[pbs-devel] [v2 proxmox-backup] www: show more ACLs in datastore panel

[Fabian Grünbichler]

On November 9, 2020 7:56 pm, Thomas Lamprecht wrote:
> On 09.11.20 14:47, Fabian Grünbichler wrote:
>> since just the ACLs defined on the exact datastore path don't give
>> anywhere near a complete picture of who has access to it.
>> 
>> Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
>> ---
>> 
>> Notes:
>>     v2: handle neighbouring ACL paths properly
>> 
>>  www/config/ACLView.js  | 20 +++++++++++++++++++-
>>  www/datastore/Panel.js |  1 -
>>  2 files changed, 19 insertions(+), 2 deletions(-)
>> 
>> diff --git a/www/config/ACLView.js b/www/config/ACLView.js
>> index bf1ea6a9..20caf284 100644
>> --- a/www/config/ACLView.js
>> +++ b/www/config/ACLView.js
>> @@ -84,11 +84,29 @@ Ext.define('PBS.config.ACLView', {
>>  
>>  	    let params = {};
>>  	    if (view.aclPath !== undefined) {
>> -		params.path = view.aclPath;
>> +
>> +		let pathFilter = Ext.create('Ext.util.Filter', {
>> +		    filterPath: view.aclPath,
>> +		    filterFn: function(item) {
>> +			let me = this;
>> +			let curr = item.data.path;
>> +
>> +			if (curr.lastIndexOf("/") < me.filterPath.lastIndexOf("/")) {
>> +			    return me.filterPath.startsWith(curr);
>> +			} else {
>> +			    return me.filterPath === curr;
>> +			}
> 
> 
> argh, this gets it wrong too, e.g. if one passes /datastore as filter get
> only the /datastore ACLs, but not / or /datastore/test ones.

the former was not intended (I had the early return for "/" in an 
intermediate version with splits, but lost it on simplification), the 
latter one was ("/datastore/test" ACLs don't affect permissions on 
"/datastore").

> We probably need to split both filter and current path into components
> .split('/') and go through them, return false if filter components are
> not yet exhausted and the current level does not match, else return true.

I see that you fixed that up already which looks good, and showing child 
ACLs as well makes sense for the datastore overview and is now 
documented, so that change in behaviour is fine for me too :) we will 
only ever set intermediate (as in "overview" panels) or leaf (as in the 
datacenter panel), and for the second case there cannot be any child 
ACLs atm anyway.