[pbs-devel] [PATCH proxmox-backup 4/5] fix #3887: api2: add regenerate token endpoint

[Hannes Laimer <h.laimer@proxmox.com>]

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 src/api2/access/user.rs | 61 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 60 insertions(+), 1 deletion(-)

diff --git a/src/api2/access/user.rs b/src/api2/access/user.rs
index 40177c8d..c2b563f7 100644
--- a/src/api2/access/user.rs
+++ b/src/api2/access/user.rs
@@ -628,6 +628,59 @@ pub fn update_token(
     Ok(())
 }
 
+#[api(
+    protected: true,
+    input: {
+        properties: {
+            userid: {
+                type: Userid,
+            },
+            "token-name": {
+                type: Tokenname,
+            },
+        },
+    },
+    access: {
+        permission: &Permission::Or(&[
+            &Permission::Privilege(&["access", "users"], PRIV_PERMISSIONS_MODIFY, false),
+            &Permission::UserParam("userid"),
+        ]),
+    },
+    returns: {
+        description: "API token identifier + new generated secret.",
+        properties: {
+            value: {
+                type: String,
+                description: "The API token secret",
+            },
+            tokenid: {
+                type: String,
+                description: "The API token identifier",
+            },
+        },
+    },
+)]
+/// Regenerate an API token's secret, revokes the old secret and create a new one
+pub fn regenerate_token(userid: Userid, token_name: Tokenname) -> Result<Value, Error> {
+    let _user_lock = pbs_config::user::lock_config()?;
+
+    let tokenid = Authid::from((userid.clone(), Some(token_name.clone())));
+    let tokenid_string = tokenid.to_string();
+
+    let (user_config, _digest) = pbs_config::user::config()?;
+
+    // token just has to exist, we don't actually need it
+    let _data: ApiToken = user_config.lookup("token", &tokenid_string)?;
+
+    let secret = format!("{:x}", proxmox_uuid::Uuid::generate());
+    token_shadow::set_secret(&tokenid, &secret)?;
+
+    Ok(json!({
+        "tokenid": tokenid_string,
+        "value": secret
+    }))
+}
+
 #[api(
     protected: true,
     input: {
@@ -754,11 +807,17 @@ pub fn list_tokens(
     Ok(res)
 }
 
+const TOKEN_SUBDIRS: SubdirMap = &[(
+    "regenerate",
+    &Router::new().post(&API_METHOD_REGENERATE_TOKEN),
+)];
+
 const TOKEN_ITEM_ROUTER: Router = Router::new()
     .get(&API_METHOD_READ_TOKEN)
     .put(&API_METHOD_UPDATE_TOKEN)
     .post(&API_METHOD_GENERATE_TOKEN)
-    .delete(&API_METHOD_DELETE_TOKEN);
+    .delete(&API_METHOD_DELETE_TOKEN)
+    .subdirs(TOKEN_SUBDIRS);
 
 const TOKEN_ROUTER: Router = Router::new()
     .get(&API_METHOD_LIST_TOKENS)
-- 
2.30.2