public inbox for pve-devel@lists.proxmox.com
 help / color / mirror / Atom feed
From: Daniel Kral <d.kral@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [PATCH manager 4/4] ui: api token: allow unprivileged users to modify their own api tokens
Date: Thu, 31 Oct 2024 14:46:29 +0100	[thread overview]
Message-ID: <20241031134629.144893-4-d.kral@proxmox.com> (raw)
In-Reply-To: <20241031134629.144893-1-d.kral@proxmox.com>

Allows unprivileged users to edit and remove their own API tokens, as
this is already allowed by the respective PUT and DELETE methods on the
API endpoint `/access/users/{userid}/token/{tokenid}`.

Signed-off-by: Daniel Kral <d.kral@proxmox.com>
---
As this cannot be seen in the diff directly: The run_editor is also used
when double-clicking the record item (in addition when clicking the Edit
button while the record item is selected).

This has not been requested in the BugZilla #5722, but has similar
intentions and made sense to include into this patch series as well.

 www/manager6/dc/TokenView.js | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/www/manager6/dc/TokenView.js b/www/manager6/dc/TokenView.js
index d275a1c5..f71ab905 100644
--- a/www/manager6/dc/TokenView.js
+++ b/www/manager6/dc/TokenView.js
@@ -57,8 +57,12 @@ Ext.define('PVE.dc.TokenView', {
 	    return `/access/users/${uid}/token/${tid}`;
 	};
 
+	let hasTokenCRUDPermissions = function(userid) {
+	    return userid === Proxmox.UserName || !!caps.access['User.Modify'];
+	};
+
 	let run_editor = function(rec) {
-	    if (!caps.access['User.Modify']) {
+	    if (!hasTokenCRUDPermissions(rec.data.userid)) {
 		return;
 	    }
 
@@ -88,14 +92,14 @@ Ext.define('PVE.dc.TokenView', {
 		xtype: 'proxmoxButton',
 		text: gettext('Edit'),
 		disabled: true,
-		enableFn: (rec) => !!caps.access['User.Modify'],
+		enableFn: (rec) => hasTokenCRUDPermissions(rec.data.userid),
 		selModel: sm,
 		handler: (btn, e, rec) => run_editor(rec),
 	    },
 	    {
 		xtype: 'proxmoxStdRemoveButton',
 		selModel: sm,
-		enableFn: (rec) => !!caps.access['User.Modify'],
+		enableFn: (rec) => hasTokenCRUDPermissions(rec.data.userid),
 		callback: reload,
 		getUrl: urlFromRecord,
 	    },
-- 
2.39.5



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel


      parent reply	other threads:[~2024-10-31 13:46 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-10-31 13:46 [pve-devel] [PATCH manager 1/4] ui: api token: remove record context from TokenView add button handler Daniel Kral
2024-10-31 13:46 ` [pve-devel] [PATCH manager 2/4] ui: api token: remove unused fixed user property Daniel Kral
2024-10-31 13:46 ` [pve-devel] [PATCH manager 3/4] fix #5722: ui: api token: allow unprivileged users to create their own api tokens Daniel Kral
2024-10-31 13:46 ` Daniel Kral [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20241031134629.144893-4-d.kral@proxmox.com \
    --to=d.kral@proxmox.com \
    --cc=pve-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal