[pbs-devel] [v2 proxmox-backup] www: show more ACLs in datastore panel

[pbs-devel] [v2 proxmox-backup] www: show more ACLs in datastore panel

[Fabian Grünbichler]

since just the ACLs defined on the exact datastore path don't give
anywhere near a complete picture of who has access to it.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
---

Notes:
    v2: handle neighbouring ACL paths properly

 www/config/ACLView.js  | 20 +++++++++++++++++++-
 www/datastore/Panel.js |  1 -
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/www/config/ACLView.js b/www/config/ACLView.js
index bf1ea6a9..20caf284 100644
--- a/www/config/ACLView.js
+++ b/www/config/ACLView.js
@@ -84,11 +84,29 @@ Ext.define('PBS.config.ACLView', {
 
 	    let params = {};
 	    if (view.aclPath !== undefined) {
-		params.path = view.aclPath;
+
+		let pathFilter = Ext.create('Ext.util.Filter', {
+		    filterPath: view.aclPath,
+		    filterFn: function(item) {
+			let me = this;
+			let curr = item.data.path;
+
+			if (curr.lastIndexOf("/") < me.filterPath.lastIndexOf("/")) {
+			    return me.filterPath.startsWith(curr);
+			} else {
+			    return me.filterPath === curr;
+			}
+		    },
+		});
+		view.getStore().addFilter(pathFilter);
 	    }
 	    if (view.aclExact !== undefined) {
+		if (view.aclPath !== undefined) {
+		    params.path = view.aclPath;
+		}
 		params.exact = view.aclExact;
 	    }
+
 	    proxy.setExtraParams(params);
 	    Proxmox.Utils.monStoreErrors(view, view.getStore().rstore);
 	},
diff --git a/www/datastore/Panel.js b/www/datastore/Panel.js
index 473aa50c..bca663e8 100644
--- a/www/datastore/Panel.js
+++ b/www/datastore/Panel.js
@@ -90,7 +90,6 @@ Ext.define('PBS.DataStorePanel', {
 	    itemId: 'acl',
 	    xtype: 'pbsACLView',
 	    iconCls: 'fa fa-unlock',
-	    aclExact: true,
 	    cbind: {
 		aclPath: '{aclPath}',
 	    },
-- 
2.20.1

[pbs-devel] applied: [v2 proxmox-backup] www: show more ACLs in datastore panel

[Thomas Lamprecht]

On 09.11.20 14:47, Fabian Grünbichler wrote:
> since just the ACLs defined on the exact datastore path don't give
> anywhere near a complete picture of who has access to it.
> 
> Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
> ---
> 
> Notes:
>     v2: handle neighbouring ACL paths properly
> 
>  www/config/ACLView.js  | 20 +++++++++++++++++++-
>  www/datastore/Panel.js |  1 -
>  2 files changed, 19 insertions(+), 2 deletions(-)
> 
>

applied, thanks!

Re: [pbs-devel] [v2 proxmox-backup] www: show more ACLs in datastore panel

[Thomas Lamprecht]

On 09.11.20 14:47, Fabian Grünbichler wrote:
> since just the ACLs defined on the exact datastore path don't give
> anywhere near a complete picture of who has access to it.
> 
> Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
> ---
> 
> Notes:
>     v2: handle neighbouring ACL paths properly
> 
>  www/config/ACLView.js  | 20 +++++++++++++++++++-
>  www/datastore/Panel.js |  1 -
>  2 files changed, 19 insertions(+), 2 deletions(-)
> 
> diff --git a/www/config/ACLView.js b/www/config/ACLView.js
> index bf1ea6a9..20caf284 100644
> --- a/www/config/ACLView.js
> +++ b/www/config/ACLView.js
> @@ -84,11 +84,29 @@ Ext.define('PBS.config.ACLView', {
>  
>  	    let params = {};
>  	    if (view.aclPath !== undefined) {
> -		params.path = view.aclPath;
> +
> +		let pathFilter = Ext.create('Ext.util.Filter', {
> +		    filterPath: view.aclPath,
> +		    filterFn: function(item) {
> +			let me = this;
> +			let curr = item.data.path;
> +
> +			if (curr.lastIndexOf("/") < me.filterPath.lastIndexOf("/")) {
> +			    return me.filterPath.startsWith(curr);
> +			} else {
> +			    return me.filterPath === curr;
> +			}


argh, this gets it wrong too, e.g. if one passes /datastore as filter get
only the /datastore ACLs, but not / or /datastore/test ones.

We probably need to split both filter and current path into components
.split('/') and go through them, return false if filter components are
not yet exhausted and the current level does not match, else return true.


> +		    },
> +		});
> +		view.getStore().addFilter(pathFilter);
>  	    }
>  	    if (view.aclExact !== undefined) {
> +		if (view.aclPath !== undefined) {
> +		    params.path = view.aclPath;
> +		}
>  		params.exact = view.aclExact;
>  	    }
> +
>  	    proxy.setExtraParams(params);
>  	    Proxmox.Utils.monStoreErrors(view, view.getStore().rstore);
>  	},
> diff --git a/www/datastore/Panel.js b/www/datastore/Panel.js
> index 473aa50c..bca663e8 100644
> --- a/www/datastore/Panel.js
> +++ b/www/datastore/Panel.js
> @@ -90,7 +90,6 @@ Ext.define('PBS.DataStorePanel', {
>  	    itemId: 'acl',
>  	    xtype: 'pbsACLView',
>  	    iconCls: 'fa fa-unlock',
> -	    aclExact: true,
>  	    cbind: {
>  		aclPath: '{aclPath}',
>  	    },
> 

Re: [pbs-devel] [v2 proxmox-backup] www: show more ACLs in datastore panel

[Fabian Grünbichler]

On November 9, 2020 7:56 pm, Thomas Lamprecht wrote:
> On 09.11.20 14:47, Fabian Grünbichler wrote:
>> since just the ACLs defined on the exact datastore path don't give
>> anywhere near a complete picture of who has access to it.
>> 
>> Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
>> ---
>> 
>> Notes:
>>     v2: handle neighbouring ACL paths properly
>> 
>>  www/config/ACLView.js  | 20 +++++++++++++++++++-
>>  www/datastore/Panel.js |  1 -
>>  2 files changed, 19 insertions(+), 2 deletions(-)
>> 
>> diff --git a/www/config/ACLView.js b/www/config/ACLView.js
>> index bf1ea6a9..20caf284 100644
>> --- a/www/config/ACLView.js
>> +++ b/www/config/ACLView.js
>> @@ -84,11 +84,29 @@ Ext.define('PBS.config.ACLView', {
>>  
>>  	    let params = {};
>>  	    if (view.aclPath !== undefined) {
>> -		params.path = view.aclPath;
>> +
>> +		let pathFilter = Ext.create('Ext.util.Filter', {
>> +		    filterPath: view.aclPath,
>> +		    filterFn: function(item) {
>> +			let me = this;
>> +			let curr = item.data.path;
>> +
>> +			if (curr.lastIndexOf("/") < me.filterPath.lastIndexOf("/")) {
>> +			    return me.filterPath.startsWith(curr);
>> +			} else {
>> +			    return me.filterPath === curr;
>> +			}
> 
> 
> argh, this gets it wrong too, e.g. if one passes /datastore as filter get
> only the /datastore ACLs, but not / or /datastore/test ones.

the former was not intended (I had the early return for "/" in an 
intermediate version with splits, but lost it on simplification), the 
latter one was ("/datastore/test" ACLs don't affect permissions on 
"/datastore").

> We probably need to split both filter and current path into components
> .split('/') and go through them, return false if filter components are
> not yet exhausted and the current level does not match, else return true.

I see that you fixed that up already which looks good, and showing child 
ACLs as well makes sense for the datastore overview and is now 
documented, so that change in behaviour is fine for me too :) we will 
only ever set intermediate (as in "overview" panels) or leaf (as in the 
datacenter panel), and for the second case there cannot be any child 
ACLs atm anyway.