[PATCH pve-manager 0/3] show mappings in ACL path selector

[PATCH pve-manager 0/3] show mappings in ACL path selector

[Jonas Theisen]

This patch series makes the USB, PCI and directory mappings
defined on the Datacenter level user-selectable in the ACL path
dropdown menu in the Permissions tab.
This is to allow intuituve finer-grained permission management
for mappings similar as for the SDN zones.

Currently it is possible to achieve the same result with knwoledge
of the fact that the ACL path is a text box and can be manually
expanded.

Jonas Theisen (3):
  api: add mappings to resources endpoint
  ui: acl: add mappings to ACL path list
  ui: resource-tree: filter newly added mappings

 PVE/API2/Cluster.pm                | 58 ++++++++++++++++++++++++++++--
 www/manager6/data/PermPathStore.js |  3 ++
 www/manager6/tree/ResourceTree.js  | 13 +++++++
 3 files changed, 71 insertions(+), 3 deletions(-)

-- 
2.47.3

[PATCH pve-manager 1/3] api: add mappings to resources endpoint

[Jonas Theisen]

Similar to the SDN zones this patch adds the USB, PCI and
directory mappings to the resources endpoint of the API.
It adds a new type 'mapping' for this and distinguishes
the mappings with 'mapping-type' in the returned object.

This is needed to allow the permissions tab to gather
the IDs of the mappings for the paths list.

Signed-off-by: Jonas Theisen <j.theisen@proxmox.com>
---
 PVE/API2/Cluster.pm | 58 ++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 55 insertions(+), 3 deletions(-)

diff --git a/PVE/API2/Cluster.pm b/PVE/API2/Cluster.pm
index 4e5efbfd..3df03411 100644
--- a/PVE/API2/Cluster.pm
+++ b/PVE/API2/Cluster.pm
@@ -272,7 +272,7 @@ __PACKAGE__->register_method({
                 type => 'string',
                 description => 'Resource type.',
                 optional => 1,
-                enum => ['vm', 'storage', 'node', 'sdn'],
+                enum => ['vm', 'storage', 'node', 'sdn', 'mapping'],
             },
         },
     },
@@ -288,8 +288,17 @@ __PACKAGE__->register_method({
                 type => {
                     description => "Resource type.",
                     type => 'string',
-                    enum =>
-                        ['node', 'storage', 'pool', 'qemu', 'lxc', 'openvz', 'sdn', 'network'],
+                    enum => [
+                        'node',
+                        'storage',
+                        'pool',
+                        'qemu',
+                        'lxc',
+                        'openvz',
+                        'sdn',
+                        'network',
+                        'mapping',
+                    ],
                 },
                 status => {
                     description => "Resource type dependent status.",
@@ -503,6 +512,17 @@ __PACKAGE__->register_method({
                     default => 'x86_64',
                     optional => 1,
                 },
+                mapping => {
+                    description => "The name of the mapping (for type 'mapping')",
+                    type => "string",
+                    optional => 1,
+                },
+                'mapping-type' => {
+                    description => "The type of the mapping (for type 'mapping')",
+                    type => "string",
+                    enum => ["pci", "usb", "dir"],
+                    optional => 1,
+                },
             },
         },
     },
@@ -723,6 +743,38 @@ __PACKAGE__->register_method({
             }
         }
 
+        if (!$param->{type} || $param->{type} eq 'mapping') {
+            my $can_see_mapping_privs = ['Mapping.Modify', 'Mapping.Use', 'Mapping.Audit'];
+
+            foreach my $mapping_type ('pci', 'usb', 'dir') {
+                my $cfg = {};
+
+                if ($mapping_type eq 'pci') {
+                    $cfg = PVE::Mapping::PCI::config();
+                } elsif ($mapping_type eq 'usb') {
+                    $cfg = PVE::Mapping::USB::config();
+                } elsif ($mapping_type eq 'dir') {
+                    $cfg = PVE::Mapping::Dir::config();
+                }
+
+                for my $id (keys $cfg->{ids}->%*) {
+                    next
+                        if !($rpcenv->check(
+                            $authuser, "/mapping/$mapping_type/$id", $can_see_mapping_privs, 1,
+                        ));
+                    next if !$cfg->{ids}->{$id};
+
+                    push @$res,
+                        {
+                            id => "mapping/$mapping_type/$id",
+                            mapping => $id,
+                            'mapping-type' => $mapping_type,
+                            type => 'mapping',
+                        };
+                }
+            }
+        }
+
         return $res;
     },
 });
-- 
2.47.3

[PATCH pve-manager 2/3] ui: acl: add mappings to ACL path list

[Jonas Theisen]

This patch adds the USB, PCI and directory mappings
from the ressources API endpoint to the ACL path selection.

This is to allow the user to intuitively assign the specific mappings
to individual users or groups as needed.

Until now this was only possible with knowledge of the fact
that the ACL path is a text box and the path can be
manually adjusted.

Signed-off-by: Jonas Theisen <j.theisen@proxmox.com>
---
 www/manager6/data/PermPathStore.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/www/manager6/data/PermPathStore.js b/www/manager6/data/PermPathStore.js
index 7210e0cd..48e85cdb 100644
--- a/www/manager6/data/PermPathStore.js
+++ b/www/manager6/data/PermPathStore.js
@@ -55,6 +55,9 @@ Ext.define('PVE.data.PermPathStore', {
                 case 'pool':
                     path = '/pool/' + record.get('pool');
                     break;
+                case 'mapping':
+                    path = '/mapping/' + record.get('mapping-type') + '/' + record.get('mapping');
+                    break;
             }
             if (path !== undefined && !donePaths[path]) {
                 me.add({ value: path });
-- 
2.47.3

[PATCH pve-manager 3/3] ui: resource-tree: filter newly added mappings

[Jonas Theisen]

The newly added mapping resources added to the PVE API
unintentionally show up in the Resource Tree.

This patch adds a permanent filter to hide these objects
by filtering for the type.

Signed-off-by: Jonas Theisen <j.theisen@proxmox.com>
---
 www/manager6/tree/ResourceTree.js | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/www/manager6/tree/ResourceTree.js b/www/manager6/tree/ResourceTree.js
index e2acc431..88971a6b 100644
--- a/www/manager6/tree/ResourceTree.js
+++ b/www/manager6/tree/ResourceTree.js
@@ -330,6 +330,19 @@ Ext.define('PVE.tree.ResourceTree', {
             },
         });
 
+        store.addFilter({
+            id: 'typeFilter',
+            filterFn: function (node) {
+                if (!node.data || !node.data.type) {
+                    return true;
+                }
+
+                let hiddenTypes = ['mapping'];
+
+                return !Ext.Array.contains(hiddenTypes, node.data.type);
+            },
+        });
+
         let stateid = 'rid';
 
         const changedFields = [
-- 
2.47.3