Re: [pdm-devel] [PATCH proxmox 2/4] access-control: add acl api feature

From: Dietmar Maurer <dietmar@proxmox.com>
To: Proxmox Datacenter Manager development discussion
	<pdm-devel@lists.proxmox.com>,
	Shannon Sterz <s.sterz@proxmox.com>
Subject: Re: [pdm-devel] [PATCH proxmox 2/4] access-control: add acl api feature
Date: Wed, 9 Apr 2025 13:01:48 +0200 (CEST)	[thread overview]
Message-ID: <2022147362.1680.1744196508347@webmail.proxmox.com> (raw)
In-Reply-To: <20250403141806.402974-3-s.sterz@proxmox.com>

> +/// Get ACL entries, can be filter by path.
> +pub fn read_acl(
> +    path: Option<String>,
> +    exact: bool,
> +    rpcenv: &mut dyn RpcEnvironment,
> +) -> Result<Vec<AclListItem>, Error> {
> +    let auth_id = rpcenv
> +        .get_auth_id()
> +        .ok_or_else(|| format_err!("endpoint called without an auth id"))?
> +        .parse()?;
> +
> +    let top_level_privs = CachedUserInfo::new()?.lookup_privs(&auth_id, &["access", "acl"]);
> +
> +    let filter = if top_level_privs & access_conf().acl_audit_privileges() == 0 {
> +        Some(auth_id)
> +    } else {
> +        None
> +    };

As discussed offline, maybe we can use CachedUserInfo::check_privs here?

_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel