From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id A13B81FF0A7 for ; Wed, 19 Aug 2026 14:03:17 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 39D5E214B2; Wed, 19 Aug 2026 14:03:17 +0200 (CEST) Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Wed, 19 Aug 2026 14:03:08 +0200 Message-Id: Subject: Re: [PATCH proxmox 3/4] api-types: add a scheme generic URL regex From: "Shan Shaji" To: "Shan Shaji" , "Thomas Ellmenreich" , X-Mailer: aerc 0.20.0 References: <20260813150551.415237-1-t.ellmenreich@proxmox.com> <20260813150551.415237-4-t.ellmenreich@proxmox.com> In-Reply-To: X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1787140964841 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.621 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) NUMERIC_HTTP_ADDR 0.001 Uses a numeric IP address in URL RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record WEIRD_PORT 0.001 Uses non-standard port number for HTTP Message-ID-Hash: RUTVA4V3LWH373KZN5Q3RYOHTAX5T3EH X-Message-ID-Hash: RUTVA4V3LWH373KZN5Q3RYOHTAX5T3EH X-MailFrom: s.shaji@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Datacenter Manager development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Hi, I have tested this again when checking the app open ID [0] series with the = custom scheme and I was wrong about optionaly allowing to not have the host part. Sorry! So, when the redirect_uri is specified without the host part (com.proxmox.a= pp.openid://) it will generate an authorization URL but keycloak will fail to parse it. T= he login prompt won't be shown. So, the behavior for PDM I believe is correct. Perha= ps, we might need to update the validation for PVE and PBS as well? I am also not sure why it= was relaxed there in first place.=20 Anyways, the changes inside this series looks fine to me. I am getting the authorization url correctly. So, please consider this:=20 ``` curl -o - --data '{"realm":"proxmox","redirect-url":"com.proxmox.app.openid= ://openid-callback"}' \\ --header 'Content-Type: application/json;charset=3DUTF-8' \\ -k https://10.12.0.11:8443/api2/extjs/access/openid/auth-url | jq ``` - [0] https://lore.proxmox.com/pve-devel/20260810144713.75806-1-haque@azha= rul.com/T/#u Reviewed-by: Shan Shaji Tested-by: Shan Shaji On Tue Aug 18, 2026 at 5:08 PM CEST, Shan Shaji wrote: > Hi, > > I have tested the changes and went through the code. AFAICT, > everything looks good except for one thing. > > Without the changes, when sending a curl request, I got the error > as mentioned in the ticket. After applying the fix, the > "redirect-url" regex validation works when using the same test URLs from > the test and I am getting a valid "data" response. However, when > using the redirect URIs without the host part (e.g: pveauth://, proxman:/= /), > the validation still fails. > > AFAIK, in Android and iOS, since the host part is not mandatory for > custom schemes, IMHO it would be better to support the case where > the host part is optional as well. That is, as we discussed off > list: for http(s) URLs, the host part is mandatory, and for custom > URLs, the host part doesn't have to be mandatory. > > On Thu Aug 13, 2026 at 5:05 PM CEST, Thomas Ellmenreich wrote: >> The current URL regex, HTTP_URL_REGEX, is specific to the HTTP and HTTPS >> schemes. This patch creates a new regex that is scheme-generic and thus >> allows any other valid scheme. >> >> It also adds tests that cover some basic URL edge cases. >> >> Signed-off-by: Thomas Ellmenreich >> --- >> pbs-api-types/src/lib.rs | 1 + >> proxmox-schema/src/api_types.rs | 40 ++++++++++++++++++++++++++++++++- >> 2 files changed, 40 insertions(+), 1 deletion(-) >> >> diff --git a/pbs-api-types/src/lib.rs b/pbs-api-types/src/lib.rs >> index 21ef733d..924f356b 100644 >> --- a/pbs-api-types/src/lib.rs >> +++ b/pbs-api-types/src/lib.rs >> @@ -44,6 +44,7 @@ pub use proxmox_schema::api_types::HTTP_URL_SCHEMA; >> pub use proxmox_schema::api_types::MULTI_LINE_COMMENT_SCHEMA; >> pub use proxmox_schema::api_types::NODE_SCHEMA; >> pub use proxmox_schema::api_types::SINGLE_LINE_COMMENT_FORMAT; >> +pub use proxmox_schema::api_types::URL_SCHEMA; >> pub use proxmox_schema::api_types::{ >> BLOCKDEVICE_DISK_AND_PARTITION_NAME_SCHEMA, BLOCKDEVICE_NAME_SCHEMA= , >> }; > >>>snip<<