[pdm-devel] [PATCH datacenter-manager v2 10/12] api: remote-tasks: add support for view-filter parameter

[Dominik Csapak]

Reviewed-by: Dominik Csapak <d.csapak at proxmox.com>

On 11/3/25 1:36 PM, Lukas Wagner wrote:
> A view filter allows one to get filtered subset of all resources, based
> on filter rules defined in a config file. View filters integrate with
> the permission system - if a user has permissions on
> /view/{view-filter-id}, then these privileges are transitively applied
> to all resources which are matched by the rules. All other permission
> checks are replaced if requesting data through a view filter.
> 
> Signed-off-by: Lukas Wagner <l.wagner at proxmox.com>
> ---
>   server/src/api/remote_tasks.rs | 36 +++++++++++++++++++++++++++----
>   server/src/remote_tasks/mod.rs | 39 +++++++++++++++++++++++-----------
>   2 files changed, 59 insertions(+), 16 deletions(-)
> 
> diff --git a/server/src/api/remote_tasks.rs b/server/src/api/remote_tasks.rs
> index 7b97b9cd..4a68c5d9 100644
> --- a/server/src/api/remote_tasks.rs
> +++ b/server/src/api/remote_tasks.rs
> @@ -4,9 +4,10 @@ use anyhow::Error;
>   
>   use pdm_api_types::{
>       remotes::REMOTE_ID_SCHEMA, RemoteUpid, TaskCount, TaskFilters, TaskListItem, TaskStateType,
> -    TaskStatistics,
> +    TaskStatistics, PRIV_RESOURCE_AUDIT, VIEW_FILTER_ID_SCHEMA,
>   };
> -use proxmox_router::{list_subdirs_api_method, Permission, Router, SubdirMap};
> +use proxmox_access_control::CachedUserInfo;
> +use proxmox_router::{list_subdirs_api_method, Permission, Router, RpcEnvironment, SubdirMap};
>   use proxmox_schema::api;
>   use proxmox_sortable_macro::sortable;
>   
> @@ -41,6 +42,11 @@ const SUBDIRS: SubdirMap = &sorted!([
>                   schema: REMOTE_ID_SCHEMA,
>                   optional: true,
>               },
> +            "view-filter": {
> +                schema: VIEW_FILTER_ID_SCHEMA,
> +                optional: true,
> +            },
> +
>           },
>       },
>   )]
> @@ -48,8 +54,17 @@ const SUBDIRS: SubdirMap = &sorted!([
>   async fn list_tasks(
>       filters: TaskFilters,
>       remote: Option<String>,
> +    view_filter: Option<String>,
> +    rpcenv: &mut dyn RpcEnvironment,
>   ) -> Result<Vec<TaskListItem>, Error> {
> -    let tasks = remote_tasks::get_tasks(filters, remote).await?;
> +    let auth_id = rpcenv.get_auth_id().unwrap().parse()?;
> +    let user_info = CachedUserInfo::new()?;
> +
> +    if let Some(view_filter) = &view_filter {
> +        user_info.check_privs(&auth_id, &["view", view_filter], PRIV_RESOURCE_AUDIT, false)?;
> +    }
> +
> +    let tasks = remote_tasks::get_tasks(filters, remote, view_filter).await?;
>   
>       Ok(tasks)
>   }
> @@ -70,6 +85,10 @@ async fn list_tasks(
>                   schema: REMOTE_ID_SCHEMA,
>                   optional: true,
>               },
> +            "view-filter": {
> +                schema: VIEW_FILTER_ID_SCHEMA,
> +                optional: true,
> +            },
>           },
>       },
>   )]
> @@ -77,8 +96,17 @@ async fn list_tasks(
>   async fn task_statistics(
>       filters: TaskFilters,
>       remote: Option<String>,
> +    view_filter: Option<String>,
> +    rpcenv: &mut dyn RpcEnvironment,
>   ) -> Result<TaskStatistics, Error> {
> -    let tasks = remote_tasks::get_tasks(filters, remote).await?;
> +    let auth_id = rpcenv.get_auth_id().unwrap().parse()?;
> +    let user_info = CachedUserInfo::new()?;
> +
> +    if let Some(view_filter) = &view_filter {
> +        user_info.check_privs(&auth_id, &["view", view_filter], PRIV_RESOURCE_AUDIT, false)?;
> +    }
> +
> +    let tasks = remote_tasks::get_tasks(filters, remote, view_filter).await?;
>   
>       let mut by_type: HashMap<String, TaskCount> = HashMap::new();
>       let mut by_remote: HashMap<String, TaskCount> = HashMap::new();
> diff --git a/server/src/remote_tasks/mod.rs b/server/src/remote_tasks/mod.rs
> index c4939742..4d93d9b8 100644
> --- a/server/src/remote_tasks/mod.rs
> +++ b/server/src/remote_tasks/mod.rs
> @@ -9,6 +9,8 @@ pub mod task_cache;
>   
>   use task_cache::{GetTasks, TaskCache, TaskCacheItem};
>   
> +use crate::views;
> +
>   /// Base directory for the remote task cache.
>   pub const REMOTE_TASKS_DIR: &str = concat!(pdm_buildcfg::PDM_CACHE_DIR_M!(), "/remote-tasks");
>   
> @@ -29,7 +31,12 @@ const NUMBER_OF_UNCOMPRESSED_FILES: u32 = 2;
>   pub async fn get_tasks(
>       filters: TaskFilters,
>       remote_filter: Option<String>,
> +    view_filter: Option<String>,
>   ) -> Result<Vec<TaskListItem>, Error> {
> +    let view_filter = view_filter
> +        .map(|filter_name| views::view_filter::get_view_filter(&filter_name))
> +        .transpose()?;
> +
>       tokio::task::spawn_blocking(move || {
>           let cache = get_cache()?.read()?;
>   
> @@ -52,21 +59,29 @@ pub async fn get_tasks(
>                           return None;
>                       }
>                   }
> +
>                   // TODO: Handle PBS tasks
>                   let pve_upid: Result<PveUpid, Error> = task.upid.upid.parse();
>                   match pve_upid {
> -                    Ok(pve_upid) => Some(TaskListItem {
> -                        upid: task.upid.to_string(),
> -                        node: pve_upid.node,
> -                        pid: pve_upid.pid as i64,
> -                        pstart: pve_upid.pstart,
> -                        starttime: pve_upid.starttime,
> -                        worker_type: pve_upid.worker_type,
> -                        worker_id: None,
> -                        user: pve_upid.auth_id,
> -                        endtime: task.endtime,
> -                        status: task.status,
> -                    }),
> +                    Ok(pve_upid) => {
> +                        if let Some(view_filter) = &view_filter {
> +                            if !view_filter.is_node_included(task.upid.remote(), &pve_upid.node) {
> +                                return None;
> +                            }
> +                        }
> +                        Some(TaskListItem {
> +                            upid: task.upid.to_string(),
> +                            node: pve_upid.node,
> +                            pid: pve_upid.pid as i64,
> +                            pstart: pve_upid.pstart,
> +                            starttime: pve_upid.starttime,
> +                            worker_type: pve_upid.worker_type,
> +                            worker_id: None,
> +                            user: pve_upid.auth_id,
> +                            endtime: task.endtime,
> +                            status: task.status,
> +                        })
> +                    }
>                       Err(err) => {
>                           log::error!("could not parse UPID: {err:#}");
>                           None