[pbs-devel] [RFC proxmox-backup 14/15] manager: add token commands

[Fabian Grünbichler]

to generate, list and delete tokens. adding them to ACLs already works
out of the box.

Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
---
Notes:
    it might make sense to allow updating ACLs of tokens irrespective of
    general ACL editing capabilities of the user, since the effective
    permissions of a token are always a subset of that of the user
    anyway. otherwise we'd need to implement fine-grained ACL update
    checks for no gain to make API tokens usable for regular users.

 src/bin/proxmox_backup_manager/user.rs | 62 ++++++++++++++++++++++++++
 src/config/user.rs                     | 29 ++++++++++++
 2 files changed, 91 insertions(+)

diff --git a/src/bin/proxmox_backup_manager/user.rs b/src/bin/proxmox_backup_manager/user.rs
index 80dbcb1b..31f74396 100644
--- a/src/bin/proxmox_backup_manager/user.rs
+++ b/src/bin/proxmox_backup_manager/user.rs
@@ -6,6 +6,7 @@ use proxmox::api::{api, cli::*, RpcEnvironment, ApiHandler};
 use proxmox_backup::config;
 use proxmox_backup::tools;
 use proxmox_backup::api2;
+use proxmox_backup::api2::types::PROXMOX_USER_ID_SCHEMA;
 
 #[api(
     input: {
@@ -48,6 +49,48 @@ fn list_users(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<Value, Er
     Ok(Value::Null)
 }
 
+#[api(
+    input: {
+        properties: {
+            "output-format": {
+                schema: OUTPUT_FORMAT,
+                optional: true,
+            },
+            userid: {
+                schema: PROXMOX_USER_ID_SCHEMA,
+            }
+        }
+    }
+)]
+/// List tokens associated with user.
+fn list_tokens(param: Value, rpcenv: &mut dyn RpcEnvironment) -> Result<Value, Error> {
+
+    let output_format = get_output_format(&param);
+
+    let info = &api2::access::user::API_METHOD_LIST_TOKENS;
+    let mut data = match info.handler {
+        ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+        _ => unreachable!(),
+    };
+
+    let options = default_table_format_options()
+        .column(ColumnConfig::new("tokenid"))
+        .column(
+            ColumnConfig::new("enable")
+                .renderer(tools::format::render_bool_with_default_true)
+        )
+        .column(
+            ColumnConfig::new("expire")
+                .renderer(tools::format::render_epoch)
+        )
+        .column(ColumnConfig::new("comment"));
+
+    format_and_print_result_full(&mut data, info.returns, &output_format, &options);
+
+    Ok(Value::Null)
+}
+
+
 pub fn user_commands() -> CommandLineInterface {
 
     let cmd_def = CliCommandMap::new()
@@ -69,6 +112,25 @@ pub fn user_commands() -> CommandLineInterface {
             CliCommand::new(&api2::access::user::API_METHOD_DELETE_USER)
                 .arg_param(&["userid"])
                 .completion_cb("userid", config::user::complete_user_name)
+        )
+        .insert(
+            "list-tokens",
+            CliCommand::new(&&API_METHOD_LIST_TOKENS)
+                .arg_param(&["userid"])
+                .completion_cb("userid", config::user::complete_user_name)
+        )
+        .insert(
+            "generate-token",
+            CliCommand::new(&api2::access::user::API_METHOD_GENERATE_TOKEN)
+                .arg_param(&["userid", "tokenname"])
+                .completion_cb("userid", config::user::complete_user_name)
+        )
+        .insert(
+            "delete-token",
+            CliCommand::new(&api2::access::user::API_METHOD_DELETE_TOKEN)
+                .arg_param(&["userid", "tokenname"])
+                .completion_cb("userid", config::user::complete_user_name)
+                .completion_cb("tokenname", config::user::complete_token_name)
         );
 
     cmd_def.into()
diff --git a/src/config/user.rs b/src/config/user.rs
index 5ebb9f99..2684a529 100644
--- a/src/config/user.rs
+++ b/src/config/user.rs
@@ -265,3 +265,32 @@ pub fn complete_userid(_arg: &str, _param: &HashMap<String, String>) -> Vec<Stri
         Err(_) => vec![],
     }
 }
+
+// shell completion helper
+pub fn complete_token_name(_arg: &str, param: &HashMap<String, String>) -> Vec<String> {
+    match config() {
+        Ok((data, _digest)) => {
+            match param.get("userid") {
+                Some(userid) => {
+                    match (data.lookup::<User>("user", userid), data.convert_to_typed_array("token")) {
+                        (Ok(_), Ok(tokens)) => {
+                            tokens
+                                .into_iter()
+                                .filter_map(|token:ApiToken| {
+                                    let tokenid = token.tokenid;
+                                    if tokenid.is_tokenid() && &tokenid.owner().unwrap() == userid {
+                                        Some(tokenid.tokenname().unwrap().as_str().to_string())
+                                    } else {
+                                        None
+                                    }
+                                }).collect()
+                        },
+                        _ => vec![],
+                    }
+                },
+                None => vec![],
+            }
+        },
+        Err(_) => vec![],
+    }
+}
-- 
2.20.1