[pdm-devel] [PATCH proxmox v2 4/4] access-control: allow reading all acls of the current authid

[Shannon Sterz]

adds a parameter to the `API_METHOD_READ_ACL` endpoint to allow
listing all ACL entries of the currently authenticated Authid.
allowing a user to see their own ACLs does not really exposes any
additional confidential information. however, being able to query this
information allows us, for example, to adapt ui components to a users
capabilities.

Signed-off-by: Shannon Sterz <s.sterz at proxmox.com>
---
 proxmox-access-control/src/api/acl.rs | 37 ++++++++++++++++++++++-----
 1 file changed, 31 insertions(+), 6 deletions(-)

diff --git a/proxmox-access-control/src/api/acl.rs b/proxmox-access-control/src/api/acl.rs
index 0194d517..07222939 100644
--- a/proxmox-access-control/src/api/acl.rs
+++ b/proxmox-access-control/src/api/acl.rs
@@ -23,6 +23,12 @@ use crate::CachedUserInfo;
                 optional: true,
                 default: false,
             },
+            "exact-authid": {
+                description: "Whether to return ACL entries for the exact current authid only.",
+                type: bool,
+                optional: true,
+                default: false,
+            }
         },
     },
     returns: {
@@ -34,13 +40,17 @@ use crate::CachedUserInfo;
     },
     access: {
         permission: &Permission::Anybody,
-        description: "Returns all ACLs if user has sufficient privileges on this endpoint, otherwise it is limited to the user's API tokens.",
+        description: "Returns all ACLs if a user has sufficient privileges on this endpoint. \
+            Otherwise it is limited to the user's API tokens. However, if `exact-authid` is \
+            specified, all ACLs of the current Auhtid will be returned, whether the Authid has \
+            privileges to list other ACLs here or not.",
     },
 )]
 /// Get ACL entries, can be filter by path.
 pub fn read_acl(
     path: Option<String>,
     exact: bool,
+    exact_authid: bool,
     rpcenv: &mut dyn RpcEnvironment,
 ) -> Result<Vec<AclListItem>, Error> {
     let auth_id = rpcenv
@@ -58,7 +68,11 @@ pub fn read_acl(
         )
         .is_err();
 
-    let filter = if filter_entries { Some(auth_id) } else { None };
+    let filter = if filter_entries || exact_authid {
+        Some(auth_id)
+    } else {
+        None
+    };
 
     let (mut tree, digest) = crate::acl::config()?;
 
@@ -74,7 +88,13 @@ pub fn read_acl(
 
     rpcenv["digest"] = hex::encode(digest).into();
 
-    Ok(extract_acl_node_data(node, path.as_deref(), exact, &filter))
+    Ok(extract_acl_node_data(
+        node,
+        path.as_deref(),
+        exact_authid,
+        exact,
+        &filter,
+    ))
 }
 
 #[api(
@@ -241,7 +261,8 @@ pub fn update_acl(
 fn extract_acl_node_data(
     node: &AclTreeNode,
     path: Option<&str>,
-    exact: bool,
+    exact_authid: bool,
+    exact_path: bool,
     auth_id_filter: &Option<Authid>,
 ) -> Vec<AclListItem> {
     // tokens can't have tokens, so we can early return
@@ -259,7 +280,11 @@ fn extract_acl_node_data(
 
         for (user, roles) in &node.users {
             if let Some(auth_id_filter) = auth_id_filter {
-                if !user.is_token() || user.user() != auth_id_filter.user() {
+                if exact_authid {
+                    if user != auth_id_filter {
+                        continue;
+                    }
+                } else if !user.is_token() || user.user() != auth_id_filter.user() {
                     continue;
                 }
             }
@@ -291,7 +316,7 @@ fn extract_acl_node_data(
             }
         }
 
-        if !exact {
+        if !exact_path {
             nodes.extend(
                 node.children
                     .iter()
-- 
2.47.3