Re: [PATCH datacenter-manager 2/2] server: api: pve firewall: remove 'remote' parameter from overall status

[Dominik Csapak <d.csapak@proxmox.com>]

On 7/13/26 1:09 PM, Lukas Wagner wrote:
> On Wed Jul 8, 2026 at 3:36 PM CEST, Dominik Csapak wrote:
>> this is the api call for the overall status, not a specific remote, so
>> there isn't a 'remote' parameter to limit us to.
>>
>> Simply require audit on '/resource' to indicate we need resource
>> permissions.
> 
> Maybe I'm missing something, but wouldn't it make more sense to filter
> the results based on which resources the user has access to, instead of
> this all-or-nothing approach? So just the usual in-code checks we have
> in place for resources, tasks, etc.?

probably yes, but this has to be done inside the api call

the way it's currently configured it'll fail for any non root@pam user
regardless of permission...

> 
>>
>> This fixes a 403 error on the firewall panel for non root@pam users.
>>
>> Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
>> ---
>>   server/src/api/pve/firewall.rs | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/server/src/api/pve/firewall.rs b/server/src/api/pve/firewall.rs
>> index 5a6a209e..6c18ba10 100644
>> --- a/server/src/api/pve/firewall.rs
>> +++ b/server/src/api/pve/firewall.rs
>> @@ -242,7 +242,7 @@ async fn fetch_node_firewall_status(
>>           items: { type: RemoteFirewallStatus },
>>       },
>>       access: {
>> -        permission: &Permission::Privilege(&["resource", "{remote}"], PRIV_RESOURCE_AUDIT, false),
>> +        permission: &Permission::Privilege(&["resource"], PRIV_RESOURCE_AUDIT, false),
>>       },
>>   )]
>>   /// Get firewall status of all PVE remotes.
>