Re: [PATCH proxmox-backup v2 11/27] api: config: check sync owner has access to en-/decryption keys

[Christian Ebner <c.ebner@proxmox.com>]

On 4/11/26 10:50 AM, Thomas Lamprecht wrote:
> Am 10.04.26 um 18:54 schrieb Christian Ebner:
>> diff --git a/src/api2/config/sync.rs b/src/api2/config/sync.rs
>> @@ -62,6 +62,16 @@ fn is_correct_owner(auth_id: &Authid, job: &SyncJobConfig) -> bool {
>>
>> +fn sync_user_can_access_optional_key(key_id: Option<&str>, owner: &Authid) -> Result<(), Error> {
>> +    if let Some(key_id) = key_id {
>> +        if crate::server::sync::check_privs_and_load_key_config(key_id, owner, false).is_err() {
>> +            bail!("no such key or cannot access key '{key_id}'");
>> +        }
>> +    }
>> +    Ok(())
>> +}
> 
> For push direction, the call passes fail_on_archived=false, meaning an archived
> key is accepted as active_encryption_key at job creation/update time. The push
> runtime (PushParameters::new) does pass fail_on_archived=true, so the job would
> fail when actually executed, but the error only shows up then - not when the
> admin edits the config. should the push path use fail_on_archived=true here
> too?

Yes, indeed. When setting the active encryption key it should always be 
checked if the key is not archived. Will expose this additional flag 
also to sync_user_can_access_optional_key(), so it can be checked 
respectively.