[pdm-devel] [PATCH proxmox 4/4] access-control: add generic roles endpoint to `api` feature

[Shannon Sterz <s.sterz@proxmox.com>]

since this is always the same between most products and we already
have access to all the relevant information

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---
 proxmox-access-control/src/api.rs   | 45 ++++++++++++++++++++++++++++-
 proxmox-access-control/src/types.rs | 28 ++++++++++++++++++
 2 files changed, 72 insertions(+), 1 deletion(-)

diff --git a/proxmox-access-control/src/api.rs b/proxmox-access-control/src/api.rs
index 4a6aabf5..3c62fbcf 100644
--- a/proxmox-access-control/src/api.rs
+++ b/proxmox-access-control/src/api.rs
@@ -7,7 +7,9 @@ use proxmox_schema::api;
 
 use crate::acl::AclTreeNode;
 use crate::init::access_conf;
-use crate::types::{AclListItem, AclUgidType, ACL_PATH_SCHEMA, ACL_PROPAGATE_SCHEMA};
+use crate::types::{
+    AclListItem, AclUgidType, RoleInfo, ACL_PATH_SCHEMA, ACL_PROPAGATE_SCHEMA,
+};
 use crate::CachedUserInfo;
 
 #[api(
@@ -276,3 +278,44 @@ fn extract_acl_node_data(
 pub const ACL_ROUTER: Router = Router::new()
     .get(&API_METHOD_READ_ACL)
     .put(&API_METHOD_UPDATE_ACL);
+
+#[api(
+    returns: {
+        description: "List of roles.",
+        type: Array,
+        items: {
+            type: RoleInfo,
+        }
+    },
+    access: {
+        permission: &Permission::Anybody,
+    }
+)]
+/// A list of available roles
+fn list_roles() -> Result<Vec<RoleInfo>, Error> {
+    let list = access_conf()
+        .roles()
+        .iter()
+        .map(|(role, (privs, comment))| {
+            let priv_list = access_conf()
+                .privileges()
+                .iter()
+                .filter_map(|(name, privilege)| {
+                    if privs & privilege > 0 {
+                        Some(name.to_string())
+                    } else {
+                        None
+                    }
+                });
+
+            RoleInfo {
+                roleid: role.to_string(),
+                privs: priv_list.collect(),
+                comment: Some(comment.to_string()),
+            }
+        });
+
+    Ok(list.collect())
+}
+
+pub const ROLE_ROUTER: Router = Router::new().get(&API_METHOD_LIST_ROLES);
diff --git a/proxmox-access-control/src/types.rs b/proxmox-access-control/src/types.rs
index 01d078de..ea64d333 100644
--- a/proxmox-access-control/src/types.rs
+++ b/proxmox-access-control/src/types.rs
@@ -247,3 +247,31 @@ pub struct AclListItem {
     /// A role represented as a string.
     pub roleid: String,
 }
+
+#[api(
+    properties: {
+        privs: {
+            type: Array,
+            description: "List of Privileges",
+            items: {
+                type: String,
+                description: "A Privilege",
+            },
+        },
+        comment: {
+            schema: COMMENT_SCHEMA,
+            optional: true,
+        }
+    }
+)]
+/// A struct that the describes a role and shows the associated privileges.
+#[derive(Serialize, Deserialize, PartialEq, Clone)]
+pub struct RoleInfo {
+    /// The id of the role
+    pub roleid: String,
+    /// The privileges the role holds
+    pub privs: Vec<String>,
+    /// A comment describing the role
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub comment: Option<String>,
+}
-- 
2.39.5



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel