[PATCH datacenter-manager v3 19/38] server: api: auto-installer: add access token management endpoints

[Christoph Heiss <c.heiss@proxmox.com>]

Quick overview:

GET    /auto-install/tokens
       list all available answer authentication tokens

POST   /auto-install/tokens
       create a new token

PUT    /auto-install/tokens/{id}
       update an existing token

DELETE /auto-install/tokens/{id}
       delete an existing token

Signed-off-by: Christoph Heiss <c.heiss@proxmox.com>
---
Changes v2 -> v3:
  * new patch

 server/src/api/auto_installer/mod.rs | 279 ++++++++++++++++++++++++++-
 1 file changed, 276 insertions(+), 3 deletions(-)

diff --git a/server/src/api/auto_installer/mod.rs b/server/src/api/auto_installer/mod.rs
index 60eccd8..fed88aa 100644
--- a/server/src/api/auto_installer/mod.rs
+++ b/server/src/api/auto_installer/mod.rs
@@ -1,17 +1,18 @@
 //! Implements all the methods under `/api2/json/auto-install/`.
 
-use anyhow::{anyhow, Result};
+use anyhow::{anyhow, Context, Result};
 use handlebars::Handlebars;
 use http::StatusCode;
 use std::collections::{BTreeMap, HashMap};
 
 use pdm_api_types::{
     auto_installer::{
+        AnswerAuthToken, AnswerAuthTokenUpdater, DeletableAnswerAuthTokenProperty,
         DeletablePreparedInstallationConfigProperty, Installation, InstallationStatus,
         PreparedInstallationConfig, PreparedInstallationConfigUpdater, INSTALLATION_UUID_SCHEMA,
         PREPARED_INSTALL_CONFIG_ID_SCHEMA,
     },
-    ConfigDigest, PRIV_SYS_AUDIT, PRIV_SYS_MODIFY, PROXMOX_CONFIG_DIGEST_SCHEMA,
+    Authid, ConfigDigest, PRIV_SYS_AUDIT, PRIV_SYS_MODIFY, PROXMOX_CONFIG_DIGEST_SCHEMA,
 };
 use pdm_config::auto_install::types::PreparedInstallationSectionConfigWrapper;
 use proxmox_installer_types::{
@@ -27,7 +28,9 @@ use proxmox_router::{
     http_bail, list_subdirs_api_method, ApiHandler, ApiMethod, ApiResponseFuture, Permission,
     Router, RpcEnvironment, SubdirMap,
 };
-use proxmox_schema::{api, AllOfSchema, ApiType, ParameterSchema, ReturnType, StringSchema};
+use proxmox_schema::{
+    api, api_types::COMMENT_SCHEMA, AllOfSchema, ApiType, ParameterSchema, ReturnType, StringSchema,
+};
 use proxmox_sortable_macro::sortable;
 use proxmox_uuid::Uuid;
 
@@ -62,6 +65,18 @@ const SUBDIRS: SubdirMap = &sorted!([
                     .delete(&API_METHOD_DELETE_PREPARED_ANSWER)
             )
     ),
+    (
+        "tokens",
+        &Router::new()
+            .get(&API_METHOD_LIST_TOKENS)
+            .post(&API_METHOD_CREATE_TOKEN)
+            .match_all(
+                "id",
+                &Router::new()
+                    .put(&API_METHOD_UPDATE_TOKEN)
+                    .delete(&API_METHOD_DELETE_TOKEN)
+            )
+    ),
 ]);
 
 pub const ROUTER: Router = Router::new()
@@ -698,6 +713,264 @@ async fn handle_post_hook(uuid: Uuid, info: PostHookInfo) -> Result<()> {
     Ok(())
 }
 
+#[api(
+    returns: {
+        description: "List of secrets for authenticating automated installations requests.",
+        type: Array,
+        items: {
+            type: AnswerAuthToken,
+        },
+    },
+    access: {
+        permission: &Permission::Privilege(&["system", "auto-installation"], PRIV_SYS_AUDIT, false),
+    },
+)]
+/// GET /auto-install/tokens
+///
+/// Get all tokens that can be used for authenticating automated installations requests.
+async fn list_tokens(rpcenv: &mut dyn RpcEnvironment) -> Result<Vec<AnswerAuthToken>> {
+    let (secrets, digest) = pdm_config::auto_install::read_tokens()?;
+
+    rpcenv["digest"] = hex::encode(digest).into();
+
+    Ok(secrets.values().map(|t| t.clone().into()).collect())
+}
+
+#[api(
+    input: {
+        properties: {
+            id: {
+                type: String,
+                description: "Token ID.",
+            },
+            comment: {
+                schema: COMMENT_SCHEMA,
+                optional: true,
+            },
+            enabled: {
+                type: bool,
+                description: "Whether the token is enabled.",
+                default: true,
+                optional: true,
+            },
+            "expire-at": {
+                type: Integer,
+                description: "Token expiration date, in seconds since the epoch. '0' means no expiration.",
+                default: 0,
+                minimum: 0,
+                optional: true,
+            },
+        },
+    },
+    returns: {
+        type: Object,
+        description: "Secret of the newly created token.",
+        properties: {
+            token: {
+                type: AnswerAuthToken,
+            },
+            secret: {
+                type: String,
+                description: "Secret of the newly created token.",
+            },
+        },
+    },
+    access: {
+        permission: &Permission::Privilege(&["system", "auto-installation"], PRIV_SYS_MODIFY, false),
+    },
+    protected: true,
+)]
+/// POST /auto-install/tokens
+///
+/// Creates a new token for authenticating automated installations.
+async fn create_token(
+    id: String,
+    comment: Option<String>,
+    enabled: Option<bool>,
+    expire_at: Option<i64>,
+    rpcenv: &mut dyn RpcEnvironment,
+) -> Result<serde_json::Value> {
+    let _lock = pdm_config::auto_install::token_write_lock();
+
+    let authid = rpcenv
+        .get_auth_id()
+        .ok_or_else(|| anyhow!("no authid"))?
+        .parse::<Authid>()?;
+
+    let token = AnswerAuthToken {
+        id,
+        created_by: authid.user().clone(),
+        comment,
+        enabled,
+        expire_at,
+    };
+    let secret = Uuid::generate();
+
+    pdm_config::auto_install::add_token(&token, &secret.to_string())
+        .context("failed to create new token")?;
+
+    Ok(serde_json::json!({
+        "token": token,
+        "secret": secret,
+    }))
+}
+
+#[api(
+    input: {
+        properties: {
+            id: {
+                type: String,
+                description: "Token ID.",
+            },
+            update: {
+                type: AnswerAuthTokenUpdater,
+                flatten: true,
+            },
+            delete: {
+                type: Array,
+                description: "List of properties to delete.",
+                optional: true,
+                items: {
+                    type: DeletableAnswerAuthTokenProperty,
+                }
+            },
+            "regenerate-secret": {
+                type: bool,
+                description: "Whether to regenerate the current secret, invalidating the old one.",
+                optional: true,
+                default: false,
+            },
+            digest: {
+                type: ConfigDigest,
+                optional: true,
+            },
+        },
+    },
+    returns: {
+        type: Object,
+        description: "The updated access token information.",
+        properties: {
+            token: {
+                type: AnswerAuthToken,
+            },
+        },
+    },
+    access: {
+        permission: &Permission::Privilege(&["system", "auto-installation"], PRIV_SYS_MODIFY, false),
+    },
+    protected: true,
+)]
+/// PUT /auto-install/tokens/{id}
+///
+/// Updates an existing access token.
+async fn update_token(
+    id: String,
+    update: AnswerAuthTokenUpdater,
+    delete: Option<Vec<DeletableAnswerAuthTokenProperty>>,
+    regenerate_secret: bool,
+    digest: Option<ConfigDigest>,
+) -> Result<serde_json::Value> {
+    let _lock = pdm_config::auto_install::token_write_lock();
+    let (tokens, config_digest) = pdm_config::auto_install::read_tokens()?;
+
+    config_digest.detect_modification(digest.as_ref())?;
+
+    let mut token: AnswerAuthToken = match tokens.get(&id.to_string()).cloned() {
+        Some(token) => token.into(),
+        None => http_bail!(NOT_FOUND, "no such access token: {id}"),
+    };
+
+    if let Some(delete) = delete {
+        for prop in delete {
+            match prop {
+                DeletableAnswerAuthTokenProperty::Comment => token.comment = None,
+                DeletableAnswerAuthTokenProperty::ExpireAt => token.expire_at = None,
+            }
+        }
+    }
+
+    let AnswerAuthTokenUpdater {
+        comment,
+        enabled,
+        expire_at,
+    } = update;
+
+    if let Some(comment) = comment {
+        token.comment = Some(comment);
+    }
+
+    if let Some(enabled) = enabled {
+        token.enabled = Some(enabled);
+    }
+
+    if let Some(expire_at) = expire_at {
+        token.expire_at = Some(expire_at);
+    }
+
+    if regenerate_secret {
+        // If the user instructed to update secret, just delete + re-create the token and let
+        // the config implementation handle updating the shadow
+        pdm_config::auto_install::delete_token(&token.id)?;
+
+        let secret = Uuid::generate();
+        pdm_config::auto_install::add_token(&token, &secret.to_string())?;
+
+        Ok(serde_json::json!({
+            "token": token,
+            "secret": secret,
+        }))
+    } else {
+        pdm_config::auto_install::update_token(&token).context("failed to update token")?;
+
+        Ok(serde_json::json!({
+            "token": token,
+        }))
+    }
+}
+
+#[api(
+    input: {
+        properties: {
+            id: {
+                type: String,
+                description: "Token ID.",
+            },
+        },
+    },
+    access: {
+        permission: &Permission::Privilege(&["system", "auto-installation"], PRIV_SYS_MODIFY, false),
+    },
+    protected: true,
+)]
+/// DELETE /auto-install/tokens/{id}
+///
+/// Deletes a prepared auto-installer answer configuration.
+///
+/// If the token is currently in use by any prepared answer configuration, the deletion will fail.
+async fn delete_token(id: String) -> Result<()> {
+    // first check if the token is used anywhere
+    let (prepared, _) = pdm_config::auto_install::read_prepared_answers()?;
+
+    let used = prepared
+        .values()
+        .filter_map(|p| {
+            let PreparedInstallationSectionConfigWrapper::PreparedConfig(p) = p;
+            p.authorized_tokens.contains(&id).then(|| p.id.clone())
+        })
+        .collect::<Vec<String>>();
+
+    if !used.is_empty() {
+        http_bail!(
+            CONFLICT,
+            "token still in use by answer configurations: {}",
+            used.join(", ")
+        );
+    }
+
+    let _lock = pdm_config::auto_install::token_write_lock();
+    pdm_config::auto_install::delete_token(&id)
+}
+
 /// Tries to find a prepared answer configuration matching the given target node system
 /// information.
 ///
-- 
2.53.0