Basic functional RBAC support.

gns3server/api/routes/controller/dependencies/authentication.py

@@ -15,13 +15,13 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 
-from fastapi import Depends, HTTPException, status
+from fastapi import Request, Depends, HTTPException, status
 from fastapi.security import OAuth2PasswordBearer
 
 from gns3server import schemas
 from gns3server.db.repositories.users import UsersRepository
+from gns3server.db.repositories.rbac import RbacRepository
 from gns3server.services import auth_service
-
 from .database import get_repository
 
 oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/v3/users/login")
@@ -42,7 +42,11 @@ async def get_user_from_token(
     return user
 
 
-async def get_current_active_user(current_user: schemas.User = Depends(get_user_from_token)) -> schemas.User:
+async def get_current_active_user(
+        request: Request,
+        current_user: schemas.User = Depends(get_user_from_token),
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository))
+) -> schemas.User:
 
     # Super admin is always authorized
     if current_user.is_superadmin:
@@ -54,4 +58,19 @@ async def get_current_active_user(current_user: schemas.User = Depends(get_user_
             detail="Not an active user",
             headers={"WWW-Authenticate": "Bearer"},
         )
+
+    # remove the prefix (e.g. "/v3") from URL path
+    if request.url.path.startswith("/v3"):
+        path = request.url.path[len("/v3"):]
+    else:
+        path = request.url.path
+
+    authorized = await rbac_repo.check_user_is_authorized(current_user.user_id, request.method, path)
+    if not authorized:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail=f"User is not authorized '{current_user.user_id}' on {request.method} '{path}'",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
     return current_user