From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id C45981FF0A7 for ; Wed, 19 Aug 2026 15:19:02 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 8A01321480; Wed, 19 Aug 2026 15:19:02 +0200 (CEST) Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Wed, 19 Aug 2026 15:18:58 +0200 Message-Id: Subject: Re: [PATCH proxmox 3/4] api-types: add a scheme generic URL regex From: "Thomas Ellmenreich" To: "Shan Shaji" , X-Mailer: aerc 0.20.0 References: <20260813150551.415237-1-t.ellmenreich@proxmox.com> <20260813150551.415237-4-t.ellmenreich@proxmox.com> In-Reply-To: X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1787145515006 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.746 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) NUMERIC_HTTP_ADDR 0.001 Uses a numeric IP address in URL RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record WEIRD_PORT 0.001 Uses non-standard port number for HTTP Message-ID-Hash: 3J2NUMOE3R7WXT2LKVOXBOZP3RXKK44J X-Message-ID-Hash: 3J2NUMOE3R7WXT2LKVOXBOZP3RXKK44J X-MailFrom: t.ellmenreich@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Datacenter Manager development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Thank you so much for your extensive testing, especially for using a mobile device as well. Personally, I would tackle the possible changes to PVE and PBS in a separate patch series and on their own mailing lists. On Wed Aug 19, 2026 at 2:03 PM CEST, Shan Shaji wrote: > Hi, > > I have tested this again when checking the app open ID [0] series with th= e custom > scheme and I was wrong about optionaly allowing to not have the > host part. Sorry! > > So, when the redirect_uri is specified without the host part (com.proxmox= .app.openid://) > it will generate an authorization URL but keycloak will fail to parse it.= The login > prompt won't be shown. So, the behavior for PDM I believe is correct. Per= haps, we might need > to update the validation for PVE and PBS as well? I am also not sure why = it was relaxed > there in first place.=20 > > Anyways, the changes inside this series looks fine to me. I am getting t= he > authorization url correctly. So, please consider this:=20 > > ``` > curl -o - --data '{"realm":"proxmox","redirect-url":"com.proxmox.app.open= id://openid-callback"}' \\ > --header 'Content-Type: application/json;charset=3DUTF-8' \\ > -k https://10.12.0.11:8443/api2/extjs/access/openid/auth-url | jq > ``` > > - [0] https://lore.proxmox.com/pve-devel/20260810144713.75806-1-haque@az= harul.com/T/#u > > Reviewed-by: Shan Shaji > Tested-by: Shan Shaji > > On Tue Aug 18, 2026 at 5:08 PM CEST, Shan Shaji wrote: >> Hi, >> >> I have tested the changes and went through the code. AFAICT, >> everything looks good except for one thing. >> >> Without the changes, when sending a curl request, I got the error >> as mentioned in the ticket. After applying the fix, the >> "redirect-url" regex validation works when using the same test URLs from >> the test and I am getting a valid "data" response. However, when >> using the redirect URIs without the host part (e.g: pveauth://, proxman:= //), >> the validation still fails. >> >> AFAIK, in Android and iOS, since the host part is not mandatory for >> custom schemes, IMHO it would be better to support the case where >> the host part is optional as well. That is, as we discussed off >> list: for http(s) URLs, the host part is mandatory, and for custom >> URLs, the host part doesn't have to be mandatory. >> >> On Thu Aug 13, 2026 at 5:05 PM CEST, Thomas Ellmenreich wrote: >>> The current URL regex, HTTP_URL_REGEX, is specific to the HTTP and HTTP= S >>> schemes. This patch creates a new regex that is scheme-generic and thus >>> allows any other valid scheme. >>> >>> It also adds tests that cover some basic URL edge cases. >>> >>> Signed-off-by: Thomas Ellmenreich >>> --- >>> pbs-api-types/src/lib.rs | 1 + >>> proxmox-schema/src/api_types.rs | 40 ++++++++++++++++++++++++++++++++- >>> 2 files changed, 40 insertions(+), 1 deletion(-) >>> >>> diff --git a/pbs-api-types/src/lib.rs b/pbs-api-types/src/lib.rs >>> index 21ef733d..924f356b 100644 >>> --- a/pbs-api-types/src/lib.rs >>> +++ b/pbs-api-types/src/lib.rs >>> @@ -44,6 +44,7 @@ pub use proxmox_schema::api_types::HTTP_URL_SCHEMA; >>> pub use proxmox_schema::api_types::MULTI_LINE_COMMENT_SCHEMA; >>> pub use proxmox_schema::api_types::NODE_SCHEMA; >>> pub use proxmox_schema::api_types::SINGLE_LINE_COMMENT_FORMAT; >>> +pub use proxmox_schema::api_types::URL_SCHEMA; >>> pub use proxmox_schema::api_types::{ >>> BLOCKDEVICE_DISK_AND_PARTITION_NAME_SCHEMA, BLOCKDEVICE_NAME_SCHEM= A, >>> }; >> >>>>snip<<