[PATCH storage] api: prune backups: dry run: filter volumes based on permissions

[Fiona Ebner <f.ebner@proxmox.com>]

In the API endpoint for the prune backups dry run, filter volumes in
the result based on permissions using check_volume_access(), similar
to what the API endpoint for listing storage contents is already
doing.

The permission check is based on permissions for the storage and the
'VM.Backup' permission for guest IDs, so each backup group is either
fully absent or fully present in the result.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
 src/PVE/API2/Storage/PruneBackups.pm | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/PVE/API2/Storage/PruneBackups.pm b/src/PVE/API2/Storage/PruneBackups.pm
index 2920c89..60a8182 100644
--- a/src/PVE/API2/Storage/PruneBackups.pm
+++ b/src/PVE/API2/Storage/PruneBackups.pm
@@ -100,6 +100,9 @@ __PACKAGE__->register_method({
     code => sub {
         my ($param) = @_;
 
+        my $rpcenv = PVE::RPCEnvironment::get();
+        my $authuser = $rpcenv->get_user();
+
         my $cfg = PVE::Storage::config();
 
         my $vmid = extract_param($param, 'vmid');
@@ -110,7 +113,19 @@ __PACKAGE__->register_method({
         $prune_backups = PVE::JSONSchema::parse_property_string('prune-backups', $prune_backups)
             if defined($prune_backups);
 
-        return PVE::Storage::prune_backups($cfg, $storeid, $prune_backups, $vmid, $type, 1);
+        my $result = [];
+        my $prune_list =
+            PVE::Storage::prune_backups($cfg, $storeid, $prune_backups, $vmid, $type, 1);
+        for my $prune_entry ($prune_list->@*) {
+            eval {
+                PVE::Storage::check_volume_access(
+                    $rpcenv, $authuser, $cfg, undef, $prune_entry->{volid}, 'backup',
+                );
+            };
+            next if $@;
+            push $result->@*, $prune_entry;
+        }
+        return $result;
     },
 });
 
-- 
2.47.3