[PATCH installer v2 09/16] post-hook: support creating API token if requested in answer file

[Christoph Heiss <c.heiss@proxmox.com>]

If `global.post-installation-webhook.api-token` is set and we're
installing either PVE or PBS, create a new API token with the given
name, and include it in the info sent back.

Signed-off-by: Christoph Heiss <c.heiss@proxmox.com>
---
Depends on the `proxmox-installer-types` changes and an accompanying
dependency bump.

Changes v1 -> v2:
  * document create_api_token()
  * use Result::inspect_err() for simplifying error handling

 Cargo.toml                    |   4 +-
 debian/control                |   1 +
 proxmox-post-hook/Cargo.toml  |   3 +-
 proxmox-post-hook/src/main.rs | 125 +++++++++++++++++++++++++++++++++-
 4 files changed, 128 insertions(+), 5 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index a134ffb..55d2192 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -28,12 +28,14 @@ serde_plain = "1.0"
 sha2 = "0.10"
 toml = "0.8"
 proxmox-auto-installer.path = "./proxmox-auto-installer"
-proxmox-installer-common.path = "./proxmox-installer-common"
 proxmox-network-types = "1.1"
+proxmox-installer-common.path = "./proxmox-installer-common"
 proxmox-installer-types = { version = "0.1.1", features = ["legacy"] }
+proxmox-time = "2.1"
 
 # Local path overrides
 # NOTE: You must run `cargo update` after changing this for it to take effect!
 [patch.crates-io]
 # proxmox-network-types.path = "../proxmox/proxmox-network-types"
 # proxmox-installer-types.path = "../proxmox/proxmox-installer-types"
+# proxmox-time.path = "../proxmox/proxmox-time"
diff --git a/debian/control b/debian/control
index 7565c2a..cc1f278 100644
--- a/debian/control
+++ b/debian/control
@@ -22,6 +22,7 @@ Build-Depends: cargo:native,
                librust-proxmox-installer-types-0.1+legacy-dev (>= 0.1.1-~~),
                librust-proxmox-network-types-1-dev (>= 1.1-~~),
                librust-proxmox-sys+crypt-dev,
+               librust-proxmox-time-dev,
                librust-regex-1+default-dev (>= 1.7~~),
                librust-rustls-0.23-dev,
                librust-rustls-native-certs-dev,
diff --git a/proxmox-post-hook/Cargo.toml b/proxmox-post-hook/Cargo.toml
index b6d9ce5..82a23c4 100644
--- a/proxmox-post-hook/Cargo.toml
+++ b/proxmox-post-hook/Cargo.toml
@@ -13,8 +13,9 @@ homepage = "https://www.proxmox.com"
 [dependencies]
 anyhow.workspace = true
 proxmox-installer-common = { workspace = true, features = ["http"] }
-proxmox-network-types.workspace = true
 proxmox-installer-types.workspace = true
+proxmox-network-types.workspace = true
+proxmox-time.workspace = true
 rustls.workspace = true
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
diff --git a/proxmox-post-hook/src/main.rs b/proxmox-post-hook/src/main.rs
index e4f1fec..6455838 100644
--- a/proxmox-post-hook/src/main.rs
+++ b/proxmox-post-hook/src/main.rs
@@ -49,8 +49,8 @@ mod detail {
             AutoInstallerConfig, FqdnConfig, FqdnFromDhcpConfig, FqdnSourceMode, SchemaVersion,
         },
         post_hook::{
-            BootInfo, CpuInfo, DiskInfo, KernelVersionInformation, NetworkInterfaceInfo,
-            PostHookInfo, PostHookInfoSchema, ProductInfo, SchemaVersion, SshPublicHostKeys,
+            BootInfo, CpuInfo, CreatedApiToken, DiskInfo, KernelVersionInformation,
+            NetworkInterfaceInfo, PostHookInfo, PostHookInfoSchema, ProductInfo, SshPublicHostKeys,
         },
     };
 
@@ -140,6 +140,20 @@ mod detail {
             None
         };
 
+        let api_token = if let Some(name) = answer
+            .post_installation_webhook
+            .as_ref()
+            .and_then(|p| p.api_token_name.as_ref())
+            && schema_1_3_supported
+            && setup_info.config.product.supports_api_token_creation()
+        {
+            create_api_token(name, target_path, setup_info.config.product, &run_cmd)
+                .inspect_err(|err| eprintln!("could not create API token: {err:#}"))
+                .ok()
+        } else {
+            None
+        };
+
         Ok(PostHookInfo {
             schema: PostHookInfoSchema {
                 version: super::POST_HOOK_SCHEMA_VERSION.to_owned(),
@@ -212,7 +226,7 @@ mod detail {
             },
             reboot_mode: answer.global.reboot_mode,
             cert_fingerprint,
-            api_token: None,
+            api_token,
         })
     }
 
@@ -633,6 +647,111 @@ mod detail {
         }
     }
 
+    /// Creates a new, fully privileged API token with the given `name` for the target system.
+    ///
+    /// The token is set to never expire, and the comment will include that it was created during
+    /// installation, as well as the creation time.
+    ///
+    /// # Returns
+    ///
+    /// The ID and secret of the created API token.
+    pub fn create_api_token(
+        name: &str,
+        target_path: &str,
+        product: ProxmoxProduct,
+        run_cmd: &dyn Fn(&[&str]) -> Result<String>,
+    ) -> Result<CreatedApiToken> {
+        const USER: &str = "root@pam";
+        let date = proxmox_time::epoch_to_rfc2822(proxmox_time::epoch_i64())?;
+        let comment = format!("auto-generated during installation on {date}");
+
+        println!("Creating API token '{name}' for '{USER}' ..");
+        match product {
+            ProxmoxProduct::Pve => with_pmxcfs(target_path, |_| {
+                run_cmd(&[
+                    "pveum",
+                    "user",
+                    "token",
+                    "add",
+                    USER,
+                    name,
+                    "-privsep=0",
+                    "-expire=0",
+                    "-comment",
+                    &comment,
+                    "-output-format=json",
+                ])
+                .map_err(|err| anyhow!(err))
+                .and_then(|s| {
+                    serde_json::from_str::<serde_json::Value>(&s).map_err(|err| anyhow!(err))
+                })
+                .and_then(|v| {
+                    Ok(CreatedApiToken {
+                        id: v["full-tokenid"]
+                            .as_str()
+                            .ok_or_else(|| anyhow!("expected string for tokenid"))?
+                            .parse()?,
+                        secret: v["value"]
+                            .as_str()
+                            .ok_or_else(|| anyhow!("expected string for secret"))?
+                            .to_owned(),
+                    })
+                })
+                .context("generating API token")
+            }),
+            ProxmoxProduct::Pbs => {
+                let token = run_cmd(&[
+                    "proxmox-backup-manager",
+                    "user",
+                    "generate-token",
+                    USER,
+                    name,
+                    "--comment",
+                    &comment,
+                    "--expire=0",
+                    // TODO: once `user generate-token` supports it, switch to `--output-format
+                    // json` and drop the rather ugly trim() hack below.
+                ])
+                .map_err(|err| anyhow!(err))
+                .and_then(|s| {
+                    serde_json::from_str::<serde_json::Value>(
+                        s.trim_start_matches("Result:").trim(),
+                    )
+                    .map_err(|err| anyhow!(err))
+                })
+                .and_then(|v| {
+                    Ok(CreatedApiToken {
+                        id: v["tokenid"]
+                            .as_str()
+                            .ok_or_else(|| anyhow!("expected string for tokenid"))?
+                            .parse()?,
+                        secret: v["value"]
+                            .as_str()
+                            .ok_or_else(|| anyhow!("expected string for secret"))?
+                            .to_owned(),
+                    })
+                })
+                .context("generating API token")?;
+
+                // Give the token full privileges - same as the PDM wizard
+                run_cmd(&[
+                    "proxmox-backup-manager",
+                    "acl",
+                    "update",
+                    "/",
+                    "Admin",
+                    "--auth-id",
+                    &token.id.to_string(),
+                    "--propagate=true",
+                ])
+                .context("setting up API token ACL")?;
+
+                Ok(token)
+            }
+            _ => bail!("cannot create API token for {}", product.full_name()),
+        }
+    }
+
     fn is_path_a_mountpoint(path: impl AsRef<Path>) -> Result<bool> {
         let path = path.as_ref();
 
-- 
2.55.0