[pdm-devel] [PATCH proxmox v2 4/6] access-control: add generic roles endpoint to `api` feature

[Shannon Sterz]

since this is always the same between most products and we already
have access to all the relevant information

Signed-off-by: Shannon Sterz <s.sterz at proxmox.com>
---

the api type was moved from proxmox-yew-comp and the api endpoint from
pbs:

- proxmox-yew-comp: src/common_api_types.rs
- pbs: src/api2/access/role.rs

 proxmox-access-control/src/api.rs   | 43 ++++++++++++++++++++++++++++-
 proxmox-access-control/src/types.rs | 28 +++++++++++++++++++
 2 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/proxmox-access-control/src/api.rs b/proxmox-access-control/src/api.rs
index 4a6aabf5..bb872b97 100644
--- a/proxmox-access-control/src/api.rs
+++ b/proxmox-access-control/src/api.rs
@@ -7,7 +7,7 @@ use proxmox_schema::api;

 use crate::acl::AclTreeNode;
 use crate::init::access_conf;
-use crate::types::{AclListItem, AclUgidType, ACL_PATH_SCHEMA, ACL_PROPAGATE_SCHEMA};
+use crate::types::{AclListItem, AclUgidType, RoleInfo, ACL_PATH_SCHEMA, ACL_PROPAGATE_SCHEMA};
 use crate::CachedUserInfo;

 #[api(
@@ -276,3 +276,44 @@ fn extract_acl_node_data(
 pub const ACL_ROUTER: Router = Router::new()
     .get(&API_METHOD_READ_ACL)
     .put(&API_METHOD_UPDATE_ACL);
+
+#[api(
+    returns: {
+        description: "List of roles.",
+        type: Array,
+        items: {
+            type: RoleInfo,
+        }
+    },
+    access: {
+        permission: &Permission::Anybody,
+    }
+)]
+/// A list of available roles
+fn list_roles() -> Result<Vec<RoleInfo>, Error> {
+    let list = access_conf()
+        .roles()
+        .iter()
+        .map(|(role, (privs, comment))| {
+            let priv_list = access_conf()
+                .privileges()
+                .iter()
+                .filter_map(|(name, privilege)| {
+                    if privs & privilege > 0 {
+                        Some(name.to_string())
+                    } else {
+                        None
+                    }
+                });
+
+            RoleInfo {
+                roleid: role.to_string(),
+                privs: priv_list.collect(),
+                comment: Some(comment.to_string()),
+            }
+        });
+
+    Ok(list.collect())
+}
+
+pub const ROLE_ROUTER: Router = Router::new().get(&API_METHOD_LIST_ROLES);
diff --git a/proxmox-access-control/src/types.rs b/proxmox-access-control/src/types.rs
index 01d078de..ea64d333 100644
--- a/proxmox-access-control/src/types.rs
+++ b/proxmox-access-control/src/types.rs
@@ -247,3 +247,31 @@ pub struct AclListItem {
     /// A role represented as a string.
     pub roleid: String,
 }
+
+#[api(
+    properties: {
+        privs: {
+            type: Array,
+            description: "List of Privileges",
+            items: {
+                type: String,
+                description: "A Privilege",
+            },
+        },
+        comment: {
+            schema: COMMENT_SCHEMA,
+            optional: true,
+        }
+    }
+)]
+/// A struct that the describes a role and shows the associated privileges.
+#[derive(Serialize, Deserialize, PartialEq, Clone)]
+pub struct RoleInfo {
+    /// The id of the role
+    pub roleid: String,
+    /// The privileges the role holds
+    pub privs: Vec<String>,
+    /// A comment describing the role
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub comment: Option<String>,
+}
--
2.39.5