Re: [pdm-devel] [PATCH datacenter-manager/proxmox/yew-comp v3 00/10] add support for checking acl permissions in (yew) front-ends

[Thomas Lamprecht <t.lamprecht@proxmox.com>]

Am 13.11.25 um 17:39 schrieb Shannon Sterz:
> On Thu Nov 13, 2025 at 5:18 PM CET, Thomas Lamprecht wrote:
>> Am 13.11.25 um 15:26 schrieb Shannon Sterz:
>>> i suppose i could also try to extract the roles with `AclTree::roles`,
>>> which extracts the roles via `AclTreeNode::extract_roles` which is
>>> already somewhat opinionated about how groups should work here. not sure
>>> what is ideal here.
>>
>> That I did not looked closely enough into to answer for sure.
> 
> thanks for your quick reply, i looked into this some more after i send
> this mail and i have a version of this series here now that uses
> `AclTreeNode::extract_roles` to extract the roles for user in general.
> the upshot of this approach is that we already use the acl tree's
> implementation here instead of manually extracting the roles. so once we
> add better support for groups in the acl tree, we'll pick them up here
> for free.
> 
> context: the acl tree has somewhat half-baked support for groups already
> and supports extracting them correctly for a given user. the part that
> is missing there is the look up of what groups a user belongs too. so
> relying on that seems somewhat safe to me as the pre-existing codepaths
> have been around for a while now.
> 
> it looks somewhat like this:
> 
>         if all_for_authid {
>             if let Some(auth_id) = auth_id_filter {
>                for (role, propagate) in node.extract_roles(auth_id, true) {
>                     to_return.push(AclListItem {
>                         path: path_str.to_owned(),
>                         propagate,
>                         // do not disclose what groups exist and by
>                         // making them always look like user permissions
>                         ugid_type: AclUgidType::User,
>                         ugid: auth_id.to_string(),
>                         roleid: role.to_string(),
>                     })
>                 }
>             }
> 
> what do you think? should we go with this approach instead?

Again, only glanced at your series and this hunk, so do take this with a grain
of salt (and a potential for Fabian's rejection ;), but it does look OK to me,
and would indeed be a bit more future proof w.r.t. hedging against leaking
any groups themselves.


_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel