[pdm-devel] [PATCH proxmox-datacenter-manager 5/9] api: sdn: add granular permissions for zones

[Gabriel Goller]

Add more granular permissions for sdn zones. It is possible to add
permissions like `/resource/{resource}/sdn/zone/{zone-name}`.

Signed-off-by: Gabriel Goller <g.goller at proxmox.com>
---
 server/src/api/sdn/zones.rs | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/server/src/api/sdn/zones.rs b/server/src/api/sdn/zones.rs
index a185d368f365..c2536289bcfe 100644
--- a/server/src/api/sdn/zones.rs
+++ b/server/src/api/sdn/zones.rs
@@ -62,7 +62,7 @@ pub const ROUTER: Router = Router::new()
         permission: &Permission::Anybody,
         description: "The user needs to have at least the `Resource.Audit` privilege under `/resource`.
         Only zones from remotes for which the user has `Resource.Audit` on `/resource/{remote_name}`
-        will be included in the returned list."
+        and `/resource/{remote_name}/sdn/zone/{zone_name}` will be included in the returned list."
     }
 )]
 /// Query zones of remotes with optional filtering options
@@ -116,12 +116,20 @@ pub async fn list_zones(
             Ok(remote_result) => {
                 for (node, node_result) in remote_result.node_results.into_iter() {
                     match node_result {
-                        Ok(NodeResults { data, .. }) => {
-                            zones.extend(data.into_iter().map(|zone| ListZone {
-                                remote: remote.clone(),
-                                zone,
-                            }))
-                        }
+                        Ok(NodeResults { data, .. }) => zones.extend(
+                            data.into_iter()
+                                .filter(|zone| {
+                                    user_info.lookup_privs(
+                                        &auth_id,
+                                        &["resource", &remote, "sdn", "zone", &zone.zone],
+                                    ) & PRIV_RESOURCE_AUDIT
+                                        != 0
+                                })
+                                .map(|zone| ListZone {
+                                    remote: remote.clone(),
+                                    zone,
+                                }),
+                        ),
                         Err(error) => {
                             log::error!(
                                 "could not fetch zones from remote {} node {}: {error:#}",
-- 
2.47.3