* [pdm-devel] [PATCH datacenter-manager] api: fail with HTTP 403 Forbidden if user does have access to resource
@ 2025-11-05 8:12 Lukas Wagner
2025-11-05 8:54 ` Thomas Lamprecht
0 siblings, 1 reply; 2+ messages in thread
From: Lukas Wagner @ 2025-11-05 8:12 UTC (permalink / raw)
To: pdm-devel
As discussed in another patch series [1], if a user does not have
enough permissions to see a resource, we should fail with 403 Forbidden
instead of 401 Unauthorized. The UI relies on returning the correct
error codes, since a 401 will redirect the user to the login mask.
[1] https://lore.proxmox.com/pdm-devel/DDJLG0Y8J5CP.1NMNIMD5ZEYZE@proxmox.com/
Signed-off-by: Lukas Wagner <l.wagner@proxmox.com>
---
Notes:
There are a few instances where we return 401 in auth/tfa related code
which I didn't touch - not sure if any of these should also be replaced.
server/src/api/pve/lxc.rs | 2 +-
server/src/api/pve/mod.rs | 4 ++--
server/src/api/pve/qemu.rs | 2 +-
server/src/api/resources.rs | 2 +-
4 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/server/src/api/pve/lxc.rs b/server/src/api/pve/lxc.rs
index 61db8ff2..1b05a302 100644
--- a/server/src/api/pve/lxc.rs
+++ b/server/src/api/pve/lxc.rs
@@ -379,7 +379,7 @@ pub async fn lxc_remote_migrate(
);
if target_privs & PRIV_RESOURCE_MIGRATE == 0 {
http_bail!(
- UNAUTHORIZED,
+ FORBIDDEN,
"missing PRIV_RESOURCE_MIGRATE on target remote+vmid"
);
}
diff --git a/server/src/api/pve/mod.rs b/server/src/api/pve/mod.rs
index fd4ea542..2b50afb8 100644
--- a/server/src/api/pve/mod.rs
+++ b/server/src/api/pve/mod.rs
@@ -197,7 +197,7 @@ pub async fn cluster_resources(
.ok_or_else(|| format_err!("no authid available"))?
.parse()?;
if !user_info.any_privs_below(&auth_id, &["resource", &remote], PRIV_RESOURCE_AUDIT)? {
- http_bail!(UNAUTHORIZED, "user has no access to resource list");
+ http_bail!(FORBIDDEN, "user has no access to resource list");
}
let cluster_resources = connect_to_remote(&remotes, &remote)?
@@ -268,7 +268,7 @@ fn check_guest_list_permissions(
let user_info = CachedUserInfo::new()?;
if !user_info.any_privs_below(&auth_id, &["resource", remote], PRIV_RESOURCE_AUDIT)? {
- http_bail!(UNAUTHORIZED, "user has no access to resource list");
+ http_bail!(FORBIDDEN, "user has no access to resource list");
}
let top_level_allowed =
diff --git a/server/src/api/pve/qemu.rs b/server/src/api/pve/qemu.rs
index 6158bef2..05fa92c1 100644
--- a/server/src/api/pve/qemu.rs
+++ b/server/src/api/pve/qemu.rs
@@ -427,7 +427,7 @@ pub async fn qemu_remote_migrate(
);
if target_privs & PRIV_RESOURCE_MIGRATE == 0 {
http_bail!(
- UNAUTHORIZED,
+ FORBIDDEN,
"missing PRIV_RESOURCE_MIGRATE on target remote+vmid"
);
}
diff --git a/server/src/api/resources.rs b/server/src/api/resources.rs
index e7d43987..dad3e6b6 100644
--- a/server/src/api/resources.rs
+++ b/server/src/api/resources.rs
@@ -286,7 +286,7 @@ pub(crate) async fn get_resources_impl(
.ok_or_else(|| format_err!("no authid available"))?
.parse()?;
if !user_info.any_privs_below(&auth_id, &["resource"], PRIV_RESOURCE_AUDIT)? {
- http_bail!(UNAUTHORIZED, "user has no access to resources");
+ http_bail!(FORBIDDEN, "user has no access to resources");
}
opt_auth_id = Some(auth_id);
}
--
2.47.3
_______________________________________________
pdm-devel mailing list
pdm-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pdm-devel
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-11-05 8:54 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-11-05 8:12 [pdm-devel] [PATCH datacenter-manager] api: fail with HTTP 403 Forbidden if user does have access to resource Lukas Wagner
2025-11-05 8:54 ` Thomas Lamprecht
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox