mirror of
https://github.com/GNS3/gns3-server.git
synced 2026-09-28 06:40:12 +03:00
226 lines
9.0 KiB
Python
226 lines
9.0 KiB
Python
#!/usr/bin/env python
|
|
#
|
|
# Copyright (C) 2023 GNS3 Technologies Inc.
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
from sqlalchemy import Table, Column, String, ForeignKey, event
|
|
from sqlalchemy.orm import relationship
|
|
|
|
from .base import Base, BaseTable, generate_uuid, GUID
|
|
|
|
import logging
|
|
|
|
log = logging.getLogger(__name__)
|
|
|
|
|
|
privilege_role_map = Table(
|
|
"privilege_role_map",
|
|
Base.metadata,
|
|
Column("privilege_id", GUID, ForeignKey("privileges.privilege_id", ondelete="CASCADE")),
|
|
Column("role_id", GUID, ForeignKey("roles.role_id", ondelete="CASCADE")),
|
|
)
|
|
|
|
|
|
class Privilege(BaseTable):
|
|
__tablename__ = "privileges"
|
|
|
|
privilege_id = Column(GUID, primary_key=True, default=generate_uuid)
|
|
name = Column(String)
|
|
description = Column(String)
|
|
roles = relationship("Role", secondary=privilege_role_map, back_populates="privileges")
|
|
|
|
|
|
@event.listens_for(Privilege.__table__, "after_create")
|
|
def create_default_roles(target, connection, **kw):
|
|
|
|
default_privileges = [
|
|
{"description": "Create or delete a user", "name": "User.Allocate"},
|
|
{"description": "View a user", "name": "User.Audit"},
|
|
{"description": "Update a user", "name": "User.Modify"},
|
|
{"description": "Create or delete a group", "name": "Group.Allocate"},
|
|
{"description": "View a group", "name": "Group.Audit"},
|
|
{"description": "Update a group", "name": "Group.Modify"},
|
|
{"description": "Create or delete a role", "name": "Role.Allocate"},
|
|
{"description": "View a role", "name": "Role.Audit"},
|
|
{"description": "Update a role", "name": "Role.Modify"},
|
|
{"description": "Create or delete an ACE", "name": "ACE.Allocate"},
|
|
{"description": "View an ACE", "name": "ACE.Audit"},
|
|
{"description": "Update an ACE", "name": "ACE.Modify"},
|
|
{"description": "Create or delete a resource pool", "name": "Pool.Allocate"},
|
|
{"description": "View a resource pool", "name": "Pool.Audit"},
|
|
{"description": "Update a resource pool", "name": "Pool.Modify"},
|
|
{"description": "Create or delete a template", "name": "Template.Allocate"},
|
|
{"description": "View a template", "name": "Template.Audit"},
|
|
{"description": "Update a template", "name": "Template.Modify"},
|
|
{"description": "Create or delete a project", "name": "Project.Allocate"},
|
|
{"description": "View a project", "name": "Project.Audit"},
|
|
{"description": "Update a project", "name": "Project.Modify"},
|
|
{"description": "Create or delete project snapshots", "name": "Snapshot.Allocate"},
|
|
{"description": "Restore a snapshot", "name": "Snapshot.Restore"},
|
|
{"description": "View a snapshot", "name": "Snapshot.Audit"},
|
|
{"description": "Create or delete a node", "name": "Node.Allocate"},
|
|
{"description": "View a node", "name": "Node.Audit"},
|
|
{"description": "Update a node", "name": "Node.Modify"},
|
|
{"description": "Console access to a node", "name": "Node.Console"},
|
|
{"description": "Power management for a node", "name": "Node.PowerMgmt"},
|
|
{"description": "Create or delete a link", "name": "Link.Allocate"},
|
|
{"description": "View a link", "name": "Link.Audit"},
|
|
{"description": "Update a link", "name": "Link.Modify"},
|
|
{"description": "Capture packets on a link", "name": "Link.Capture"},
|
|
{"description": "Create or delete a drawing", "name": "Drawing.Allocate"},
|
|
{"description": "View a drawing", "name": "Drawing.Audit"},
|
|
{"description": "Update a drawing", "name": "Drawing.Modify"},
|
|
{"description": "Create or delete a symbol", "name": "Symbol.Allocate"},
|
|
{"description": "View a symbol", "name": "Symbol.Audit"},
|
|
{"description": "Create or delete an image", "name": "Image.Allocate"},
|
|
{"description": "View an image", "name": "Image.Audit"},
|
|
{"description": "Create or delete a compute", "name": "Compute.Allocate"},
|
|
{"description": "Update a compute", "name": "Compute.Modify"},
|
|
{"description": "View a compute", "name": "Compute.Audit"},
|
|
{"description": "Install an appliance", "name": "Appliance.Allocate"},
|
|
{"description": "View an appliance", "name": "Appliance.Audit"},
|
|
{"description": "Create or delete an LLM model configuration", "name": "LLMConfig.Allocate"},
|
|
{"description": "View an LLM model configuration", "name": "LLMConfig.Audit"},
|
|
{"description": "Update an LLM model configuration", "name": "LLMConfig.Modify"},
|
|
{"description": "View server settings", "name": "Server.Audit"},
|
|
{"description": "Update server settings", "name": "Server.Modify"},
|
|
]
|
|
|
|
stmt = target.insert().values(default_privileges)
|
|
connection.execute(stmt)
|
|
connection.commit()
|
|
log.debug("The default privileges have been created in the database")
|
|
|
|
|
|
def add_privileges_to_role(target, connection, role, privileges):
|
|
|
|
from .roles import Role
|
|
|
|
roles_table = Role.__table__
|
|
privileges_table = Privilege.__table__
|
|
|
|
stmt = roles_table.select().where(roles_table.c.name == role)
|
|
result = connection.execute(stmt)
|
|
role_id = result.first().role_id
|
|
for privilege_name in privileges:
|
|
stmt = privileges_table.select().where(privileges_table.c.name == privilege_name)
|
|
result = connection.execute(stmt)
|
|
privilege_id = result.first().privilege_id
|
|
stmt = target.insert().values(privilege_id=privilege_id, role_id=role_id)
|
|
connection.execute(stmt)
|
|
|
|
|
|
@event.listens_for(privilege_role_map, "after_create")
|
|
def add_privileges_to_default_roles(target, connection, **kw):
|
|
|
|
from .roles import Role
|
|
|
|
roles_table = Role.__table__
|
|
stmt = roles_table.select().where(roles_table.c.name == "Administrator")
|
|
result = connection.execute(stmt)
|
|
role_id = result.first().role_id
|
|
|
|
# add all privileges to the "Administrator" role
|
|
privileges_table = Privilege.__table__
|
|
stmt = privileges_table.select()
|
|
result = connection.execute(stmt)
|
|
for row in result:
|
|
privilege_id = row.privilege_id
|
|
stmt = target.insert().values(privilege_id=privilege_id, role_id=role_id)
|
|
connection.execute(stmt)
|
|
|
|
# add required privileges to the "User" role
|
|
user_privileges = (
|
|
"Project.Allocate",
|
|
"Project.Audit",
|
|
"Project.Modify",
|
|
"Snapshot.Allocate",
|
|
"Snapshot.Audit",
|
|
"Snapshot.Restore",
|
|
"Node.Allocate",
|
|
"Node.Audit",
|
|
"Node.Modify",
|
|
"Node.Console",
|
|
"Node.PowerMgmt",
|
|
"Link.Allocate",
|
|
"Link.Audit",
|
|
"Link.Modify",
|
|
"Link.Capture",
|
|
"Drawing.Allocate",
|
|
"Drawing.Audit",
|
|
"Drawing.Modify",
|
|
"Template.Audit",
|
|
"Symbol.Audit",
|
|
"Image.Audit",
|
|
"Compute.Audit",
|
|
"Appliance.Allocate",
|
|
"Appliance.Audit",
|
|
"LLMConfig.Audit",
|
|
"LLMConfig.Modify",
|
|
)
|
|
|
|
add_privileges_to_role(target, connection, "User", user_privileges)
|
|
|
|
# add required privileges to the "Auditor" role
|
|
auditor_privileges = (
|
|
"Project.Audit",
|
|
"Snapshot.Audit",
|
|
"Node.Audit",
|
|
"Link.Audit",
|
|
"Drawing.Audit",
|
|
"Template.Audit",
|
|
"Symbol.Audit",
|
|
"Image.Audit",
|
|
"Compute.Audit",
|
|
"Appliance.Audit",
|
|
)
|
|
|
|
add_privileges_to_role(target, connection, "Auditor", auditor_privileges)
|
|
|
|
# add required privileges to the "Template manager" role
|
|
template_manager_privileges = (
|
|
"Template.Allocate",
|
|
"Template.Audit",
|
|
"Template.Modify",
|
|
"Symbol.Allocate",
|
|
"Symbol.Audit",
|
|
"Image.Allocate",
|
|
"Image.Audit",
|
|
"Appliance.Allocate",
|
|
"Appliance.Audit",
|
|
)
|
|
|
|
add_privileges_to_role(target, connection, "Template manager", template_manager_privileges)
|
|
|
|
# add required privileges to the "User manager" role
|
|
user_manager_privileges = (
|
|
"User.Allocate",
|
|
"User.Audit",
|
|
"User.Modify",
|
|
"Group.Allocate",
|
|
"Group.Audit",
|
|
"Group.Modify",
|
|
)
|
|
|
|
add_privileges_to_role(target, connection, "User manager", user_manager_privileges)
|
|
|
|
# add required privileges to the "ACL manager" role
|
|
acl_manager_privileges = ("Role.Allocate", "Role.Audit", "Role.Modify", "ACE.Allocate", "ACE.Audit", "ACE.Modify")
|
|
|
|
add_privileges_to_role(target, connection, "ACL manager", acl_manager_privileges)
|
|
|
|
connection.commit()
|
|
log.debug("Privileges have been added to the default roles in the database")
|