[pve-devel] [PATCH access-control v2 1/1] fix #4546: api: Return user expiration date on access/ticket API call

[Philipp Hufnagl]

Adds an additional, optional parameter to the access/tickets api call
which tells when the currently used user account will expire. If it will
not expire, the parameter will not be added.

Signed-off-by: Philipp Hufnagl <p.hufnagl at proxmox.com>
---
 src/PVE/API2/AccessControl.pm | 8 ++++++++
 src/PVE/AccessControl.pm      | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/src/PVE/API2/AccessControl.pm b/src/PVE/API2/AccessControl.pm
index 74b3910..caba720 100644
--- a/src/PVE/API2/AccessControl.pm
+++ b/src/PVE/API2/AccessControl.pm
@@ -267,6 +267,11 @@ __PACKAGE__->register_method ({
 	    ticket => { type => 'string', optional => 1},
 	    CSRFPreventionToken => { type => 'string', optional => 1 },
 	    clustername => { type => 'string', optional => 1 },
+	    'account-expiry-date' => {
+		type => 'number',
+                description => "Account expiration date as a UNIX timestamp",
+		optional => 1 ,
+	    },
 	    # cap => computed api permissions, unless there's a u2f challenge
 	}
     },
@@ -304,6 +309,9 @@ __PACKAGE__->register_method ({
 	    die PVE::Exception->new("authentication failure\n", code => 401);
 	}
 
+	my $expires = PVE::AccessControl::lookup_user_expiration($username);
+	$res->{'account-expiry-date'} = $expires if defined($expires);
+
 	$res->{cap} = $rpcenv->compute_api_permission($username)
 	    if !defined($res->{NeedTFA});
 
diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm
index cc0f00b..b30570b 100644
--- a/src/PVE/AccessControl.pm
+++ b/src/PVE/AccessControl.pm
@@ -1234,6 +1234,14 @@ sub lookup_username {
     return $username;
 }
 
+sub lookup_user_expiration {
+    my ($username) = @_;
+    my $usercfg = cfs_read_file('user.cfg');
+    my $expires = $usercfg->{users}->{$username}->{expire};
+    return undef if $expires == 0;
+    return $expires;
+}
+
 sub normalize_path {
     my $path = shift;
 
-- 
2.39.2