[PATCH proxmox-backup 27/28] api: admin: allow to update snapshot retention for root user

[Christian Ebner <c.ebner@proxmox.com>]

Only root user should be able to ever modify the retention setting
set by the sync/backup api.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 src/api2/admin/datastore.rs | 53 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 52 insertions(+), 1 deletion(-)

diff --git a/src/api2/admin/datastore.rs b/src/api2/admin/datastore.rs
index bb829cd3f..244320989 100644
--- a/src/api2/admin/datastore.rs
+++ b/src/api2/admin/datastore.rs
@@ -45,7 +45,7 @@ use pbs_api_types::{
     MaintenanceMode, MaintenanceType, NS_MAX_DEPTH_SCHEMA, Operation, PRIV_DATASTORE_AUDIT,
     PRIV_DATASTORE_BACKUP, PRIV_DATASTORE_MODIFY, PRIV_DATASTORE_PRUNE, PRIV_DATASTORE_READ,
     PRIV_DATASTORE_VERIFY, PRIV_SYS_MODIFY, PruneJobOptions, SnapshotListItem, SyncJobConfig, UPID,
-    UPID_SCHEMA, VERIFICATION_OUTDATED_AFTER_SCHEMA, VERIFY_JOB_READ_THREADS_SCHEMA,
+    UPID_SCHEMA, Userid, VERIFICATION_OUTDATED_AFTER_SCHEMA, VERIFY_JOB_READ_THREADS_SCHEMA,
     VERIFY_JOB_VERIFY_THREADS_SCHEMA, print_ns_and_snapshot, print_store_and_ns,
 };
 use pbs_client::pxar::{create_tar, create_zip};
@@ -2319,6 +2319,56 @@ pub async fn set_protection(
     .await?
 }
 
+#[api(
+    input: {
+        properties: {
+            store: { schema: DATASTORE_SCHEMA },
+            ns: {
+                type: BackupNamespace,
+                optional: true,
+            },
+            backup_dir: {
+                type: pbs_api_types::BackupDir,
+                flatten: true,
+            },
+            "retain-until": {
+                type: Number,
+                description: "Set retention timestamp (clears retention if not given)",
+                optional: true,
+            },
+        },
+    },
+    access: {
+        permission: &Permission::Anybody,
+        description: "Only root@pam is allowed to modify retentions",
+    },
+)]
+/// Set retention for a specific already existing backup
+pub fn set_retention(
+    store: String,
+    ns: Option<BackupNamespace>,
+    backup_dir: pbs_api_types::BackupDir,
+    retain_until: Option<i64>,
+    rpcenv: &mut dyn RpcEnvironment,
+) -> Result<(), Error> {
+    let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
+    if auth_id.is_token() || auth_id.user() != Userid::root_userid() {
+        bail!("only root can modifiy snapshot retention");
+    }
+
+    let datastore = DataStore::lookup_datastore(lookup_with(&store, Operation::Write))?;
+    let backend = datastore.backend()?;
+    let ns = ns.unwrap_or_default();
+    let backup_dir = datastore.backup_dir(ns, backup_dir)?;
+    backup_dir
+        .update_manifest(&backend, |manifest| {
+            manifest.add_retention_timestamp(retain_until);
+        })
+        .map_err(|err| format_err!("failed to set retention timestamp on manifest: {err}"))?;
+
+    Ok(())
+}
+
 #[api(
     input: {
         properties: {
@@ -2994,6 +3044,7 @@ const DATASTORE_INFO_SUBDIRS: SubdirMap = &[
         "pxar-file-download",
         &Router::new().download(&API_METHOD_PXAR_FILE_DOWNLOAD),
     ),
+    ("retention", &Router::new().put(&API_METHOD_SET_RETENTION)),
     ("rrd", &Router::new().get(&API_METHOD_GET_RRD_STATS)),
     ("s3-refresh", &Router::new().put(&API_METHOD_S3_REFRESH)),
     (
-- 
2.47.3