[pdm-devel] [PATCH datacenter-manager] api: fail with HTTP 403 Forbidden if user does have access to resource

* [pdm-devel] [PATCH datacenter-manager] api: fail with HTTP 403 Forbidden if user does have access to resource
@ 2025-11-05  8:12 Lukas Wagner
  2025-11-05  8:54 ` Thomas Lamprecht
  0 siblings, 1 reply; 2+ messages in thread
From: Lukas Wagner @ 2025-11-05  8:12 UTC (permalink / raw)
  To: pdm-devel

As discussed in another patch series [1], if a user does not have
enough permissions to see a resource, we should fail with 403 Forbidden
instead of 401 Unauthorized. The UI relies on returning the correct
error codes, since a 401 will redirect the user to the login mask.

[1] https://lore.proxmox.com/pdm-devel/DDJLG0Y8J5CP.1NMNIMD5ZEYZE@proxmox.com/

Signed-off-by: Lukas Wagner <l.wagner@proxmox.com>
---

Notes:
    There are a few instances where we return 401 in auth/tfa related code
    which I didn't touch - not sure if any of these should also be replaced.

 server/src/api/pve/lxc.rs   | 2 +-
 server/src/api/pve/mod.rs   | 4 ++--
 server/src/api/pve/qemu.rs  | 2 +-
 server/src/api/resources.rs | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/server/src/api/pve/lxc.rs b/server/src/api/pve/lxc.rs
index 61db8ff2..1b05a302 100644
--- a/server/src/api/pve/lxc.rs
+++ b/server/src/api/pve/lxc.rs
@@ -379,7 +379,7 @@ pub async fn lxc_remote_migrate(
     );
     if target_privs & PRIV_RESOURCE_MIGRATE == 0 {
         http_bail!(
-            UNAUTHORIZED,
+            FORBIDDEN,
             "missing PRIV_RESOURCE_MIGRATE on target remote+vmid"
         );
     }
diff --git a/server/src/api/pve/mod.rs b/server/src/api/pve/mod.rs
index fd4ea542..2b50afb8 100644
--- a/server/src/api/pve/mod.rs
+++ b/server/src/api/pve/mod.rs
@@ -197,7 +197,7 @@ pub async fn cluster_resources(
         .ok_or_else(|| format_err!("no authid available"))?
         .parse()?;
     if !user_info.any_privs_below(&auth_id, &["resource", &remote], PRIV_RESOURCE_AUDIT)? {
-        http_bail!(UNAUTHORIZED, "user has no access to resource list");
+        http_bail!(FORBIDDEN, "user has no access to resource list");
     }
 
     let cluster_resources = connect_to_remote(&remotes, &remote)?
@@ -268,7 +268,7 @@ fn check_guest_list_permissions(
     let user_info = CachedUserInfo::new()?;
 
     if !user_info.any_privs_below(&auth_id, &["resource", remote], PRIV_RESOURCE_AUDIT)? {
-        http_bail!(UNAUTHORIZED, "user has no access to resource list");
+        http_bail!(FORBIDDEN, "user has no access to resource list");
     }
 
     let top_level_allowed =
diff --git a/server/src/api/pve/qemu.rs b/server/src/api/pve/qemu.rs
index 6158bef2..05fa92c1 100644
--- a/server/src/api/pve/qemu.rs
+++ b/server/src/api/pve/qemu.rs
@@ -427,7 +427,7 @@ pub async fn qemu_remote_migrate(
     );
     if target_privs & PRIV_RESOURCE_MIGRATE == 0 {
         http_bail!(
-            UNAUTHORIZED,
+            FORBIDDEN,
             "missing PRIV_RESOURCE_MIGRATE on target remote+vmid"
         );
     }
diff --git a/server/src/api/resources.rs b/server/src/api/resources.rs
index e7d43987..dad3e6b6 100644
--- a/server/src/api/resources.rs
+++ b/server/src/api/resources.rs
@@ -286,7 +286,7 @@ pub(crate) async fn get_resources_impl(
             .ok_or_else(|| format_err!("no authid available"))?
             .parse()?;
         if !user_info.any_privs_below(&auth_id, &["resource"], PRIV_RESOURCE_AUDIT)? {
-            http_bail!(UNAUTHORIZED, "user has no access to resources");
+            http_bail!(FORBIDDEN, "user has no access to resources");
         }
         opt_auth_id = Some(auth_id);
     }
-- 
2.47.3



_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel


^ permalink raw reply	[flat|nested] 2+ messages in thread