[pbs-devel] [PATCH proxmox 2/5] access: define shared `User`, `UserWithTokens` and `ApiTokens types

[Wolfgang Bumiller]

On Mon, Jun 10, 2024 at 05:42:11PM GMT, Shannon Sterz wrote:
> +#[api(
> +    properties: {
> +        userid: {
> +            type: Userid,
> +        },
> +        comment: {
> +            optional: true,
> +            schema: COMMENT_SCHEMA,
> +        },
> +        enable: {
> +            optional: true,
> +            schema: ENABLE_USER_SCHEMA,
> +        },
> +        expire: {
> +            optional: true,
> +            schema: EXPIRE_USER_SCHEMA,
> +        },
> +        firstname: {
> +            optional: true,
> +            schema: FIRST_NAME_SCHEMA,
> +        },
> +        lastname: {
> +            schema: LAST_NAME_SCHEMA,
> +            optional: true,
> +         },
> +        email: {
> +            schema: EMAIL_SCHEMA,
> +            optional: true,
> +        },
> +        tokens: {
> +            type: Array,
> +            optional: true,
> +            description: "List of user's API tokens.",
> +            items: {
> +                type: ApiToken
> +            },
> +        },
> +        "totp-locked": {
> +            type: bool,
> +            optional: true,
> +            default: false,
> +            description: "True if the user is currently locked out of TOTP factors",
> +        },
> +        "tfa-locked-until": {
> +            optional: true,
> +            description: "Contains a timestamp until when a user is locked out of 2nd factors",
> +        },
> +    }
> +)]
> +#[derive(Serialize, Deserialize, Clone, PartialEq)]
> +#[serde(rename_all = "kebab-case")]
> +/// User properties with added list of ApiTokens
> +pub struct UserWithTokens {

While already moving things around, can we make this just contain a
nested `User` with `#[serde(flatten)]`?

> +    pub userid: Userid,
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub comment: Option<String>,
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub enable: Option<bool>,
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub expire: Option<i64>,
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub firstname: Option<String>,
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub lastname: Option<String>,
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub email: Option<String>,
> +    #[serde(skip_serializing_if = "Vec::is_empty", default)]
> +    pub tokens: Vec<ApiToken>,
> +    #[serde(skip_serializing_if = "bool_is_false", default)]
> +    pub totp_locked: bool,
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub tfa_locked_until: Option<i64>,
> +}
> +
> +fn bool_is_false(b: &bool) -> bool {
> +    !b
> +}
> +
> +#[api(
> +    properties: {
> +        tokenid: {
> +            schema: PROXMOX_TOKEN_ID_SCHEMA,
> +        },
> +        comment: {
> +            optional: true,
> +            schema: COMMENT_SCHEMA,
> +        },
> +        enable: {
> +            optional: true,
> +            schema: ENABLE_USER_SCHEMA,
> +        },
> +        expire: {
> +            optional: true,
> +            schema: EXPIRE_USER_SCHEMA,
> +        },
> +    }
> +)]
> +#[derive(Serialize, Deserialize, Clone, PartialEq)]
> +/// ApiToken properties.
> +pub struct ApiToken {
> +    pub tokenid: Authid,
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub comment: Option<String>,
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub enable: Option<bool>,
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub expire: Option<i64>,
> +}
> +
> +impl ApiToken {
> +    pub fn is_active(&self) -> bool {
> +        if !self.enable.unwrap_or(true) {
> +            return false;
> +        }
> +        if let Some(expire) = self.expire {
> +            let now = proxmox_time::epoch_i64();
> +            if expire > 0 && expire <= now {
> +                return false;
> +            }
> +        }
> +        true
> +    }
> +}
> +
> +#[api(
> +    properties: {
> +        userid: {
> +            type: Userid,
> +        },
> +        comment: {
> +            optional: true,
> +            schema: COMMENT_SCHEMA,
> +        },
> +        enable: {
> +            optional: true,
> +            schema: ENABLE_USER_SCHEMA,
> +        },
> +        expire: {
> +            optional: true,
> +            schema: EXPIRE_USER_SCHEMA,
> +        },
> +        firstname: {
> +            optional: true,
> +            schema: FIRST_NAME_SCHEMA,
> +        },
> +        lastname: {
> +            schema: LAST_NAME_SCHEMA,
> +            optional: true,
> +         },
> +        email: {
> +            schema: EMAIL_SCHEMA,
> +            optional: true,
> +        },
> +    }
> +)]
> +#[derive(Serialize, Deserialize, Updater, PartialEq, Eq)]
> +/// User properties.
> +pub struct User {
> +    #[updater(skip)]
> +    pub userid: Userid,
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub comment: Option<String>,
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub enable: Option<bool>,
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub expire: Option<i64>,
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub firstname: Option<String>,
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub lastname: Option<String>,
> +    #[serde(skip_serializing_if = "Option::is_none")]
> +    pub email: Option<String>,
> +}
> +
> +impl User {
> +    pub fn is_active(&self) -> bool {
> +        if !self.enable.unwrap_or(true) {
> +            return false;
> +        }
> +        if let Some(expire) = self.expire {
> +            let now = proxmox_time::epoch_i64();
> +            if expire > 0 && expire <= now {
> +                return false;
> +            }
> +        }
> +        true
> +    }
> +}
> -- 
> 2.39.2