[pve-devel] [PATCH access-control 02/10] update read_user_tfa_type call

[Wolfgang Bumiller]

Signed-off-by: Wolfgang Bumiller <w.bumiller at proxmox.com>
---
 src/PVE/API2/User.pm | 41 +++++++++++++++++++++++++++++++++++------
 1 file changed, 35 insertions(+), 6 deletions(-)

diff --git a/src/PVE/API2/User.pm b/src/PVE/API2/User.pm
index 8893d03..3d4d4e0 100644
--- a/src/PVE/API2/User.pm
+++ b/src/PVE/API2/User.pm
@@ -485,6 +485,12 @@ __PACKAGE__->register_method ({
 	additionalProperties => 0,
 	properties => {
 	    userid => get_standard_option('userid-completed'),
+	    multiple => {
+		type => 'boolean',
+		description => 'Request all entries as an array.',
+		optional => 1,
+		default => 0,
+	    },
 	},
     },
     returns => {
@@ -499,9 +505,23 @@ __PACKAGE__->register_method ({
 	    user => {
 		type => 'string',
 		enum => [qw(oath u2f)],
-		description => "The type of TFA the user has set, if any.",
+		description =>
+		    "The type of TFA the user has set, if any."
+		    . " Only set if 'multiple' was not passed.",
 		optional => 1,
 	    },
+	    types => {
+		type => 'array',
+		description =>
+		    "Array of the user configured TFA types, if any."
+		    . " Only available if 'multiple' was not passed.",
+		optional => 1,
+		items => {
+		    type => 'string',
+		    enum => [qw(totp u2f yubico webauthn recovedry)],
+		    description => 'A TFA type.',
+		},
+	    },
 	},
 	type => "object"
     },
@@ -514,15 +534,24 @@ __PACKAGE__->register_method ({
 	my $realm_cfg = $domain_cfg->{ids}->{$realm};
 	die "auth domain '$realm' does not exist\n" if !$realm_cfg;
 
+	my $res = {};
 	my $realm_tfa = {};
 	$realm_tfa = PVE::Auth::Plugin::parse_tfa_config($realm_cfg->{tfa}) if $realm_cfg->{tfa};
+	$res->{realm} = $realm_tfa->{type} if $realm_tfa->{type};
 
 	my $tfa_cfg = cfs_read_file('priv/tfa.cfg');
-	my $tfa = $tfa_cfg->{users}->{$username};
-
-	my $res = {};
-	$res->{realm} = $realm_tfa->{type} if $realm_tfa->{type};
-	$res->{user} = $tfa->{type} if $tfa->{type};
+	if ($param->{multiple}) {
+	    my $tfa = $tfa_cfg->get_user($username);
+	    my $user = [];
+	    foreach my $type (keys %$tfa) {
+		next if !scalar($tfa->{$type}->@*);
+		push @$user, $type;
+	    }
+	    $res->{user} = $user;
+	} else {
+	    my $tfa = $tfa_cfg->{users}->{$username};
+	    $res->{user} = $tfa->{type} if $tfa->{type};
+	}
 	return $res;
     }});
 
-- 
2.30.2