Re: [pbs-devel] [PATCH proxmox-backup 1/2] fix #3853: api: add force option to tape key change-passphrase

[Wolfgang Bumiller <w.bumiller@proxmox.com>]

On Mon, Feb 07, 2022 at 01:48:24PM +0100, Stefan Sterz wrote:
> When force is used, the current passphrase is not required. Instead
> it will be read from the file pointed to by TAPE_KEYS_FILENAME and
> the old key configuration will be overwritten using the new
> passphrase.
> 
> Signed-off-by: Stefan Sterz <s.sterz@proxmox.com>
> ---
>  src/api2/config/tape_encryption_keys.rs | 36 ++++++++++++++++++++++---
>  1 file changed, 33 insertions(+), 3 deletions(-)
> 
> diff --git a/src/api2/config/tape_encryption_keys.rs b/src/api2/config/tape_encryption_keys.rs
> index 1ad99377..b31f741d 100644
> --- a/src/api2/config/tape_encryption_keys.rs
> +++ b/src/api2/config/tape_encryption_keys.rs
> @@ -70,6 +70,7 @@ pub fn list_keys(
>              password: {
>                  description: "The current password.",
>                  min_length: 5,
> +                optional: true,
>              },
>              "new-password": {
>                  description: "The new password.",
> @@ -78,6 +79,12 @@ pub fn list_keys(
>              hint: {
>                  schema: PASSWORD_HINT_SCHEMA,
>              },
> +            force: {
> +                optional: true,
> +                type: bool,
> +                description: "Don't ask for the old passphrase and overwrite it. Root only.",

"Root only.", but this seems to lack the actual permission check.

You seem to be doing this on the CLI side in the other patch, but that's
the wrong place for it, the API is what's reachable from the outside.

Also, as an HTTP API endpoint, "don't ask for the old passphrase" is a
bit of a weird description ;-)