Basic functional RBAC support.

gns3server/db/models/permissions.py

@@ -15,7 +15,7 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-from sqlalchemy import Table, Column, String, ForeignKey, Boolean
+from sqlalchemy import Table, Column, String, ForeignKey, event
 from sqlalchemy.orm import relationship
 
 from .base import Base, BaseTable, generate_uuid, GUID, ListType
@@ -39,7 +39,78 @@ class Permission(BaseTable):
     __tablename__ = "permissions"
 
     permission_id = Column(GUID, primary_key=True, default=generate_uuid)
+    description = Column(String)
     methods = Column(ListType)
     path = Column(String)
     action = Column(String)
+    user_id = Column(GUID, ForeignKey('users.user_id', ondelete="CASCADE"))
     roles = relationship("Role", secondary=permission_role_link, back_populates="permissions")
+
+
+@event.listens_for(Permission.__table__, 'after_create')
+def create_default_roles(target, connection, **kw):
+
+    default_permissions = [
+        {
+            "description": "Allow access to all endpoints",
+            "methods": ["GET", "HEAD", "POST", "PUT", "DELETE", "PATCH"],
+            "path": "/",
+            "action": "ALLOW"
+        },
+        {
+            "description": "Allow access to the logged in user",
+            "methods": ["GET"],
+            "path": "/users/me",
+            "action": "ALLOW"
+        },
+        {
+            "description": "Allow to create a project or list projects",
+            "methods": ["GET", "POST"],
+            "path": "/projects",
+            "action": "ALLOW"
+        },
+        {
+            "description": "Allow to access to all symbol endpoints",
+            "methods": ["GET", "HEAD", "POST", "PUT", "DELETE", "PATCH"],
+            "path": "/symbols",
+            "action": "ALLOW"
+        },
+    ]
+
+    stmt = target.insert().values(default_permissions)
+    connection.execute(stmt)
+    connection.commit()
+    log.debug("The default permissions have been created in the database")
+
+
+@event.listens_for(permission_role_link, 'after_create')
+def add_permissions_to_role(target, connection, **kw):
+
+    from .roles import Role
+    roles_table = Role.__table__
+    stmt = roles_table.select().where(roles_table.c.name == "Administrator")
+    result = connection.execute(stmt)
+    role_id = result.first().role_id
+
+    permissions_table = Permission.__table__
+    stmt = permissions_table.select().where(permissions_table.c.path == "/")
+    result = connection.execute(stmt)
+    permission_id = result.first().permission_id
+
+    # add root path to the "Administrator" role
+    stmt = target.insert().values(permission_id=permission_id, role_id=role_id)
+    connection.execute(stmt)
+
+    stmt = roles_table.select().where(roles_table.c.name == "User")
+    result = connection.execute(stmt)
+    role_id = result.first().role_id
+
+    # add minimum required paths to the "User" role
+    for path in ("/projects", "/symbols", "/users/me"):
+        stmt = permissions_table.select().where(permissions_table.c.path == path)
+        result = connection.execute(stmt)
+        permission_id = result.first().permission_id
+        stmt = target.insert().values(permission_id=permission_id, role_id=role_id)
+        connection.execute(stmt)
+
+    connection.commit()

gns3server/db/models/roles.py

@@ -40,7 +40,7 @@ class Role(BaseTable):
     role_id = Column(GUID, primary_key=True, default=generate_uuid)
     name = Column(String)
     description = Column(String)
-    is_updatable = Column(Boolean, default=True)
+    builtin = Column(Boolean, default=False)
     permissions = relationship("Permission", secondary=permission_role_link, back_populates="roles")
     groups = relationship("UserGroup", secondary=role_group_link, back_populates="roles")
 
@@ -49,11 +49,33 @@ class Role(BaseTable):
 def create_default_roles(target, connection, **kw):
 
     default_roles = [
-        {"name": "Administrator", "description": "Administrator role", "is_updatable": False},
-        {"name": "User", "description": "User role", "is_updatable": False},
+        {"name": "Administrator", "description": "Administrator role", "builtin": True},
+        {"name": "User", "description": "User role", "builtin": True},
     ]
 
     stmt = target.insert().values(default_roles)
     connection.execute(stmt)
     connection.commit()
-    log.info("The default roles have been created in the database")
+    log.debug("The default roles have been created in the database")
+
+
+@event.listens_for(role_group_link, 'after_create')
+def add_admin_to_group(target, connection, **kw):
+
+    from .users import UserGroup
+    user_groups_table = UserGroup.__table__
+    roles_table = Role.__table__
+
+    # Add roles to built-in user groups
+    groups_to_roles = {"Administrators": "Administrator", "Users": "User"}
+    for user_group, role in groups_to_roles.items():
+        stmt = user_groups_table.select().where(user_groups_table.c.name == user_group)
+        result = connection.execute(stmt)
+        user_group_id = result.first().user_group_id
+        stmt = roles_table.select().where(roles_table.c.name == role)
+        result = connection.execute(stmt)
+        role_id = result.first().role_id
+        stmt = target.insert().values(role_id=role_id, user_group_id=user_group_id)
+        connection.execute(stmt)
+
+    connection.commit()

gns3server/db/models/users.py

@@ -48,7 +48,6 @@ class User(BaseTable):
     is_active = Column(Boolean, default=True)
     is_superadmin = Column(Boolean, default=False)
     groups = relationship("UserGroup", secondary=user_group_link, back_populates="users")
-    permission_id = Column(GUID, ForeignKey('permissions.permission_id', ondelete="CASCADE"))
     permissions = relationship("Permission")
 
 
@@ -67,7 +66,7 @@ def create_default_super_admin(target, connection, **kw):
     )
     connection.execute(stmt)
     connection.commit()
-    log.info("The default super admin account has been created in the database")
+    log.debug("The default super admin account has been created in the database")
 
 
 class UserGroup(BaseTable):
@@ -76,7 +75,7 @@ class UserGroup(BaseTable):
 
     user_group_id = Column(GUID, primary_key=True, default=generate_uuid)
     name = Column(String, unique=True, index=True)
-    is_updatable = Column(Boolean, default=True)
+    builtin = Column(Boolean, default=False)
     users = relationship("User", secondary=user_group_link, back_populates="groups")
     roles = relationship("Role", secondary=role_group_link, back_populates="groups")
 
@@ -85,30 +84,29 @@ class UserGroup(BaseTable):
 def create_default_user_groups(target, connection, **kw):
 
     default_groups = [
-        {"name": "Administrators", "is_updatable": False},
-        {"name": "Editors", "is_updatable": False},
-        {"name": "Users", "is_updatable": False}
+        {"name": "Administrators", "builtin": True},
+        {"name": "Users", "builtin": True}
     ]
 
     stmt = target.insert().values(default_groups)
     connection.execute(stmt)
     connection.commit()
-    log.info("The default user groups have been created in the database")
+    log.debug("The default user groups have been created in the database")
 
 
-@event.listens_for(user_group_link, 'after_create')
-def add_admin_to_group(target, connection, **kw):
-
-    user_groups_table = UserGroup.__table__
-    stmt = user_groups_table.select().where(user_groups_table.c.name == "Administrators")
-    result = connection.execute(stmt)
-    user_group_id = result.first().user_group_id
-
-    users_table = User.__table__
-    stmt = users_table.select().where(users_table.c.is_superadmin.is_(True))
-    result = connection.execute(stmt)
-    user_id = result.first().user_id
-
-    stmt = target.insert().values(user_id=user_id, user_group_id=user_group_id)
-    connection.execute(stmt)
-    connection.commit()
+# @event.listens_for(user_group_link, 'after_create')
+# def add_admin_to_group(target, connection, **kw):
+#
+#     user_groups_table = UserGroup.__table__
+#     stmt = user_groups_table.select().where(user_groups_table.c.name == "Administrators")
+#     result = connection.execute(stmt)
+#     user_group_id = result.first().user_group_id
+#
+#     users_table = User.__table__
+#     stmt = users_table.select().where(users_table.c.is_superadmin.is_(True))
+#     result = connection.execute(stmt)
+#     user_id = result.first().user_id
+#
+#     stmt = target.insert().values(user_id=user_id, user_group_id=user_group_id)
+#     connection.execute(stmt)
+#     connection.commit()