authz: protect VPC endpoints

nexus/src/authz/api_resources.rs

@@ -479,3 +479,4 @@ impl ApiResourceError for ProjectChild {
 
 pub type Disk = ProjectChild;
 pub type Instance = ProjectChild;
+pub type Vpc = ProjectChild;

nexus/src/authz/mod.rs

@@ -170,6 +170,7 @@ pub use api_resources::FleetChild;
 pub use api_resources::Instance;
 pub use api_resources::Organization;
 pub use api_resources::Project;
+pub use api_resources::Vpc;
 pub use api_resources::FLEET;
 
 mod context;

nexus/src/db/datastore.rs

@@ -2067,30 +2067,111 @@ impl DataStore {
 
     // VPCs
 
+    /// Fetches a Vpc from the database and returns both the database row
+    /// and an [`authz::Vpc`] for doing authz checks
+    ///
+    /// See [`DataStore::organization_lookup_noauthz()`] for intended use cases
+    /// and caveats.
+    // TODO-security See the note on organization_lookup_noauthz().
+    async fn vpc_lookup_noauthz(
+        &self,
+        authz_project: &authz::Project,
+        vpc_name: &Name,
+    ) -> LookupResult<(authz::Vpc, Vpc)> {
+        use db::schema::vpc::dsl;
+        dsl::vpc
+            .filter(dsl::time_deleted.is_null())
+            .filter(dsl::project_id.eq(authz_project.id()))
+            .filter(dsl::name.eq(vpc_name.clone()))
+            .select(Vpc::as_select())
+            .first_async(self.pool())
+            .await
+            .map_err(|e| {
+                public_error_from_diesel_pool(
+                    e,
+                    ErrorHandler::NotFoundByLookup(
+                        ResourceType::Vpc,
+                        LookupType::ByName(vpc_name.as_str().to_owned()),
+                    ),
+                )
+            })
+            .map(|d| {
+                (
+                    authz_project.child_generic(
+                        ResourceType::Vpc,
+                        d.id(),
+                        LookupType::from(&vpc_name.0),
+                    ),
+                    d,
+                )
+            })
+    }
+
+    /// Look up the id for a Vpc based on its name
+    ///
+    /// Returns an [`authz::Vpc`] (which makes the id available).
+    ///
+    /// Like the other "lookup_by_path()" functions, this function does no authz
+    /// checks.
+    pub async fn vpc_lookup_by_path(
+        &self,
+        organization_name: &Name,
+        project_name: &Name,
+        vpc_name: &Name,
+    ) -> LookupResult<authz::Vpc> {
+        let authz_project = self
+            .project_lookup_by_path(organization_name, project_name)
+            .await?;
+        self.vpc_lookup_noauthz(&authz_project, vpc_name).await.map(|(v, _)| v)
+    }
+
+    /// Lookup a Vpc by name and return the full database record, along
+    /// with an [`authz::Vpc`] for subsequent authorization checks
+    pub async fn vpc_fetch(
+        &self,
+        opctx: &OpContext,
+        authz_project: &authz::Project,
+        name: &Name,
+    ) -> LookupResult<(authz::Vpc, Vpc)> {
+        let (authz_vpc, db_vpc) =
+            self.vpc_lookup_noauthz(authz_project, name).await?;
+        opctx.authorize(authz::Action::Read, &authz_vpc).await?;
+        Ok((authz_vpc, db_vpc))
+    }
+
     pub async fn project_list_vpcs(
         &self,
-        project_id: &Uuid,
+        opctx: &OpContext,
+        authz_project: &authz::Project,
         pagparams: &DataPageParams<'_, Name>,
     ) -> ListResultVec<Vpc> {
-        use db::schema::vpc::dsl;
+        opctx.authorize(authz::Action::ListChildren, authz_project).await?;
 
+        use db::schema::vpc::dsl;
         paginated(dsl::vpc, dsl::name, &pagparams)
             .filter(dsl::time_deleted.is_null())
-            .filter(dsl::project_id.eq(*project_id))
+            .filter(dsl::project_id.eq(authz_project.id()))
             .select(Vpc::as_select())
-            .load_async(self.pool())
+            .load_async(self.pool_authorized(opctx).await?)
             .await
             .map_err(|e| public_error_from_diesel_pool(e, ErrorHandler::Server))
     }
 
-    pub async fn project_create_vpc(&self, vpc: Vpc) -> Result<Vpc, Error> {
+    pub async fn project_create_vpc(
+        &self,
+        opctx: &OpContext,
+        authz_project: &authz::Project,
+        vpc: Vpc,
+    ) -> Result<Vpc, Error> {
         use db::schema::vpc::dsl;
 
+        assert_eq!(authz_project.id(), vpc.project_id);
+        opctx.authorize(authz::Action::CreateChild, authz_project).await?;
+
+        // TODO-correctness Shouldn't this use "insert_resource"?
         let name = vpc.name().clone();
         let vpc = diesel::insert_into(dsl::vpc)
             .values(vpc)
-            .on_conflict(dsl::id)
-            .do_nothing()
             .returning(Vpc::as_returning())
             .get_result_async(self.pool())
             .await
@@ -2105,29 +2186,30 @@ impl DataStore {
 
     pub async fn project_update_vpc(
         &self,
-        vpc_id: &Uuid,
+        opctx: &OpContext,
+        authz_vpc: &authz::Vpc,
         updates: VpcUpdate,
-    ) -> Result<(), Error> {
-        use db::schema::vpc::dsl;
+    ) -> UpdateResult<Vpc> {
+        opctx.authorize(authz::Action::Modify, authz_vpc).await?;
 
+        use db::schema::vpc::dsl;
         diesel::update(dsl::vpc)
             .filter(dsl::time_deleted.is_null())
-            .filter(dsl::id.eq(*vpc_id))
+            .filter(dsl::id.eq(authz_vpc.id()))
             .set(updates)
-            .execute_async(self.pool())
+            .returning(Vpc::as_returning())
+            .get_result_async(self.pool_authorized(opctx).await?)
             .await
             .map_err(|e| {
                 public_error_from_diesel_pool(
                     e,
-                    ErrorHandler::NotFoundByLookup(
-                        ResourceType::Vpc,
-                        LookupType::ById(*vpc_id),
-                    ),
+                    ErrorHandler::NotFoundByResource(authz_vpc),
                 )
-            })?;
-        Ok(())
+            })
     }
 
+    // TODO-security TODO-cleanup Remove this function.  Update callers to use
+    // vpc_lookup_by_path() or vpc_fetch() instead.
     pub async fn vpc_fetch_by_name(
         &self,
         project_id: &Uuid,
@@ -2153,7 +2235,13 @@ impl DataStore {
             })
     }
 
-    pub async fn project_delete_vpc(&self, vpc_id: &Uuid) -> DeleteResult {
+    pub async fn project_delete_vpc(
+        &self,
+        opctx: &OpContext,
+        authz_vpc: &authz::Vpc,
+    ) -> DeleteResult {
+        opctx.authorize(authz::Action::Delete, authz_vpc).await?;
+
         use db::schema::vpc::dsl;
 
         // Note that we don't ensure the firewall rules are empty here, because
@@ -2165,18 +2253,15 @@ impl DataStore {
         let now = Utc::now();
         diesel::update(dsl::vpc)
             .filter(dsl::time_deleted.is_null())
-            .filter(dsl::id.eq(*vpc_id))
+            .filter(dsl::id.eq(authz_vpc.id()))
             .set(dsl::time_deleted.eq(now))
             .returning(Vpc::as_returning())
-            .get_result_async(self.pool())
+            .get_result_async(self.pool_authorized(opctx).await?)
             .await
             .map_err(|e| {
                 public_error_from_diesel_pool(
                     e,
-                    ErrorHandler::NotFoundByLookup(
-                        ResourceType::Vpc,
-                        LookupType::ById(*vpc_id),
-                    ),
+                    ErrorHandler::NotFoundByResource(authz_vpc),
                 )
             })?;
         Ok(())

nexus/src/external_api/http_entrypoints.rs

@@ -1130,8 +1130,10 @@ async fn project_vpcs_get(
     let organization_name = &path.organization_name;
     let project_name = &path.project_name;
     let handler = async {
+        let opctx = OpContext::for_external_api(&rqctx).await?;
         let vpcs = nexus
             .project_list_vpcs(
+                &opctx,
                 &organization_name,
                 &project_name,
                 &data_page_params_for(&rqctx, &query)?
@@ -1176,8 +1178,9 @@ async fn project_vpcs_get_vpc(
     let project_name = &path.project_name;
     let vpc_name = &path.vpc_name;
     let handler = async {
+        let opctx = OpContext::for_external_api(&rqctx).await?;
         let vpc = nexus
-            .project_lookup_vpc(&organization_name, &project_name, &vpc_name)
+            .vpc_fetch(&opctx, &organization_name, &project_name, &vpc_name)
             .await?;
         Ok(HttpResponseOk(vpc.into()))
     };
@@ -1204,8 +1207,10 @@ async fn project_vpcs_post(
     let project_name = &path.project_name;
     let new_vpc_params = &new_vpc.into_inner();
     let handler = async {
+        let opctx = OpContext::for_external_api(&rqctx).await?;
         let vpc = nexus
             .project_create_vpc(
+                &opctx,
                 &organization_name,
                 &project_name,
                 &new_vpc_params,
@@ -1228,20 +1233,22 @@ async fn project_vpcs_put_vpc(
     rqctx: Arc<RequestContext<Arc<ServerContext>>>,
     path_params: Path<VpcPathParam>,
     updated_vpc: TypedBody<params::VpcUpdate>,
-) -> Result<HttpResponseUpdatedNoContent, HttpError> {
+) -> Result<HttpResponseOk<Vpc>, HttpError> {
     let apictx = rqctx.context();
     let nexus = &apictx.nexus;
     let path = path_params.into_inner();
     let handler = async {
-        nexus
+        let opctx = OpContext::for_external_api(&rqctx).await?;
+        let newvpc = nexus
             .project_update_vpc(
+                &opctx,
                 &path.organization_name,
                 &path.project_name,
                 &path.vpc_name,
                 &updated_vpc.into_inner(),
             )
             .await?;
-        Ok(HttpResponseUpdatedNoContent())
+        Ok(HttpResponseOk(newvpc.into()))
     };
     apictx.external_latencies.instrument_dropshot_handler(&rqctx, handler).await
 }
@@ -1265,8 +1272,14 @@ async fn project_vpcs_delete_vpc(
     let project_name = &path.project_name;
     let vpc_name = &path.vpc_name;
     let handler = async {
+        let opctx = OpContext::for_external_api(&rqctx).await?;
         nexus
-            .project_delete_vpc(&organization_name, &project_name, &vpc_name)
+            .project_delete_vpc(
+                &opctx,
+                &organization_name,
+                &project_name,
+                &vpc_name,
+            )
             .await?;
         Ok(HttpResponseDeleted())
     };