[pve-devel] [PATCH manager 2/2] api: notifications: give targets and matchers their own ACL namespace
Lukas Wagner
l.wagner at proxmox.com
Tue Nov 7 13:46:07 CET 2023
Right now, matchers and targets share a single namespace due to
limitations of the section-config parser. This will probably be fixed
some time in the future.
As a preparation for that we need to ensure that the ACL tree has
separate namespaces for both.
Signed-off-by: Lukas Wagner <l.wagner at proxmox.com>
---
This patch requires the pve-manager patches from my notification
revamp patch series.
PVE/API2/Cluster/Notifications.pm | 55 +++++++++++++++----------------
1 file changed, 27 insertions(+), 28 deletions(-)
diff --git a/PVE/API2/Cluster/Notifications.pm b/PVE/API2/Cluster/Notifications.pm
index 8f716f26..6ff6d89e 100644
--- a/PVE/API2/Cluster/Notifications.pm
+++ b/PVE/API2/Cluster/Notifications.pm
@@ -57,7 +57,7 @@ sub raise_api_error {
}
sub filter_entities_by_privs {
- my ($rpcenv, $entities) = @_;
+ my ($rpcenv, $prefix, $entities) = @_;
my $authuser = $rpcenv->get_user();
my $can_see_mapping_privs = ['Mapping.Modify', 'Mapping.Use', 'Mapping.Audit'];
@@ -65,7 +65,7 @@ sub filter_entities_by_privs {
my $filtered = [grep {
$rpcenv->check_any(
$authuser,
- "/mapping/notification/$_->{name}",
+ "/mapping/notification/$prefix/$_->{name}",
$can_see_mapping_privs,
1
);
@@ -138,8 +138,7 @@ __PACKAGE__->register_method ({
description => 'Returns a list of all entities that can be used as notification targets.',
permissions => {
description => "Only lists entries where you have 'Mapping.Modify', 'Mapping.Use' or"
- . " 'Mapping.Audit' permissions on '/mapping/notification/<name>'."
- . " The special 'mail-to-root' target is available to all users.",
+ . " 'Mapping.Audit' permissions on '/mapping/notification/targets/<name>'.",
user => 'all',
},
protected => 1,
@@ -199,7 +198,7 @@ __PACKAGE__->register_method ({
raise_api_error($@) if $@;
- return filter_entities_by_privs($rpcenv, $targets);
+ return filter_entities_by_privs($rpcenv, "targets", $targets);
}
});
@@ -211,7 +210,7 @@ __PACKAGE__->register_method ({
description => 'Send a test notification to a provided target.',
permissions => {
description => "The user requires 'Mapping.Modify', 'Mapping.Use' or"
- . " 'Mapping.Audit' permissions on '/mapping/notification/<name>'."
+ . " 'Mapping.Audit' permissions on '/mapping/notification/targets/<name>'."
. " The special 'mail-to-root' target can be accessed by all users.",
user => 'all',
},
@@ -236,7 +235,7 @@ __PACKAGE__->register_method ({
$rpcenv->check_any(
$authuser,
- "/mapping/notification/$name",
+ "/mapping/notification/targets/$name",
$privs,
);
@@ -299,7 +298,7 @@ __PACKAGE__->register_method ({
description => 'Returns a list of all sendmail endpoints',
permissions => {
description => "Only lists entries where you have 'Mapping.Modify', 'Mapping.Use' or"
- . " 'Mapping.Audit' permissions on '/mapping/notification/<name>'.",
+ . " 'Mapping.Audit' permissions on '/mapping/notification/targets/<name>'.",
user => 'all',
},
protected => 1,
@@ -324,7 +323,7 @@ __PACKAGE__->register_method ({
};
raise_api_error($@) if $@;
- return filter_entities_by_privs($rpcenv, $entities);
+ return filter_entities_by_privs($rpcenv, "targets", $entities);
}
});
@@ -335,8 +334,8 @@ __PACKAGE__->register_method ({
description => 'Return a specific sendmail endpoint',
permissions => {
check => ['or',
- ['perm', '/mapping/notification/{name}', ['Mapping.Modify']],
- ['perm', '/mapping/notification/{name}', ['Mapping.Audit']],
+ ['perm', '/mapping/notification/targets/{name}', ['Mapping.Modify']],
+ ['perm', '/mapping/notification/targets/{name}', ['Mapping.Audit']],
],
},
protected => 1,
@@ -380,7 +379,7 @@ __PACKAGE__->register_method ({
method => 'POST',
description => 'Create a new sendmail endpoint',
permissions => {
- check => ['perm', '/mapping/notification', ['Mapping.Modify']],
+ check => ['perm', '/mapping/notification/targets', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
@@ -426,7 +425,7 @@ __PACKAGE__->register_method ({
method => 'PUT',
description => 'Update existing sendmail endpoint',
permissions => {
- check => ['perm', '/mapping/notification/{name}', ['Mapping.Modify']],
+ check => [ 'perm', '/mapping/notification/targets/{name}', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
@@ -490,7 +489,7 @@ __PACKAGE__->register_method ({
method => 'DELETE',
description => 'Remove sendmail endpoint',
permissions => {
- check => ['perm', '/mapping/notification', ['Mapping.Modify']],
+ check => ['perm', '/mapping/notification/targets', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
@@ -548,7 +547,7 @@ __PACKAGE__->register_method ({
protected => 1,
permissions => {
description => "Only lists entries where you have 'Mapping.Modify', 'Mapping.Use' or"
- . " 'Mapping.Audit' permissions on '/mapping/notification/<name>'.",
+ . " 'Mapping.Audit' permissions on '/mapping/notification/targets/<name>'.",
user => 'all',
},
parameters => {
@@ -572,7 +571,7 @@ __PACKAGE__->register_method ({
};
raise_api_error($@) if $@;
- return filter_entities_by_privs($rpcenv, $entities);
+ return filter_entities_by_privs($rpcenv, "targets", $entities);
}
});
@@ -584,8 +583,8 @@ __PACKAGE__->register_method ({
protected => 1,
permissions => {
check => ['or',
- ['perm', '/mapping/notification/{name}', ['Mapping.Modify']],
- ['perm', '/mapping/notification/{name}', ['Mapping.Audit']],
+ ['perm', '/mapping/notification/targets/{name}', ['Mapping.Modify']],
+ ['perm', '/mapping/notification/targets/{name}', ['Mapping.Audit']],
],
},
parameters => {
@@ -628,7 +627,7 @@ __PACKAGE__->register_method ({
method => 'POST',
description => 'Create a new gotify endpoint',
permissions => {
- check => ['perm', '/mapping/notification', ['Mapping.Modify']],
+ check => ['perm', '/mapping/notification/targets', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
@@ -670,7 +669,7 @@ __PACKAGE__->register_method ({
method => 'PUT',
description => 'Update existing gotify endpoint',
permissions => {
- check => ['perm', '/mapping/notification/{name}', ['Mapping.Modify']],
+ check => [ 'perm', '/mapping/notification/targets/{name}', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
@@ -729,7 +728,7 @@ __PACKAGE__->register_method ({
method => 'DELETE',
description => 'Remove gotify endpoint',
permissions => {
- check => ['perm', '/mapping/notification/{name}', ['Mapping.Modify']],
+ check => [ 'perm', '/mapping/notification/targets/{name}', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
@@ -825,7 +824,7 @@ __PACKAGE__->register_method ({
protected => 1,
permissions => {
description => "Only lists entries where you have 'Mapping.Modify', 'Mapping.Use' or"
- . " 'Mapping.Audit' permissions on '/mapping/notification/<name>'.",
+ . " 'Mapping.Audit' permissions on '/mapping/notification/matchers/<name>'.",
user => 'all',
},
parameters => {
@@ -849,7 +848,7 @@ __PACKAGE__->register_method ({
};
raise_api_error($@) if $@;
- return filter_entities_by_privs($rpcenv, $entities);
+ return filter_entities_by_privs($rpcenv, "matchers", $entities);
}
});
@@ -861,8 +860,8 @@ __PACKAGE__->register_method ({
protected => 1,
permissions => {
check => ['or',
- ['perm', '/mapping/notification/{name}', ['Mapping.Modify']],
- ['perm', '/mapping/notification/{name}', ['Mapping.Audit']],
+ ['perm', '/mapping/notification/matchers/{name}', ['Mapping.Modify']],
+ ['perm', '/mapping/notification/matchers/{name}', ['Mapping.Audit']],
],
},
parameters => {
@@ -906,7 +905,7 @@ __PACKAGE__->register_method ({
description => 'Create a new matcher',
protected => 1,
permissions => {
- check => ['perm', '/mapping/notification', ['Mapping.Modify']],
+ check => ['perm', '/mapping/notification/matchers', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
@@ -956,7 +955,7 @@ __PACKAGE__->register_method ({
method => 'PUT',
description => 'Update existing matcher',
permissions => {
- check => ['perm', '/mapping/notification/{name}', ['Mapping.Modify']],
+ check => [ 'perm', '/mapping/notification/matchers/{name}', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
@@ -1022,7 +1021,7 @@ __PACKAGE__->register_method ({
method => 'DELETE',
description => 'Remove matcher',
permissions => {
- check => ['perm', '/mapping/notification/{name}', ['Mapping.Modify']],
+ check => ['perm', '/mapping/notification/matchers/{name}', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
--
2.39.2
More information about the pve-devel
mailing list