editoast: add check privilege to delete rolling stock endpoint

Signed-off-by: Youness CHRIFI ALAOUI <youness.chrifi@gmail.com>

Author: younesschrifi

editoast/src/views/rolling_stock.rs

@@ -42,7 +42,6 @@ use utoipa::ToSchema;
 use crate::AppState;
 use crate::error::InternalError;
 use crate::error::Result;
-use crate::views::AuthorizationError;
 
 #[derive(Debug, Serialize, ToSchema)]
 pub struct RollingStockWithLiveries {
@@ -322,7 +321,7 @@ pub(in crate::views) async fn update(
     State(AppState {
         regulator, db_pool, ..
     }): State<AppState>,
-    Extension(state): Extension<crate::authentication::State>,
+    Extension(authn_state): Extension<crate::authentication::State>,
     Path(rolling_stock_id): Path<i64>,
     Json(rolling_stock_form): Json<RollingStockForm>,
 ) -> Result<Json<RollingStockWithLiveries>> {
@@ -333,10 +332,8 @@ pub(in crate::views) async fn update(
             rolling_stock_privileges(user, authz::RollingStock(rolling_stock_id)),
             &RollingStockPrivilege::CanWrite,
         )
-        .await?
-    {
-        return Err(AuthorizationError::Forbidden.into());
-    };
+        .await?;
+    }
     let new_rolling_stock = db_pool
         .get()
         .await?
@@ -396,10 +393,23 @@ pub(in crate::views) struct DeleteRollingStockQueryParams {
     )
 )]
 pub(in crate::views) async fn delete(
-    State(db_pool): State<Arc<DbConnectionPoolV2>>,
+    State(AppState {
+        regulator, db_pool, ..
+    }): State<AppState>,
+    Extension(authn_state): Extension<crate::authentication::State>,
     Path(rolling_stock_id): Path<i64>,
     Query(DeleteRollingStockQueryParams { force }): Query<DeleteRollingStockQueryParams>,
 ) -> Result<impl IntoResponse> {
+    if let Some(user) = authn_state.regular_user() {
+        let authorizer = authn_state.authorizer(regulator.openfga(), db_pool.get().await?);
+        crate::authorizers::require(
+            &authorizer,
+            rolling_stock_privileges(user, authz::RollingStock(rolling_stock_id)),
+            &RollingStockPrivilege::CanDelete,
+        )
+        .await?;
+    }
+
     let conn = &mut db_pool.get().await?;
 
     let rolling_stock = RollingStock::retrieve_or_fail(conn.clone(), rolling_stock_id, || {
@@ -1520,7 +1530,7 @@ pub mod tests {
     #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
     async fn delete_locked_rolling_stock_fails() {
         // GIVEN
-        let app = test_app!().skip_authz().build();
+        let app = test_app!().build();
         let db_pool = app.db_pool();
 
         let locked_rs_name = "locked_fast_rolling_stock_name";
@@ -1534,9 +1544,16 @@ pub mod tests {
             .await
             .expect("Failed to create rolling stock");
 
+        let user = app
+            .user("owner", "Owner")
+            .with_roles([Role::OperationalStudies])
+            .with_rolling_stock_grant(locked_fast_rolling_stock.id, RollingStockGrant::Owner)
+            .create()
+            .await;
         // WHEN
         let raw_response = app
             .delete(format!("/rolling_stock/{}", locked_fast_rolling_stock.id).as_str())
+            .by_user(&user.info)
             .await;
 
         // THEN
@@ -1555,16 +1572,24 @@ pub mod tests {
     #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
     async fn delete_unlocked_unused_rolling_stock_succeeds() {
         // GIVEN
-        let app = test_app!().skip_authz().build();
+        let app = test_app!().build();
         let db_pool = app.db_pool();
 
         let rs_name = "fast_rolling_stock_name";
         let fast_rolling_stock = create_fast_rolling_stock(&mut db_pool.get_ok(), rs_name).await;
         assert!(!fast_rolling_stock.locked);
 
+        let user = app
+            .user("owner", "Owner")
+            .with_roles([Role::OperationalStudies])
+            .with_rolling_stock_grant(fast_rolling_stock.id, RollingStockGrant::Owner)
+            .create()
+            .await;
+
         // WHEN
         let raw_response = app
             .delete(format!("/rolling_stock/{}", fast_rolling_stock.id).as_str())
+            .by_user(&user.info)
             .await;
 
         // THEN
@@ -1577,6 +1602,41 @@ pub mod tests {
         assert!(!rolling_stock_exists);
     }
 
+    #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+    async fn delete_rolling_stock_without_authorization() {
+        // GIVEN
+        let app = test_app!().build();
+        let db_pool = app.db_pool();
+
+        let fast_rolling_stock =
+            create_fast_rolling_stock(&mut db_pool.get_ok(), "unauthorized_rolling_stock").await;
+
+        // A user with the OperationalStudies role but only a write grant on the rolling stock
+        // (delete requires an owner/delete grant)
+        let user = app
+            .user("writer", "Writer")
+            .with_roles([Role::OperationalStudies])
+            .with_rolling_stock_grant(fast_rolling_stock.id, RollingStockGrant::Writer)
+            .create()
+            .await;
+
+        // WHEN
+        let raw_response = app
+            .delete(format!("/rolling_stock/{}", fast_rolling_stock.id).as_str())
+            .by_user(user.as_ref())
+            .await;
+
+        // THEN
+        raw_response.assert_status_forbidden();
+
+        // The rolling stock should still exist
+        let rolling_stock_exists =
+            RollingStock::exists(&mut db_pool.get_ok(), fast_rolling_stock.id)
+                .await
+                .expect("Failed to check if rolling stock exists");
+        assert!(rolling_stock_exists);
+    }
+
     #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
     async fn delete_unlocked_used_rolling_stock_requires_force_flag() {
         // GIVEN