[pbs-devel] [RFC proxmox-backup 13/15] tasks: allow unpriv users to read their tokens' tasks

["Fabian Grünbichler" <f.gruenbichler@proxmox.com>]

and tighten down the return schema while we're at it.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
---
 src/api2/node/tasks.rs | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/src/api2/node/tasks.rs b/src/api2/node/tasks.rs
index b86eaec7..379ec6fc 100644
--- a/src/api2/node/tasks.rs
+++ b/src/api2/node/tasks.rs
@@ -14,6 +14,14 @@ use crate::server::{self, UPID, TaskState, TaskListInfoIterator};
 use crate::config::acl::{PRIV_SYS_AUDIT, PRIV_SYS_MODIFY};
 use crate::config::cached_user_info::CachedUserInfo;
 
+fn check_task_access(auth_user: &Userid, task_user: &Userid) -> Result<(), Error> {
+    if auth_user == task_user || (task_user.is_tokenid() && &task_user.owner().unwrap() == auth_user) {
+        Ok(())
+    } else {
+        let user_info = CachedUserInfo::new()?;
+        user_info.check_privs(auth_user, &["system", "tasks"], PRIV_SYS_AUDIT, false)
+    }
+}
 
 #[api(
     input: {
@@ -57,7 +65,7 @@ use crate::config::cached_user_info::CachedUserInfo;
                 description: "Worker ID (arbitrary ASCII string)",
             },
             user: {
-                type: String,
+                schema: PROXMOX_USER_OR_TOKEN_ID_SCHEMA,
                 description: "The user who started the task.",
             },
             status: {
@@ -85,11 +93,7 @@ async fn get_task_status(
     let upid = extract_upid(&param)?;
 
     let userid: Userid = rpcenv.get_user().unwrap().parse()?;
-
-    if userid != upid.userid {
-        let user_info = CachedUserInfo::new()?;
-        user_info.check_privs(&userid, &["system", "tasks"], PRIV_SYS_AUDIT, false)?;
-    }
+    check_task_access(&userid, &upid.userid)?;
 
     let mut result = json!({
         "upid": param["upid"],
@@ -162,11 +166,7 @@ async fn read_task_log(
     let upid = extract_upid(&param)?;
 
     let userid: Userid = rpcenv.get_user().unwrap().parse()?;
-
-    if userid != upid.userid {
-        let user_info = CachedUserInfo::new()?;
-        user_info.check_privs(&userid, &["system", "tasks"], PRIV_SYS_AUDIT, false)?;
-    }
+    check_task_access(&userid, &upid.userid)?;
 
     let test_status = param["test-status"].as_bool().unwrap_or(false);
 
@@ -326,7 +326,9 @@ pub fn list_tasks(
             Err(_) => return None,
         };
 
-        if !list_all && info.upid.userid != userid { return None; }
+        if !list_all && check_task_access(&userid, &info.upid.userid).is_err() {
+            return None;
+        }
 
         if let Some(userid) = &userfilter {
             if !info.upid.userid.as_str().contains(userid) { return None; }
-- 
2.20.1