[pmg-devel] [PATCH pmg-api] fix permissions for APT

[pmg-devel] [PATCH pmg-api] fix permissions for APT

[Oguz Bektas]

it wrongly uses the permission model from PVE, fix those to allow
PMG users with administrator role to add/delete repositories, and
auditor role to view the repositories.

reported in forum [0]

[0]:
https://forum.proxmox.com/threads/no-apt-repo-information-for-non-root-on-the-web-gui.95217/

Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>
---
 src/PMG/API2/APT.pm | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/src/PMG/API2/APT.pm b/src/PMG/API2/APT.pm
index 5e132c4..18bb992 100644
--- a/src/PMG/API2/APT.pm
+++ b/src/PMG/API2/APT.pm
@@ -477,9 +477,7 @@ __PACKAGE__->register_method({
     method => 'GET',
     proxyto => 'node',
     description => "Get APT repository information.",
-    permissions => {
-	check => ['perm', '/nodes/{node}', [ 'Sys.Audit' ]],
-    },
+    permissions => { check => [ 'admin', 'audit' ] },
     parameters => {
 	additionalProperties => 0,
 	properties => {
@@ -678,9 +676,7 @@ __PACKAGE__->register_method({
     path => 'repositories',
     method => 'PUT',
     description => "Add a standard repository to the configuration",
-    permissions => {
-	check => ['perm', '/nodes/{node}', [ 'Sys.Modify' ]],
-    },
+    permissions => { check => [ 'admin' ] },
     protected => 1,
     proxyto => 'node',
     parameters => {
@@ -713,9 +709,7 @@ __PACKAGE__->register_method({
     path => 'repositories',
     method => 'POST',
     description => "Change the properties of a repository. Currently only allows enabling/disabling.",
-    permissions => {
-	check => ['perm', '/nodes/{node}', [ 'Sys.Modify' ]],
-    },
+    permissions => { check => [ 'admin' ] },
     protected => 1,
     proxyto => 'node',
     parameters => {
-- 
2.30.2

Re: [pmg-devel] [PATCH pmg-api] fix permissions for APT

[Thomas Lamprecht]

Looks good in general, just having some comments regarding the commit meta info.
The commit subject could also mean that we had the wrong file permissions
on the apt executable or the like, it'd be nice if we can be more specific to
and clear.

"api: apt: use actual pmg-style permission for endpoint schema"

Am 8/30/21 um 12:02 PM schrieb Oguz Bektas:
> it wrongly uses the permission model from PVE,

I'd note that they where root only due to that:

"... PVE, which is not recognized by the PMG aPI stack, meaning those
endpoints where all root only." 

With that (or similar in semantics) added information:

Reviewed-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

 fix those to allow
> PMG users with administrator role to add/delete repositories, and
> auditor role to view the repositories.
> 
> reported in forum [0]
> 
> [0]:
> https://forum.proxmox.com/threads/no-apt-repo-information-for-non-root-on-the-web-gui.95217/
> 
> Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>
> ---
>  src/PMG/API2/APT.pm | 12 +++---------
>  1 file changed, 3 insertions(+), 9 deletions(-)
> 
> diff --git a/src/PMG/API2/APT.pm b/src/PMG/API2/APT.pm
> index 5e132c4..18bb992 100644
> --- a/src/PMG/API2/APT.pm
> +++ b/src/PMG/API2/APT.pm
> @@ -477,9 +477,7 @@ __PACKAGE__->register_method({
>      method => 'GET',
>      proxyto => 'node',
>      description => "Get APT repository information.",
> -    permissions => {
> -	check => ['perm', '/nodes/{node}', [ 'Sys.Audit' ]],
> -    },
> +    permissions => { check => [ 'admin', 'audit' ] },
>      parameters => {
>  	additionalProperties => 0,
>  	properties => {
> @@ -678,9 +676,7 @@ __PACKAGE__->register_method({
>      path => 'repositories',
>      method => 'PUT',
>      description => "Add a standard repository to the configuration",
> -    permissions => {
> -	check => ['perm', '/nodes/{node}', [ 'Sys.Modify' ]],
> -    },
> +    permissions => { check => [ 'admin' ] },
>      protected => 1,
>      proxyto => 'node',
>      parameters => {
> @@ -713,9 +709,7 @@ __PACKAGE__->register_method({
>      path => 'repositories',
>      method => 'POST',
>      description => "Change the properties of a repository. Currently only allows enabling/disabling.",
> -    permissions => {
> -	check => ['perm', '/nodes/{node}', [ 'Sys.Modify' ]],
> -    },
> +    permissions => { check => [ 'admin' ] },
>      protected => 1,
>      proxyto => 'node',
>      parameters => {
>