Re: [PATCH proxmox-backup v2 11/27] api: config: check sync owner has access to en-/decryption keys

Thomas Lamprecht
2026-04-11T08:51:38Z

Am 10.04.26 um 18:54 schrieb Christian Ebner:
> diff --git a/src/api2/config/sync.rs b/src/api2/config/sync.rs
> @@ -62,6 +62,16 @@ fn is_correct_owner(auth_id: &Authid, job: &SyncJobConfig) -> bool {
>
> +fn sync_user_can_access_optional_key(key_id: Option<&str>, owner: &Authid) -> Result<(), Error> {
> + if let Some(key_id) = key_id {
> + if crate::server::sync::check_privs_and_load_key_config(key_id, owner, false).is_err() {
> + bail!("no such key or cannot access key '{key_id}'");
> + }
> + }
> + Ok(())
> +}

For push direction, the call passes fail_on_archived=false, meaning an archived
key is accepted as active_encryption_key at job creation/update time. The push
runtime (PushParameters::new) does pass fail_on_archived=true, so the job would
fail when actually executed, but the error only shows up then - not when the
admin edits the config. should the push path use fail_on_archived=true here
too?