From: Lukas Wagner <l.wagner@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [PATCH v2 pve-manager 35/52] api: notification: simplify ACLs for notification
Date: Tue, 14 Nov 2023 13:59:43 +0100 [thread overview]
Message-ID: <20231114130000.565122-36-l.wagner@proxmox.com> (raw)
In-Reply-To: <20231114130000.565122-1-l.wagner@proxmox.com>
Use coarse-grained /mapping/notifications for now. We
can always extend later if we need to.
Signed-off-by: Lukas Wagner <l.wagner@proxmox.com>
---
PVE/API2/Cluster/Notifications.pm | 131 ++++++++++++------------------
1 file changed, 54 insertions(+), 77 deletions(-)
diff --git a/PVE/API2/Cluster/Notifications.pm b/PVE/API2/Cluster/Notifications.pm
index 27e3a66d..7047f0b1 100644
--- a/PVE/API2/Cluster/Notifications.pm
+++ b/PVE/API2/Cluster/Notifications.pm
@@ -56,24 +56,6 @@ sub raise_api_error {
die $exc;
}
-sub filter_entities_by_privs {
- my ($rpcenv, $entities) = @_;
- my $authuser = $rpcenv->get_user();
-
- my $can_see_mapping_privs = ['Mapping.Modify', 'Mapping.Use', 'Mapping.Audit'];
-
- my $filtered = [grep {
- $rpcenv->check_any(
- $authuser,
- "/mapping/notification/$_->{name}",
- $can_see_mapping_privs,
- 1
- );
- } @$entities];
-
- return $filtered;
-}
-
__PACKAGE__->register_method ({
name => 'index',
path => '',
@@ -137,10 +119,11 @@ __PACKAGE__->register_method ({
method => 'GET',
description => 'Returns a list of all entities that can be used as notification targets.',
permissions => {
- description => "Only lists entries where you have 'Mapping.Modify', 'Mapping.Use' or"
- . " 'Mapping.Audit' permissions on '/mapping/notification/<name>'."
- . " The special 'mail-to-root' target is available to all users.",
- user => 'all',
+ check => ['or',
+ ['perm', '/mapping/notifications', ['Mapping.Modify']],
+ ['perm', '/mapping/notifications', ['Mapping.Audit']],
+ ['perm', '/mapping/notifications', ['Mapping.Use']],
+ ],
},
protected => 1,
parameters => {
@@ -184,7 +167,6 @@ __PACKAGE__->register_method ({
},
code => sub {
my $config = PVE::Notify::read_config();
- my $rpcenv = PVE::RPCEnvironment::get();
my $targets = eval {
my $result = [];
@@ -224,7 +206,7 @@ __PACKAGE__->register_method ({
raise_api_error($@) if $@;
- return filter_entities_by_privs($rpcenv, $targets);
+ return $targets;
}
});
@@ -235,10 +217,11 @@ __PACKAGE__->register_method ({
method => 'POST',
description => 'Send a test notification to a provided target.',
permissions => {
- description => "The user requires 'Mapping.Modify', 'Mapping.Use' or"
- . " 'Mapping.Audit' permissions on '/mapping/notification/<name>'."
- . " The special 'mail-to-root' target can be accessed by all users.",
- user => 'all',
+ check => ['or',
+ ['perm', '/mapping/notifications', ['Mapping.Modify']],
+ ['perm', '/mapping/notifications', ['Mapping.Audit']],
+ ['perm', '/mapping/notifications', ['Mapping.Use']],
+ ],
},
parameters => {
additionalProperties => 0,
@@ -254,16 +237,6 @@ __PACKAGE__->register_method ({
code => sub {
my ($param) = @_;
my $name = extract_param($param, 'name');
- my $rpcenv = PVE::RPCEnvironment::get();
- my $authuser = $rpcenv->get_user();
-
- my $privs = ['Mapping.Modify', 'Mapping.Use', 'Mapping.Audit'];
-
- $rpcenv->check_any(
- $authuser,
- "/mapping/notification/$name",
- $privs,
- );
eval {
my $config = PVE::Notify::read_config();
@@ -329,9 +302,10 @@ __PACKAGE__->register_method ({
method => 'GET',
description => 'Returns a list of all sendmail endpoints',
permissions => {
- description => "Only lists entries where you have 'Mapping.Modify', 'Mapping.Use' or"
- . " 'Mapping.Audit' permissions on '/mapping/notification/<name>'.",
- user => 'all',
+ check => ['or',
+ ['perm', '/mapping/notifications', ['Mapping.Modify']],
+ ['perm', '/mapping/notifications', ['Mapping.Audit']],
+ ],
},
protected => 1,
parameters => {
@@ -355,14 +329,13 @@ __PACKAGE__->register_method ({
},
code => sub {
my $config = PVE::Notify::read_config();
- my $rpcenv = PVE::RPCEnvironment::get();
my $entities = eval {
$config->get_sendmail_endpoints();
};
raise_api_error($@) if $@;
- return filter_entities_by_privs($rpcenv, $entities);
+ return $entities;
}
});
@@ -373,8 +346,8 @@ __PACKAGE__->register_method ({
description => 'Return a specific sendmail endpoint',
permissions => {
check => ['or',
- ['perm', '/mapping/notification/{name}', ['Mapping.Modify']],
- ['perm', '/mapping/notification/{name}', ['Mapping.Audit']],
+ ['perm', '/mapping/notifications', ['Mapping.Modify']],
+ ['perm', '/mapping/notifications', ['Mapping.Audit']],
],
},
protected => 1,
@@ -418,7 +391,7 @@ __PACKAGE__->register_method ({
method => 'POST',
description => 'Create a new sendmail endpoint',
permissions => {
- check => ['perm', '/mapping/notification', ['Mapping.Modify']],
+ check => ['perm', '/mapping/notifications', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
@@ -466,7 +439,7 @@ __PACKAGE__->register_method ({
method => 'PUT',
description => 'Update existing sendmail endpoint',
permissions => {
- check => ['perm', '/mapping/notification/{name}', ['Mapping.Modify']],
+ check => ['perm', '/mapping/notifications', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
@@ -532,7 +505,7 @@ __PACKAGE__->register_method ({
method => 'DELETE',
description => 'Remove sendmail endpoint',
permissions => {
- check => ['perm', '/mapping/notification', ['Mapping.Modify']],
+ check => ['perm', '/mapping/notifications', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
@@ -595,9 +568,8 @@ __PACKAGE__->register_method ({
description => 'Returns a list of all gotify endpoints',
protected => 1,
permissions => {
- description => "Only lists entries where you have 'Mapping.Modify', 'Mapping.Use' or"
- . " 'Mapping.Audit' permissions on '/mapping/notification/<name>'.",
- user => 'all',
+ check => ['perm', '/mapping/notifications', ['Mapping.Modify']],
+ check => ['perm', '/mapping/notifications', ['Mapping.Audit']],
},
parameters => {
additionalProperties => 0,
@@ -627,7 +599,7 @@ __PACKAGE__->register_method ({
};
raise_api_error($@) if $@;
- return filter_entities_by_privs($rpcenv, $entities);
+ return $entities;
}
});
@@ -639,8 +611,8 @@ __PACKAGE__->register_method ({
protected => 1,
permissions => {
check => ['or',
- ['perm', '/mapping/notification/{name}', ['Mapping.Modify']],
- ['perm', '/mapping/notification/{name}', ['Mapping.Audit']],
+ ['perm', '/mapping/notifications', ['Mapping.Modify']],
+ ['perm', '/mapping/notifications', ['Mapping.Audit']],
],
},
parameters => {
@@ -683,7 +655,7 @@ __PACKAGE__->register_method ({
method => 'POST',
description => 'Create a new gotify endpoint',
permissions => {
- check => ['perm', '/mapping/notification', ['Mapping.Modify']],
+ check => ['perm', '/mapping/notifications', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
@@ -727,7 +699,7 @@ __PACKAGE__->register_method ({
method => 'PUT',
description => 'Update existing gotify endpoint',
permissions => {
- check => ['perm', '/mapping/notification/{name}', ['Mapping.Modify']],
+ check => ['perm', '/mapping/notifications', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
@@ -788,7 +760,7 @@ __PACKAGE__->register_method ({
method => 'DELETE',
description => 'Remove gotify endpoint',
permissions => {
- check => ['perm', '/mapping/notification/{name}', ['Mapping.Modify']],
+ check => ['perm', '/mapping/notifications', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
@@ -897,9 +869,10 @@ __PACKAGE__->register_method ({
method => 'GET',
description => 'Returns a list of all smtp endpoints',
permissions => {
- description => "Only lists entries where you have 'Mapping.Modify', 'Mapping.Use' or"
- . " 'Mapping.Audit' permissions on '/mapping/notification/targets/<name>'.",
- user => 'all',
+ check => ['or',
+ ['perm', '/mapping/notifications', ['Mapping.Modify']],
+ ['perm', '/mapping/notifications', ['Mapping.Audit']],
+ ],
},
protected => 1,
parameters => {
@@ -923,14 +896,13 @@ __PACKAGE__->register_method ({
},
code => sub {
my $config = PVE::Notify::read_config();
- my $rpcenv = PVE::RPCEnvironment::get();
my $entities = eval {
$config->get_smtp_endpoints();
};
raise_api_error($@) if $@;
- return filter_entities_by_privs($rpcenv, "targets", $entities);
+ return $entities;
}
});
@@ -941,8 +913,8 @@ __PACKAGE__->register_method ({
description => 'Return a specific smtp endpoint',
permissions => {
check => ['or',
- ['perm', '/mapping/notification/targets/{name}', ['Mapping.Modify']],
- ['perm', '/mapping/notification/targets/{name}', ['Mapping.Audit']],
+ ['perm', '/mapping/notifications', ['Mapping.Modify']],
+ ['perm', '/mapping/notifications', ['Mapping.Audit']],
],
},
protected => 1,
@@ -986,7 +958,9 @@ __PACKAGE__->register_method ({
method => 'POST',
description => 'Create a new smtp endpoint',
permissions => {
- check => ['perm', '/mapping/notification/targets', ['Mapping.Modify']],
+ check => ['or',
+ ['perm', '/mapping/notifications', ['Mapping.Modify']],
+ ],
},
parameters => {
additionalProperties => 0,
@@ -1044,7 +1018,9 @@ __PACKAGE__->register_method ({
method => 'PUT',
description => 'Update existing smtp endpoint',
permissions => {
- check => ['perm', '/mapping/notification/targets/{name}', ['Mapping.Modify']],
+ check => ['or',
+ ['perm', '/mapping/notifications', ['Mapping.Modify']],
+ ],
},
parameters => {
additionalProperties => 0,
@@ -1120,7 +1096,7 @@ __PACKAGE__->register_method ({
method => 'DELETE',
description => 'Remove smtp endpoint',
permissions => {
- check => ['perm', '/mapping/notification/targets/{name}', ['Mapping.Modify']],
+ check => ['perm', '/mapping/notifications', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
@@ -1221,9 +1197,11 @@ __PACKAGE__->register_method ({
description => 'Returns a list of all matchers',
protected => 1,
permissions => {
- description => "Only lists entries where you have 'Mapping.Modify', 'Mapping.Use' or"
- . " 'Mapping.Audit' permissions on '/mapping/notification/<name>'.",
- user => 'all',
+ check => ['or',
+ ['perm', '/mapping/notifications', ['Mapping.Modify']],
+ ['perm', '/mapping/notifications', ['Mapping.Audit']],
+ ['perm', '/mapping/notifications', ['Mapping.Use']],
+ ],
},
parameters => {
additionalProperties => 0,
@@ -1246,14 +1224,13 @@ __PACKAGE__->register_method ({
},
code => sub {
my $config = PVE::Notify::read_config();
- my $rpcenv = PVE::RPCEnvironment::get();
my $entities = eval {
$config->get_matchers();
};
raise_api_error($@) if $@;
- return filter_entities_by_privs($rpcenv, $entities);
+ return $entities;
}
});
@@ -1265,8 +1242,8 @@ __PACKAGE__->register_method ({
protected => 1,
permissions => {
check => ['or',
- ['perm', '/mapping/notification/{name}', ['Mapping.Modify']],
- ['perm', '/mapping/notification/{name}', ['Mapping.Audit']],
+ ['perm', '/mapping/notifications', ['Mapping.Modify']],
+ ['perm', '/mapping/notifications', ['Mapping.Audit']],
],
},
parameters => {
@@ -1310,7 +1287,7 @@ __PACKAGE__->register_method ({
description => 'Create a new matcher',
protected => 1,
permissions => {
- check => ['perm', '/mapping/notification', ['Mapping.Modify']],
+ check => ['perm', '/mapping/notifications', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
@@ -1362,7 +1339,7 @@ __PACKAGE__->register_method ({
method => 'PUT',
description => 'Update existing matcher',
permissions => {
- check => ['perm', '/mapping/notification/{name}', ['Mapping.Modify']],
+ check => ['perm', '/mapping/notifications', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
@@ -1430,7 +1407,7 @@ __PACKAGE__->register_method ({
method => 'DELETE',
description => 'Remove matcher',
permissions => {
- check => ['perm', '/mapping/notification/{name}', ['Mapping.Modify']],
+ check => ['perm', '/mapping/notifications', ['Mapping.Modify']],
},
parameters => {
additionalProperties => 0,
--
2.39.2
next prev parent reply other threads:[~2023-11-14 13:01 UTC|newest]
Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-14 12:59 [pve-devel] [PATCH v2 many 00/52] revamp notifications; smtp endpoints; system mail Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 debcargo-conf 01/52] cherry-pick chumsky 0.9.2 from debian unstable Lukas Wagner
2023-11-14 16:15 ` [pve-devel] applied: " Thomas Lamprecht
2023-11-14 12:59 ` [pve-devel] [PATCH v2 debcargo-conf 02/52] update lettre to 0.11.1 Lukas Wagner
2023-11-14 16:15 ` [pve-devel] applied: " Thomas Lamprecht
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox 03/52] notify: introduce Error::Generic Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox 04/52] notify: factor out notification content into its own type Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox 05/52] notify: replace filters and groups with matcher-based system Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox 06/52] notify: add calendar matcher Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox 07/52] notify: matcher: introduce common trait for match directives Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox 08/52] notify: let a matcher always match if it has no matching directives Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox 09/52] sys: email: add `forward` Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox 10/52] notify: add mechanisms for email message forwarding Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox 11/52] notify: add PVE/PBS context Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox 12/52] notify: add 'smtp' endpoint Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox 13/52] notify: add api for smtp endpoints Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox 14/52] notify: add 'disable' parameter for matchers and targets Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox 15/52] notify: add built-in config and 'origin' parameter Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox-perl-rs 16/52] notify: adapt to new matcher-based notification routing Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox-perl-rs 17/52] notify: add bindings for smtp API calls Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox-perl-rs 18/52] pve-rs: notify: remove notify_context for PVE Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox-perl-rs 19/52] notify: add 'disable' parameter Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox-perl-rs 20/52] notify: support 'origin' paramter Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-cluster 21/52] notify: adapt to matcher based notification system Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-guest-common 22/52] vzdump: deprecate mailto/mailnotification/notification-{target, policy} Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-ha-manager 23/52] env: switch to matcher-based notification system Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-manager 24/52] api: notification: remove notification groups Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-manager 25/52] api: notification: add new matcher-based notification API Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-manager 26/52] ui: dc: remove unneeded notification events panel Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-manager 27/52] vzdump: adapt to new matcher based notification system Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-manager 28/52] api: apt: adapt to matcher-based notifications Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-manager 29/52] api: replication: adapt to matcher-based notification system Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-manager 30/52] test: fix vzdump notification test Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-manager 31/52] ui: vzdump: remove left-overs from target/policy based notifications Lukas Wagner
2023-11-16 11:52 ` [pve-devel] [PATCH manager] ui: fix backup job create Dominik Csapak
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-manager 32/52] ui: dc: config: show notification panel again Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-manager 33/52] notify: add API routes for smtp endpoints Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-manager 34/52] api: notification: add disable and origin params Lukas Wagner
2023-11-14 12:59 ` Lukas Wagner [this message]
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox-widget-toolkit 36/52] notification ui: add target selector for matcher Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox-widget-toolkit 37/52] notification ui: remove filter setting for targets Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox-widget-toolkit 38/52] notification ui: remove notification groups Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox-widget-toolkit 39/52] notification ui: rename filter to matcher Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox-widget-toolkit 40/52] notification: matcher: add UI for matcher editing Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox-widget-toolkit 41/52] notification ui: unprotected mailto-root target Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox-widget-toolkit 42/52] noficiation: matcher edit: make 'field' an editable combobox Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox-widget-toolkit 43/52] panel: notification: add gui for SMTP endpoints Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox-widget-toolkit 44/52] notification ui: add enable checkbox for targets/matchers Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox-widget-toolkit 45/52] notification ui: add column for 'origin' Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-docs 46/52] notifications: update docs to for matcher-based notifications Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-docs 47/52] notifications: document SMTP endpoints Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-docs 48/52] notifications: document 'comment' option for targets/matchers Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-docs 49/52] notifications: add documentation for system mail forwarding Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 pve-docs 50/52] notifications: change to simplified ACL structure Lukas Wagner
2023-11-14 12:59 ` [pve-devel] [PATCH v2 proxmox-mail-forward 51/52] feed forwarded mails into proxmox_notify Lukas Wagner
2023-11-14 13:00 ` [pve-devel] [PATCH v2 proxmox-mail-forward 52/52] update d/control Lukas Wagner
2023-11-16 11:57 ` [pve-devel] [PATCH widget-toolkit 0/2] follow-ups for notification series Dominik Csapak
2023-11-16 11:57 ` [pve-devel] [PATCH widget-toolkit 1/2] notification matcher: improve handling empty and invalid values Dominik Csapak
2023-11-16 11:57 ` [pve-devel] [PATCH widget-toolkit 2/2] notification matcher: improve wording for mode Dominik Csapak
2023-11-17 8:41 ` [pve-devel] [PATCH v2 many 00/52] revamp notifications; smtp endpoints; system mail Dominik Csapak
2023-11-20 9:03 ` Lukas Wagner
2023-11-20 9:11 ` Dominik Csapak
2023-11-20 9:49 ` Lukas Wagner
2023-11-20 9:11 ` Thomas Lamprecht
2023-11-17 15:31 ` [pve-devel] applied-series: " Thomas Lamprecht
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231114130000.565122-36-l.wagner@proxmox.com \
--to=l.wagner@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox