[pdm-devel] [PATCH datacenter-manager v2 07/12] api: resources: top entities: add support for view-filter parameter

[Dominik Csapak]

Reviewed-by: Dominik Csapak <d.csapak at proxmox.com>

On 11/3/25 1:35 PM, Lukas Wagner wrote:
> A view filter allows one to get filtered subset of all resources, based
> on filter rules defined in a config file. View filters integrate with
> the permission system - if a user has permissions on
> /view/{view-filter-id}, then these privileges are transitively applied
> to all resources which are matched by the rules. All other permission
> checks are replaced if requesting data through a view filter.
> 
> Signed-off-by: Lukas Wagner <l.wagner at proxmox.com>
> ---
>   server/src/api/resources.rs                  | 41 ++++++++++++++++++--
>   server/src/metric_collection/top_entities.rs |  5 +++
>   2 files changed, 42 insertions(+), 4 deletions(-)
> 
> diff --git a/server/src/api/resources.rs b/server/src/api/resources.rs
> index 6feda45b..ea76d81b 100644
> --- a/server/src/api/resources.rs
> +++ b/server/src/api/resources.rs
> @@ -623,7 +623,11 @@ pub async fn get_subscription_status(
>               "timeframe": {
>                   type: RrdTimeframe,
>                   optional: true,
> -            }
> +            },
> +            "view-filter": {
> +                schema: VIEW_FILTER_ID_SCHEMA,
> +                optional: true,
> +            },
>           }
>       },
>       access: {
> @@ -636,6 +640,7 @@ pub async fn get_subscription_status(
>   /// Returns the top X entities regarding the chosen type
>   async fn get_top_entities(
>       timeframe: Option<RrdTimeframe>,
> +    view_filter: Option<String>,
>       rpcenv: &mut dyn RpcEnvironment,
>   ) -> Result<TopEntities, Error> {
>       let user_info = CachedUserInfo::new()?;
> @@ -644,17 +649,45 @@ async fn get_top_entities(
>           .ok_or_else(|| format_err!("no authid available"))?
>           .parse()?;
>   
> -    if !user_info.any_privs_below(&auth_id, &["resource"], PRIV_RESOURCE_AUDIT)? {
> +    if let Some(view_filter) = &view_filter {
> +        user_info.check_privs(&auth_id, &["view", view_filter], PRIV_RESOURCE_AUDIT, false)?;
> +    } else if !user_info.any_privs_below(&auth_id, &["resource"], PRIV_RESOURCE_AUDIT)? {
>           http_bail!(FORBIDDEN, "user has no access to resources");
>       }
>   
> +    let view_filter = view_filter
> +        .map(|a| views::view_filter::get_view_filter(&a))
> +        .transpose()?;
> +
>       let (remotes_config, _) = pdm_config::remotes::config()?;
> +
>       let check_remote_privs = |remote_name: &str| {
> -        user_info.lookup_privs(&auth_id, &["resource", remote_name]) & PRIV_RESOURCE_AUDIT != 0
> +        if let Some(view_filter) = &view_filter {
> +            // if `include-remote` or `exclude-remote` are used we can limit the
> +            // number of remotes to check.
> +            !view_filter.can_skip_remote(remote_name)
> +        } else {
> +            user_info.lookup_privs(&auth_id, &["resource", remote_name]) & PRIV_RESOURCE_AUDIT != 0
> +        }
> +    };
> +
> +    let is_resource_included = |remote: &str, resource: &Resource| {
> +        if let Some(view_filter) = &view_filter {
> +            view_filter.resource_matches(remote, resource)
> +        } else {
> +            true
> +        }
>       };
>   
>       let timeframe = timeframe.unwrap_or(RrdTimeframe::Day);
> -    let res = top_entities::calculate_top(&remotes_config, timeframe, 10, check_remote_privs);
> +    let res = top_entities::calculate_top(
> +        &remotes_config,
> +        timeframe,
> +        10,
> +        check_remote_privs,
> +        is_resource_included,
> +    );
> +
>       Ok(res)
>   }
>   
> diff --git a/server/src/metric_collection/top_entities.rs b/server/src/metric_collection/top_entities.rs
> index 73a3e63f..a91d586c 100644
> --- a/server/src/metric_collection/top_entities.rs
> +++ b/server/src/metric_collection/top_entities.rs
> @@ -37,6 +37,7 @@ pub fn calculate_top(
>       timeframe: proxmox_rrd_api_types::RrdTimeframe,
>       num: usize,
>       check_remote_privs: impl Fn(&str) -> bool,
> +    is_resource_included: impl Fn(&str, &Resource) -> bool,
>   ) -> TopEntities {
>       let mut guest_cpu = Vec::new();
>       let mut node_cpu = Vec::new();
> @@ -51,6 +52,10 @@ pub fn calculate_top(
>               crate::api::resources::get_cached_resources(remote_name, i64::MAX as u64)
>           {
>               for res in data.resources {
> +                if !is_resource_included(remote_name, &res) {
> +                    continue;
> +                }
> +
>                   let id = res.id().to_string();
>                   let name = format!("pve/{remote_name}/{id}");
>                   match &res {