[PATCH datacenter-manager 0/3] ui: acl: pre-populate permission path selector

[PATCH datacenter-manager 0/3] ui: acl: pre-populate permission path selector

[Shan Shaji]

vikunja ticket: #858

This series lists specific remotes and views in the permission path selector
which users can use to select and assign specific roles.

### Testing
===========

Remotes: 3
Role: Auditor

/resource/cluster: 3 node cluster
  - propogate disabled: The resources list won't be shown.
    Shows "user has no access to resource list" error.  
  - propogate enabled: The resources are visible under the remote specific dashboard.

/resource/Trial: PVE node
  - propogate disabled: Resources list won't be shown.
    Shows "user has no access to resources list" error.
  - propogate enabled: The resources are visible under the remote specific dashboard.

/resource/backup: PBS node
  - propogate disabled: RRD data is shown.
  - propogate enabled: RRD data and datastore details are shown under the remote
    specific dasboard.

Views: 2
Role: Auditor

/view/layout:
  - Only the `layout` view and all the widgets added inside the specific view
    were visible to the user.
/view
  - propagate enabled: Both views are visible to the user.
  - propagate disabled: Views are visible under the views in the sidebar but the
    resources are not visible when clicking on each view.

Shan Shaji (3):
  pdm-client: add `list_views` function to fetch views list
  ui: acl: list granular level permission paths for views
  ui: acl: extend permission paths to allow specific remote access

 lib/pdm-client/src/lib.rs                     | 10 +++
 .../configuration/permission_path_selector.rs | 80 +++++++++++++++----
 2 files changed, 76 insertions(+), 14 deletions(-)

-- 
2.47.3

[PATCH datacenter-manager 1/3] pdm-client: add `list_views` function to fetch views list

[Shan Shaji]

Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
---
 lib/pdm-client/src/lib.rs | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/pdm-client/src/lib.rs b/lib/pdm-client/src/lib.rs
index 0fee97a..1565869 100644
--- a/lib/pdm-client/src/lib.rs
+++ b/lib/pdm-client/src/lib.rs
@@ -1366,6 +1366,16 @@ impl<T: HttpApiClient> PdmClient<T> {
             .expect_json()?
             .data)
     }
+
+    /// Get the list of views.
+    pub async fn list_views(&self) -> Result<Vec<pdm_api_types::views::ViewConfig>, Error> {
+        Ok(self
+            .0
+            .get("/api2/extjs/config/views")
+            .await?
+            .expect_json()?
+            .data)
+    }
 }
 
 /// Builder for migration parameters.
-- 
2.47.3

[PATCH datacenter-manager 2/3] ui: acl: list granular level permission paths for views

[Shan Shaji]

Previously, users were unable to assign permissions to individual views.
Resolved this by loading the views list and extending permission paths
to include specific view routes.

Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
---
 .../configuration/permission_path_selector.rs | 66 +++++++++++++++----
 1 file changed, 52 insertions(+), 14 deletions(-)

diff --git a/ui/src/configuration/permission_path_selector.rs b/ui/src/configuration/permission_path_selector.rs
index 59bdabb..91d8072 100644
--- a/ui/src/configuration/permission_path_selector.rs
+++ b/ui/src/configuration/permission_path_selector.rs
@@ -1,12 +1,15 @@
 use std::rc::Rc;
 
+use anyhow::Error;
 use yew::html::IntoPropValue;
 
-use pwt::prelude::*;
 use pwt::widget::form::Combobox;
+use pwt::{prelude::*, AsyncPool};
 
 use pwt_macros::{builder, widget};
 
+use crate::pdm_client;
+
 static PREDEFINED_PATHS: &[&str] = &[
     "/",
     "/access",
@@ -44,33 +47,68 @@ impl PermissionPathSelector {
     }
 }
 
-enum Msg {}
+enum Msg {
+    Prefetched(Vec<String>),
+    PrefetchFailed,
+}
 
 struct PdmPermissionPathSelector {
     items: Rc<Vec<AttrValue>>,
+    _async_pool: AsyncPool,
 }
 
-impl PdmPermissionPathSelector {}
+impl PdmPermissionPathSelector {
+    async fn get_view_paths() -> Result<Vec<String>, Error> {
+        let views = pdm_client().list_views().await?;
+        let paths: Vec<String> = views
+            .iter()
+            .map(|cfg| format!("/view/{}", cfg.id))
+            .collect();
+        Ok(paths)
+    }
+
+    async fn get_paths() -> Result<Vec<String>, Error> {
+        let paths = Self::get_view_paths().await?;
+        Ok(paths)
+    }
+}
 
 impl Component for PdmPermissionPathSelector {
     type Message = Msg;
     type Properties = PermissionPathSelector;
 
-    fn create(_ctx: &Context<Self>) -> Self {
-        // TODO: fetch resources & remotes from the backend to improve the pre-defined selection of
-        // acl paths
+    fn create(ctx: &Context<Self>) -> Self {
+        let base_items: Vec<AttrValue> = PREDEFINED_PATHS
+            .iter()
+            .map(|i| AttrValue::from(*i))
+            .collect();
+
+        let link = ctx.link().clone();
+        let async_pool = AsyncPool::new();
+        async_pool.spawn(async move {
+            let paths = Self::get_paths().await;
+            match paths {
+                Ok(paths) => link.send_message(Msg::Prefetched(paths)),
+                Err(_) => link.send_message(Msg::PrefetchFailed),
+            }
+        });
+
         Self {
-            items: Rc::new(
-                PREDEFINED_PATHS
-                    .iter()
-                    .map(|i| AttrValue::from(*i))
-                    .collect(),
-            ),
+            items: Rc::new(base_items),
+            _async_pool: async_pool,
         }
     }
 
-    fn update(&mut self, _ctx: &Context<Self>, _msg: Self::Message) -> bool {
-        false
+    fn update(&mut self, _ctx: &Context<Self>, msg: Self::Message) -> bool {
+        match msg {
+            Msg::Prefetched(paths) => {
+                let items = Rc::make_mut(&mut self.items);
+                items.extend(paths.into_iter().map(AttrValue::from));
+                items.sort_by_key(|k| k.to_lowercase());
+                true
+            }
+            Msg::PrefetchFailed => false,
+        }
     }
 
     fn view(&self, ctx: &Context<Self>) -> Html {
-- 
2.47.3

[PATCH datacenter-manager 3/3] ui: acl: extend permission paths to allow specific remote access

[Shan Shaji]

previously, users were not able to assign permissions to specific
remotes. Resolved this by listing the remote Ids and extending the
permission paths to include specific remote paths.

Signed-off-by: Shan Shaji <s.shaji@proxmox.com>
---
 .../configuration/permission_path_selector.rs | 24 +++++++++++++++----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/ui/src/configuration/permission_path_selector.rs b/ui/src/configuration/permission_path_selector.rs
index 91d8072..ad99177 100644
--- a/ui/src/configuration/permission_path_selector.rs
+++ b/ui/src/configuration/permission_path_selector.rs
@@ -8,7 +8,7 @@ use pwt::{prelude::*, AsyncPool};
 
 use pwt_macros::{builder, widget};
 
-use crate::pdm_client;
+use crate::{pdm_client, RemoteList};
 
 static PREDEFINED_PATHS: &[&str] = &[
     "/",
@@ -67,8 +67,18 @@ impl PdmPermissionPathSelector {
         Ok(paths)
     }
 
-    async fn get_paths() -> Result<Vec<String>, Error> {
-        let paths = Self::get_view_paths().await?;
+    async fn get_paths(remote_list: Option<RemoteList>) -> Result<Vec<String>, Error> {
+        let mut paths = Self::get_view_paths().await?;
+
+        if let Some(remotes) = remote_list {
+            let mut remote_paths = remotes
+                .0
+                .iter()
+                .map(|remote| format!("/resource/{}", remote.id))
+                .collect();
+            paths.append(&mut remote_paths);
+        }
+
         Ok(paths)
     }
 }
@@ -83,10 +93,14 @@ impl Component for PdmPermissionPathSelector {
             .map(|i| AttrValue::from(*i))
             .collect();
 
-        let link = ctx.link().clone();
+        let result = ctx.link().context(Callback::from(|_: RemoteList| {}));
+        let remote_list = result.map(|(remote_list, _)| remote_list);
+
         let async_pool = AsyncPool::new();
+        let link = ctx.link().clone();
+
         async_pool.spawn(async move {
-            let paths = Self::get_paths().await;
+            let paths = Self::get_paths(remote_list).await;
             match paths {
                 Ok(paths) => link.send_message(Msg::Prefetched(paths)),
                 Err(_) => link.send_message(Msg::PrefetchFailed),
-- 
2.47.3

Re: [PATCH datacenter-manager 0/3] ui: acl: pre-populate permission path selector

[Shannon Sterz]

On Tue Mar 31, 2026 at 11:57 AM CEST, Shan Shaji wrote:
> vikunja ticket: #858
>
> This series lists specific remotes and views in the permission path selector
> which users can use to select and assign specific roles.
>
> ### Testing
> ===========

[snip]

the code in this series looks good to me now, so consider this:

Reviewed-by: Shannon Sterz <s.sterz@proxmox.com>

applied: [PATCH datacenter-manager 0/3] ui: acl: pre-populate permission path selector

[Lukas Wagner]

On Tue Mar 31, 2026 at 11:57 AM CEST, Shan Shaji wrote:
> vikunja ticket: #858
>
> This series lists specific remotes and views in the permission path selector
> which users can use to select and assign specific roles.
>

applied, thanks!