From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 9B6331FF146 for ; Tue, 07 Jul 2026 14:05:12 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id C460B21494; Tue, 07 Jul 2026 14:05:05 +0200 (CEST) From: David Riley To: pve-devel@lists.proxmox.com Subject: [PATCH pve-access-control v5 1/7] permission: add acl tree node parent lookup without node creation Date: Tue, 7 Jul 2026 14:03:58 +0200 Message-ID: <20260707120404.73072-2-d.riley@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260707120404.73072-1-d.riley@proxmox.com> References: <20260707120404.73072-1-d.riley@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1783425864701 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.049 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: K5FYVY7FRAQ6NFUF66SXEF6YRCFJRVA7 X-Message-ID-Hash: K5FYVY7FRAQ6NFUF66SXEF6YRCFJRVA7 X-MailFrom: d.riley@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Add helper function to look up ACL nodes by path without creating missing nodes along the path. This is necessary for safely locating paths intended for deletion or migration without side effects. This is in preparation for the following SDN resource ACL pruning and VNet migration changes. Signed-off-by: David Riley --- src/PVE/AccessControl.pm | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm index 0d632b3..e26dfce 100644 --- a/src/PVE/AccessControl.pm +++ b/src/PVE/AccessControl.pm @@ -1000,6 +1000,31 @@ sub find_acl_tree_node { return $node; } +# finds an ACL node by path without autovivifying (creating) missing +# nodes. returns a list containing the parent node, the final path +# segment, and the target node itself. +sub find_acl_tree_node_parent { + my ($root, $path) = @_; + + my $current = $root; + my $parent = undef; + my $last_key = undef; + + my @split_path = split('/', $path); + + for my $segment (@split_path) { + if (defined($current->{children}) && defined($current->{children}->{$segment})) { + $parent = $current; + $last_key = $segment; + $current = $current->{children}->{$segment}; + } else { + return (undef, undef, undef); + } + } + + return ($parent, $last_key, $current); +} + sub add_user_group { my ($username, $usercfg, $group) = @_; -- 2.47.3