From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 816381FF0AB for ; Wed, 23 Sep 2026 23:00:57 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 293A4216D9; Wed, 23 Sep 2026 23:00:15 +0200 (CEST) From: Thomas Lamprecht To: pve-devel@lists.proxmox.com Subject: [PATCH manager 6/9] ui: dc options: allow editing the API token policy Date: Wed, 23 Sep 2026 22:59:55 +0200 Message-ID: <20260923210000.4031318-7-t.lamprecht@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260923210000.4031318-1-t.lamprecht@proxmox.com> References: <20260923210000.4031318-1-t.lamprecht@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1790197207559 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.677 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: RFYJZOPP7BLLAGM36BZCHRJKPOWUC36T X-Message-ID-Hash: RFYJZOPP7BLLAGM36BZCHRJKPOWUC36T X-MailFrom: t.lamprecht@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Render and edit the new datacenter token-policy option. The maximum lifetime is entered in days, fractional values are allowed for sub-day lifetimes, and the exact stored value is kept when the field is left untouched, so a finer grained value set via the API survives unrelated edits. Signed-off-by: Thomas Lamprecht --- www/manager6/dc/OptionView.js | 107 ++++++++++++++++++++++++++++++++++ 1 file changed, 107 insertions(+) diff --git a/www/manager6/dc/OptionView.js b/www/manager6/dc/OptionView.js index dc12aa7e1..595a8f070 100644 --- a/www/manager6/dc/OptionView.js +++ b/www/manager6/dc/OptionView.js @@ -384,6 +384,113 @@ Ext.define('PVE.dc.OptionView', { }, ], }); + me.rows['token-policy'] = { + required: true, + header: gettext('API Token Policy'), + renderer: function (policy) { + if (!policy) { + return Proxmox.Utils.NoneText; + } + let parts = []; + if (Number(policy['require-expiry'])) { + parts.push(gettext('Require Expiration Date')); + } + if (policy['max-lifetime'] !== undefined) { + let lifetime = Proxmox.Utils.format_duration_human( + Number(policy['max-lifetime']), + ); + parts.push(Ext.String.format(gettext('Max. Lifetime: {0}'), lifetime)); + } + if (Number(policy['disallow-expiry-changes'])) { + parts.push(gettext('Disallow Expiration Changes')); + } + if (Number(policy['require-privilege-separation'])) { + parts.push(gettext('Require Privilege Separation')); + } + return parts.length ? parts.join(', ') : Proxmox.Utils.NoneText; + }, + editor: { + xtype: 'proxmoxWindowEdit', + subject: gettext('API Token Policy'), + onlineHelp: 'pveum_token_policy', + url: '/api2/extjs/cluster/options', + fieldDefaults: { + labelWidth: 150, + }, + setValues: function (values) { + let me = this; + // work on a copy, max-lifetime is stored in seconds but entered in days, + // fractional values are allowed; round up at two decimals for display and + // remember the exact stored value so that saving with the field untouched + // does not alter it + let policy = Ext.apply({}, values['token-policy'] || {}); + me.storedMaxLifetime = policy['max-lifetime']; + if (policy['max-lifetime'] !== undefined) { + policy['max-lifetime'] = + Math.ceil((Number(policy['max-lifetime']) / 86400) * 100) / 100; + } + Ext.Array.each(me.query('inputpanel'), (panel) => panel.setValues(policy)); + }, + items: [ + { + xtype: 'inputpanel', + onGetValues: function (values) { + let me = this; + let win = me.up('proxmoxWindowEdit'); + let policy = {}; + if (values['require-expiry']) { + policy['require-expiry'] = 1; + } + if (values['disallow-expiry-changes']) { + policy['disallow-expiry-changes'] = 1; + } + if (values['require-privilege-separation']) { + policy['require-privilege-separation'] = 1; + } + let days = values['max-lifetime']; + if (days !== undefined && days !== null && days !== '') { + let untouched = !me.down('field[name=max-lifetime]').isDirty(); + policy['max-lifetime'] = + untouched && win.storedMaxLifetime !== undefined + ? win.storedMaxLifetime + : Math.round(Number(days) * 86400); + } + if (Object.keys(policy).length === 0) { + return { delete: 'token-policy' }; + } + return { 'token-policy': PVE.Parser.printPropertyString(policy) }; + }, + items: [ + { + xtype: 'proxmoxcheckbox', + name: 'require-expiry', + uncheckedValue: 0, + fieldLabel: gettext('Require Expiration Date'), + }, + { + xtype: 'numberfield', + name: 'max-lifetime', + minValue: 0.01, + emptyText: gettext('No limit'), + fieldLabel: gettext('Maximum Lifetime (days)'), + }, + { + xtype: 'proxmoxcheckbox', + name: 'disallow-expiry-changes', + uncheckedValue: 0, + fieldLabel: gettext('Disallow Expiration Changes'), + }, + { + xtype: 'proxmoxcheckbox', + name: 'require-privilege-separation', + uncheckedValue: 0, + fieldLabel: gettext('Require Privilege Separation'), + }, + ], + }, + ], + }, + }; me.rows['tag-style'] = { required: true, renderer: (value) => { -- 2.47.3