YueGuobin
ee36a9aec2
feat: fix permission check logic to properly handle ACE and user isolation
...
Implement the correct three-step permission check logic:
- Step 1: ACE check - basic access permission (get projects user has ACE for)
- Step 2: Filter ace_projects by created_by - user's own projects (project sharing only through resource pools)
- Step 3: Resource pool projects (projects shared through resource pools)
This fixes the design flaw where:
- ACE check could bypass user isolation with broad ACE configurations
- seen_project_ids mechanism prevented proper layered checking
- Project sharing was confused with direct ACE configuration
The new logic ensures:
- User isolation works even with broad ACE (path='/', propagate=True)
- Project sharing is only available through resource pools (clear design)
- Proper layered checking without seen blocking mechanism
2026-05-26 12:33:08 +08:00
YueGuobin
265d0ff860
feat: implement layered permission checks for proper user isolation and sharing
...
Implement a three-layer permission system:
- Layer 1: ACE strategy check (explicitly authorized/shared projects)
- Layer 2: Ownership check (user's own projects based on created_by)
- Layer 3: Resource pools (team shared projects)
This approach:
- Resolves the conflict between ACE and user isolation
- Enables project sharing via ACE (other users can grant access)
- Maintains default user isolation via ownership
- Prevents duplicate projects in results
- Preserves resource pool functionality
2026-05-26 00:31:19 +08:00
YueGuobin
7c0b465b74
feat: implement simple user isolation based on project ownership
...
Users can only see projects they created (created_by field).
Super admins see all projects.
Resource pool projects continue to work as before.
2026-05-26 00:16:45 +08:00
grossmj
be4b87e8cd
Update project schema and fix tests
2026-02-22 18:13:08 +08:00
Felix Schulz
8ab34924b5
Add 'created_by' field to track project creator
2026-02-21 22:15:21 +01:00
Jeremy Grossmann
d269a4c125
Merge pull request #2570 from Mytic2330/3.0-patch3
...
Fixed Connection closed when exporting a running project
2025-11-04 04:07:01 +01:00
Bine
d5f360c176
Update projects.py
2025-10-18 19:28:15 +02:00
Bine
e817228280
Fix non-ASCII characters in project names
2025-10-18 18:10:24 +02:00
grossmj
4e41aefbdb
Require "Project.Audit" permission to duplicate a project and check if "Project.Allocate" permission for the destination.
2024-12-06 14:09:08 +10:00
grossmj
e83e12b51a
Add a duplicated project in the same resource pools as the original project if it is in any
2024-11-17 14:03:47 +10:00
grossmj
6b14abc06f
Add allow_unsafe_options for Qemu settings
2024-07-07 19:08:12 +02:00
grossmj
31c7fe88f1
Remove websocket.close()
2024-03-16 16:00:27 +01:00
grossmj
a95dda0d1d
Complete resource pool support for projects
2023-09-11 18:15:03 +07:00
grossmj
0077fd98aa
Add required privileges to all endpoints
2023-09-02 17:54:24 +07:00
grossmj
60ce1172e0
Use an ACL table to check for privileges
2023-08-27 18:20:42 +10:00
grossmj
427bbc40b9
Fix websocket authentication after upgrade to FastAPI 0.97.0 + tests
2023-06-24 14:55:43 +09:30
grossmj
b0e646b97d
Fix some issues with HTTP notification streams
2022-09-13 22:10:01 +02:00
grossmj
2976e220dc
Return a boolean directly from API endpoint for project locked status
2022-09-03 23:08:13 +02:00
grossmj
27debfff8d
API endpoint to get the locked status of a project
2022-09-03 22:58:44 +02:00
grossmj
ca3bf592d6
Global project lock and unlock
2022-08-30 22:49:47 +02:00
grossmj
fc6aeb715a
Remove explicit Response for endpoints returning HTTP 204 status code
2022-07-16 00:12:18 +02:00
grossmj
149d086fd8
Reactivate project importation
2022-07-05 23:01:44 +02:00
grossmj
162af5bb7a
Checks for compression levels + tests
2022-06-01 20:26:59 +07:00
grossmj
8a964390f8
Add zstandard compression support for project export
2022-05-31 18:08:34 +07:00
grossmj
900d4f79ee
"Local" command line parameter is only for stopping
...
a server that has been started by the desktop GUI
2022-03-30 18:38:34 +08:00
grossmj
ab4d964d69
Do not require the local server param to open a .gns3 file. Fixes https://github.com/GNS3/gns3-gui/issues/2421 Ref #1460
2021-12-10 15:52:57 +10:30
grossmj
01a9e83f08
Ignore OSError when closing websocket
2021-12-08 00:00:54 +10:30
grossmj
741fc4a557
Secure websocket endpoints
2021-11-01 16:45:14 +10:30
grossmj
5807dd068e
Revert "No need to add permissions when the super admin creates templates or projects"
...
This reverts commit 3d1c3303f9451cf39bb09cb7d5bf0281d5afe52a.
2021-09-20 10:36:56 +09:30
grossmj
3d1c3303f9
No need to add permissions when the super admin creates templates or projects
2021-09-18 12:49:54 +09:30
grossmj
ce55ec73a4
Fix exception with endpoints returning HTTP status code 204. Fixes #1891
2021-08-10 21:53:21 +09:30
grossmj
8be015cd86
Move "/{project_id}/templates/{template_id}" endpoint.
2021-06-03 18:18:34 +09:30
grossmj
d65b49acaa
Add user permissions + RBAC tests.
2021-06-03 15:40:12 +09:30
grossmj
fbc47598d9
Basic functional RBAC support.
2021-05-27 17:28:44 +09:30
grossmj
2bf16f1e5f
Change method to prevent forbidden directory traversal. Ref #1894
2021-05-16 14:29:56 +09:30
grossmj
f3d81fa450
Clean files and catch file path escape. Ref #1894
2021-05-15 22:35:44 +09:30
grossmj
9404c00411
Complete type annotations for API endpoints.
2021-04-18 15:40:38 +09:30
grossmj
cefab8d362
Rename __json__() to asdict()
2021-04-17 23:34:28 +09:30
grossmj
c021e21309
Use black with -l 120 param.
2021-04-13 18:46:50 +09:30
grossmj
f928738bd5
Use pyupgrade with --py36-plus param.
2021-04-13 18:37:58 +09:30
grossmj
a9eb035b7d
Move error responses to API routers.
2021-04-13 16:19:56 +09:30
grossmj
30ebae207f
Use Pydantic to validate the server config file.
2021-04-12 17:02:23 +09:30
grossmj
bf7cf862af
Refactor tests and start work on database integration.
2020-12-02 18:39:08 +10:30
grossmj
c043830e3f
Move endpoints to routes & preparations to use a database.
2020-11-19 15:21:03 +10:30
