Re: [PATCH datacenter-manager 2/2] server: api: pve firewall: remove 'remote' parameter from overall status

["Lukas Wagner" <l.wagner@proxmox.com>]

On Wed Jul 8, 2026 at 3:36 PM CEST, Dominik Csapak wrote:
> this is the api call for the overall status, not a specific remote, so
> there isn't a 'remote' parameter to limit us to.
>
> Simply require audit on '/resource' to indicate we need resource
> permissions.

Maybe I'm missing something, but wouldn't it make more sense to filter
the results based on which resources the user has access to, instead of
this all-or-nothing approach? So just the usual in-code checks we have
in place for resources, tasks, etc.?

>
> This fixes a 403 error on the firewall panel for non root@pam users.
>
> Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
> ---
>  server/src/api/pve/firewall.rs | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/server/src/api/pve/firewall.rs b/server/src/api/pve/firewall.rs
> index 5a6a209e..6c18ba10 100644
> --- a/server/src/api/pve/firewall.rs
> +++ b/server/src/api/pve/firewall.rs
> @@ -242,7 +242,7 @@ async fn fetch_node_firewall_status(
>          items: { type: RemoteFirewallStatus },
>      },
>      access: {
> -        permission: &Permission::Privilege(&["resource", "{remote}"], PRIV_RESOURCE_AUDIT, false),
> +        permission: &Permission::Privilege(&["resource"], PRIV_RESOURCE_AUDIT, false),
>      },
>  )]
>  /// Get firewall status of all PVE remotes.