Re: [PATCH pmg-api v2 1/5] config: add root_only paramter option.

["Max R. Carrara" <m.carrara@proxmox.com>]

On Tue Jun 9, 2026 at 10:04 PM CEST, Stoiko Ivanov wrote:
> this introduces a way to have some options in our pmg.conf
> SectionConfig restricted to 'root@pam' only.
>
> I skimmed the (quite improved) documentation in PVE::SectionConfig,

😇

> and did not see any blockers to extending adding other options instead
> of 'optional' and 'fixed' there.

Yeah, this should be fine, especially for such relatively small things.

The SectionConfig code doesn't really care about any other keys, i.e. it
leaves them untouched.

Also, I want to mention that it's good that it's in `options()` anyway,
because even though adding an equivalent key to the property itself in
`properties()` would've also worked, it would've nevertheless been more
tricky to handle. (We have a separate getter method for acquiring a
property's schema that you'd have to call.)

>
> This is needed to have unified way to check if a particular option
> shoudld be restricted to 'root@pam' only.

s/shoudld/should

>
> Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
> ---
>  src/PMG/API2/Config.pm | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/src/PMG/API2/Config.pm b/src/PMG/API2/Config.pm
> index 9cce95dd..6edde9b4 100644
> --- a/src/PMG/API2/Config.pm
> +++ b/src/PMG/API2/Config.pm
> @@ -10,6 +10,7 @@ use HTTP::Status qw(:constants);
>  use Storable qw(dclone);
>  use PVE::JSONSchema qw(get_standard_option);
>  use PVE::RESTHandler;
> +use PVE::Exception qw(raise_perm_exc);
>  use Time::HiRes qw();
>
>  use PMG::Config;
> @@ -194,14 +195,21 @@ my $api_update_config_section = sub {
>          die "no options specified\n"
>              if !$delete_str && !scalar(keys %$param);
>
> +        my $plugin = PMG::Config::Base->lookup($section);
> +        my $rpcenv = PMG::RESTEnvironment->get();
> +        my $authuser = $rpcenv->get_user();
> +
>          foreach my $opt (PVE::Tools::split_list($delete_str)) {
> +            my $is_root_only = $plugin->options()->{$opt}->{root_only};

I would maaaybe rename the key from root_only to 'root-only' (quotes
included), since that's the newer convention we're using.
(Note that this isn't mentioned in our Perl style guide (yet?) FWICT, so
it's your call whether you want to rename it or not, tbh.)

> +            raise_perm_exc() if ( $is_root_only && $authuser ne 'root@pam') ;
>              delete $ids->{$section}->{$opt};
>          }
>
> -        my $plugin = PMG::Config::Base->lookup($section);
>          my $config = $plugin->check_config($section, $param, 0, 1);
>
>          foreach my $p (keys %$config) {
> +            my $is_root_only = $plugin->options()->{$p}->{root_only};

Here as well, if you do decide to change it.

> +            raise_perm_exc() if ( $is_root_only && $authuser ne 'root@pam') ;
>              $ids->{$section}->{$p} = $config->{$p};
>          }
>