From: Michael Tremer <michael.tremer@ipfire.org>
Date: Thu, 6 Oct 2022 10:00:35 +0000 (+0000)
Subject: keys: Introduce permissions model
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9a3a1a92d4634b6e798ecd75fdcd70c10f82fd3e;p=pbs.git

keys: Introduce permissions model

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/src/buildservice/keys.py b/src/buildservice/keys.py
index f438eca5..bde0a842 100644
--- a/src/buildservice/keys.py
+++ b/src/buildservice/keys.py
@@ -126,6 +126,14 @@ class Key(base.DataObject):
 		self.db.execute("DELETE FROM keys_subkeys WHERE key_id = %s", self.id)
 		self.db.execute("DELETE FROM keys WHERE id = %s", self.id)
 
+	def has_perm(self, user):
+		# Anonymous users have no permission
+		if not user:
+			return False
+
+		# Admins have all permissions
+		return user.is_admin()
+
 	@property
 	def fingerprint(self):
 		return self.data.fingerprint[-16:]
diff --git a/src/templates/keys-list.html b/src/templates/keys-list.html
index 2c695f8f..29dd25b1 100644
--- a/src/templates/keys-list.html
+++ b/src/templates/keys-list.html
@@ -56,7 +56,7 @@
 							</a>
 						</div>
 
-						{% if current_user and current_user.has_perm("manage_keys") and key.can_be_deleted() %}
+						{% if key.has_perm(current_user) and key.can_be_deleted() %}
 							<div class="btn-group">
 								<a class="btn btn-mini btn-danger" href="/key/{{ key.fingerprint }}/delete">
 									<i class="icon-trash icon-white"></i>
@@ -100,7 +100,7 @@
 		</tbody>
 	</table>
 
-	{% if current_user and current_user.has_perm("manage_keys") %}
+	{% if current_user and current_user.is_admin() %}
 		<a class="btn btn-danger pull-right" href="/key/import">
 			<i class="icon-star icon-white"></i>
 			{{ _("Import new key") }}
diff --git a/src/web/keys.py b/src/web/keys.py
index 097aa71a..c23354b5 100644
--- a/src/web/keys.py
+++ b/src/web/keys.py
@@ -5,10 +5,7 @@ import tornado.web
 from . import base
 
 class KeysActionHandler(base.BaseHandler):
-	def prepare(self):
-		if not self.current_user.has_perm("manage_keys"):
-			raise tornado.web.HTTPError(403)
-
+	pass
 
 class KeysImportHandler(KeysActionHandler):
 	@tornado.web.authenticated
@@ -19,6 +16,10 @@ class KeysImportHandler(KeysActionHandler):
 	def post(self):
 		data = self.get_argument("data")
 
+		# Check permissions
+		if not key.has_perm(self.current_user):
+			raise tornado.web.HTTPError(403)
+
 		key = self.backend.keys.create(data)
 		assert key
 
@@ -32,6 +33,10 @@ class KeysDeleteHandler(KeysActionHandler):
 		if not key:
 			raise tornado.web.HTTPError(404, "Could not find key: %s" % fingerprint)
 
+		# Check permissions
+		if not key.has_perm(self.current_user):
+			raise tornado.web.HTTPError(403)
+
 		confirmed = self.get_argument("confirmed", False)
 		if confirmed:
 			key.delete()