[pbs-devel] [PATCH proxmox-backup 4/8] verify jobs: add permissions

[Fabian Grünbichler]

equivalent to verifying a whole datastore, except for reading job
(entries), which is accessible to regular Datastore.Audit/Backup users
as well.

Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
---

Notes:
    modifying the config could also be guarded by Datastore.Modify, but I like the
    idea of scheduling an action and doing it now requiring the same permissions..

 src/api2/config/verify.rs | 41 +++++++++++++++++++++++++++++++++++++--
 1 file changed, 39 insertions(+), 2 deletions(-)

diff --git a/src/api2/config/verify.rs b/src/api2/config/verify.rs
index 32d83d17..0c5a6460 100644
--- a/src/api2/config/verify.rs
+++ b/src/api2/config/verify.rs
@@ -2,10 +2,17 @@ use anyhow::{bail, Error};
 use serde_json::Value;
 use ::serde::{Deserialize, Serialize};
 
-use proxmox::api::{api, Router, RpcEnvironment};
+use proxmox::api::{api, Permission, Router, RpcEnvironment};
 use proxmox::tools::fs::open_file_locked;
 
 use crate::api2::types::*;
+
+use crate::config::acl::{
+    PRIV_DATASTORE_AUDIT,
+    PRIV_DATASTORE_BACKUP,
+    PRIV_DATASTORE_VERIFY,
+};
+
 use crate::config::verify::{self, VerificationJobConfig};
 
 #[api(
@@ -17,6 +24,12 @@ use crate::config::verify::{self, VerificationJobConfig};
         type: Array,
         items: { type: verify::VerificationJobConfig },
     },
+    access: {
+        permission: &Permission::Privilege(
+            &["datastore", "{store}"],
+            PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_BACKUP | PRIV_DATASTORE_VERIFY,
+            true),
+    },
 )]
 /// List all verification jobs
 pub fn list_verification_jobs(
@@ -61,7 +74,13 @@ pub fn list_verification_jobs(
                 schema: VERIFICATION_SCHEDULE_SCHEMA,
             },
         }
-    }
+    },
+    access: {
+        permission: &Permission::Privilege(
+            &["datastore", "{store}"],
+            PRIV_DATASTORE_VERIFY,
+            true),
+    },
 )]
 /// Create a new verification job.
 pub fn create_verification_job(param: Value) -> Result<(), Error> {
@@ -97,6 +116,12 @@ pub fn create_verification_job(param: Value) -> Result<(), Error> {
         description: "The verification job configuration.",
         type: verify::VerificationJobConfig,
     },
+    access: {
+        permission: &Permission::Privilege(
+            &["datastore", "{store}"],
+            PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_BACKUP | PRIV_DATASTORE_VERIFY,
+            true),
+    },
 )]
 /// Read a verification job configuration.
 pub fn read_verification_job(
@@ -167,6 +192,12 @@ pub enum DeletableProperty {
             },
         },
     },
+    access: {
+        permission: &Permission::Privilege(
+            &["datastore", "{store}"],
+            PRIV_DATASTORE_VERIFY,
+            true),
+    },
 )]
 /// Update verification job config.
 pub fn update_verification_job(
@@ -238,6 +269,12 @@ pub fn update_verification_job(
             },
         },
     },
+    access: {
+        permission: &Permission::Privilege(
+            &["datastore", "{store}"],
+            PRIV_DATASTORE_VERIFY,
+            true),
+    },
 )]
 /// Remove a verification job configuration
 pub fn delete_verification_job(id: String, digest: Option<String>) -> Result<(), Error> {
-- 
2.20.1