Add required privileges to all endpoints

gns3server/api/routes/controller/computes.py

@@ -24,10 +24,12 @@ from uuid import UUID
 
 from gns3server.controller import Controller
 from gns3server.db.repositories.computes import ComputesRepository
+from gns3server.db.repositories.rbac import RbacRepository
 from gns3server.services.computes import ComputesService
 from gns3server import schemas
 
 from .dependencies.database import get_repository
+from .dependencies.rbac import has_privilege
 
 responses = {404: {"model": schemas.ErrorMessage, "description": "Compute not found"}}
 
@@ -43,6 +45,7 @@ router = APIRouter(responses=responses)
         409: {"model": schemas.ErrorMessage, "description": "Could not create compute"},
         401: {"model": schemas.ErrorMessage, "description": "Invalid authentication for compute"},
     },
+    dependencies=[Depends(has_privilege("Compute.Allocate"))]
 )
 async def create_compute(
     compute_create: schemas.ComputeCreate,
@@ -51,15 +54,23 @@ async def create_compute(
 ) -> schemas.Compute:
     """
     Create a new compute on the controller.
+
+    Required privilege: Compute.Allocate
     """
 
     return await ComputesService(computes_repo).create_compute(compute_create, connect)
 
 
-@router.post("/{compute_id}/connect", status_code=status.HTTP_204_NO_CONTENT)
+@router.post(
+    "/{compute_id}/connect",
+    status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(has_privilege("Compute.Audit"))]
+)
 async def connect_compute(compute_id: Union[str, UUID]) -> None:
     """
     Connect to compute on the controller.
+
+    Required privilege: Compute.Audit
     """
 
     compute = Controller.instance().get_compute(str(compute_id))
@@ -67,29 +78,48 @@ async def connect_compute(compute_id: Union[str, UUID]) -> None:
         await compute.connect(report_failed_connection=True)
 
 
-@router.get("/{compute_id}", response_model=schemas.Compute, response_model_exclude_unset=True)
+@router.get(
+    "/{compute_id}",
+    response_model=schemas.Compute,
+    response_model_exclude_unset=True,
+    dependencies=[Depends(has_privilege("Compute.Audit"))]
+)
 async def get_compute(
     compute_id: Union[str, UUID], computes_repo: ComputesRepository = Depends(get_repository(ComputesRepository))
 ) -> schemas.Compute:
     """
     Return a compute from the controller.
+
+    Required privilege: Compute.Audit
     """
 
     return await ComputesService(computes_repo).get_compute(compute_id)
 
 
-@router.get("", response_model=List[schemas.Compute], response_model_exclude_unset=True)
+@router.get(
+    "",
+    response_model=List[schemas.Compute],
+    response_model_exclude_unset=True,
+    dependencies=[Depends(has_privilege("Compute.Audit"))]
+)
 async def get_computes(
     computes_repo: ComputesRepository = Depends(get_repository(ComputesRepository)),
 ) -> List[schemas.Compute]:
     """
     Return all computes known by the controller.
+
+    Required privilege: Compute.Audit
     """
 
     return await ComputesService(computes_repo).get_computes()
 
 
-@router.put("/{compute_id}", response_model=schemas.Compute, response_model_exclude_unset=True)
+@router.put(
+    "/{compute_id}",
+    response_model=schemas.Compute,
+    response_model_exclude_unset=True,
+    dependencies=[Depends(has_privilege("Compute.Modify"))]
+)
 async def update_compute(
     compute_id: Union[str, UUID],
     compute_update: schemas.ComputeUpdate,
@@ -97,20 +127,31 @@ async def update_compute(
 ) -> schemas.Compute:
     """
     Update a compute on the controller.
+
+    Required privilege: Compute.Modify
     """
 
     return await ComputesService(computes_repo).update_compute(compute_id, compute_update)
 
 
-@router.delete("/{compute_id}", status_code=status.HTTP_204_NO_CONTENT)
+@router.delete(
+    "/{compute_id}",
+    status_code=status.HTTP_204_NO_CONTENT,
+    dependencies=[Depends(has_privilege("Compute.Allocate"))]
+)
 async def delete_compute(
-    compute_id: Union[str, UUID], computes_repo: ComputesRepository = Depends(get_repository(ComputesRepository))
+        compute_id: Union[str, UUID],
+        computes_repo: ComputesRepository = Depends(get_repository(ComputesRepository)),
+        rbac_repo: RbacRepository = Depends(get_repository(RbacRepository)),
 ) -> None:
     """
     Delete a compute from the controller.
+
+    Required privilege: Compute.Allocate
     """
 
     await ComputesService(computes_repo).delete_compute(compute_id)
+    await rbac_repo.delete_all_ace_starting_with_path(f"/computes/{compute_id}")
 
 
 @router.get("/{compute_id}/docker/images", response_model=List[schemas.ComputeDockerImage])