Re: [PATCH access-control 1/2] fix #6510: api: acl: allow deleting ACLs for non-existent entities

["Daniel Kral" <d.kral@proxmox.com>]

On Mon Jul 20, 2026 at 3:45 PM CEST, Elias Huhsovitz wrote:
> When a user, group, or API token is deleted, the system usually cleans
> up the associated ACLs. However, edge cases like
> manual configuration edits can leave orphaned ACL entries in the
> cluster configuration.
>
> Currently, the `update_acl` API endpoint strictly validates the
> existence of the target entity before processing any request. If the
> entity is missing, the API throws an error (e.g., "user 'foo@pve' does
> not exist") and aborts the operation. This prevents administrators from
> cleaning up leftover ACLs through the API.
>
> Bypass the existence check when the `delete` flag is set. This change
> allows the API to remove orphaned ACL entries.
>
> Signed-off-by: Elias Huhsovitz <e.huhsovitz@proxmox.com>
> ---
>  src/PVE/API2/ACL.pm | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/src/PVE/API2/ACL.pm b/src/PVE/API2/ACL.pm
> index c57dd38..01329f7 100644
> --- a/src/PVE/API2/ACL.pm
> +++ b/src/PVE/API2/ACL.pm
> @@ -224,7 +224,7 @@ __PACKAGE__->register_method({
>                      foreach my $group (split_list($param->{groups})) {
>  
>                          die "group '$group' does not exist\n"
> -                            if !$cfg->{groups}->{$group};
> +                            if !$param->{delete} && !$cfg->{groups}->{$group};
>  
>                          if ($param->{delete}) {
>                              delete($node->{groups}->{$group}->{$role});
> @@ -237,7 +237,7 @@ __PACKAGE__->register_method({
>                          my $username = PVE::AccessControl::verify_username($userid);
>  
>                          die "user '$username' does not exist\n"
> -                            if !$cfg->{users}->{$username};
> +                            if !$param->{delete} && !$cfg->{users}->{$username};
>  
>                          if ($param->{delete}) {
>                              delete($node->{users}->{$username}->{$role});
> @@ -248,7 +248,7 @@ __PACKAGE__->register_method({
>  
>                      foreach my $tokenid (split_list($param->{tokens})) {
>                          my ($username, $token) = PVE::AccessControl::split_tokenid($tokenid);
> -                        PVE::AccessControl::check_token_exist($cfg, $username, $token);
> +                        PVE::AccessControl::check_token_exist($cfg, $username, $token) if !$param->{delete};

This line is a bit too long, please run `make tidy` on the individual
patches before sending.

>  
>                          if ($param->{delete}) {
>                              delete $node->{tokens}->{$tokenid}->{$role};

Otherwise, this looks good to me and works as expected testing with some
ACLs and removing non-existing users, groups or tokens from ACL paths,
so modulo the make tidy consider this as:

Reviewed-by: Daniel Kral <d.kral@proxmox.com>
Tested-by: Daniel Kral <d.kral@proxmox.com>