[PATCH pve-access-control v5 2/7] fix #7520: sdn: add pruning SDN resources ACLs

[David Riley <d.riley@proxmox.com>]

Add a cleanup routine to remove ACLs under the '/sdn/' path when the
corresponding resources are deleted.

This is a preparatory change that does not have an immediate effect on
its own, but lays the foundation for preventing dangling permission
states and ensures configuration consistency.

Link: https://bugzilla.proxmox.com/show_bug.cgi?id=7520
Signed-off-by: David Riley <d.riley@proxmox.com>
---
 src/PVE/AccessControl.pm | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/src/PVE/AccessControl.pm b/src/PVE/AccessControl.pm
index e26dfce..8e2b4f2 100644
--- a/src/PVE/AccessControl.pm
+++ b/src/PVE/AccessControl.pm
@@ -1999,6 +1999,33 @@ sub remove_vm_from_pool {
     lock_user_config($delVMfromPoolFn, "pool cleanup for VM $vmid failed");
 }
 
+sub remove_sdn_resource_access {
+    my ($paths) = @_; # [ 'zones/<zone>', 'zones/<zone>/<vnet>' ]
+
+    my $delete_resource_fn = sub {
+        my $usercfg = cfs_read_file("user.cfg");
+        my $modified = 0;
+
+        for my $path (@$paths) {
+            my $full_path = "sdn/$path";
+
+            my $current = $usercfg->{acl_root};
+            my ($parent, $last_key) = find_acl_tree_node_parent($current, $full_path);
+
+            if ($parent && $last_key) {
+                delete $parent->{children}->{$last_key};
+                $modified = 1;
+            }
+        }
+
+        if ($modified) {
+            cfs_write_file("user.cfg", $usercfg);
+        }
+    };
+
+    lock_user_config($delete_resource_fn, "SDN ACL cleanup failed");
+}
+
 my $USER_CONTROLLED_TFA_TYPES = {
     u2f => 1,
     oath => 1,
-- 
2.47.3