editoast: add authorisation check for rolling stock

younesschrifi · younesschrifi · commit bf067acd4c13 · 2026-06-23T22:09:44.000+02:00
Signed-off-by: Youness CHRIFI ALAOUI &lt;youness.chrifi@gmail.com&gt;
diff --git a/editoast/src/authentication.rs b/editoast/src/authentication.rs
@@ -124,4 +124,15 @@ impl State {
             Mode::Skip { .. } => Ok(State::Skip { user, roles }),
         }
     }
+
+    /// The authenticated user if authorization is **not** skipped
+    ///
+    /// If this function returns a user, then it is subject to permissions,
+    /// otherwise they likely can be bypassed.
+    pub fn regular_user(&self) -> Option<authz::User> {
+        match self {
+            State::Authenticated { user, .. } => Some(*user),
+            State::Skip { .. } => None,
+        }
+    }
 }
diff --git a/editoast/src/authorizers.rs b/editoast/src/authorizers.rs
@@ -1,5 +1,7 @@
 use std::convert::Infallible;
 
+use crate::views::AuthorizationError;
+use crate::views::AuthorizerError;
 use authz::v2::Access;
 use authz::v2::Actor;
 use authz::v2::Authorizer;
@@ -209,6 +211,38 @@ macro_rules! impossible {
 }
 pub(crate) use impossible;
 
+/// Ensures the issuer holds a privilege satisfying `required`.
+/// `protected` is an operation yielding the set of privileges the issuer holds on a resource.
+/// Access is granted when the operation is authorized and the issuer holds a privilege equal to `required`.
+pub async fn require<I, U>(
+    authorizer: &U,
+    protected: Protected<I>,
+    required: &<I as IntoIterator>::Item,
+) -> Result<(), AuthorizationError>
+where
+    I: IntoIterator,
+    <I as IntoIterator>::Item: PartialEq,
+    U: Authorizer<Error = Error>,
+{
+    let access = authorizer.authorize(protected).await.map_err(|e| match e {
+        Error::Database(error) => {
+            AuthorizationError::AuthError(AuthorizerError::Storage(error.into()))
+        }
+        Error::OpenFga(error) => error.into(),
+    })?;
+    let Ok(privileges) = access.access().await? else {
+        return Err(AuthorizationError::Forbidden);
+    };
+    if privileges
+        .into_iter()
+        .any(|privilege| privilege == *required)
+    {
+        Ok(())
+    } else {
+        Err(AuthorizationError::Forbidden)
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use authz::InfraGrant;
diff --git a/editoast/src/views/rolling_stock.rs b/editoast/src/views/rolling_stock.rs
@@ -1,6 +1,9 @@
 pub(in crate::views) mod light;
 pub(in crate::views) mod towed;
 
+use authz::RollingStockPrivilege;
+use authz::v2::rolling_stock_privileges;
+use axum::Extension;
 use schemas::RollingStock as RollingStockForm;
 
 use std::io::Cursor;
@@ -36,6 +39,7 @@ use thiserror::Error;
 use utoipa::IntoParams;
 use utoipa::ToSchema;
 
+use crate::AppState;
 use crate::error::InternalError;
 use crate::error::Result;
 
@@ -180,9 +184,22 @@ pub struct RollingStockNameParam {
     )
 )]
 pub(in crate::views) async fn get(
-    State(db_pool): State<Arc<DbConnectionPoolV2>>,
+    State(AppState {
+        regulator, db_pool, ..
+    }): State<AppState>,
+    Extension(authn_state): Extension<crate::authentication::State>,
     Path(rolling_stock_id): Path<i64>,
 ) -> Result<Json<RollingStockWithLiveries>> {
+    if let Some(user) = authn_state.regular_user() {
+        let authorizer = authn_state.authorizer(regulator.openfga(), db_pool.get().await?);
+        crate::authorizers::require(
+            &authorizer,
+            rolling_stock_privileges(user, authz::RollingStock(rolling_stock_id)),
+            &RollingStockPrivilege::CanRead,
+        )
+        .await?;
+    }
+
     let rolling_stock = retrieve_existing_rolling_stock(
         &mut db_pool.get().await?,
         RollingStockKey::Id(rolling_stock_id),
@@ -204,14 +221,28 @@ pub(in crate::views) async fn get(
     )
 )]
 pub(in crate::views) async fn get_by_name(
-    State(db_pool): State<Arc<DbConnectionPoolV2>>,
+    State(AppState {
+        regulator, db_pool, ..
+    }): State<AppState>,
+    Extension(authn_state): Extension<crate::authentication::State>,
     Path(rolling_stock_name): Path<String>,
 ) -> Result<Json<RollingStockWithLiveries>> {
     let rolling_stock = retrieve_existing_rolling_stock(
         &mut db_pool.get().await?,
         RollingStockKey::Name(rolling_stock_name),
     )
     .await?;
+
+    if let Some(user) = authn_state.regular_user() {
+        let authorizer = authn_state.authorizer(regulator.openfga(), db_pool.get().await?);
+        crate::authorizers::require(
+            &authorizer,
+            rolling_stock_privileges(user, authz::RollingStock(rolling_stock.id)),
+            &RollingStockPrivilege::CanRead,
+        )
+        .await?;
+    }
+
     let rolling_stock_with_liveries =
         RollingStockWithLiveries::try_fetch(&mut db_pool.get().await?, rolling_stock).await?;
     Ok(Json(rolling_stock_with_liveries))
@@ -689,6 +720,7 @@ pub mod tests {
     use crate::fixtures::simple_paced_train_changeset;
     use crate::views::test_app;
     use crate::views::test_app::TestApp;
+    use crate::views::test_app::TestRequestExt;
     use editoast_models::rolling_stock::RollingStock;
 
     impl TestApp {
@@ -1012,15 +1044,24 @@ pub mod tests {
     #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
     async fn get_rolling_stock_by_id() {
         // GIVEN
-        let app = test_app!().skip_authz().build();
+        let app = test_app!().build();
         let db_pool = app.db_pool();
 
         let rs_name = "fast_rolling_stock_name";
         let fast_rolling_stock = create_fast_rolling_stock(&mut db_pool.get_ok(), rs_name).await;
 
+        // a user with the role to reach the endpoint and a read grant on the rolling stock
+        let user = app
+            .user("authorized", "Authorized")
+            .with_roles([Role::OperationalStudies])
+            .with_rolling_stock_grant(fast_rolling_stock.id, authz::RollingStockGrant::Reader)
+            .create()
+            .await;
+
         // WHEN
         let raw_response = app
             .rolling_stock_get_by_id_request(fast_rolling_stock.id)
+            .by_user(&user.info)
             .await;
 
         // THEN
@@ -1029,6 +1070,48 @@ pub mod tests {
         assert_eq!(response, fast_rolling_stock);
     }
 
+    #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+    async fn get_rolling_stock_by_id_with_privilege_and_no_roles() {
+        let app = test_app!().build();
+        let db_pool = app.db_pool();
+
+        let fast_rolling_stock =
+            create_fast_rolling_stock(&mut db_pool.get_ok(), "fast_rolling_stock_name").await;
+
+        // a user that does not have the role to reach the endpoint but has a read grant on the rolling stock
+        let user = app
+            .user("unauthorized", "Unauthorized")
+            .with_rolling_stock_grant(fast_rolling_stock.id, authz::RollingStockGrant::Reader)
+            .create()
+            .await;
+
+        app.rolling_stock_get_by_id_request(fast_rolling_stock.id)
+            .by_user(&user.info)
+            .await
+            .assert_status_forbidden();
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+    async fn get_rolling_stock_by_id_without_permission() {
+        let app = test_app!().build();
+        let db_pool = app.db_pool();
+
+        let fast_rolling_stock =
+            create_fast_rolling_stock(&mut db_pool.get_ok(), "fast_rolling_stock_name").await;
+
+        // a user that has the role to reach the endpoint but no read grant on the rolling stock
+        let user = app
+            .user("unauthorized", "Unauthorized")
+            .with_roles([Role::OperationalStudies])
+            .create()
+            .await;
+
+        app.rolling_stock_get_by_id_request(fast_rolling_stock.id)
+            .by_user(&user.info)
+            .await
+            .assert_status_forbidden();
+    }
+
     #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
     async fn get_rolling_stock_by_name() {
         // GIVEN
diff --git a/editoast/src/views/rolling_stock/light.rs b/editoast/src/views/rolling_stock/light.rs
@@ -1,3 +1,6 @@
+use authz::RollingStockPrivilege;
+use authz::v2::rolling_stock_privileges;
+use axum::Extension;
 use axum::extract::Json;
 use axum::extract::Path;
 use axum::extract::Query;
@@ -28,6 +31,7 @@ use super::RollingStockError;
 use super::RollingStockIdParam;
 use super::RollingStockKey;
 use super::RollingStockNameParam;
+use crate::AppState;
 use crate::error::Result;
 use crate::views::pagination::PaginatedList;
 use crate::views::pagination::PaginationQueryParams;
@@ -118,9 +122,22 @@ pub(in crate::views) async fn list(
     )
 )]
 pub(in crate::views) async fn get(
-    State(db_pool): State<Arc<DbConnectionPoolV2>>,
+    State(AppState {
+        regulator, db_pool, ..
+    }): State<AppState>,
+    Extension(authn_state): Extension<crate::authentication::State>,
     Path(light_rolling_stock_id): Path<i64>,
 ) -> Result<Json<LightRollingStockWithLiveries>> {
+    if let Some(user) = authn_state.regular_user() {
+        let authorizer = authn_state.authorizer(regulator.openfga(), db_pool.get().await?);
+        crate::authorizers::require(
+            &authorizer,
+            rolling_stock_privileges(user, authz::RollingStock(light_rolling_stock_id)),
+            &RollingStockPrivilege::CanRead,
+        )
+        .await?;
+    }
+
     let rolling_stock =
         RollingStock::retrieve_or_fail(db_pool.get().await?, light_rolling_stock_id, || {
             RollingStockError::KeyNotFound {
@@ -144,7 +161,10 @@ pub(in crate::views) async fn get(
     )
 )]
 pub(in crate::views) async fn get_by_name(
-    State(db_pool): State<Arc<DbConnectionPoolV2>>,
+    State(AppState {
+        regulator, db_pool, ..
+    }): State<AppState>,
+    Extension(authn_state): Extension<crate::authentication::State>,
     Path(light_rolling_stock_name): Path<String>,
 ) -> Result<Json<LightRollingStockWithLiveries>> {
     let rolling_stock = RollingStock::retrieve_or_fail(
@@ -155,6 +175,17 @@ pub(in crate::views) async fn get_by_name(
         },
     )
     .await?;
+
+    if let Some(user) = authn_state.regular_user() {
+        let authorizer = authn_state.authorizer(regulator.openfga(), db_pool.get().await?);
+        crate::authorizers::require(
+            &authorizer,
+            rolling_stock_privileges(user, authz::RollingStock(rolling_stock.id)),
+            &RollingStockPrivilege::CanRead,
+        )
+        .await?;
+    }
+
     let light_rolling_stock_with_liveries =
         LightRollingStockWithLiveries::try_fetch(&mut db_pool.get().await?, rolling_stock).await?;
     Ok(Json(light_rolling_stock_with_liveries))
@@ -281,6 +312,7 @@ mod tests {
     use crate::error::InternalError;
     use crate::fixtures::create_fast_rolling_stock;
     use crate::views::test_app;
+    use crate::views::test_app::TestRequestExt;
 
     fn is_sorted(data: &[i64]) -> bool {
         for elem in data.windows(2) {
@@ -300,15 +332,23 @@ mod tests {
     #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
     async fn get_light_rolling_stock() {
         // GIVEN
-        let app = test_app!().skip_authz().build();
+        let app = test_app!().build();
         let db_pool = app.db_pool();
 
         let rs_name = "fast_rolling_stock_name";
         let fast_rolling_stock = create_fast_rolling_stock(&mut db_pool.get_ok(), rs_name).await;
 
+        // a user with a read grant on the rolling stock
+        let user = app
+            .user("authorized", "Authorized")
+            .with_rolling_stock_grant(fast_rolling_stock.id, authz::RollingStockGrant::Reader)
+            .create()
+            .await;
+
         // WHEN
         let response: LightRollingStockWithLiveries = app
             .get(format!("/light_rolling_stock/{}", fast_rolling_stock.id).as_str())
+            .by_user(&user.info)
             .await
             .assert_status_ok()
             .json();
@@ -320,15 +360,23 @@ mod tests {
     #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
     async fn get_light_rolling_stock_by_name() {
         // GIVEN
-        let app = test_app!().skip_authz().build();
+        let app = test_app!().build();
         let db_pool = app.db_pool();
 
         let rs_name = "fast_rolling_stock_name";
         let fast_rolling_stock = create_fast_rolling_stock(&mut db_pool.get_ok(), rs_name).await;
 
+        // a user with a read grant on the rolling stock
+        let user = app
+            .user("authorized", "Authorized")
+            .with_rolling_stock_grant(fast_rolling_stock.id, authz::RollingStockGrant::Reader)
+            .create()
+            .await;
+
         // WHEN
         let response: LightRollingStockWithLiveries = app
             .get(format!("/light_rolling_stock/name/{rs_name}").as_str())
+            .by_user(&user.info)
             .await
             .assert_status_ok()
             .json();
@@ -347,6 +395,48 @@ mod tests {
             .assert_status_not_found();
     }
 
+    #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+    async fn get_light_rolling_stock_without_permission() {
+        let app = test_app!().build();
+        let db_pool = app.db_pool();
+
+        let fast_rolling_stock =
+            create_fast_rolling_stock(&mut db_pool.get_ok(), "fast_rolling_stock_name").await;
+
+        // a user that has the role to reach the endpoint but no read grant on the rolling stock
+        let user = app
+            .user("unauthorized", "Unauthorized")
+            .with_roles([authz::Role::OperationalStudies])
+            .create()
+            .await;
+
+        app.get(format!("/light_rolling_stock/{}", fast_rolling_stock.id).as_str())
+            .by_user(&user.info)
+            .await
+            .assert_status_forbidden();
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+    async fn get_light_rolling_stock_by_name_without_permission() {
+        let app = test_app!().build();
+        let db_pool = app.db_pool();
+
+        let rs_name = "fast_rolling_stock_name";
+        create_fast_rolling_stock(&mut db_pool.get_ok(), rs_name).await;
+
+        // a user that has the role to reach the endpoint but no read grant on the rolling stock
+        let user = app
+            .user("unauthorized", "Unauthorized")
+            .with_roles([authz::Role::OperationalStudies])
+            .create()
+            .await;
+
+        app.get(format!("/light_rolling_stock/name/{rs_name}").as_str())
+            .by_user(&user.info)
+            .await
+            .assert_status_forbidden();
+    }
+
     #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
     async fn list_light_rolling_stock_increasing_ids() {
         let app = test_app!().skip_authz().build();

Original file line number	Diff line number	Diff line change
`@@ -124,4 +124,15 @@ impl State {`
`124`	`124`	`Mode::Skip { .. } => Ok(State::Skip { user, roles }),`
`125`	`125`	`}`
`126`	`126`	`}`
	`127`	`+`
	`128`	`+ /// The authenticated user if authorization is not skipped`
	`129`	`+ ///`
	`130`	`+ /// If this function returns a user, then it is subject to permissions,`
	`131`	`+ /// otherwise they likely can be bypassed.`
	`132`	`+ pub fn regular_user(&self) -> Option<authz::User> {`
	`133`	`+ match self {`
	`134`	`+ State::Authenticated { user, .. } => Some(*user),`
	`135`	`+ State::Skip { .. } => None,`
	`136`	`+ }`
	`137`	`+ }`
`127`	`138`	`}`