[pdm-devel] [PATCH datacenter-manager v5 09/11] api: remote-tasks: add support for view parameter
Lukas Wagner
l.wagner at proxmox.com
Thu Nov 13 13:16:42 CET 2025
A view allows one to get filtered subset of all resources, based on
filter rules defined in a config file. View filters integrate with the
permission system - if a user has permissions on /view/{view-id}, then
these privileges are transitively applied to all resources which are
matched by the rules. All other permission checks are replaced if
requesting data through a view.
Signed-off-by: Lukas Wagner <l.wagner at proxmox.com>
Reviewed-by: Dominik Csapak <d.csapak at proxmox.com>
Reviewed-by: Michael Köppl <m.koeppl at proxmox.com>
---
server/src/api/remote_tasks.rs | 36 ++++++++++++++++--
server/src/remote_tasks/mod.rs | 67 ++++++++++++++++++++++------------
2 files changed, 75 insertions(+), 28 deletions(-)
diff --git a/server/src/api/remote_tasks.rs b/server/src/api/remote_tasks.rs
index 7b97b9cd..02b6383b 100644
--- a/server/src/api/remote_tasks.rs
+++ b/server/src/api/remote_tasks.rs
@@ -4,9 +4,10 @@ use anyhow::Error;
use pdm_api_types::{
remotes::REMOTE_ID_SCHEMA, RemoteUpid, TaskCount, TaskFilters, TaskListItem, TaskStateType,
- TaskStatistics,
+ TaskStatistics, PRIV_RESOURCE_AUDIT, VIEW_ID_SCHEMA,
};
-use proxmox_router::{list_subdirs_api_method, Permission, Router, SubdirMap};
+use proxmox_access_control::CachedUserInfo;
+use proxmox_router::{list_subdirs_api_method, Permission, Router, RpcEnvironment, SubdirMap};
use proxmox_schema::api;
use proxmox_sortable_macro::sortable;
@@ -41,6 +42,11 @@ const SUBDIRS: SubdirMap = &sorted!([
schema: REMOTE_ID_SCHEMA,
optional: true,
},
+ view: {
+ schema: VIEW_ID_SCHEMA,
+ optional: true,
+ },
+
},
},
)]
@@ -48,8 +54,17 @@ const SUBDIRS: SubdirMap = &sorted!([
async fn list_tasks(
filters: TaskFilters,
remote: Option<String>,
+ view: Option<String>,
+ rpcenv: &mut dyn RpcEnvironment,
) -> Result<Vec<TaskListItem>, Error> {
- let tasks = remote_tasks::get_tasks(filters, remote).await?;
+ let auth_id = rpcenv.get_auth_id().unwrap().parse()?;
+ let user_info = CachedUserInfo::new()?;
+
+ if let Some(view) = &view {
+ user_info.check_privs(&auth_id, &["view", view], PRIV_RESOURCE_AUDIT, false)?;
+ }
+
+ let tasks = remote_tasks::get_tasks(filters, remote, view).await?;
Ok(tasks)
}
@@ -70,6 +85,10 @@ async fn list_tasks(
schema: REMOTE_ID_SCHEMA,
optional: true,
},
+ view: {
+ schema: VIEW_ID_SCHEMA,
+ optional: true,
+ },
},
},
)]
@@ -77,8 +96,17 @@ async fn list_tasks(
async fn task_statistics(
filters: TaskFilters,
remote: Option<String>,
+ view: Option<String>,
+ rpcenv: &mut dyn RpcEnvironment,
) -> Result<TaskStatistics, Error> {
- let tasks = remote_tasks::get_tasks(filters, remote).await?;
+ let auth_id = rpcenv.get_auth_id().unwrap().parse()?;
+ let user_info = CachedUserInfo::new()?;
+
+ if let Some(view) = &view {
+ user_info.check_privs(&auth_id, &["view", view], PRIV_RESOURCE_AUDIT, false)?;
+ }
+
+ let tasks = remote_tasks::get_tasks(filters, remote, view).await?;
let mut by_type: HashMap<String, TaskCount> = HashMap::new();
let mut by_remote: HashMap<String, TaskCount> = HashMap::new();
diff --git a/server/src/remote_tasks/mod.rs b/server/src/remote_tasks/mod.rs
index f39d0b77..ea3c5539 100644
--- a/server/src/remote_tasks/mod.rs
+++ b/server/src/remote_tasks/mod.rs
@@ -9,6 +9,8 @@ pub mod task_cache;
use task_cache::{GetTasks, TaskCache, TaskCacheItem};
+use crate::views;
+
/// Base directory for the remote task cache.
pub const REMOTE_TASKS_DIR: &str = concat!(pdm_buildcfg::PDM_CACHE_DIR_M!(), "/remote-tasks");
@@ -29,7 +31,10 @@ const NUMBER_OF_UNCOMPRESSED_FILES: u32 = 2;
pub async fn get_tasks(
filters: TaskFilters,
remote_filter: Option<String>,
+ view: Option<String>,
) -> Result<Vec<TaskListItem>, Error> {
+ let view = views::get_optional_view(view.as_deref())?;
+
tokio::task::spawn_blocking(move || {
let cache = get_cache()?.read()?;
@@ -54,30 +59,44 @@ pub async fn get_tasks(
}
match task.upid.native_upid() {
- Ok(NativeUpid::PveUpid(pve_upid)) => Some(TaskListItem {
- upid: task.upid.to_string(),
- node: pve_upid.node,
- pid: pve_upid.pid as i64,
- pstart: pve_upid.pstart,
- starttime: pve_upid.starttime,
- worker_type: pve_upid.worker_type,
- worker_id: None,
- user: pve_upid.auth_id,
- endtime: task.endtime,
- status: task.status,
- }),
- Ok(NativeUpid::PbsUpid(pbs_upid)) => Some(TaskListItem {
- upid: task.upid.to_string(),
- node: pbs_upid.node,
- pid: pbs_upid.pid as i64,
- pstart: pbs_upid.pstart,
- starttime: pbs_upid.starttime,
- worker_type: pbs_upid.worker_type,
- worker_id: pbs_upid.worker_id,
- user: pbs_upid.auth_id,
- endtime: task.endtime,
- status: task.status,
- }),
+ Ok(NativeUpid::PveUpid(pve_upid)) => {
+ if let Some(view) = &view {
+ if !view.is_node_included(task.upid.remote(), &pve_upid.node) {
+ return None;
+ }
+ }
+ Some(TaskListItem {
+ upid: task.upid.to_string(),
+ node: pve_upid.node,
+ pid: pve_upid.pid as i64,
+ pstart: pve_upid.pstart,
+ starttime: pve_upid.starttime,
+ worker_type: pve_upid.worker_type,
+ worker_id: None,
+ user: pve_upid.auth_id,
+ endtime: task.endtime,
+ status: task.status,
+ })
+ }
+ Ok(NativeUpid::PbsUpid(pbs_upid)) => {
+ if let Some(view) = &view {
+ if !view.is_node_included(task.upid.remote(), &pbs_upid.node) {
+ return None;
+ }
+ }
+ Some(TaskListItem {
+ upid: task.upid.to_string(),
+ node: pbs_upid.node,
+ pid: pbs_upid.pid as i64,
+ pstart: pbs_upid.pstart,
+ starttime: pbs_upid.starttime,
+ worker_type: pbs_upid.worker_type,
+ worker_id: pbs_upid.worker_id,
+ user: pbs_upid.auth_id,
+ endtime: task.endtime,
+ status: task.status,
+ })
+ }
Err(err) => {
log::error!("could not parse UPID: {err:#}");
None
--
2.47.3
More information about the pdm-devel
mailing list