[pdm-devel] [PATCH proxmox-datacenter-manager 4/9] api: add remote_shell module with termproxy endpoint

[Fabian Grünbichler]

contrary to the PDM node one or the PVE/PBS ones, this doesn't spawn a
termproxy instance, but just generates the ticket used for authenticating the
websocket upgrade on the PDM side.

the returned port is hard-coded as 0 to be compatible with the rest of the
stack that expects one.

Signed-off-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
---

Notes:
    replaces previous patch which was PVE only

 server/src/api/mod.rs          |  1 +
 server/src/api/remote_shell.rs | 80 ++++++++++++++++++++++++++++++++++
 2 files changed, 81 insertions(+)
 create mode 100644 server/src/api/remote_shell.rs

diff --git a/server/src/api/mod.rs b/server/src/api/mod.rs
index 6a7a65a..dca597f 100644
--- a/server/src/api/mod.rs
+++ b/server/src/api/mod.rs
@@ -13,6 +13,7 @@ pub mod metric_collection;
 pub mod nodes;
 pub mod pbs;
 pub mod pve;
+pub mod remote_shell;
 pub mod remote_tasks;
 pub mod remote_updates;
 pub mod remotes;
diff --git a/server/src/api/remote_shell.rs b/server/src/api/remote_shell.rs
new file mode 100644
index 0000000..380bbba
--- /dev/null
+++ b/server/src/api/remote_shell.rs
@@ -0,0 +1,80 @@
+use anyhow::{bail, format_err, Error};
+use serde_json::{json, Value};
+
+use proxmox_auth_api::{
+    ticket::{Empty, Ticket},
+    Keyring,
+};
+use proxmox_router::{Permission, RpcEnvironment};
+use proxmox_schema::api;
+
+use pdm_api_types::{remotes::REMOTE_ID_SCHEMA, Authid, NODE_SCHEMA, PRIV_SYS_CONSOLE};
+
+fn encode_term_ticket_path(remote: &str, node: &str) -> String {
+    format!("/shell/{remote}/{node}")
+}
+
+#[api(
+    protected: true,
+    input: {
+        properties: {
+            remote: { schema: REMOTE_ID_SCHEMA },
+            node: {
+                schema: NODE_SCHEMA,
+            },
+        },
+    },
+    returns: {
+        type: Object,
+        description: "Object with the user and ticket",
+        properties: {
+            user: {
+                description: "User that obtained the VNC ticket.",
+                type: String,
+            },
+            ticket: {
+                description: "VNC ticket used to authenticate websocket upgrade.",
+                type: String,
+            },
+            port: {
+                description: "Always '0'.",
+                type: Integer,
+            }
+        }
+    },
+    access: {
+        description: "Restricted to users",
+        permission: &Permission::Privilege(&["resource", "{remote}", "node", "{node}"], PRIV_SYS_CONSOLE, false),
+    }
+)]
+/// Call termproxy and return shell ticket
+pub(crate) async fn shell_ticket(
+    remote: String,
+    node: String,
+    rpcenv: &mut dyn RpcEnvironment,
+) -> Result<Value, Error> {
+    // intentionally user only for now
+    let auth_id: Authid = rpcenv
+        .get_auth_id()
+        .ok_or_else(|| format_err!("no authid available"))?
+        .parse()?;
+
+    if auth_id.is_token() {
+        bail!("API tokens cannot access this API endpoint");
+    }
+
+    let userid = auth_id.user();
+    let path = encode_term_ticket_path(&remote, &node);
+
+    let private_auth_keyring =
+        Keyring::with_private_key(crate::auth::key::private_auth_key().clone());
+
+    let ticket = Ticket::new(crate::auth::TERM_PREFIX, &Empty)?
+        .sign(&private_auth_keyring, Some(&format!("{}{}", userid, path)))?;
+
+    Ok(json!({
+        "user": userid,
+        "ticket": ticket,
+        "port": 0,
+    }))
+}
-- 
2.47.3