[PATCH pmg-api v3 1/5] config: add root_only paramter option.

[Stoiko Ivanov <s.ivanov@proxmox.com>]

this introduces a way to have some options in our pmg.conf
SectionConfig restricted to 'root@pam' only.

I skimmed the (quite improved) documentation in PVE::SectionConfig,
and did not see any blockers to extending adding other options instead
of 'optional' and 'fixed' there.

This is needed to have unified way to check if a particular option
should be restricted to 'root@pam' only.

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
---
 src/PMG/API2/Config.pm | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/PMG/API2/Config.pm b/src/PMG/API2/Config.pm
index 9cce95dd..6edde9b4 100644
--- a/src/PMG/API2/Config.pm
+++ b/src/PMG/API2/Config.pm
@@ -10,6 +10,7 @@ use HTTP::Status qw(:constants);
 use Storable qw(dclone);
 use PVE::JSONSchema qw(get_standard_option);
 use PVE::RESTHandler;
+use PVE::Exception qw(raise_perm_exc);
 use Time::HiRes qw();
 
 use PMG::Config;
@@ -194,14 +195,21 @@ my $api_update_config_section = sub {
         die "no options specified\n"
             if !$delete_str && !scalar(keys %$param);
 
+        my $plugin = PMG::Config::Base->lookup($section);
+        my $rpcenv = PMG::RESTEnvironment->get();
+        my $authuser = $rpcenv->get_user();
+
         foreach my $opt (PVE::Tools::split_list($delete_str)) {
+            my $is_root_only = $plugin->options()->{$opt}->{root_only};
+            raise_perm_exc() if ( $is_root_only && $authuser ne 'root@pam') ;
             delete $ids->{$section}->{$opt};
         }
 
-        my $plugin = PMG::Config::Base->lookup($section);
         my $config = $plugin->check_config($section, $param, 0, 1);
 
         foreach my $p (keys %$config) {
+            my $is_root_only = $plugin->options()->{$p}->{root_only};
+            raise_perm_exc() if ( $is_root_only && $authuser ne 'root@pam') ;
             $ids->{$section}->{$p} = $config->{$p};
         }
 
-- 
2.47.3