[pbs-devel] [RFC proxmox-backup 00/15] API tokens

[Fabian Grünbichler]

sending as RFC since there are a few implementation details up for
discussion while I struggle with the JS/GUI part ;)

it's mostly modeled after API tokens in PVE, with two differences:
- tokens are always privilege separated
- the user+token list returns full tokenids, not token names

first three patches are just cleanups that fell out of developing this
series.

missing/room for follow-ups:
- allow setting arbitrary ACLs for tokens (since they are restricted to
  the permissions of the user anyway)
- cache authenticated tokens to avoid round trip through hashing/shadow
  file?
- GUI

Fabian Grünbichler (15):
  fix indentation
  fix typos
  REST: rename token to csrf_token
  Userid: extend schema with token name
  add ApiToken to user.cfg and CachedUserInfo
  config: add token.shadow file
  REST: extract and handle API tokens
  api: add API token endpoints
  api: allow listing users + tokens
  api: add permissions endpoint
  client: allow using ApiToken + secret
  owner checks: handle backups owned by API tokens
  tasks: allow unpriv users to read their tokens' tasks
  manager: add token commands
  manager: add user permissions command

 src/api2/access.rs                     |  99 +++++-
 src/api2/access/acl.rs                 |   2 +-
 src/api2/access/user.rs                | 450 ++++++++++++++++++++++++-
 src/api2/admin/datastore.rs            | 134 +++++---
 src/api2/backup.rs                     |   3 +-
 src/api2/config/remote.rs              |   4 +-
 src/api2/node/tasks.rs                 |  30 +-
 src/api2/reader.rs                     |   3 +-
 src/api2/types/mod.rs                  |  15 +-
 src/api2/types/userid.rs               | 367 +++++++++++++++++---
 src/bin/proxmox-backup-client.rs       |   6 +-
 src/bin/proxmox_backup_manager/acl.rs  |   2 +-
 src/bin/proxmox_backup_manager/user.rs | 129 +++++++
 src/client/http_client.rs              |  41 ++-
 src/config.rs                          |   1 +
 src/config/acl.rs                      |  67 ++--
 src/config/cached_user_info.rs         |  65 +++-
 src/config/remote.rs                   |   2 +-
 src/config/token_shadow.rs             |  79 +++++
 src/config/user.rs                     |  98 +++++-
 src/server/rest.rs                     |  71 ++--
 21 files changed, 1443 insertions(+), 225 deletions(-)
 create mode 100644 src/config/token_shadow.rs

-- 
2.20.1