editoast: add authorization to the rolling stock endpoints

editoast/authz/src/model.rs

@@ -140,6 +140,7 @@ pub enum InfraGrant {
     Eq,
     Hash,
 )]
+#[cfg_attr(test, derive(PartialOrd, Ord))]
 #[fga(name = "rolling_stock")]
 pub struct RollingStock(pub i64);
 
@@ -177,7 +178,18 @@ pub enum RollingStockPrivilege {
 }
 
 #[derive(
-    Debug, Display, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize,
+    Debug,
+    Display,
+    Clone,
+    Copy,
+    PartialEq,
+    Eq,
+    PartialOrd,
+    Ord,
+    Hash,
+    Serialize,
+    Deserialize,
+    EnumIter,
 )]
 #[serde(rename_all = "SCREAMING_SNAKE_CASE")]
 #[strum(serialize_all = "SCREAMING_SNAKE_CASE")]

editoast/authz/src/v2.rs

@@ -210,6 +210,12 @@ impl<T> Protected<T> {
     }
 }
 
+impl Protected<()> {
+    pub fn check(check: Check) -> Self {
+        Protected::<()>::default().with_check_iter([check])
+    }
+}
+
 impl<T: Send + 'static> Protected<T> {
     /// A [Protected] value that always succeeds with the provided value
     pub fn value(t: T) -> Self {

editoast/authz/src/v2/rolling_stock.rs

@@ -14,6 +14,8 @@ use crate::RollingStockPrivilege;
 use crate::Subject;
 use crate::User;
 use crate::v2::Actor;
+use crate::v2::ResourcesList;
+use crate::v2::subject_roles;
 use crate::v2::validate_direct_grant;
 
 pub fn rolling_stock_privileges(
@@ -441,6 +443,63 @@ pub fn rolling_stock_revoke_grant(
     .with_check(Check::IsNotLastRollingStockOwner(subject, rolling_stock))
 }
 
+pub fn rolling_stock_list(
+    user: User,
+    privilege: RollingStockPrivilege,
+) -> Protected<ResourcesList<RollingStock>> {
+    subject_roles(Subject::user(user)).then(move |openfga, roles| {
+        async move {
+            if roles.contains(&Role::Admin) {
+                return Ok(ResourcesList::All);
+            }
+            let authorized_rolling_stocks = match privilege {
+                RollingStockPrivilege::CanRestrictedRead => {
+                    openfga
+                        .list_objects(RollingStock::can_restricted_read().query_objects(&user))
+                        .await?
+                }
+                RollingStockPrivilege::CanRead => {
+                    openfga
+                        .list_objects(RollingStock::can_read().query_objects(&user))
+                        .await?
+                }
+                RollingStockPrivilege::CanShareRead => {
+                    openfga
+                        .list_objects(RollingStock::can_share_read().query_objects(&user))
+                        .await?
+                }
+                RollingStockPrivilege::CanWrite => {
+                    openfga
+                        .list_objects(RollingStock::can_write().query_objects(&user))
+                        .await?
+                }
+                RollingStockPrivilege::CanShareWrite => {
+                    openfga
+                        .list_objects(RollingStock::can_share_write().query_objects(&user))
+                        .await?
+                }
+                RollingStockPrivilege::CanDelete => {
+                    openfga
+                        .list_objects(RollingStock::can_delete().query_objects(&user))
+                        .await?
+                }
+                RollingStockPrivilege::CanShareOwnership => {
+                    openfga
+                        .list_objects(RollingStock::can_share_ownership().query_objects(&user))
+                        .await?
+                }
+                RollingStockPrivilege::CanRevoke => {
+                    openfga
+                        .list_objects(RollingStock::can_revoke().query_objects(&user))
+                        .await?
+                }
+            };
+            Ok(ResourcesList::Privileged(authorized_rolling_stocks))
+        }
+        .boxed()
+    })
+}
+
 #[cfg(test)]
 mod tests {
     use rstest::rstest;
@@ -781,7 +840,6 @@ mod tests {
             .execute()
             .await
             .unwrap();
-
         assert_eq!(
             openfga
                 .rolling_stock_direct_grant(Subject::user(1), RollingStock(1))
@@ -813,6 +871,79 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn check_rolling_stock_list_no_rights_and_admin() {
+        let openfga = crate::authz_client!();
+        openfga
+            .prepare_writes()
+            .write(&RollingStock::reader().tuple(&User(1), &RollingStock(1)))
+            .write(&RollingStock::reader().tuple(&User(1), &RollingStock(3)))
+            .write(&RollingStock::writer().tuple(&User(2), &RollingStock(2)))
+            .write(&User::role().tuple(&Role::Admin, &User(3)))
+            .execute()
+            .await
+            .unwrap();
+        let rolling_stocks_1 = openfga
+            .rolling_stock_list(User(1), RollingStockPrivilege::CanRead)
+            .await
+            .unwrap_privileged()
+            .into_iter();
+        let rolling_stocks_2 = openfga
+            .rolling_stock_list(User(2), RollingStockPrivilege::CanRead)
+            .await
+            .unwrap_privileged()
+            .into_iter();
+        let rolling_stocks_no_rights = openfga
+            .rolling_stock_list(User(4), RollingStockPrivilege::CanRead)
+            .await
+            .unwrap_privileged();
+        let rolling_stocks_admin = openfga
+            .rolling_stock_list(User(3), RollingStockPrivilege::CanRead)
+            .await;
+        assert_eq!(
+            rolling_stocks_1.sorted().collect_vec(),
+            vec![RollingStock(1), RollingStock(3)]
+        );
+        assert_eq!(
+            rolling_stocks_2.sorted().collect_vec(),
+            vec![RollingStock(2)]
+        );
+        assert_eq!(rolling_stocks_no_rights, vec![]);
+        assert!(matches!(rolling_stocks_admin, ResourcesList::All));
+    }
+
+    #[tokio::test]
+    async fn rolling_stock_list_only_returns_resources_with_the_queried_privilege() {
+        let openfga = crate::authz_client!();
+        openfga
+            .prepare_writes()
+            .write(&RollingStock::reader().tuple(&User(1), &RollingStock(1)))
+            .write(&RollingStock::writer().tuple(&User(2), &RollingStock(2)))
+            .execute()
+            .await
+            .unwrap();
+
+        // A reader grant grants read access and not write access
+        let reader_can_read = openfga
+            .rolling_stock_list(User(1), RollingStockPrivilege::CanRead)
+            .await
+            .unwrap_privileged();
+        assert_eq!(reader_can_read, vec![RollingStock(1)]);
+
+        let reader_can_write = openfga
+            .rolling_stock_list(User(1), RollingStockPrivilege::CanWrite)
+            .await
+            .unwrap_privileged();
+        assert_eq!(reader_can_write, vec![]);
+
+        // A writer grant grants both read and write access
+        let writer_can_write = openfga
+            .rolling_stock_list(User(2), RollingStockPrivilege::CanWrite)
+            .await
+            .unwrap_privileged();
+        assert_eq!(writer_can_write, vec![RollingStock(2)]);
+    }
+
     #[rstest]
     #[case::rolling_stock_privileges(
         rolling_stock_privileges(User(1), RollingStock(1)).checks,
@@ -834,6 +965,11 @@ mod tests {
            Check::HasRollingStockPrivilege(Actor::Issuer, RollingStockPrivilege::CanRead, RollingStock(1))
         ]
     )]
+    #[rstest]
+    #[case::rolling_stock_list(
+        rolling_stock_list(User(1), RollingStockPrivilege::CanRead).checks,
+        &[]
+    )]
     fn protected_contains_expected_checks(
         #[case] protected_checks: HashSet<Check>,
         #[case] expected_checks: &[Check],

editoast/authz/src/v2/test_client_ext.rs

@@ -109,6 +109,11 @@ pub trait TestClientExt {
     async fn project_privileges(&self, user: User, project: Project) -> HashSet<ProjectPrivilege>;
     async fn project_list(&self, user: User) -> ResourcesList<Project>;
     async fn project_granted_subjects(&self, project: Project) -> Vec<Subject>;
+    async fn rolling_stock_list(
+        &self,
+        user: User,
+        privilege: RollingStockPrivilege,
+    ) -> ResourcesList<RollingStock>;
 }
 
 impl TestClientExt for fga::Client {
@@ -360,4 +365,18 @@ impl TestClientExt for fga::Client {
             .await
             .unwrap()
     }
+
+    async fn rolling_stock_list(
+        &self,
+        user: User,
+        privilege: RollingStockPrivilege,
+    ) -> ResourcesList<RollingStock> {
+        let authorize = special_authorizers::Authorize(self);
+        authorize
+            .access_value(crate::v2::rolling_stock::rolling_stock_list(
+                user, privilege,
+            ))
+            .await
+            .unwrap()
+    }
 }

editoast/core_client/src/pathfinding.rs

@@ -141,6 +141,9 @@ pub enum PathfindingInputError {
         items: Vec<InvalidPathItem>,
     },
     NotEnoughPathItems,
+    UnauthorizedRollingStock {
+        rolling_stock_id: i64,
+    },
     RollingStockNotFound {
         rolling_stock_name: String,
     },

editoast/src/authorizers.rs

@@ -2,12 +2,14 @@ use std::convert::Infallible;
 use std::marker::PhantomData;
 use std::ops::Not as _;
 
+use crate::views::AuthorizationError;
 use authz::ProjectGrant;
 use authz::v2::Access;
 use authz::v2::Actor;
 use authz::v2::Authorizer;
 use authz::v2::Check;
 use authz::v2::Protected;
+use editoast_models::prelude::RetrieveBatchUnchecked as _;
 use futures::StreamExt as _;
 use futures::stream::FuturesUnordered;
 use tracing::Instrument as _;
@@ -281,6 +283,70 @@ impl Authorizer for UserAuthorizer<'_> {
 #[error(transparent)]
 pub struct Error(#[from] pub authz::v2::OpenFgaError);
 
+/// Ensures the issuer holds a privilege satisfying `required`.
+/// `protected` is an operation yielding the set of privileges the issuer holds on a resource.
+/// Access is granted when the operation is authorized and the issuer holds a privilege equal to `required`.
+pub async fn require<I, U>(
+    authorizer: &U,
+    protected: Protected<I>,
+    required: &<I as IntoIterator>::Item,
+) -> Result<(), AuthorizationError>
+where
+    I: IntoIterator,
+    <I as IntoIterator>::Item: PartialEq,
+    U: Authorizer<Error = Error>,
+{
+    let access = authorizer
+        .authorize(protected)
+        .await
+        .map_err(|e| AuthorizationError::from(e.0))?;
+    let Ok(privileges) = access.access().await? else {
+        return Err(AuthorizationError::Forbidden);
+    };
+    if privileges
+        .into_iter()
+        .any(|privilege| privilege == *required)
+    {
+        Ok(())
+    } else {
+        Err(AuthorizationError::Forbidden)
+    }
+}
+
+/// Ensures the issuer can read every rolling stock of `rolling_stock_names`, and fails with a
+/// [`AuthorizationError::Forbidden`] as soon as one of them isn't readable.
+pub async fn require_readable_rolling_stocks(
+    rolling_stock_names: impl IntoIterator<Item = String>,
+    conn: &mut database::DbConnection,
+    authn_state: &crate::authentication::State,
+    openfga: &fga::Client,
+) -> crate::error::Result<()> {
+    let Some(user) = authn_state.user() else {
+        return Ok(());
+    };
+
+    // Rolling stocks are referenced by name, the authorization by id
+    let rolling_stock_names = rolling_stock_names
+        .into_iter()
+        .collect::<std::collections::HashSet<_>>();
+    let rolling_stocks: Vec<editoast_models::RollingStock> =
+        editoast_models::RollingStock::retrieve_batch_unchecked(conn, rolling_stock_names)
+            .await
+            .map_err(crate::views::rolling_stock::RollingStockError::from)?;
+
+    // Not using rolling_stock_list: we bail out as soon as one rolling stock isn't readable
+    let authorizer = authn_state.authorizer(openfga);
+    for rolling_stock in rolling_stocks {
+        require(
+            &authorizer,
+            authz::v2::rolling_stock_privileges(user, authz::RollingStock(rolling_stock.id)),
+            &authz::RollingStockPrivilege::CanRead,
+        )
+        .await?;
+    }
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use authz::InfraGrant;