[PATCH proxmox-backup v2 30/43] api: config: allow to set or delete retention timespan for sync jobs

[Christian Ebner <c.ebner@proxmox.com>]

Extend the sync job config API handler to allow for a retention
timespan to be configured or removed. Check for local sync targets
if the configured retention setting falls within the configured
limits of the datastore.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 src/api2/config/sync.rs | 47 ++++++++++++++++++++++++++++++++++++-----
 1 file changed, 42 insertions(+), 5 deletions(-)

diff --git a/src/api2/config/sync.rs b/src/api2/config/sync.rs
index 7ed624c9f..f08285ad6 100644
--- a/src/api2/config/sync.rs
+++ b/src/api2/config/sync.rs
@@ -7,16 +7,18 @@ use proxmox_router::{Permission, Router, RpcEnvironment, http_bail};
 use proxmox_schema::{api, param_bail};
 
 use pbs_api_types::{
-    Authid, JOB_ID_SCHEMA, PRIV_DATASTORE_APPEND, PRIV_DATASTORE_AUDIT, PRIV_DATASTORE_BACKUP,
-    PRIV_DATASTORE_MODIFY, PRIV_DATASTORE_PRUNE, PRIV_DATASTORE_READ, PRIV_REMOTE_AUDIT,
-    PRIV_REMOTE_DATASTORE_APPEND, PRIV_REMOTE_DATASTORE_BACKUP, PRIV_REMOTE_DATASTORE_PRUNE,
-    PRIV_REMOTE_READ, PROXMOX_CONFIG_DIGEST_SCHEMA, SyncJobConfig, SyncJobConfigUpdater,
+    Authid, JOB_ID_SCHEMA, Operation, PRIV_DATASTORE_APPEND, PRIV_DATASTORE_AUDIT,
+    PRIV_DATASTORE_BACKUP, PRIV_DATASTORE_MODIFY, PRIV_DATASTORE_PRUNE, PRIV_DATASTORE_READ,
+    PRIV_REMOTE_AUDIT, PRIV_REMOTE_DATASTORE_APPEND, PRIV_REMOTE_DATASTORE_BACKUP,
+    PRIV_REMOTE_DATASTORE_PRUNE, PRIV_REMOTE_READ, PROXMOX_CONFIG_DIGEST_SCHEMA, SyncJobConfig,
+    SyncJobConfigUpdater,
 };
 use pbs_config::sync;
 
 use crate::api2::admin::sync::ListSyncDirection;
+use crate::tools::lookup_with;
 use pbs_config::CachedUserInfo;
-use pbs_datastore::check_backup_owner;
+use pbs_datastore::{DataStore, check_backup_owner};
 
 pub fn check_sync_job_read_access(
     user_info: &CachedUserInfo,
@@ -187,6 +189,28 @@ pub fn check_sync_job_modify_access(
     }
 }
 
+// Check if the retention config for the local target datastore is within the set limits.
+// Does not check remote stores.
+fn check_retention_config(job: &SyncJobConfig) -> Result<(), Error> {
+    let Some(timespan) = &job.retention_timespan else {
+        return Ok(());
+    };
+
+    let sync_direction = job.sync_direction.unwrap_or_default();
+    if sync_direction == SyncDirection::Pull || job.remote.is_none() {
+        let target_store = if sync_direction == SyncDirection::Pull {
+            &job.store
+        } else {
+            &job.remote_store
+        };
+        let datastore = DataStore::lookup_datastore(lookup_with(target_store, Operation::Lookup))?;
+        let timestamp = timespan.to_timestamp_from_systemtime()?;
+        datastore.check_max_retention(timestamp)?;
+    }
+
+    Ok(())
+}
+
 #[api(
     input: {
         properties: {
@@ -308,6 +332,8 @@ pub fn create_sync_job(
         }
     }
 
+    check_retention_config(&config)?;
+
     let (mut section_config, _digest) = sync::config()?;
 
     if section_config.sections.contains_key(&config.id) {
@@ -423,6 +449,8 @@ pub enum DeletableProperty {
     ActiveEncryptionKey,
     /// Delete associated key property,
     AssociatedKey,
+    /// Delete retention-timespan property
+    RetentionTimespan,
 }
 
 #[api(
@@ -590,6 +618,9 @@ fn do_update_sync_job_config(
                     // Previous active encryption key might be added as associated below.
                     data.associated_key = None;
                 }
+                DeletableProperty::RetentionTimespan => {
+                    data.retention_timespan = None;
+                }
             }
         }
         keep_previous_key_as_associated(
@@ -747,6 +778,12 @@ fn do_update_sync_job_config(
         }
     }
 
+    if update.retention_timespan.is_some() {
+        data.retention_timespan = update.retention_timespan;
+    }
+
+    check_retention_config(data)?;
+
     if !check_sync_job_modify_access(user_info, auth_id, data) {
         bail!("permission check failed");
     }
-- 
2.47.3