[PATCH manager v4 0/2] fix #6735: api: pci: allow mdevscan access via mapping permissions

[Elias Huhsovitz <e.huhsovitz@proxmox.com>]

This series allows users who have been granted Mapping.Use
(or Mapping.Modify / Mapping.Audit) on a specific PCI mapping to list
the mediated device (mdev) types for that mapping without requiring
global Sys.Audit or Sys.Modify privileges on the entire cluster.

In multi‑team environments where access is compartmentalized via
resource pools and PCI mappings, the previous requirement forced
administrators to grant overly broad permissions for GPU usage.
By checking mapping‑specific permissions when a mapping name is
supplied, the patch enables non‑administrative users to select and use
vGPU types for their assigned hardware.

Patch 1/2 makes the necessary logical change for fixing #6735.
Patch 2/2 utilizes a new constant parameter for the `pci_scan` endpoint

Changes v3->v4
--------------
* factor out global permissions into constant
* de-rerence global permissions array when passing it to
  `raise_perm_exc`
* add optional second patch to utilize global permissions constant for
  `pci_scan` endpoint

Changes v2->v3
--------------
* re-introduce else-statement in API handler
* move permissions checks into respective logical branches
  (previously sepate sesection before core code)
* update commit message

Changes v1->v2
--------------
* Allow all users in the declarative API permissions.
* Implement ACL check in API handler by calling
  check_any and raise_perm_exc.
* Remove else statement in API handler, since return statement
  provides implicit branching
* update commit message

Previous Versions
-----------------
v3: https://lore.proxmox.com/pve-devel/20260903121143.145841-1-e.huhsovitz@proxmox.com/
v2: https://lore.proxmox.com/pve-devel/20260827112525.154445-1-e.huhsovitz@proxmox.com/
v1: https://lore.proxmox.com/pve-devel/20260824112610.148089-1-e.huhsovitz@proxmox.com/

Summary of Changes
------------------
Elias Huhsovitz (2):
  fix #6735: api: pci: allow mdevscan access via mapping permissions
  api: pci: utilize constant perm variable for pci_scan

 PVE/API2/Hardware/PCI.pm | 47 ++++++++++++++++++++++++++++++----------
 1 file changed, 35 insertions(+), 12 deletions(-)

-- 
2.47.3