[PATCH proxmox 02/28] pbs-api-types: add remote datastore append privs and role

[Christian Ebner <c.ebner@proxmox.com>]

While allowing to push/backup to remotes like Remote.DatastoreBackup,
Remote.DatastoreAppend also allows creation of namespaces, but never
deletion/modification as Remote.DatastoreModify would imply, not even
for owned contents.

The role is intended to allow local (source) user configuration for
immutable push sync jobs and is to be set on the user/token on the
remote's datastore ACL path.

This is intended to be used with a remote user on the push target
having Datastore.Audit and Datastore.Append on the target datastore
or sub-namespace.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 pbs-api-types/src/acl.rs | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pbs-api-types/src/acl.rs b/pbs-api-types/src/acl.rs
index 9055dfab..f467db8d 100644
--- a/pbs-api-types/src/acl.rs
+++ b/pbs-api-types/src/acl.rs
@@ -61,6 +61,8 @@ constnamedbitmap! {
         PRIV_REMOTE_MODIFY("Remote.Modify");
         /// Remote.Read allows reading data from a configured `Remote`
         PRIV_REMOTE_READ("Remote.Read");
+        /// Remote.DatastoreAppend allows creating new snapshots and namespaces on remote datastores
+        PRIV_REMOTE_DATASTORE_APPEND("Remote.DatastoreAppend");
         /// Remote.DatastoreBackup allows creating new snapshots on remote datastores
         PRIV_REMOTE_DATASTORE_BACKUP("Remote.DatastoreBackup");
         /// Remote.DatastoreModify allows to modify remote datastores
@@ -183,6 +185,14 @@ pub const ROLE_REMOTE_SYNC_PUSH_OPERATOR: u64 = 0
     | PRIV_REMOTE_AUDIT
     | PRIV_REMOTE_DATASTORE_BACKUP;
 
+#[rustfmt::skip]
+#[allow(clippy::identity_op)]
+/// Remote.SyncAppendOperator can read remote datastores, as well as push snapshots and create
+/// namespaces on the remote.
+pub const ROLE_REMOTE_SYNC_APPEND_OPERATOR: u64 = 0
+    | PRIV_REMOTE_AUDIT
+    | PRIV_REMOTE_DATASTORE_APPEND;
+
 #[rustfmt::skip]
 #[allow(clippy::identity_op)]
 /// Remote.DatastorePowerUser can read and push snapshots to the remote, and prune owned snapshots
@@ -271,6 +281,8 @@ pub enum Role {
     RemoteSyncOperator = ROLE_REMOTE_SYNC_OPERATOR,
     /// Synchronisation Operator (push direction)
     RemoteSyncPushOperator = ROLE_REMOTE_SYNC_PUSH_OPERATOR,
+    /// Synchronisation Operator (append push direction)
+    RemoteSyncAppendOperator = ROLE_REMOTE_SYNC_APPEND_OPERATOR,
     /// Remote Datastore Prune
     RemoteDatastorePowerUser = ROLE_REMOTE_DATASTORE_POWERUSER,
     /// Remote Datastore Admin
-- 
2.47.3