[PATCH access-control v3 2/2] fix #6510: api: acl: allow deletion for non-existent entities

[Elias Huhsovitz <e.huhsovitz@proxmox.com>]

When a user, group, or API token is deleted, the system usually cleans
up the associated ACLs. However, edge cases like manual configuration
edits can leave orphaned ACL entries in the cluster configuration.

Currently, the `update_acl` API endpoint strictly validates the
existence of the target entity before processing any request. If the
entity is missing, the API throws an error (e.g., "user 'foo@pve' does
not exist") and aborts the operation. This prevents administrators from
cleaning up leftover ACLs through the API.

Bypass the existence check when the `delete` flag is set, to allow
removal of orphaned ACLs.

Signed-off-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>
---
 src/PVE/API2/ACL.pm | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/src/PVE/API2/ACL.pm b/src/PVE/API2/ACL.pm
index c57dd38..80de548 100644
--- a/src/PVE/API2/ACL.pm
+++ b/src/PVE/API2/ACL.pm
@@ -183,14 +183,14 @@ __PACKAGE__->register_method({
                 my $node = PVE::AccessControl::find_acl_tree_node($cfg->{acl_root}, $path);
 
                 foreach my $role (split_list($param->{roles})) {
+                    my $role_privs = $cfg->{roles}->{$role};
                     die "role '$role' does not exist\n"
-                        if !$cfg->{roles}->{$role};
+                        if !$role_privs && !$param->{delete};
 
                     # permissions() returns set privs as key, and propagate bit as value!
-                    if (!defined($auth_user_privs->{'Permissions.Modify'})) {
+                    if (!defined($auth_user_privs->{'Permissions.Modify'}) && $role_privs) {
                         # 'perm-modify' allows /vms/* with VM.Allocate and similar restricted use cases
                         # filter those to only allow handing out a subset of currently active privs
-                        my $role_privs = $cfg->{roles}->{$role};
                         my $verb = $param->{delete} ? 'remove' : 'add';
                         foreach my $priv (keys $role_privs->%*) {
                             raise_param_exc(
@@ -224,7 +224,7 @@ __PACKAGE__->register_method({
                     foreach my $group (split_list($param->{groups})) {
 
                         die "group '$group' does not exist\n"
-                            if !$cfg->{groups}->{$group};
+                            if !$param->{delete} && !$cfg->{groups}->{$group};
 
                         if ($param->{delete}) {
                             delete($node->{groups}->{$group}->{$role});
@@ -237,7 +237,7 @@ __PACKAGE__->register_method({
                         my $username = PVE::AccessControl::verify_username($userid);
 
                         die "user '$username' does not exist\n"
-                            if !$cfg->{users}->{$username};
+                            if !$param->{delete} && !$cfg->{users}->{$username};
 
                         if ($param->{delete}) {
                             delete($node->{users}->{$username}->{$role});
@@ -248,7 +248,8 @@ __PACKAGE__->register_method({
 
                     foreach my $tokenid (split_list($param->{tokens})) {
                         my ($username, $token) = PVE::AccessControl::split_tokenid($tokenid);
-                        PVE::AccessControl::check_token_exist($cfg, $username, $token);
+                        PVE::AccessControl::check_token_exist($cfg, $username, $token)
+                            if !$param->{delete};
 
                         if ($param->{delete}) {
                             delete $node->{tokens}->{$tokenid}->{$role};
-- 
2.47.3