api: Restrict API scopes

This change adds support for restricting API scopes in the OpenDC API
server. This is necessary to make a distinction between runners and
regular users.

1 files changed, 6 insertions, 2 deletions

diff --git a/opendc-web/opendc-web-api/opendc/api/topologies.py b/opendc-web/opendc-web-api/opendc/api/topologies.py
index a2d3f41a..c0b2e7ee 100644
--- a/opendc-web/opendc-web-api/opendc/api/topologies.py
+++ b/opendc-web/opendc-web-api/opendc/api/topologies.py
@@ -26,7 +26,7 @@ from marshmallow import Schema, fields
 
 from opendc.models.project import Project
 from opendc.models.topology import Topology as TopologyModel, TopologySchema
-from opendc.exts import current_user, requires_auth
+from opendc.exts import current_user, requires_auth, has_scope
 
 
 class Topology(Resource):
@@ -41,7 +41,11 @@ class Topology(Resource):
         """
         topology = TopologyModel.from_id(topology_id)
         topology.check_exists()
-        topology.check_user_access(current_user['sub'], False)
+
+        # Users with scope runner can access all topologies
+        if not has_scope('runner'):
+            topology.check_user_access(current_user['sub'], False)
+
         data = TopologySchema().dump(topology.obj)
         return {'data': data}