resource_type="project", name=project.name) + resource = await pools_repo.create_resource(resource_create) + await pools_repo.add_resource_to_pool(resource_pool_id, resource) + + +@router.delete( + "/{resource_pool_id}/resources/{resource_id}", + status_code=status.HTTP_204_NO_CONTENT, + dependencies=[Depends(has_privilege("Pool.Modify"))] +) +async def remove_resource_from_pool( + resource_pool_id: UUID, + resource_id: UUID, + pools_repo: ResourcePoolsRepository = Depends(get_repository(ResourcePoolsRepository)), +) -> None: + """ + Remove resource from a resource pool. + + Required privilege: Pool.Modify + """ + + resource = await pools_repo.get_resource(resource_id) + if not resource: + raise ControllerNotFoundError(f"Resource '{resource_id}' not found") + + resource_pool = await pools_repo.remove_resource_from_pool(resource_pool_id, resource) + if not resource_pool: + raise ControllerNotFoundError(f"Resource pool '{resource_pool_id}' not found") diff --git a/gns3server/db/models/__init__.py b/gns3server/db/models/__init__.py index c31c21b12..ed7c01425 100644 --- a/gns3server/db/models/__init__.py +++ b/gns3server/db/models/__init__.py @@ -22,7 +22,7 @@ from .roles import Role from .privileges import Privilege from .computes import Compute from .images import Image -from .resource_pools import Resource, ResourcePool +from .pools import Resource, ResourcePool from .templates import ( Template, CloudTemplate, diff --git a/gns3server/db/models/resource_pools.py b/gns3server/db/models/pools.py similarity index 100% rename from gns3server/db/models/resource_pools.py rename to gns3server/db/models/pools.py diff --git a/gns3server/db/models/privileges.py b/gns3server/db/models/privileges.py index 65f0df380..ad63503c9 100644 --- a/gns3server/db/models/privileges.py +++ b/gns3server/db/models/privileges.py @@ -95,6 +95,18 @@ def create_default_roles(target, connection, **kw): "description": "Update an ACE", "name": "ACE.Modify" }, + { + "description": "Create or delete a resource pool", + "name": "Pool.Allocate" + }, + { + "description": "View a resource pool", + "name": "Pool.Audit" + }, + { + "description": "Update a resource pool", + "name": "Pool.Modify" + }, { "description": "Create or delete a template", "name": "Template.Allocate" diff --git a/gns3server/db/repositories/pools.py b/gns3server/db/repositories/pools.py new file mode 100644 index 000000000..5f3f259de --- /dev/null +++ b/gns3server/db/repositories/pools.py @@ -0,0 +1,206 @@ +#!/usr/bin/env python +# +# Copyright (C) 2023 GNS3 Technologies Inc. +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +from uuid import UUID +from typing import Optional, List, Union +from sqlalchemy import select, update, delete +from sqlalchemy.ext.asyncio import AsyncSession +from sqlalchemy.orm import selectinload + +from .base import BaseRepository + +import gns3server.db.models as models +from gns3server import schemas + +import logging + +log = logging.getLogger(__name__) + + +class ResourcePoolsRepository(BaseRepository): + + def __init__(self, db_session: AsyncSession) -> None: + + super().__init__(db_session) + + async def get_resource(self, resource_id: UUID) -> Optional[models.Resource]: + """ + Get a resource by its ID. + """ + + query = select(models.Resource).where(models.Resource.resource_id == resource_id) + result = await self._db_session.execute(query) + return result.scalars().first() + + async def get_resources(self) -> List[models.Resource]: + """ + Get all resources. + """ + + query = select(models.Resource) + result = await self._db_session.execute(query) + return result.scalars().all() + + async def create_resource(self, resource: schemas.ResourceCreate) -> models.Resource: + """ + Create a new resource. + """ + + db_resource = models.Resource( + resource_id=resource.resource_id, + resource_type=resource.resource_type, + name=resource.name + ) + self._db_session.add(db_resource) + await self._db_session.commit() + await self._db_session.refresh(db_resource) + return db_resource + + async def delete_resource(self, resource_id: UUID) -> bool: + """ + Delete a resource. + """ + + query = delete(models.Resource).where(models.Resource.resource_id == resource_id) + result = await self._db_session.execute(query) + await self._db_session.commit() + return result.rowcount > 0 + + async def get_resource_pool(self, resource_pool_id: UUID) -> Optional[models.ResourcePool]: + """ + Get a resource pool by its ID. + """ + + query = select(models.ResourcePool).where(models.ResourcePool.resource_pool_id == resource_pool_id) + result = await self._db_session.execute(query) + return result.scalars().first() + + async def get_resource_pool_by_name(self, name: str) -> Optional[models.ResourcePool]: + """ + Get a resource pool by its name. + """ + + query = select(models.ResourcePool).where(models.ResourcePool.name == name) + result = await self._db_session.execute(query) + return result.scalars().first() + + async def get_resource_pools(self) -> List[models.ResourcePool]: + """ + Get all resource pools. + """ + + query = select(models.ResourcePool) + result = await self._db_session.execute(query) + return result.scalars().all() + + async def create_resource_pool(self, resource_pool: schemas.ResourcePoolCreate) -> models.ResourcePool: + """ + Create a new resource pool. + """ + + db_resource_pool = models.ResourcePool(name=resource_pool.name) + self._db_session.add(db_resource_pool) + await self._db_session.commit() + await self._db_session.refresh(db_resource_pool) + return db_resource_pool + + async def update_resource_pool( + self, + resource_pool_id: UUID, + resource_pool_update: schemas.ResourcePoolUpdate + ) -> Optional[models.ResourcePool]: + """ + Update a resource pool. + """ + + update_values = resource_pool_update.model_dump(exclude_unset=True) + query = update(models.ResourcePool).\ + where(models.ResourcePool.resource_pool_id == resource_pool_id).\ + values(update_values) + + await self._db_session.execute(query) + await self._db_session.commit() + resource_pool_db = await self.get_resource_pool(resource_pool_id) + if resource_pool_db: + await self._db_session.refresh(resource_pool_db) # force refresh of updated_at value + return resource_pool_db + + async def delete_resource_pool(self, resource_pool_id: UUID) -> bool: + """ + Delete a resource pool. + """ + + query = delete(models.ResourcePool).where(models.ResourcePool.resource_pool_id == resource_pool_id) + result = await self._db_session.execute(query) + await self._db_session.commit() + return result.rowcount > 0 + + async def add_resource_to_pool( + self, + resource_pool_id: UUID, + resource: models.Resource + ) -> Union[None, models.ResourcePool]: + """ + Add a resource to a resource pool. + """ + + query = select(models.ResourcePool).\ + options(selectinload(models.ResourcePool.resources)).\ + where(models.ResourcePool.resource_pool_id == resource_pool_id) + result = await self._db_session.execute(query) + resource_pool_db = result.scalars().first() + if not resource_pool_db: + return None + + resource_pool_db.resources.append(resource) + await self._db_session.commit() + await self._db_session.refresh(resource_pool_db) + return resource_pool_db + + async def remove_resource_from_pool( + self, + resource_pool_id: UUID, + resource: models.Resource + ) -> Union[None, models.ResourcePool]: + """ + Remove a resource from a resource pool. + """ + + query = select(models.ResourcePool).\ + options(selectinload(models.ResourcePool.resources)).\ + where(models.ResourcePool.resource_pool_id == resource_pool_id) + result = await self._db_session.execute(query) + resource_pool_db = result.scalars().first() + if not resource_pool_db: + return None + + resource_pool_db.resources.remove(resource) + await self._db_session.commit() + await self._db_session.refresh(resource_pool_db) + return resource_pool_db + + async def get_pool_resources(self, resource_pool_id: UUID) -> List[models.Resource]: + """ + Get all resources from a resource pool. + """ + + query = select(models.Resource).\ + join(models.Resource.resource_pools).\ + filter(models.ResourcePool.resource_pool_id == resource_pool_id) + + result = await self._db_session.execute(query) + return result.scalars().all() diff --git a/gns3server/db/repositories/rbac.py b/gns3server/db/repositories/rbac.py index cf1aa9a84..99ea8deaa 100644 --- a/gns3server/db/repositories/rbac.py +++ b/gns3server/db/repositories/rbac.py @@ -18,7 +18,7 @@ from uuid import UUID from urllib.parse import urlparse from typing import Optional, List, Union -from sqlalchemy import select, update, delete, null +from sqlalchemy import select, update, delete from sqlalchemy.ext.asyncio import AsyncSession from sqlalchemy.orm import selectinload diff --git a/gns3server/schemas/__init__.py b/gns3server/schemas/__init__.py index 5b764c7e6..d38b31d3d 100644 --- a/gns3server/schemas/__init__.py +++ b/gns3server/schemas/__init__.py @@ -31,6 +31,7 @@ from .controller.nodes import NodeCreate, NodeUpdate, NodeDuplicate, NodeCapture from .controller.projects import ProjectCreate, ProjectUpdate, ProjectDuplicate, Project, ProjectFile, ProjectCompression from .controller.users import UserCreate, UserUpdate, LoggedInUserUpdate, User, Credentials, UserGroupCreate, UserGroupUpdate, UserGroup from .controller.rbac import RoleCreate, RoleUpdate, Role, Privilege, ACECreate, ACEUpdate, ACE +from .controller.pools import Resource, ResourceCreate, ResourcePoolCreate, ResourcePoolUpdate, ResourcePool from .controller.tokens import Token from .controller.snapshots import SnapshotCreate, Snapshot from .controller.iou_license import IOULicense diff --git a/gns3server/schemas/controller/pools.py b/gns3server/schemas/controller/pools.py new file mode 100644 index 000000000..0235cc1c2 --- /dev/null +++ b/gns3server/schemas/controller/pools.py @@ -0,0 +1,81 @@ +# +# Copyright (C) 2020 GNS3 Technologies Inc. +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +from typing import Optional +from pydantic import ConfigDict, BaseModel, Field +from uuid import UUID +from enum import Enum + +from .base import DateTimeModelMixin + + +class ResourceType(str, Enum): + + project = "project" + + +class ResourceBase(BaseModel): + """ + Common resource properties. + """ + + resource_id: UUID + resource_type: ResourceType = Field(..., description="Type of the resource") + name: Optional[str] = None + model_config = ConfigDict(use_enum_values=True) + + +class ResourceCreate(ResourceBase): + """ + Properties to create a resource. + """ + + pass + + +class Resource(DateTimeModelMixin, ResourceBase): + + model_config = ConfigDict(from_attributes=True) + + +class ResourcePoolBase(BaseModel): + """ + Common resource pool properties. + """ + + name: str + + +class ResourcePoolCreate(ResourcePoolBase): + """ + Properties to create a resource pool. + """ + + pass + + +class ResourcePoolUpdate(ResourcePoolBase): + """ + Properties to update a resource pool. + """ + + pass + + +class ResourcePool(DateTimeModelMixin, ResourcePoolBase): + + resource_pool_id: UUID + model_config = ConfigDict(from_attributes=True) diff --git a/tests/api/routes/controller/test_pools.py b/tests/api/routes/controller/test_pools.py new file mode 100644 index 000000000..38782e442 --- /dev/null +++ b/tests/api/routes/controller/test_pools.py @@ -0,0 +1,183 @@ +#!/usr/bin/env python +# +# Copyright (C) 2023 GNS3 Technologies Inc. +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +import uuid +import pytest +import pytest_asyncio + +from fastapi import FastAPI, status +from httpx import AsyncClient + +from sqlalchemy.ext.asyncio import AsyncSession +from gns3server.db.repositories.pools import ResourcePoolsRepository +from gns3server.controller import Controller +from gns3server.controller.project import Project +from gns3server.schemas.controller.pools import ResourceCreate, ResourcePoolCreate + +pytestmark = pytest.mark.asyncio + + +class TestPoolRoutes: + + async def test_resource_pool(self, app: FastAPI, client: AsyncClient) -> None: + + new_group = {"name": "pool1"} + response = await client.post(app.url_path_for("create_resource_pool"), json=new_group) + assert response.status_code == status.HTTP_201_CREATED + + async def test_get_resource_pool(self, app: FastAPI, client: AsyncClient, db_session: AsyncSession) -> None: + + pools_repo = ResourcePoolsRepository(db_session) + pool_in_db = await pools_repo.get_resource_pool_by_name("pool1") + response = await client.get(app.url_path_for("get_resource_pool", resource_pool_id=pool_in_db.resource_pool_id)) + assert response.status_code == status.HTTP_200_OK + assert response.json()["resource_pool_id"] == str(pool_in_db.resource_pool_id) + + async def test_list_resource_pools(self, app: FastAPI, client: AsyncClient) -> None: + + response = await client.get(app.url_path_for("get_resource_pools")) + assert response.status_code == status.HTTP_200_OK + assert len(response.json()) == 1 + + async def test_update_resource_pool(self, app: FastAPI, client: AsyncClient, db_session: AsyncSession) -> None: + + pools_repo = ResourcePoolsRepository(db_session) + pool_in_db = await pools_repo.get_resource_pool_by_name("pool1") + + update_pool = {"name": "pool42"} + response = await client.put( + app.url_path_for("update_resource_pool", resource_pool_id=pool_in_db.resource_pool_id), + json=update_pool + ) + assert response.status_code == status.HTTP_200_OK + updated_pool_in_db = await pools_repo.get_resource_pool(pool_in_db.resource_pool_id) + assert updated_pool_in_db.name == "pool42" + + async def test_resource_group( + self, + app: FastAPI, + client: AsyncClient, + db_session: AsyncSession + ) -> None: + + pools_repo = ResourcePoolsRepository(db_session) + pool_in_db = await pools_repo.get_resource_pool_by_name("pool42") + response = await client.delete(app.url_path_for("delete_resource_pool", resource_pool_id=pool_in_db.resource_pool_id)) + assert response.status_code == status.HTTP_204_NO_CONTENT + + +class TestResourcesPoolRoutes: + + @pytest_asyncio.fixture + async def project(self, app: FastAPI, client: AsyncClient, controller: Controller) -> Project: + project_id = str(uuid.uuid4()) + params = {"name": "test", "project_id": project_id} + await client.post(app.url_path_for("create_project"), json=params) + return controller.get_project(project_id) + + async def test_add_resource_to_pool( + self, + app: FastAPI, + client: AsyncClient, + db_session: AsyncSession, + project: Project + ) -> None: + + pools_repo = ResourcePoolsRepository(db_session) + new_resource_pool = ResourcePoolCreate( + name="pool1", + ) + pool_in_db = await pools_repo.create_resource_pool(new_resource_pool) + response = await client.put( + app.url_path_for( + "add_resource_to_pool", + resource_pool_id=pool_in_db.resource_pool_id, + resource_id=str(project.id) + ) + ) + assert response.status_code == status.HTTP_204_NO_CONTENT + resources = await pools_repo.get_pool_resources(pool_in_db.resource_pool_id) + assert len(resources) == 1 + assert str(resources[0].resource_id) == project.id + + async def test_add_to_resource_already_in_resource_pool( + self, + app: FastAPI, + client: AsyncClient, + db_session: AsyncSession, + project: Project + ) -> None: + + pools_repo = ResourcePoolsRepository(db_session) + pool_in_db = await pools_repo.get_resource_pool_by_name("pool1") + resource_create = ResourceCreate(resource_id=project.id, resource_type="project") + resource = await pools_repo.create_resource(resource_create) + await pools_repo.add_resource_to_pool(pool_in_db.resource_pool_id, resource) + + response = await client.put( + app.url_path_for( + "add_resource_to_pool", + resource_pool_id=pool_in_db.resource_pool_id, + resource_id=str(resource.resource_id) + ) + ) + assert response.status_code == status.HTTP_400_BAD_REQUEST + + async def test_get_pool_resources( + self, + app: FastAPI, + client: AsyncClient, + db_session: AsyncSession + ) -> None: + + pools_repo = ResourcePoolsRepository(db_session) + pool_in_db = await pools_repo.get_resource_pool_by_name("pool1") + response = await client.get( + app.url_path_for( + "get_pool_resources", + resource_pool_id=pool_in_db.resource_pool_id) + ) + assert response.status_code == status.HTTP_200_OK + assert len(response.json()) == 2 + + async def test_remove_resource_from_pool( + self, + app: FastAPI, + client: AsyncClient, + db_session: AsyncSession, + project: Project + ) -> None: + + pools_repo = ResourcePoolsRepository(db_session) + pool_in_db = await pools_repo.get_resource_pool_by_name("pool1") + resource_create = ResourceCreate(resource_id=project.id, resource_type="project") + resource = await pools_repo.create_resource(resource_create) + await pools_repo.add_resource_to_pool(pool_in_db.resource_pool_id, resource) + + resources = await pools_repo.get_pool_resources(pool_in_db.resource_pool_id) + assert len(resources) == 3 + + response = await client.delete( + app.url_path_for( + "remove_resource_from_pool", + resource_pool_id=pool_in_db.resource_pool_id, + resource_id=str(project.id) + ), + ) + assert response.status_code == status.HTTP_204_NO_CONTENT + resources = await pools_repo.get_pool_resources(pool_in_db.resource_pool_id) + assert len(resources) == 2 From a95dda0d1da4a9ef86bad7e3bd74b99c6b161562 Mon Sep 17 00:00:00 2001 From: grossmj Date: Mon, 11 Sep 2023 18:15:03 +0700 Subject: [PATCH 2/3] Complete resource pool support for projects --- gns3server/api/routes/controller/acl.py | 9 +- gns3server/api/routes/controller/projects.py | 28 ++++- gns3server/api/routes/controller/roles.py | 17 +++ gns3server/db/repositories/rbac.py | 115 +++++++++++++++---- tests/api/routes/controller/test_roles.py | 6 + tests/controller/test_rbac.py | 111 ++++++++++++++++++ 6 files changed, 256 insertions(+), 30 deletions(-) diff --git a/gns3server/api/routes/controller/acl.py b/gns3server/api/routes/controller/acl.py index 778ef51bb..cef43bf23 100644 --- a/gns3server/api/routes/controller/acl.py +++ b/gns3server/api/routes/controller/acl.py @@ -38,6 +38,7 @@ from gns3server.db.repositories.users import UsersRepository from gns3server.db.repositories.rbac import RbacRepository from gns3server.db.repositories.images import ImagesRepository from gns3server.db.repositories.templates import TemplatesRepository +from gns3server.db.repositories.pools import ResourcePoolsRepository from .dependencies.database import get_repository from .dependencies.rbac import has_privilege @@ -57,7 +58,8 @@ async def endpoints( users_repo: UsersRepository = Depends(get_repository(UsersRepository)), rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)), images_repo: ImagesRepository = Depends(get_repository(ImagesRepository)), - templates_repo: TemplatesRepository = Depends(get_repository(TemplatesRepository)) + templates_repo: TemplatesRepository = Depends(get_repository(TemplatesRepository)), + pools_repo: ResourcePoolsRepository = Depends(get_repository(ResourcePoolsRepository)) ) -> List[dict]: """ List all endpoints to be used in ACL entries. @@ -128,6 +130,11 @@ async def endpoints( for template in templates: add_to_endpoints(f"/templates/{template.template_id}", f'Template "{template.name}"', "template") + # resource pools + add_to_endpoints("/pools", "All resource pools", "pool") + pools = await pools_repo.get_resource_pools() + for pool in pools: + add_to_endpoints(f"/pools/{pool.resource_pool_id}", f'Resource pool "{pool.name}"', "pool") return endpoints diff --git a/gns3server/api/routes/controller/projects.py b/gns3server/api/routes/controller/projects.py index d228fcf76..758ab79f8 100644 --- a/gns3server/api/routes/controller/projects.py +++ b/gns3server/api/routes/controller/projects.py @@ -47,9 +47,11 @@ from gns3server.utils.asyncio import aiozipstream from gns3server.utils.path import is_safe_path from gns3server.db.repositories.templates import TemplatesRepository from gns3server.db.repositories.rbac import RbacRepository +from gns3server.db.repositories.pools import ResourcePoolsRepository from gns3server.services.templates import TemplatesService from .dependencies.rbac import has_privilege, has_privilege_on_websocket +from .dependencies.authentication import get_current_active_user from .dependencies.database import get_repository responses = {404: {"model": schemas.ErrorMessage, "description": "Could not find project"}} @@ -69,10 +71,13 @@ def dep_project(project_id: UUID) -> Project: @router.get( "", response_model=List[schemas.Project], - response_model_exclude_unset=True, - dependencies=[Depends(has_privilege("Project.Audit"))] + response_model_exclude_unset=True ) -async def get_projects() -> List[schemas.Project]: +async def get_projects( + current_user: schemas.User = Depends(get_current_active_user), + rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)), + pools_repo: ResourcePoolsRepository = Depends(get_repository(ResourcePoolsRepository)) +) -> List[schemas.Project]: """ Return all projects. @@ -80,7 +85,22 @@ async def get_projects() -> List[schemas.Project]: """ controller = Controller.instance() - return [p.asdict() for p in controller.projects.values()] + projects = [] + + if current_user.is_superadmin: + # super admin sees all projects + return [p.asdict() for p in controller.projects.values()] + elif await rbac_repo.check_user_has_privilege(current_user.user_id, "/projects", "Project.Audit"): + # user with Project.Audit privilege on '/projects' sees all projects except those in resource pools + project_ids_in_pools = [str(r.resource_id) for r in await pools_repo.get_resources() if r.resource_type == "project"] + projects.extend([p.asdict() for p in controller.projects.values() if p.id not in project_ids_in_pools]) + + # user with Project.Audit privilege on resource pools sees the projects in these pools + user_pool_resources = await rbac_repo.get_user_pool_resources(current_user.user_id, "Project.Audit") + project_ids_in_pools = [str(r.resource_id) for r in user_pool_resources if r.resource_type == "project"] + projects.extend([p.asdict() for p in controller.projects.values() if p.id in project_ids_in_pools]) + + return projects @router.post( diff --git a/gns3server/api/routes/controller/roles.py b/gns3server/api/routes/controller/roles.py index f1a5434f1..a3aceca3c 100644 --- a/gns3server/api/routes/controller/roles.py +++ b/gns3server/api/routes/controller/roles.py @@ -81,6 +81,23 @@ async def create_role( return await rbac_repo.create_role(role_create) +@router.get( + "/privileges", + response_model=List[schemas.Privilege], + dependencies=[Depends(has_privilege("Role.Audit"))] +) +async def get_privileges( + rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)), +) -> List[schemas.Privilege]: + """ + Get all available privileges. + + Required privilege: Role.Audit + """ + + return await rbac_repo.get_privileges() + + @router.get( "/{role_id}", response_model=schemas.Role, diff --git a/gns3server/db/repositories/rbac.py b/gns3server/db/repositories/rbac.py index 99ea8deaa..a0ed5efcf 100644 --- a/gns3server/db/repositories/rbac.py +++ b/gns3server/db/repositories/rbac.py @@ -309,6 +309,75 @@ class RbacRepository(BaseRepository): return True # only allow if the path is the original path or the ACE is set to propagate return False + async def _get_resources_in_pools(self, aces, path: str = None) -> List[models.Resource]: + """ + Get all resources in pools. + """ + + pool_resources = [] + for ace_path, ace_propagate, ace_allowed, ace_privilege in aces: + if ace_path.startswith("/pool"): + resource_pool_id = ace_path.split("/")[2] + query = select(models.Resource). \ + join(models.Resource.resource_pools). \ + filter(models.ResourcePool.resource_pool_id == resource_pool_id) + + result = await self._db_session.execute(query) + resources = result.scalars().all() + + for resource in resources: + # we only support projects in resource pools for now + if resource.resource_type == "project": + if path: + if path.startswith(f"/projects/{resource.resource_id}"): + pool_resources.append(resource) + else: + pool_resources.append(resource) + return pool_resources + + async def _get_user_aces(self, user_id: UUID, privilege_name: str): + """ + Retrieve all user ACEs matching the user_id and privilege name. + """ + + query = select(models.ACE.path, models.ACE.propagate, models.ACE.allowed, models.Privilege.name).\ + join(models.Privilege.roles).\ + join(models.Role.acl_entries).\ + join(models.ACE.user). \ + filter(models.User.user_id == user_id).\ + filter(models.Privilege.name == privilege_name).\ + order_by(models.ACE.path.desc()) + + result = await self._db_session.execute(query) + return result.all() + + async def _get_group_aces(self, user_id: UUID, privilege_name: str): + """ + Retrieve all group ACEs matching the user_id and privilege name. + """ + + query = select(models.ACE.path, models.ACE.propagate, models.ACE.allowed, models.Privilege.name). \ + join(models.Privilege.roles). \ + join(models.Role.acl_entries). \ + join(models.ACE.group). \ + join(models.UserGroup.users).\ + filter(models.User.user_id == user_id). \ + filter(models.Privilege.name == privilege_name) + + result = await self._db_session.execute(query) + return result.all() + + async def get_user_pool_resources(self, user_id: UUID, privilege_name: str) -> List[models.Resource]: + """ + Get all resources in pools belonging to a user and groups + """ + + user_aces = await self._get_user_aces(user_id, privilege_name) + pool_resources = await self._get_resources_in_pools(user_aces) + group_aces = await self._get_group_aces(user_id, privilege_name) + pool_resources.extend(await self._get_resources_in_pools(group_aces)) + return list(set(pool_resources)) + async def check_user_has_privilege(self, user_id: UUID, path: str, privilege_name: str) -> bool: """ Resource paths form a file system like tree and privileges can be inherited by paths down that tree @@ -321,38 +390,34 @@ class RbacRepository(BaseRepository): * Privileges on deeper levels replace those inherited from an upper level. """ - # retrieve all user ACEs matching the user_id and privilege name - query = select(models.ACE.path, models.ACE.propagate, models.ACE.allowed, models.Privilege.name).\ - join(models.Privilege.roles).\ - join(models.Role.acl_entries).\ - join(models.ACE.user). \ - filter(models.User.user_id == user_id).\ - filter(models.Privilege.name == privilege_name).\ - order_by(models.ACE.path.desc()) - + query = select(models.Resource) result = await self._db_session.execute(query) - aces = result.all() + resources = result.scalars().all() + projects_in_pools = [f"/projects/{r.resource_id}" for r in resources if r.resource_type == "project"] + path_is_in_pool = False + for project_in_pool in projects_in_pools: + if path.startswith(project_in_pool): + path_is_in_pool = True + break + aces = await self._get_user_aces(user_id, privilege_name) try: - if self._check_path_with_aces(path, aces): - # the user has an ACE matching the path and privilege,there is no need to check group ACEs + if path_is_in_pool: + if await self._get_resources_in_pools(aces, path): + return True + elif self._check_path_with_aces(path, aces): + # the user has an ACE matching the path and privilege, there is no need to check group ACEs return True except PermissionError: return False - # retrieve all group ACEs matching the user_id and privilege name - query = select(models.ACE.path, models.ACE.propagate, models.ACE.allowed, models.Privilege.name). \ - join(models.Privilege.roles). \ - join(models.Role.acl_entries). \ - join(models.ACE.group). \ - join(models.UserGroup.users).\ - filter(models.User.user_id == user_id). \ - filter(models.Privilege.name == privilege_name) - - result = await self._db_session.execute(query) - aces = result.all() - + aces = await self._get_group_aces(user_id, privilege_name) try: - return self._check_path_with_aces(path, aces) + if path_is_in_pool: + if await self._get_resources_in_pools(aces, path): + return True + elif self._check_path_with_aces(path, aces): + return True except PermissionError: return False + return False diff --git a/tests/api/routes/controller/test_roles.py b/tests/api/routes/controller/test_roles.py index b6fca22b6..ec0f614d1 100644 --- a/tests/api/routes/controller/test_roles.py +++ b/tests/api/routes/controller/test_roles.py @@ -42,6 +42,12 @@ class TestRolesRoutes: assert response.status_code == status.HTTP_200_OK assert response.json()["role_id"] == str(role_in_db.role_id) + async def test_get_privileges(self, app: FastAPI, client: AsyncClient): + + response = await client.get(app.url_path_for("get_privileges")) + assert response.status_code == status.HTTP_200_OK + assert len(response.json()) == 45 # 45 built-in privileges + async def test_list_roles(self, app: FastAPI, client: AsyncClient) -> None: response = await client.get(app.url_path_for("get_roles")) diff --git a/tests/controller/test_rbac.py b/tests/controller/test_rbac.py index 51339d834..7dde61e4b 100644 --- a/tests/controller/test_rbac.py +++ b/tests/controller/test_rbac.py @@ -17,14 +17,18 @@ import pytest import pytest_asyncio +import uuid from fastapi import FastAPI, status from httpx import AsyncClient from sqlalchemy.ext.asyncio import AsyncSession +from gns3server.controller import Controller from gns3server.db.repositories.rbac import RbacRepository from gns3server.db.repositories.users import UsersRepository +from gns3server.db.repositories.pools import ResourcePoolsRepository from gns3server.schemas.controller.rbac import ACECreate +from gns3server.schemas.controller.pools import ResourceCreate, ResourcePoolCreate from gns3server.db.models import User pytestmark = pytest.mark.asyncio @@ -128,6 +132,113 @@ class TestPrivileges: authorized = await RbacRepository(db_session).check_user_has_privilege(test_user.user_id, path, privilege) assert authorized is True + +class TestResourcePools: + + async def test_resource_pool(self, test_user: User, db_session: AsyncSession): + + project_id = uuid.uuid4() + project_name = "project42" + + pools_repo = ResourcePoolsRepository(db_session) + new_resource_pool = ResourcePoolCreate(name="pool1") + pool_in_db = await pools_repo.create_resource_pool(new_resource_pool) + + resource_create = ResourceCreate(resource_id=project_id, resource_type="project", name=project_name) + resource = await pools_repo.create_resource(resource_create) + await pools_repo.add_resource_to_pool(pool_in_db.resource_pool_id, resource) + + group_id = (await UsersRepository(db_session).get_user_group_by_name("Users")).user_group_id + role_id = (await RbacRepository(db_session).get_role_by_name("User")).role_id + ace = ACECreate( + path=f"/pools/{pool_in_db.resource_pool_id}", + ace_type="group", + propagate=False, + group_id=str(group_id), + role_id=str(role_id) + ) + await RbacRepository(db_session).create_ace(ace) + + privilege = "Project.Audit" + path = f"/projects/{project_id}" + authorized = await RbacRepository(db_session).check_user_has_privilege(test_user.user_id, path, privilege) + assert authorized is True + + async def test_list_projects_in_resource_pool( + self, + app: FastAPI, + controller: Controller, + authorized_client: AsyncClient, + db_session: AsyncSession + ) -> None: + + uuid1 = str(uuid.uuid4()) + uuid2 = str(uuid.uuid4()) + uuid3 = str(uuid.uuid4()) + await controller.add_project(project_id=uuid1, name="Project1") + await controller.add_project(project_id=uuid2, name="Project2") + await controller.add_project(project_id=uuid3, name="Project3") + + # user has no access to projects (no ACE on /projects or resource pools) + response = await authorized_client.get(app.url_path_for("get_projects")) + assert response.status_code == status.HTTP_200_OK + assert len(response.json()) == 0 + + pools_repo = ResourcePoolsRepository(db_session) + new_resource_pool = ResourcePoolCreate(name="pool2") + pool_in_db = await pools_repo.create_resource_pool(new_resource_pool) + + resource_create = ResourceCreate(resource_id=uuid2, resource_type="project", name="Project2") + resource = await pools_repo.create_resource(resource_create) + await pools_repo.add_resource_to_pool(pool_in_db.resource_pool_id, resource) + + group_id = (await UsersRepository(db_session).get_user_group_by_name("Users")).user_group_id + role_id = (await RbacRepository(db_session).get_role_by_name("User")).role_id + ace = ACECreate( + path=f"/pools/{pool_in_db.resource_pool_id}", + ace_type="group", + propagate=False, + group_id=str(group_id), + role_id=str(role_id) + ) + await RbacRepository(db_session).create_ace(ace) + + response = await authorized_client.get(app.url_path_for("get_project", project_id=uuid2)) + assert response.status_code == status.HTTP_200_OK + assert response.json()["name"] == "Project2" + + # user should only see one project because it is in the resource pool he has access to + response = await authorized_client.get(app.url_path_for("get_projects")) + assert response.status_code == status.HTTP_200_OK + projects = response.json() + assert len(projects) == 1 + assert projects[0]["project_id"] == uuid2 + + ace = ACECreate( + path=f"/projects", + ace_type="group", + propagate=True, + group_id=str(group_id), + role_id=str(role_id) + ) + await RbacRepository(db_session).create_ace(ace) + + # now user should see all projects because he has access to /projects and the resource pool + response = await authorized_client.get(app.url_path_for("get_projects")) + assert response.status_code == status.HTTP_200_OK + projects = response.json() + assert len(projects) == 3 + + await RbacRepository(db_session).delete_all_ace_starting_with_path(f"/pools/{pool_in_db.resource_pool_id}") + response = await authorized_client.get(app.url_path_for("get_project", project_id=uuid2)) + assert response.status_code == status.HTTP_403_FORBIDDEN + + # now user should only see the projects that are not in a resource pool + response = await authorized_client.get(app.url_path_for("get_projects")) + assert response.status_code == status.HTTP_200_OK + assert len(response.json()) == 2 + + # class TestProjectsWithRbac: # # async def test_admin_create_project(self, app: FastAPI, client: AsyncClient): From 7534718a1c51a9893c08ecc030e2a41af623a1cf Mon Sep 17 00:00:00 2001 From: grossmj Date: Thu, 14 Sep 2023 22:41:08 +0700 Subject: [PATCH 3/3] Remove privileges endpoint from roles --- gns3server/api/routes/controller/roles.py | 17 ----------------- tests/api/routes/controller/test_roles.py | 6 ------ 2 files changed, 23 deletions(-) diff --git a/gns3server/api/routes/controller/roles.py b/gns3server/api/routes/controller/roles.py index a3aceca3c..f1a5434f1 100644 --- a/gns3server/api/routes/controller/roles.py +++ b/gns3server/api/routes/controller/roles.py @@ -81,23 +81,6 @@ async def create_role( return await rbac_repo.create_role(role_create) -@router.get( - "/privileges", - response_model=List[schemas.Privilege], - dependencies=[Depends(has_privilege("Role.Audit"))] -) -async def get_privileges( - rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)), -) -> List[schemas.Privilege]: - """ - Get all available privileges. - - Required privilege: Role.Audit - """ - - return await rbac_repo.get_privileges() - - @router.get( "/{role_id}", response_model=schemas.Role, diff --git a/tests/api/routes/controller/test_roles.py b/tests/api/routes/controller/test_roles.py index ec0f614d1..b6fca22b6 100644 --- a/tests/api/routes/controller/test_roles.py +++ b/tests/api/routes/controller/test_roles.py @@ -42,12 +42,6 @@ class TestRolesRoutes: assert response.status_code == status.HTTP_200_OK assert response.json()["role_id"] == str(role_in_db.role_id) - async def test_get_privileges(self, app: FastAPI, client: AsyncClient): - - response = await client.get(app.url_path_for("get_privileges")) - assert response.status_code == status.HTTP_200_OK - assert len(response.json()) == 45 # 45 built-in privileges - async def test_list_roles(self, app: FastAPI, client: AsyncClient) -> None: response = await client.get(app.url_path_for("get_roles"))