[pdm-devel] [PATCH proxmox v3 5/5] access-control: allow reading all acls of the current authid

[Lukas Wagner]

On Thu Nov 6, 2025 at 3:38 PM CET, Shannon Sterz wrote:
> adds a parameter to the `API_METHOD_READ_ACL` endpoint to allow
> listing all ACL entries of the currently authenticated Authid.
> allowing a user to see their own ACLs does not really exposes any
> additional confidential information. however, being able to query this
> information allows us, for example, to adapt ui components to a users
> capabilities.
>
> Signed-off-by: Shannon Sterz <s.sterz at proxmox.com>
> ---
>  proxmox-access-control/src/api/acl.rs | 37 ++++++++++++++++++++++-----
>  1 file changed, 31 insertions(+), 6 deletions(-)
>
> diff --git a/proxmox-access-control/src/api/acl.rs b/proxmox-access-control/src/api/acl.rs
> index 4326215c..8bdbe0ed 100644
> --- a/proxmox-access-control/src/api/acl.rs
> +++ b/proxmox-access-control/src/api/acl.rs
> @@ -23,6 +23,12 @@ use crate::CachedUserInfo;
>                  optional: true,
>                  default: false,
>              },
> +            "exact-authid": {
> +                description: "Whether to return ACL entries for the exact current authid only.",
> +                type: bool,
> +                optional: true,
> +                default: false,
> +            }
>          },
>      },
>      returns: {
> @@ -34,13 +40,17 @@ use crate::CachedUserInfo;
>      },
>      access: {
>          permission: &Permission::Anybody,
> -        description: "Returns all ACLs if user has sufficient privileges on this endpoint, otherwise it is limited to the user's API tokens.",
> +        description: "Returns all ACLs if a user has sufficient privileges on this endpoint. \
> +            Otherwise it is limited to the user's API tokens. However, if `exact-authid` is \
> +            specified, all ACLs of the current Auhtid will be returned, whether the Authid has \
                                                     ^
nit: typo in Authid

> +            privileges to list other ACLs here or not.",
>      },
>  )]
>  /// Get ACL entries, can be filter by path.
>  pub fn read_acl(
>      path: Option<String>,
>      exact: bool,
> +    exact_authid: bool,
>      rpcenv: &mut dyn RpcEnvironment,
>  ) -> Result<Vec<AclListItem>, Error> {
>      let auth_id = rpcenv
> @@ -58,7 +68,11 @@ pub fn read_acl(
>          )
>          .is_err();
>  
> -    let filter = if filter_entries { Some(auth_id) } else { None };
> +    let filter = if filter_entries || exact_authid {
> +        Some(auth_id)
> +    } else {
> +        None
> +    };
>  
>      let (mut tree, digest) = crate::acl::config()?;
>  
> @@ -74,7 +88,13 @@ pub fn read_acl(
>  
>      rpcenv["digest"] = hex::encode(digest).into();
>  
> -    Ok(extract_acl_node_data(node, path.as_deref(), exact, &filter))
> +    Ok(extract_acl_node_data(
> +        node,
> +        path.as_deref(),
> +        exact_authid,
> +        exact,
> +        &filter,
> +    ))
>  }
>  
>  #[api(
> @@ -241,7 +261,8 @@ pub fn update_acl(
>  fn extract_acl_node_data(
>      node: &AclTreeNode,
>      path: Option<&str>,
> -    exact: bool,
> +    exact_authid: bool,
> +    exact_path: bool,
>      auth_id_filter: &Option<Authid>,
>  ) -> Vec<AclListItem> {
>      // tokens can't have tokens, so we can early return
> @@ -259,7 +280,11 @@ fn extract_acl_node_data(
>  
>          for (user, roles) in &node.users {
>              if let Some(auth_id_filter) = auth_id_filter {
> -                if !user.is_token() || user.user() != auth_id_filter.user() {
> +                if exact_authid {
> +                    if user != auth_id_filter {
> +                        continue;
> +                    }
> +                } else if !user.is_token() || user.user() != auth_id_filter.user() {
>                      continue;
>                  }
>              }
> @@ -291,7 +316,7 @@ fn extract_acl_node_data(
>              }
>          }
>  
> -        if !exact {
> +        if !exact_path {
>              nodes.extend(
>                  node.children
>                      .iter()