[PATCH common 02/10] schema: allow marking properties as sensitive

[Thomas Lamprecht <t.lamprecht@proxmox.com>]

Credentials such as cloud-init passwords and SDN API tokens are stored
inline in configs, and from there end up in places with a wider
audience, like the system report, which only requires Sys.Audit. Code
that needs to treat such values specially currently has to know their
property names, as the cipassword masking in qemu-server does.

The new flag lets the schema declare a value as a secret, so generic
code can recognize it. It does not affect validation or how a value is
stored. It can be set on any property schema, including the keys of
property-string formats.

The meta schema is only checked by the verifyapi commands, so older
versions of this package do not break at runtime when they see the
flag.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
---
 src/PVE/JSONSchema.pm | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/PVE/JSONSchema.pm b/src/PVE/JSONSchema.pm
index 34f2949..e4225df 100644
--- a/src/PVE/JSONSchema.pm
+++ b/src/PVE/JSONSchema.pm
@@ -1791,6 +1791,14 @@ my $default_schema_noref = {
             optional => 1,
             default => 0,
         },
+        sensitive => {
+            type => "boolean",
+            description =>
+                "Whether the value is a secret or derived from one, like a password, a"
+                . " password hash or an API token.",
+            optional => 1,
+            default => 0,
+        },
         properties => {
             type => "object",
             description => "This is a definition for the properties of an object value",
-- 
2.47.3