src/api2/admin/datastore.rs

   1 //! Datastore Management
   2
   3 use std::collections::HashSet;
   4 use std::ffi::OsStr;
   5 use std::os::unix::ffi::OsStrExt;
   6 use std::path::PathBuf;
   7
   8 use anyhow::{bail, format_err, Error};
   9 use futures::*;
  10 use hyper::http::request::Parts;
  11 use hyper::{header, Body, Response, StatusCode};
  12 use serde_json::{json, Value};
  13 use tokio_stream::wrappers::ReceiverStream;
  14
  15 use proxmox_async::blocking::WrappedReaderStream;
  16 use proxmox_async::{io::AsyncChannelWriter, stream::AsyncReaderStream};
  17 use proxmox_compression::zstd::ZstdEncoder;
  18 use proxmox_router::{
  19     http_err, list_subdirs_api_method, ApiHandler, ApiMethod, ApiResponseFuture, Permission,
  20     Router, RpcEnvironment, RpcEnvironmentType, SubdirMap,
  21 };
  22 use proxmox_schema::*;
  23 use proxmox_sys::fs::{
  24     file_read_firstline, file_read_optional_string, replace_file, CreateOptions,
  25 };
  26 use proxmox_sys::sortable;
  27 use proxmox_sys::{task_log, task_warn};
  28
  29 use pxar::accessor::aio::Accessor;
  30 use pxar::EntryKind;
  31
  32 use pbs_api_types::{
  33     Authid, BackupContent, Counts, CryptMode, DataStoreListItem, DataStoreStatus,
  34     GarbageCollectionStatus, GroupListItem, Operation, PruneOptions, RRDMode, RRDTimeFrame,
  35     SnapshotListItem, SnapshotVerifyState, BACKUP_ARCHIVE_NAME_SCHEMA, BACKUP_ID_SCHEMA,
  36     BACKUP_TIME_SCHEMA, BACKUP_TYPE_SCHEMA, DATASTORE_SCHEMA, IGNORE_VERIFIED_BACKUPS_SCHEMA,
  37     PRIV_DATASTORE_AUDIT, PRIV_DATASTORE_BACKUP, PRIV_DATASTORE_MODIFY, PRIV_DATASTORE_PRUNE,
  38     PRIV_DATASTORE_READ, PRIV_DATASTORE_VERIFY, UPID_SCHEMA, VERIFICATION_OUTDATED_AFTER_SCHEMA,
  39 };
  40 use pbs_client::pxar::{create_tar, create_zip};
  41 use pbs_config::CachedUserInfo;
  42 use pbs_datastore::backup_info::BackupInfo;
  43 use pbs_datastore::cached_chunk_reader::CachedChunkReader;
  44 use pbs_datastore::catalog::{ArchiveEntry, CatalogReader};
  45 use pbs_datastore::data_blob::DataBlob;
  46 use pbs_datastore::data_blob_reader::DataBlobReader;
  47 use pbs_datastore::dynamic_index::{BufferedDynamicReader, DynamicIndexReader, LocalDynamicReadAt};
  48 use pbs_datastore::fixed_index::FixedIndexReader;
  49 use pbs_datastore::index::IndexFile;
  50 use pbs_datastore::manifest::{BackupManifest, CLIENT_LOG_BLOB_NAME, MANIFEST_BLOB_NAME};
  51 use pbs_datastore::prune::compute_prune_info;
  52 use pbs_datastore::{
  53     check_backup_owner, task_tracking, BackupDir, BackupGroup, DataStore, LocalChunkReader,
  54     StoreProgress, CATALOG_NAME,
  55 };
  56 use pbs_tools::json::{required_integer_param, required_string_param};
  57 use proxmox_rest_server::{formatter, WorkerTask};
  58
  59 use crate::api2::node::rrd::create_value_from_rrd;
  60 use crate::backup::{verify_all_backups, verify_backup_dir, verify_backup_group, verify_filter};
  61
  62 use crate::server::jobstate::Job;
  63
  64 const GROUP_NOTES_FILE_NAME: &str = "notes";
  65
  66 fn get_group_note_path(store: &DataStore, group: &BackupGroup) -> PathBuf {
  67     let mut note_path = store.base_path();
  68     note_path.push(group.group_path());
  69     note_path.push(GROUP_NOTES_FILE_NAME);
  70     note_path
  71 }
  72
  73 fn check_priv_or_backup_owner(
  74     store: &DataStore,
  75     group: &BackupGroup,
  76     auth_id: &Authid,
  77     required_privs: u64,
  78 ) -> Result<(), Error> {
  79     let user_info = CachedUserInfo::new()?;
  80     let privs = user_info.lookup_privs(auth_id, &["datastore", store.name()]);
  81
  82     if privs & required_privs == 0 {
  83         let owner = store.get_owner(group)?;
  84         check_backup_owner(&owner, auth_id)?;
  85     }
  86     Ok(())
  87 }
  88
  89 fn read_backup_index(
  90     store: &DataStore,
  91     backup_dir: &BackupDir,
  92 ) -> Result<(BackupManifest, Vec<BackupContent>), Error> {
  93     let (manifest, index_size) = store.load_manifest(backup_dir)?;
  94
  95     let mut result = Vec::new();
  96     for item in manifest.files() {
  97         result.push(BackupContent {
  98             filename: item.filename.clone(),
  99             crypt_mode: Some(item.crypt_mode),
 100             size: Some(item.size),
 101         });
 102     }
 103
 104     result.push(BackupContent {
 105         filename: MANIFEST_BLOB_NAME.to_string(),
 106         crypt_mode: match manifest.signature {
 107             Some(_) => Some(CryptMode::SignOnly),
 108             None => Some(CryptMode::None),
 109         },
 110         size: Some(index_size),
 111     });
 112
 113     Ok((manifest, result))
 114 }
 115
 116 fn get_all_snapshot_files(
 117     store: &DataStore,
 118     info: &BackupInfo,
 119 ) -> Result<(BackupManifest, Vec<BackupContent>), Error> {
 120     let (manifest, mut files) = read_backup_index(store, &info.backup_dir)?;
 121
 122     let file_set = files.iter().fold(HashSet::new(), |mut acc, item| {
 123         acc.insert(item.filename.clone());
 124         acc
 125     });
 126
 127     for file in &info.files {
 128         if file_set.contains(file) {
 129             continue;
 130         }
 131         files.push(BackupContent {
 132             filename: file.to_string(),
 133             size: None,
 134             crypt_mode: None,
 135         });
 136     }
 137
 138     Ok((manifest, files))
 139 }
 140
 141 #[api(
 142     input: {
 143         properties: {
 144             store: {
 145                 schema: DATASTORE_SCHEMA,
 146             },
 147         },
 148     },
 149     returns: pbs_api_types::ADMIN_DATASTORE_LIST_GROUPS_RETURN_TYPE,
 150     access: {
 151         permission: &Permission::Privilege(
 152             &["datastore", "{store}"],
 153             PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_BACKUP,
 154             true),
 155     },
 156 )]
 157 /// List backup groups.
 158 pub fn list_groups(
 159     store: String,
 160     rpcenv: &mut dyn RpcEnvironment,
 161 ) -> Result<Vec<GroupListItem>, Error> {
 162     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
 163     let user_info = CachedUserInfo::new()?;
 164     let user_privs = user_info.lookup_privs(&auth_id, &["datastore", &store]);
 165
 166     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Read))?;
 167     let list_all = (user_privs & PRIV_DATASTORE_AUDIT) != 0;
 168
 169     let backup_groups = BackupInfo::list_backup_groups(&datastore.base_path())?;
 170
 171     let group_info = backup_groups
 172         .into_iter()
 173         .fold(Vec::new(), |mut group_info, group| {
 174             let owner = match datastore.get_owner(&group) {
 175                 Ok(auth_id) => auth_id,
 176                 Err(err) => {
 177                     eprintln!(
 178                         "Failed to get owner of group '{}/{}' - {}",
 179                         &store, group, err
 180                     );
 181                     return group_info;
 182                 }
 183             };
 184             if !list_all && check_backup_owner(&owner, &auth_id).is_err() {
 185                 return group_info;
 186             }
 187
 188             let snapshots = match group.list_backups(&datastore.base_path()) {
 189                 Ok(snapshots) => snapshots,
 190                 Err(_) => {
 191                     return group_info;
 192                 }
 193             };
 194
 195             let backup_count: u64 = snapshots.len() as u64;
 196             if backup_count == 0 {
 197                 return group_info;
 198             }
 199
 200             let last_backup = snapshots
 201                 .iter()
 202                 .fold(&snapshots[0], |last, curr| {
 203                     if curr.is_finished()
 204                         && curr.backup_dir.backup_time() > last.backup_dir.backup_time()
 205                     {
 206                         curr
 207                     } else {
 208                         last
 209                     }
 210                 })
 211                 .to_owned();
 212
 213             let note_path = get_group_note_path(&datastore, &group);
 214             let comment = file_read_firstline(&note_path).ok();
 215
 216             group_info.push(GroupListItem {
 217                 backup_type: group.backup_type().to_string(),
 218                 backup_id: group.backup_id().to_string(),
 219                 last_backup: last_backup.backup_dir.backup_time(),
 220                 owner: Some(owner),
 221                 backup_count,
 222                 files: last_backup.files,
 223                 comment,
 224             });
 225
 226             group_info
 227         });
 228
 229     Ok(group_info)
 230 }
 231
 232 #[api(
 233     input: {
 234         properties: {
 235             store: {
 236                 schema: DATASTORE_SCHEMA,
 237             },
 238             "backup-type": {
 239                 schema: BACKUP_TYPE_SCHEMA,
 240             },
 241             "backup-id": {
 242                 schema: BACKUP_ID_SCHEMA,
 243             },
 244         },
 245     },
 246     access: {
 247         permission: &Permission::Privilege(
 248             &["datastore", "{store}"],
 249             PRIV_DATASTORE_MODIFY| PRIV_DATASTORE_PRUNE,
 250             true),
 251     },
 252 )]
 253 /// Delete backup group including all snapshots.
 254 pub fn delete_group(
 255     store: String,
 256     backup_type: String,
 257     backup_id: String,
 258     _info: &ApiMethod,
 259     rpcenv: &mut dyn RpcEnvironment,
 260 ) -> Result<Value, Error> {
 261     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
 262
 263     let group = BackupGroup::new(backup_type, backup_id);
 264     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Write))?;
 265
 266     check_priv_or_backup_owner(&datastore, &group, &auth_id, PRIV_DATASTORE_MODIFY)?;
 267
 268     if !datastore.remove_backup_group(&group)? {
 269         bail!("group only partially deleted due to protected snapshots");
 270     }
 271
 272     Ok(Value::Null)
 273 }
 274
 275 #[api(
 276     input: {
 277         properties: {
 278             store: {
 279                 schema: DATASTORE_SCHEMA,
 280             },
 281             "backup-type": {
 282                 schema: BACKUP_TYPE_SCHEMA,
 283             },
 284             "backup-id": {
 285                 schema: BACKUP_ID_SCHEMA,
 286             },
 287             "backup-time": {
 288                 schema: BACKUP_TIME_SCHEMA,
 289             },
 290         },
 291     },
 292     returns: pbs_api_types::ADMIN_DATASTORE_LIST_SNAPSHOT_FILES_RETURN_TYPE,
 293     access: {
 294         permission: &Permission::Privilege(
 295             &["datastore", "{store}"],
 296             PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_READ | PRIV_DATASTORE_BACKUP,
 297             true),
 298     },
 299 )]
 300 /// List snapshot files.
 301 pub fn list_snapshot_files(
 302     store: String,
 303     backup_type: String,
 304     backup_id: String,
 305     backup_time: i64,
 306     _info: &ApiMethod,
 307     rpcenv: &mut dyn RpcEnvironment,
 308 ) -> Result<Vec<BackupContent>, Error> {
 309     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
 310     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Read))?;
 311
 312     let snapshot = BackupDir::new(backup_type, backup_id, backup_time)?;
 313
 314     check_priv_or_backup_owner(
 315         &datastore,
 316         snapshot.group(),
 317         &auth_id,
 318         PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_READ,
 319     )?;
 320
 321     let info = BackupInfo::new(&datastore.base_path(), snapshot)?;
 322
 323     let (_manifest, files) = get_all_snapshot_files(&datastore, &info)?;
 324
 325     Ok(files)
 326 }
 327
 328 #[api(
 329     input: {
 330         properties: {
 331             store: {
 332                 schema: DATASTORE_SCHEMA,
 333             },
 334             "backup-type": {
 335                 schema: BACKUP_TYPE_SCHEMA,
 336             },
 337             "backup-id": {
 338                 schema: BACKUP_ID_SCHEMA,
 339             },
 340             "backup-time": {
 341                 schema: BACKUP_TIME_SCHEMA,
 342             },
 343         },
 344     },
 345     access: {
 346         permission: &Permission::Privilege(
 347             &["datastore", "{store}"],
 348             PRIV_DATASTORE_MODIFY| PRIV_DATASTORE_PRUNE,
 349             true),
 350     },
 351 )]
 352 /// Delete backup snapshot.
 353 pub fn delete_snapshot(
 354     store: String,
 355     backup_type: String,
 356     backup_id: String,
 357     backup_time: i64,
 358     _info: &ApiMethod,
 359     rpcenv: &mut dyn RpcEnvironment,
 360 ) -> Result<Value, Error> {
 361     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
 362
 363     let snapshot = BackupDir::new(backup_type, backup_id, backup_time)?;
 364     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Write))?;
 365
 366     check_priv_or_backup_owner(
 367         &datastore,
 368         snapshot.group(),
 369         &auth_id,
 370         PRIV_DATASTORE_MODIFY,
 371     )?;
 372
 373     datastore.remove_backup_dir(&snapshot, false)?;
 374
 375     Ok(Value::Null)
 376 }
 377
 378 #[api(
 379     streaming: true,
 380     input: {
 381         properties: {
 382             store: {
 383                 schema: DATASTORE_SCHEMA,
 384             },
 385             "backup-type": {
 386                 optional: true,
 387                 schema: BACKUP_TYPE_SCHEMA,
 388             },
 389             "backup-id": {
 390                 optional: true,
 391                 schema: BACKUP_ID_SCHEMA,
 392             },
 393         },
 394     },
 395     returns: pbs_api_types::ADMIN_DATASTORE_LIST_SNAPSHOTS_RETURN_TYPE,
 396     access: {
 397         permission: &Permission::Privilege(
 398             &["datastore", "{store}"],
 399             PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_BACKUP,
 400             true),
 401     },
 402 )]
 403 /// List backup snapshots.
 404 pub fn list_snapshots(
 405     store: String,
 406     backup_type: Option<String>,
 407     backup_id: Option<String>,
 408     _param: Value,
 409     _info: &ApiMethod,
 410     rpcenv: &mut dyn RpcEnvironment,
 411 ) -> Result<Vec<SnapshotListItem>, Error> {
 412     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
 413     let user_info = CachedUserInfo::new()?;
 414     let user_privs = user_info.lookup_privs(&auth_id, &["datastore", &store]);
 415
 416     let list_all = (user_privs & PRIV_DATASTORE_AUDIT) != 0;
 417
 418     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Read))?;
 419
 420     let base_path = datastore.base_path();
 421
 422     let groups = match (backup_type, backup_id) {
 423         (Some(backup_type), Some(backup_id)) => {
 424             let mut groups = Vec::with_capacity(1);
 425             groups.push(BackupGroup::new(backup_type, backup_id));
 426             groups
 427         }
 428         (Some(backup_type), None) => BackupInfo::list_backup_groups(&base_path)?
 429             .into_iter()
 430             .filter(|group| group.backup_type() == backup_type)
 431             .collect(),
 432         (None, Some(backup_id)) => BackupInfo::list_backup_groups(&base_path)?
 433             .into_iter()
 434             .filter(|group| group.backup_id() == backup_id)
 435             .collect(),
 436         _ => BackupInfo::list_backup_groups(&base_path)?,
 437     };
 438
 439     let info_to_snapshot_list_item = |group: &BackupGroup, owner, info: BackupInfo| {
 440         let backup_type = group.backup_type().to_string();
 441         let backup_id = group.backup_id().to_string();
 442         let backup_time = info.backup_dir.backup_time();
 443         let protected = info.backup_dir.is_protected(base_path.clone());
 444
 445         match get_all_snapshot_files(&datastore, &info) {
 446             Ok((manifest, files)) => {
 447                 // extract the first line from notes
 448                 let comment: Option<String> = manifest.unprotected["notes"]
 449                     .as_str()
 450                     .and_then(|notes| notes.lines().next())
 451                     .map(String::from);
 452
 453                 let fingerprint = match manifest.fingerprint() {
 454                     Ok(fp) => fp,
 455                     Err(err) => {
 456                         eprintln!("error parsing fingerprint: '{}'", err);
 457                         None
 458                     }
 459                 };
 460
 461                 let verification = manifest.unprotected["verify_state"].clone();
 462                 let verification: Option<SnapshotVerifyState> =
 463                     match serde_json::from_value(verification) {
 464                         Ok(verify) => verify,
 465                         Err(err) => {
 466                             eprintln!("error parsing verification state : '{}'", err);
 467                             None
 468                         }
 469                     };
 470
 471                 let size = Some(files.iter().map(|x| x.size.unwrap_or(0)).sum());
 472
 473                 SnapshotListItem {
 474                     backup_type,
 475                     backup_id,
 476                     backup_time,
 477                     comment,
 478                     verification,
 479                     fingerprint,
 480                     files,
 481                     size,
 482                     owner,
 483                     protected,
 484                 }
 485             }
 486             Err(err) => {
 487                 eprintln!("error during snapshot file listing: '{}'", err);
 488                 let files = info
 489                     .files
 490                     .into_iter()
 491                     .map(|filename| BackupContent {
 492                         filename,
 493                         size: None,
 494                         crypt_mode: None,
 495                     })
 496                     .collect();
 497
 498                 SnapshotListItem {
 499                     backup_type,
 500                     backup_id,
 501                     backup_time,
 502                     comment: None,
 503                     verification: None,
 504                     fingerprint: None,
 505                     files,
 506                     size: None,
 507                     owner,
 508                     protected,
 509                 }
 510             }
 511         }
 512     };
 513
 514     groups.iter().try_fold(Vec::new(), |mut snapshots, group| {
 515         let owner = match datastore.get_owner(group) {
 516             Ok(auth_id) => auth_id,
 517             Err(err) => {
 518                 eprintln!(
 519                     "Failed to get owner of group '{}/{}' - {}",
 520                     &store, group, err
 521                 );
 522                 return Ok(snapshots);
 523             }
 524         };
 525
 526         if !list_all && check_backup_owner(&owner, &auth_id).is_err() {
 527             return Ok(snapshots);
 528         }
 529
 530         let group_backups = group.list_backups(&datastore.base_path())?;
 531
 532         snapshots.extend(
 533             group_backups
 534                 .into_iter()
 535                 .map(|info| info_to_snapshot_list_item(group, Some(owner.clone()), info)),
 536         );
 537
 538         Ok(snapshots)
 539     })
 540 }
 541
 542 fn get_snapshots_count(store: &DataStore, filter_owner: Option<&Authid>) -> Result<Counts, Error> {
 543     let base_path = store.base_path();
 544     let groups = BackupInfo::list_backup_groups(&base_path)?;
 545
 546     groups
 547         .iter()
 548         .filter(|group| {
 549             let owner = match store.get_owner(group) {
 550                 Ok(owner) => owner,
 551                 Err(err) => {
 552                     eprintln!(
 553                         "Failed to get owner of group '{}/{}' - {}",
 554                         store.name(),
 555                         group,
 556                         err
 557                     );
 558                     return false;
 559                 }
 560             };
 561
 562             match filter_owner {
 563                 Some(filter) => check_backup_owner(&owner, filter).is_ok(),
 564                 None => true,
 565             }
 566         })
 567         .try_fold(Counts::default(), |mut counts, group| {
 568             let snapshot_count = group.list_backups(&base_path)?.len() as u64;
 569
 570             // only include groups with snapshots (avoid confusing users
 571             // by counting/displaying emtpy groups)
 572             if snapshot_count > 0 {
 573                 let type_count = match group.backup_type() {
 574                     "ct" => counts.ct.get_or_insert(Default::default()),
 575                     "vm" => counts.vm.get_or_insert(Default::default()),
 576                     "host" => counts.host.get_or_insert(Default::default()),
 577                     _ => counts.other.get_or_insert(Default::default()),
 578                 };
 579
 580                 type_count.groups += 1;
 581                 type_count.snapshots += snapshot_count;
 582             }
 583
 584             Ok(counts)
 585         })
 586 }
 587
 588 #[api(
 589     input: {
 590         properties: {
 591             store: {
 592                 schema: DATASTORE_SCHEMA,
 593             },
 594             verbose: {
 595                 type: bool,
 596                 default: false,
 597                 optional: true,
 598                 description: "Include additional information like snapshot counts and GC status.",
 599             },
 600         },
 601
 602     },
 603     returns: {
 604         type: DataStoreStatus,
 605     },
 606     access: {
 607         permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_BACKUP, true),
 608     },
 609 )]
 610 /// Get datastore status.
 611 pub fn status(
 612     store: String,
 613     verbose: bool,
 614     _info: &ApiMethod,
 615     rpcenv: &mut dyn RpcEnvironment,
 616 ) -> Result<DataStoreStatus, Error> {
 617     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Read))?;
 618     let storage = crate::tools::disks::disk_usage(&datastore.base_path())?;
 619     let (counts, gc_status) = if verbose {
 620         let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
 621         let user_info = CachedUserInfo::new()?;
 622
 623         let store_privs = user_info.lookup_privs(&auth_id, &["datastore", &store]);
 624         let filter_owner = if store_privs & PRIV_DATASTORE_AUDIT != 0 {
 625             None
 626         } else {
 627             Some(&auth_id)
 628         };
 629
 630         let counts = Some(get_snapshots_count(&datastore, filter_owner)?);
 631         let gc_status = Some(datastore.last_gc_status());
 632
 633         (counts, gc_status)
 634     } else {
 635         (None, None)
 636     };
 637
 638     Ok(DataStoreStatus {
 639         total: storage.total,
 640         used: storage.used,
 641         avail: storage.avail,
 642         gc_status,
 643         counts,
 644     })
 645 }
 646
 647 #[api(
 648     input: {
 649         properties: {
 650             store: {
 651                 schema: DATASTORE_SCHEMA,
 652             },
 653             "backup-type": {
 654                 schema: BACKUP_TYPE_SCHEMA,
 655                 optional: true,
 656             },
 657             "backup-id": {
 658                 schema: BACKUP_ID_SCHEMA,
 659                 optional: true,
 660             },
 661             "ignore-verified": {
 662                 schema: IGNORE_VERIFIED_BACKUPS_SCHEMA,
 663                 optional: true,
 664             },
 665             "outdated-after": {
 666                 schema: VERIFICATION_OUTDATED_AFTER_SCHEMA,
 667                 optional: true,
 668             },
 669             "backup-time": {
 670                 schema: BACKUP_TIME_SCHEMA,
 671                 optional: true,
 672             },
 673         },
 674     },
 675     returns: {
 676         schema: UPID_SCHEMA,
 677     },
 678     access: {
 679         permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_VERIFY | PRIV_DATASTORE_BACKUP, true),
 680     },
 681 )]
 682 /// Verify backups.
 683 ///
 684 /// This function can verify a single backup snapshot, all backup from a backup group,
 685 /// or all backups in the datastore.
 686 pub fn verify(
 687     store: String,
 688     backup_type: Option<String>,
 689     backup_id: Option<String>,
 690     backup_time: Option<i64>,
 691     ignore_verified: Option<bool>,
 692     outdated_after: Option<i64>,
 693     rpcenv: &mut dyn RpcEnvironment,
 694 ) -> Result<Value, Error> {
 695     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Read))?;
 696     let ignore_verified = ignore_verified.unwrap_or(true);
 697
 698     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
 699     let worker_id;
 700
 701     let mut backup_dir = None;
 702     let mut backup_group = None;
 703     let mut worker_type = "verify";
 704
 705     match (backup_type, backup_id, backup_time) {
 706         (Some(backup_type), Some(backup_id), Some(backup_time)) => {
 707             worker_id = format!(
 708                 "{}:{}/{}/{:08X}",
 709                 store, backup_type, backup_id, backup_time
 710             );
 711             let dir = BackupDir::new(backup_type, backup_id, backup_time)?;
 712
 713             check_priv_or_backup_owner(&datastore, dir.group(), &auth_id, PRIV_DATASTORE_VERIFY)?;
 714
 715             backup_dir = Some(dir);
 716             worker_type = "verify_snapshot";
 717         }
 718         (Some(backup_type), Some(backup_id), None) => {
 719             worker_id = format!("{}:{}/{}", store, backup_type, backup_id);
 720             let group = BackupGroup::new(backup_type, backup_id);
 721
 722             check_priv_or_backup_owner(&datastore, &group, &auth_id, PRIV_DATASTORE_VERIFY)?;
 723
 724             backup_group = Some(group);
 725             worker_type = "verify_group";
 726         }
 727         (None, None, None) => {
 728             worker_id = store.clone();
 729         }
 730         _ => bail!("parameters do not specify a backup group or snapshot"),
 731     }
 732
 733     let to_stdout = rpcenv.env_type() == RpcEnvironmentType::CLI;
 734
 735     let upid_str = WorkerTask::new_thread(
 736         worker_type,
 737         Some(worker_id),
 738         auth_id.to_string(),
 739         to_stdout,
 740         move |worker| {
 741             let verify_worker = crate::backup::VerifyWorker::new(worker.clone(), datastore);
 742             let failed_dirs = if let Some(backup_dir) = backup_dir {
 743                 let mut res = Vec::new();
 744                 if !verify_backup_dir(
 745                     &verify_worker,
 746                     &backup_dir,
 747                     worker.upid().clone(),
 748                     Some(&move |manifest| verify_filter(ignore_verified, outdated_after, manifest)),
 749                 )? {
 750                     res.push(backup_dir.to_string());
 751                 }
 752                 res
 753             } else if let Some(backup_group) = backup_group {
 754                 let failed_dirs = verify_backup_group(
 755                     &verify_worker,
 756                     &backup_group,
 757                     &mut StoreProgress::new(1),
 758                     worker.upid(),
 759                     Some(&move |manifest| verify_filter(ignore_verified, outdated_after, manifest)),
 760                 )?;
 761                 failed_dirs
 762             } else {
 763                 let privs = CachedUserInfo::new()?.lookup_privs(&auth_id, &["datastore", &store]);
 764
 765                 let owner = if privs & PRIV_DATASTORE_VERIFY == 0 {
 766                     Some(auth_id)
 767                 } else {
 768                     None
 769                 };
 770
 771                 verify_all_backups(
 772                     &verify_worker,
 773                     worker.upid(),
 774                     owner,
 775                     Some(&move |manifest| verify_filter(ignore_verified, outdated_after, manifest)),
 776                 )?
 777             };
 778             if !failed_dirs.is_empty() {
 779                 task_log!(worker, "Failed to verify the following snapshots/groups:");
 780                 for dir in failed_dirs {
 781                     task_log!(worker, "\t{}", dir);
 782                 }
 783                 bail!("verification failed - please check the log for details");
 784             }
 785             Ok(())
 786         },
 787     )?;
 788
 789     Ok(json!(upid_str))
 790 }
 791
 792 #[api(
 793     input: {
 794         properties: {
 795             "backup-id": {
 796                 schema: BACKUP_ID_SCHEMA,
 797             },
 798             "backup-type": {
 799                 schema: BACKUP_TYPE_SCHEMA,
 800             },
 801             "dry-run": {
 802                 optional: true,
 803                 type: bool,
 804                 default: false,
 805                 description: "Just show what prune would do, but do not delete anything.",
 806             },
 807             "prune-options": {
 808                 type: PruneOptions,
 809                 flatten: true,
 810             },
 811             store: {
 812                 schema: DATASTORE_SCHEMA,
 813             },
 814         },
 815     },
 816     returns: pbs_api_types::ADMIN_DATASTORE_PRUNE_RETURN_TYPE,
 817     access: {
 818         permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_MODIFY | PRIV_DATASTORE_PRUNE, true),
 819     },
 820 )]
 821 /// Prune a group on the datastore
 822 pub fn prune(
 823     backup_id: String,
 824     backup_type: String,
 825     dry_run: bool,
 826     prune_options: PruneOptions,
 827     store: String,
 828     _param: Value,
 829     rpcenv: &mut dyn RpcEnvironment,
 830 ) -> Result<Value, Error> {
 831     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
 832
 833     let group = BackupGroup::new(&backup_type, &backup_id);
 834
 835     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Write))?;
 836
 837     check_priv_or_backup_owner(&datastore, &group, &auth_id, PRIV_DATASTORE_MODIFY)?;
 838
 839     let worker_id = format!("{}:{}/{}", store, &backup_type, &backup_id);
 840
 841     let mut prune_result = Vec::new();
 842
 843     let list = group.list_backups(&datastore.base_path())?;
 844
 845     let mut prune_info = compute_prune_info(list, &prune_options)?;
 846
 847     prune_info.reverse(); // delete older snapshots first
 848
 849     let keep_all = !pbs_datastore::prune::keeps_something(&prune_options);
 850
 851     if dry_run {
 852         for (info, mark) in prune_info {
 853             let keep = keep_all || mark.keep();
 854
 855             let backup_time = info.backup_dir.backup_time();
 856             let group = info.backup_dir.group();
 857
 858             prune_result.push(json!({
 859                 "backup-type": group.backup_type(),
 860                 "backup-id": group.backup_id(),
 861                 "backup-time": backup_time,
 862                 "keep": keep,
 863                 "protected": mark.protected(),
 864             }));
 865         }
 866         return Ok(json!(prune_result));
 867     }
 868
 869     // We use a WorkerTask just to have a task log, but run synchrounously
 870     let worker = WorkerTask::new("prune", Some(worker_id), auth_id.to_string(), true)?;
 871
 872     if keep_all {
 873         task_log!(worker, "No prune selection - keeping all files.");
 874     } else {
 875         task_log!(
 876             worker,
 877             "retention options: {}",
 878             pbs_datastore::prune::cli_options_string(&prune_options)
 879         );
 880         task_log!(
 881             worker,
 882             "Starting prune on store \"{}\" group \"{}/{}\"",
 883             store,
 884             backup_type,
 885             backup_id
 886         );
 887     }
 888
 889     for (info, mark) in prune_info {
 890         let keep = keep_all || mark.keep();
 891
 892         let backup_time = info.backup_dir.backup_time();
 893         let timestamp = info.backup_dir.backup_time_string();
 894         let group = info.backup_dir.group();
 895
 896         let msg = format!(
 897             "{}/{}/{} {}",
 898             group.backup_type(),
 899             group.backup_id(),
 900             timestamp,
 901             mark,
 902         );
 903
 904         task_log!(worker, "{}", msg);
 905
 906         prune_result.push(json!({
 907             "backup-type": group.backup_type(),
 908             "backup-id": group.backup_id(),
 909             "backup-time": backup_time,
 910             "keep": keep,
 911             "protected": mark.protected(),
 912         }));
 913
 914         if !(dry_run || keep) {
 915             if let Err(err) = datastore.remove_backup_dir(&info.backup_dir, false) {
 916                 task_warn!(
 917                     worker,
 918                     "failed to remove dir {:?}: {}",
 919                     info.backup_dir.relative_path(),
 920                     err,
 921                 );
 922             }
 923         }
 924     }
 925
 926     worker.log_result(&Ok(()));
 927
 928     Ok(json!(prune_result))
 929 }
 930
 931 #[api(
 932     input: {
 933         properties: {
 934             "dry-run": {
 935                 optional: true,
 936                 type: bool,
 937                 default: false,
 938                 description: "Just show what prune would do, but do not delete anything.",
 939             },
 940             "prune-options": {
 941                 type: PruneOptions,
 942                 flatten: true,
 943             },
 944             store: {
 945                 schema: DATASTORE_SCHEMA,
 946             },
 947         },
 948     },
 949     returns: {
 950         schema: UPID_SCHEMA,
 951     },
 952     access: {
 953         permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_MODIFY | PRIV_DATASTORE_PRUNE, true),
 954     },
 955 )]
 956 /// Prune the datastore
 957 pub fn prune_datastore(
 958     dry_run: bool,
 959     prune_options: PruneOptions,
 960     store: String,
 961     _param: Value,
 962     rpcenv: &mut dyn RpcEnvironment,
 963 ) -> Result<String, Error> {
 964     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
 965
 966     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Write))?;
 967
 968     let to_stdout = rpcenv.env_type() == RpcEnvironmentType::CLI;
 969
 970     let upid_str = WorkerTask::new_thread(
 971         "prune",
 972         Some(store.clone()),
 973         auth_id.to_string(),
 974         to_stdout,
 975         move |worker| {
 976             crate::server::prune_datastore(
 977                 worker,
 978                 auth_id,
 979                 prune_options,
 980                 &store,
 981                 datastore,
 982                 dry_run,
 983             )
 984         },
 985     )?;
 986
 987     Ok(upid_str)
 988 }
 989
 990 #[api(
 991     input: {
 992         properties: {
 993             store: {
 994                 schema: DATASTORE_SCHEMA,
 995             },
 996         },
 997     },
 998     returns: {
 999         schema: UPID_SCHEMA,
1000     },
1001     access: {
1002         permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_MODIFY, false),
1003     },
1004 )]
1005 /// Start garbage collection.
1006 pub fn start_garbage_collection(
1007     store: String,
1008     _info: &ApiMethod,
1009     rpcenv: &mut dyn RpcEnvironment,
1010 ) -> Result<Value, Error> {
1011     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Write))?;
1012     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
1013
1014     let job = Job::new("garbage_collection", &store)
1015         .map_err(|_| format_err!("garbage collection already running"))?;
1016
1017     let to_stdout = rpcenv.env_type() == RpcEnvironmentType::CLI;
1018
1019     let upid_str =
1020         crate::server::do_garbage_collection_job(job, datastore, &auth_id, None, to_stdout)
1021             .map_err(|err| {
1022                 format_err!(
1023                     "unable to start garbage collection job on datastore {} - {}",
1024                     store,
1025                     err
1026                 )
1027             })?;
1028
1029     Ok(json!(upid_str))
1030 }
1031
1032 #[api(
1033     input: {
1034         properties: {
1035             store: {
1036                 schema: DATASTORE_SCHEMA,
1037             },
1038         },
1039     },
1040     returns: {
1041         type: GarbageCollectionStatus,
1042     },
1043     access: {
1044         permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_AUDIT, false),
1045     },
1046 )]
1047 /// Garbage collection status.
1048 pub fn garbage_collection_status(
1049     store: String,
1050     _info: &ApiMethod,
1051     _rpcenv: &mut dyn RpcEnvironment,
1052 ) -> Result<GarbageCollectionStatus, Error> {
1053     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Read))?;
1054
1055     let status = datastore.last_gc_status();
1056
1057     Ok(status)
1058 }
1059
1060 #[api(
1061     returns: {
1062         description: "List the accessible datastores.",
1063         type: Array,
1064         items: { type: DataStoreListItem },
1065     },
1066     access: {
1067         permission: &Permission::Anybody,
1068     },
1069 )]
1070 /// Datastore list
1071 pub fn get_datastore_list(
1072     _param: Value,
1073     _info: &ApiMethod,
1074     rpcenv: &mut dyn RpcEnvironment,
1075 ) -> Result<Vec<DataStoreListItem>, Error> {
1076     let (config, _digest) = pbs_config::datastore::config()?;
1077
1078     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
1079     let user_info = CachedUserInfo::new()?;
1080
1081     let mut list = Vec::new();
1082
1083     for (store, (_, data)) in &config.sections {
1084         let user_privs = user_info.lookup_privs(&auth_id, &["datastore", store]);
1085         let allowed = (user_privs & (PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_BACKUP)) != 0;
1086         if allowed {
1087             list.push(DataStoreListItem {
1088                 store: store.clone(),
1089                 comment: data["comment"].as_str().map(String::from),
1090             });
1091         }
1092     }
1093
1094     Ok(list)
1095 }
1096
1097 #[sortable]
1098 pub const API_METHOD_DOWNLOAD_FILE: ApiMethod = ApiMethod::new(
1099     &ApiHandler::AsyncHttp(&download_file),
1100     &ObjectSchema::new(
1101         "Download single raw file from backup snapshot.",
1102         &sorted!([
1103             ("store", false, &DATASTORE_SCHEMA),
1104             ("backup-type", false, &BACKUP_TYPE_SCHEMA),
1105             ("backup-id", false, &BACKUP_ID_SCHEMA),
1106             ("backup-time", false, &BACKUP_TIME_SCHEMA),
1107             ("file-name", false, &BACKUP_ARCHIVE_NAME_SCHEMA),
1108         ]),
1109     ),
1110 )
1111 .access(
1112     None,
1113     &Permission::Privilege(
1114         &["datastore", "{store}"],
1115         PRIV_DATASTORE_READ | PRIV_DATASTORE_BACKUP,
1116         true,
1117     ),
1118 );
1119
1120 pub fn download_file(
1121     _parts: Parts,
1122     _req_body: Body,
1123     param: Value,
1124     _info: &ApiMethod,
1125     rpcenv: Box<dyn RpcEnvironment>,
1126 ) -> ApiResponseFuture {
1127     async move {
1128         let store = required_string_param(&param, "store")?;
1129         let datastore = DataStore::lookup_datastore(store, Some(Operation::Read))?;
1130
1131         let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
1132
1133         let file_name = required_string_param(&param, "file-name")?.to_owned();
1134
1135         let backup_type = required_string_param(&param, "backup-type")?;
1136         let backup_id = required_string_param(&param, "backup-id")?;
1137         let backup_time = required_integer_param(&param, "backup-time")?;
1138
1139         let backup_dir = BackupDir::new(backup_type, backup_id, backup_time)?;
1140
1141         check_priv_or_backup_owner(
1142             &datastore,
1143             backup_dir.group(),
1144             &auth_id,
1145             PRIV_DATASTORE_READ,
1146         )?;
1147
1148         println!(
1149             "Download {} from {} ({}/{})",
1150             file_name, store, backup_dir, file_name
1151         );
1152
1153         let mut path = datastore.base_path();
1154         path.push(backup_dir.relative_path());
1155         path.push(&file_name);
1156
1157         let file = tokio::fs::File::open(&path)
1158             .await
1159             .map_err(|err| http_err!(BAD_REQUEST, "File open failed: {}", err))?;
1160
1161         let payload =
1162             tokio_util::codec::FramedRead::new(file, tokio_util::codec::BytesCodec::new())
1163                 .map_ok(|bytes| bytes.freeze())
1164                 .map_err(move |err| {
1165                     eprintln!("error during streaming of '{:?}' - {}", &path, err);
1166                     err
1167                 });
1168         let body = Body::wrap_stream(payload);
1169
1170         // fixme: set other headers ?
1171         Ok(Response::builder()
1172             .status(StatusCode::OK)
1173             .header(header::CONTENT_TYPE, "application/octet-stream")
1174             .body(body)
1175             .unwrap())
1176     }
1177     .boxed()
1178 }
1179
1180 #[sortable]
1181 pub const API_METHOD_DOWNLOAD_FILE_DECODED: ApiMethod = ApiMethod::new(
1182     &ApiHandler::AsyncHttp(&download_file_decoded),
1183     &ObjectSchema::new(
1184         "Download single decoded file from backup snapshot. Only works if it's not encrypted.",
1185         &sorted!([
1186             ("store", false, &DATASTORE_SCHEMA),
1187             ("backup-type", false, &BACKUP_TYPE_SCHEMA),
1188             ("backup-id", false, &BACKUP_ID_SCHEMA),
1189             ("backup-time", false, &BACKUP_TIME_SCHEMA),
1190             ("file-name", false, &BACKUP_ARCHIVE_NAME_SCHEMA),
1191         ]),
1192     ),
1193 )
1194 .access(
1195     None,
1196     &Permission::Privilege(
1197         &["datastore", "{store}"],
1198         PRIV_DATASTORE_READ | PRIV_DATASTORE_BACKUP,
1199         true,
1200     ),
1201 );
1202
1203 pub fn download_file_decoded(
1204     _parts: Parts,
1205     _req_body: Body,
1206     param: Value,
1207     _info: &ApiMethod,
1208     rpcenv: Box<dyn RpcEnvironment>,
1209 ) -> ApiResponseFuture {
1210     async move {
1211         let store = required_string_param(&param, "store")?;
1212         let datastore = DataStore::lookup_datastore(store, Some(Operation::Read))?;
1213
1214         let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
1215
1216         let file_name = required_string_param(&param, "file-name")?.to_owned();
1217
1218         let backup_type = required_string_param(&param, "backup-type")?;
1219         let backup_id = required_string_param(&param, "backup-id")?;
1220         let backup_time = required_integer_param(&param, "backup-time")?;
1221
1222         let backup_dir = BackupDir::new(backup_type, backup_id, backup_time)?;
1223
1224         check_priv_or_backup_owner(
1225             &datastore,
1226             backup_dir.group(),
1227             &auth_id,
1228             PRIV_DATASTORE_READ,
1229         )?;
1230
1231         let (manifest, files) = read_backup_index(&datastore, &backup_dir)?;
1232         for file in files {
1233             if file.filename == file_name && file.crypt_mode == Some(CryptMode::Encrypt) {
1234                 bail!("cannot decode '{}' - is encrypted", file_name);
1235             }
1236         }
1237
1238         println!(
1239             "Download {} from {} ({}/{})",
1240             file_name, store, backup_dir, file_name
1241         );
1242
1243         let mut path = datastore.base_path();
1244         path.push(backup_dir.relative_path());
1245         path.push(&file_name);
1246
1247         let extension = file_name.rsplitn(2, '.').next().unwrap();
1248
1249         let body = match extension {
1250             "didx" => {
1251                 let index = DynamicIndexReader::open(&path).map_err(|err| {
1252                     format_err!("unable to read dynamic index '{:?}' - {}", &path, err)
1253                 })?;
1254                 let (csum, size) = index.compute_csum();
1255                 manifest.verify_file(&file_name, &csum, size)?;
1256
1257                 let chunk_reader = LocalChunkReader::new(datastore, None, CryptMode::None);
1258                 let reader = CachedChunkReader::new(chunk_reader, index, 1).seekable();
1259                 Body::wrap_stream(AsyncReaderStream::new(reader).map_err(move |err| {
1260                     eprintln!("error during streaming of '{:?}' - {}", path, err);
1261                     err
1262                 }))
1263             }
1264             "fidx" => {
1265                 let index = FixedIndexReader::open(&path).map_err(|err| {
1266                     format_err!("unable to read fixed index '{:?}' - {}", &path, err)
1267                 })?;
1268
1269                 let (csum, size) = index.compute_csum();
1270                 manifest.verify_file(&file_name, &csum, size)?;
1271
1272                 let chunk_reader = LocalChunkReader::new(datastore, None, CryptMode::None);
1273                 let reader = CachedChunkReader::new(chunk_reader, index, 1).seekable();
1274                 Body::wrap_stream(
1275                     AsyncReaderStream::with_buffer_size(reader, 4 * 1024 * 1024).map_err(
1276                         move |err| {
1277                             eprintln!("error during streaming of '{:?}' - {}", path, err);
1278                             err
1279                         },
1280                     ),
1281                 )
1282             }
1283             "blob" => {
1284                 let file = std::fs::File::open(&path)
1285                     .map_err(|err| http_err!(BAD_REQUEST, "File open failed: {}", err))?;
1286
1287                 // FIXME: load full blob to verify index checksum?
1288
1289                 Body::wrap_stream(
1290                     WrappedReaderStream::new(DataBlobReader::new(file, None)?).map_err(
1291                         move |err| {
1292                             eprintln!("error during streaming of '{:?}' - {}", path, err);
1293                             err
1294                         },
1295                     ),
1296                 )
1297             }
1298             extension => {
1299                 bail!("cannot download '{}' files", extension);
1300             }
1301         };
1302
1303         // fixme: set other headers ?
1304         Ok(Response::builder()
1305             .status(StatusCode::OK)
1306             .header(header::CONTENT_TYPE, "application/octet-stream")
1307             .body(body)
1308             .unwrap())
1309     }
1310     .boxed()
1311 }
1312
1313 #[sortable]
1314 pub const API_METHOD_UPLOAD_BACKUP_LOG: ApiMethod = ApiMethod::new(
1315     &ApiHandler::AsyncHttp(&upload_backup_log),
1316     &ObjectSchema::new(
1317         "Upload the client backup log file into a backup snapshot ('client.log.blob').",
1318         &sorted!([
1319             ("store", false, &DATASTORE_SCHEMA),
1320             ("backup-type", false, &BACKUP_TYPE_SCHEMA),
1321             ("backup-id", false, &BACKUP_ID_SCHEMA),
1322             ("backup-time", false, &BACKUP_TIME_SCHEMA),
1323         ]),
1324     ),
1325 )
1326 .access(
1327     Some("Only the backup creator/owner is allowed to do this."),
1328     &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_BACKUP, false),
1329 );
1330
1331 pub fn upload_backup_log(
1332     _parts: Parts,
1333     req_body: Body,
1334     param: Value,
1335     _info: &ApiMethod,
1336     rpcenv: Box<dyn RpcEnvironment>,
1337 ) -> ApiResponseFuture {
1338     async move {
1339         let store = required_string_param(&param, "store")?;
1340         let datastore = DataStore::lookup_datastore(store, Some(Operation::Write))?;
1341
1342         let file_name = CLIENT_LOG_BLOB_NAME;
1343
1344         let backup_type = required_string_param(&param, "backup-type")?;
1345         let backup_id = required_string_param(&param, "backup-id")?;
1346         let backup_time = required_integer_param(&param, "backup-time")?;
1347
1348         let backup_dir = BackupDir::new(backup_type, backup_id, backup_time)?;
1349
1350         let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
1351         let owner = datastore.get_owner(backup_dir.group())?;
1352         check_backup_owner(&owner, &auth_id)?;
1353
1354         let mut path = datastore.base_path();
1355         path.push(backup_dir.relative_path());
1356         path.push(&file_name);
1357
1358         if path.exists() {
1359             bail!("backup already contains a log.");
1360         }
1361
1362         println!(
1363             "Upload backup log to {}/{}/{}/{}/{}",
1364             store,
1365             backup_type,
1366             backup_id,
1367             backup_dir.backup_time_string(),
1368             file_name
1369         );
1370
1371         let data = req_body
1372             .map_err(Error::from)
1373             .try_fold(Vec::new(), |mut acc, chunk| {
1374                 acc.extend_from_slice(&*chunk);
1375                 future::ok::<_, Error>(acc)
1376             })
1377             .await?;
1378
1379         // always verify blob/CRC at server side
1380         let blob = DataBlob::load_from_reader(&mut &data[..])?;
1381
1382         replace_file(&path, blob.raw_data(), CreateOptions::new(), false)?;
1383
1384         // fixme: use correct formatter
1385         Ok(formatter::JSON_FORMATTER.format_data(Value::Null, &*rpcenv))
1386     }
1387     .boxed()
1388 }
1389
1390 #[api(
1391     input: {
1392         properties: {
1393             store: {
1394                 schema: DATASTORE_SCHEMA,
1395             },
1396             "backup-type": {
1397                 schema: BACKUP_TYPE_SCHEMA,
1398             },
1399             "backup-id": {
1400                 schema: BACKUP_ID_SCHEMA,
1401             },
1402             "backup-time": {
1403                 schema: BACKUP_TIME_SCHEMA,
1404             },
1405             "filepath": {
1406                 description: "Base64 encoded path.",
1407                 type: String,
1408             }
1409         },
1410     },
1411     access: {
1412         permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_READ | PRIV_DATASTORE_BACKUP, true),
1413     },
1414 )]
1415 /// Get the entries of the given path of the catalog
1416 pub fn catalog(
1417     store: String,
1418     backup_type: String,
1419     backup_id: String,
1420     backup_time: i64,
1421     filepath: String,
1422     rpcenv: &mut dyn RpcEnvironment,
1423 ) -> Result<Vec<ArchiveEntry>, Error> {
1424     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Read))?;
1425
1426     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
1427
1428     let backup_dir = BackupDir::new(backup_type, backup_id, backup_time)?;
1429
1430     check_priv_or_backup_owner(
1431         &datastore,
1432         backup_dir.group(),
1433         &auth_id,
1434         PRIV_DATASTORE_READ,
1435     )?;
1436
1437     let file_name = CATALOG_NAME;
1438
1439     let (manifest, files) = read_backup_index(&datastore, &backup_dir)?;
1440     for file in files {
1441         if file.filename == file_name && file.crypt_mode == Some(CryptMode::Encrypt) {
1442             bail!("cannot decode '{}' - is encrypted", file_name);
1443         }
1444     }
1445
1446     let mut path = datastore.base_path();
1447     path.push(backup_dir.relative_path());
1448     path.push(file_name);
1449
1450     let index = DynamicIndexReader::open(&path)
1451         .map_err(|err| format_err!("unable to read dynamic index '{:?}' - {}", &path, err))?;
1452
1453     let (csum, size) = index.compute_csum();
1454     manifest.verify_file(file_name, &csum, size)?;
1455
1456     let chunk_reader = LocalChunkReader::new(datastore, None, CryptMode::None);
1457     let reader = BufferedDynamicReader::new(index, chunk_reader);
1458
1459     let mut catalog_reader = CatalogReader::new(reader);
1460
1461     let path = if filepath != "root" && filepath != "/" {
1462         base64::decode(filepath)?
1463     } else {
1464         vec![b'/']
1465     };
1466
1467     catalog_reader.list_dir_contents(&path)
1468 }
1469
1470 #[sortable]
1471 pub const API_METHOD_PXAR_FILE_DOWNLOAD: ApiMethod = ApiMethod::new(
1472     &ApiHandler::AsyncHttp(&pxar_file_download),
1473     &ObjectSchema::new(
1474         "Download single file from pxar file of a backup snapshot. Only works if it's not encrypted.",
1475         &sorted!([
1476             ("store", false, &DATASTORE_SCHEMA),
1477             ("backup-type", false, &BACKUP_TYPE_SCHEMA),
1478             ("backup-id", false,  &BACKUP_ID_SCHEMA),
1479             ("backup-time", false, &BACKUP_TIME_SCHEMA),
1480             ("filepath", false, &StringSchema::new("Base64 encoded path").schema()),
1481             ("tar", true, &BooleanSchema::new("Download as .tar.zst").schema()),
1482         ]),
1483     )
1484 ).access(None, &Permission::Privilege(
1485     &["datastore", "{store}"],
1486     PRIV_DATASTORE_READ | PRIV_DATASTORE_BACKUP,
1487     true)
1488 );
1489
1490 pub fn pxar_file_download(
1491     _parts: Parts,
1492     _req_body: Body,
1493     param: Value,
1494     _info: &ApiMethod,
1495     rpcenv: Box<dyn RpcEnvironment>,
1496 ) -> ApiResponseFuture {
1497     async move {
1498         let store = required_string_param(&param, "store")?;
1499         let datastore = DataStore::lookup_datastore(&store, Some(Operation::Read))?;
1500
1501         let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
1502
1503         let filepath = required_string_param(&param, "filepath")?.to_owned();
1504
1505         let backup_type = required_string_param(&param, "backup-type")?;
1506         let backup_id = required_string_param(&param, "backup-id")?;
1507         let backup_time = required_integer_param(&param, "backup-time")?;
1508
1509         let tar = param["tar"].as_bool().unwrap_or(false);
1510
1511         let backup_dir = BackupDir::new(backup_type, backup_id, backup_time)?;
1512
1513         check_priv_or_backup_owner(
1514             &datastore,
1515             backup_dir.group(),
1516             &auth_id,
1517             PRIV_DATASTORE_READ,
1518         )?;
1519
1520         let mut components = base64::decode(&filepath)?;
1521         if !components.is_empty() && components[0] == b'/' {
1522             components.remove(0);
1523         }
1524
1525         let mut split = components.splitn(2, |c| *c == b'/');
1526         let pxar_name = std::str::from_utf8(split.next().unwrap())?;
1527         let file_path = split.next().unwrap_or(b"/");
1528         let (manifest, files) = read_backup_index(&datastore, &backup_dir)?;
1529         for file in files {
1530             if file.filename == pxar_name && file.crypt_mode == Some(CryptMode::Encrypt) {
1531                 bail!("cannot decode '{}' - is encrypted", pxar_name);
1532             }
1533         }
1534
1535         let mut path = datastore.base_path();
1536         path.push(backup_dir.relative_path());
1537         path.push(pxar_name);
1538
1539         let index = DynamicIndexReader::open(&path)
1540             .map_err(|err| format_err!("unable to read dynamic index '{:?}' - {}", &path, err))?;
1541
1542         let (csum, size) = index.compute_csum();
1543         manifest.verify_file(pxar_name, &csum, size)?;
1544
1545         let chunk_reader = LocalChunkReader::new(datastore, None, CryptMode::None);
1546         let reader = BufferedDynamicReader::new(index, chunk_reader);
1547         let archive_size = reader.archive_size();
1548         let reader = LocalDynamicReadAt::new(reader);
1549
1550         let decoder = Accessor::new(reader, archive_size).await?;
1551         let root = decoder.open_root().await?;
1552         let path = OsStr::from_bytes(file_path).to_os_string();
1553         let file = root
1554             .lookup(&path)
1555             .await?
1556             .ok_or_else(|| format_err!("error opening '{:?}'", path))?;
1557
1558         let body = match file.kind() {
1559             EntryKind::File { .. } => Body::wrap_stream(
1560                 AsyncReaderStream::new(file.contents().await?).map_err(move |err| {
1561                     eprintln!("error during streaming of file '{:?}' - {}", filepath, err);
1562                     err
1563                 }),
1564             ),
1565             EntryKind::Hardlink(_) => Body::wrap_stream(
1566                 AsyncReaderStream::new(decoder.follow_hardlink(&file).await?.contents().await?)
1567                     .map_err(move |err| {
1568                         eprintln!("error during streaming of hardlink '{:?}' - {}", path, err);
1569                         err
1570                     }),
1571             ),
1572             EntryKind::Directory => {
1573                 let (sender, receiver) = tokio::sync::mpsc::channel::<Result<_, Error>>(100);
1574                 let channelwriter = AsyncChannelWriter::new(sender, 1024 * 1024);
1575                 if tar {
1576                     proxmox_rest_server::spawn_internal_task(create_tar(
1577                         channelwriter,
1578                         decoder,
1579                         path.clone(),
1580                         false,
1581                     ));
1582                     let zstdstream = ZstdEncoder::new(ReceiverStream::new(receiver))?;
1583                     Body::wrap_stream(zstdstream.map_err(move |err| {
1584                         eprintln!("error during streaming of tar.zst '{:?}' - {}", path, err);
1585                         err
1586                     }))
1587                 } else {
1588                     proxmox_rest_server::spawn_internal_task(create_zip(
1589                         channelwriter,
1590                         decoder,
1591                         path.clone(),
1592                         false,
1593                     ));
1594                     Body::wrap_stream(ReceiverStream::new(receiver).map_err(move |err| {
1595                         eprintln!("error during streaming of zip '{:?}' - {}", path, err);
1596                         err
1597                     }))
1598                 }
1599             }
1600             other => bail!("cannot download file of type {:?}", other),
1601         };
1602
1603         // fixme: set other headers ?
1604         Ok(Response::builder()
1605             .status(StatusCode::OK)
1606             .header(header::CONTENT_TYPE, "application/octet-stream")
1607             .body(body)
1608             .unwrap())
1609     }
1610     .boxed()
1611 }
1612
1613 #[api(
1614     input: {
1615         properties: {
1616             store: {
1617                 schema: DATASTORE_SCHEMA,
1618             },
1619             timeframe: {
1620                 type: RRDTimeFrame,
1621             },
1622             cf: {
1623                 type: RRDMode,
1624             },
1625         },
1626     },
1627     access: {
1628         permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_BACKUP, true),
1629     },
1630 )]
1631 /// Read datastore stats
1632 pub fn get_rrd_stats(
1633     store: String,
1634     timeframe: RRDTimeFrame,
1635     cf: RRDMode,
1636     _param: Value,
1637 ) -> Result<Value, Error> {
1638     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Read))?;
1639     let disk_manager = crate::tools::disks::DiskManage::new();
1640
1641     let mut rrd_fields = vec![
1642         "total",
1643         "used",
1644         "read_ios",
1645         "read_bytes",
1646         "write_ios",
1647         "write_bytes",
1648     ];
1649
1650     // we do not have io_ticks for zpools, so don't include them
1651     match disk_manager.find_mounted_device(&datastore.base_path()) {
1652         Ok(Some((fs_type, _, _))) if fs_type.as_str() == "zfs" => {}
1653         _ => rrd_fields.push("io_ticks"),
1654     };
1655
1656     create_value_from_rrd(&format!("datastore/{}", store), &rrd_fields, timeframe, cf)
1657 }
1658
1659 #[api(
1660     input: {
1661         properties: {
1662             store: {
1663                 schema: DATASTORE_SCHEMA,
1664             },
1665         },
1666     },
1667     access: {
1668         permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_AUDIT, true),
1669     },
1670 )]
1671 /// Read datastore stats
1672 pub fn get_active_operations(store: String, _param: Value) -> Result<Value, Error> {
1673     let active_operations = task_tracking::get_active_operations(&store)?;
1674     Ok(json!({
1675         "read": active_operations.read,
1676         "write": active_operations.write,
1677     }))
1678 }
1679
1680 #[api(
1681     input: {
1682         properties: {
1683             store: {
1684                 schema: DATASTORE_SCHEMA,
1685             },
1686             "backup-type": {
1687                 schema: BACKUP_TYPE_SCHEMA,
1688             },
1689             "backup-id": {
1690                 schema: BACKUP_ID_SCHEMA,
1691             },
1692         },
1693     },
1694     access: {
1695         permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_BACKUP, true),
1696     },
1697 )]
1698 /// Get "notes" for a backup group
1699 pub fn get_group_notes(
1700     store: String,
1701     backup_type: String,
1702     backup_id: String,
1703     rpcenv: &mut dyn RpcEnvironment,
1704 ) -> Result<String, Error> {
1705     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Read))?;
1706
1707     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
1708     let backup_group = BackupGroup::new(backup_type, backup_id);
1709
1710     check_priv_or_backup_owner(&datastore, &backup_group, &auth_id, PRIV_DATASTORE_AUDIT)?;
1711
1712     let note_path = get_group_note_path(&datastore, &backup_group);
1713     Ok(file_read_optional_string(note_path)?.unwrap_or_else(|| "".to_owned()))
1714 }
1715
1716 #[api(
1717     input: {
1718         properties: {
1719             store: {
1720                 schema: DATASTORE_SCHEMA,
1721             },
1722             "backup-type": {
1723                 schema: BACKUP_TYPE_SCHEMA,
1724             },
1725             "backup-id": {
1726                 schema: BACKUP_ID_SCHEMA,
1727             },
1728             notes: {
1729                 description: "A multiline text.",
1730             },
1731         },
1732     },
1733     access: {
1734         permission: &Permission::Privilege(&["datastore", "{store}"],
1735                                            PRIV_DATASTORE_MODIFY | PRIV_DATASTORE_BACKUP,
1736                                            true),
1737     },
1738 )]
1739 /// Set "notes" for a backup group
1740 pub fn set_group_notes(
1741     store: String,
1742     backup_type: String,
1743     backup_id: String,
1744     notes: String,
1745     rpcenv: &mut dyn RpcEnvironment,
1746 ) -> Result<(), Error> {
1747     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Write))?;
1748
1749     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
1750     let backup_group = BackupGroup::new(backup_type, backup_id);
1751
1752     check_priv_or_backup_owner(&datastore, &backup_group, &auth_id, PRIV_DATASTORE_MODIFY)?;
1753
1754     let note_path = get_group_note_path(&datastore, &backup_group);
1755     replace_file(note_path, notes.as_bytes(), CreateOptions::new(), false)?;
1756
1757     Ok(())
1758 }
1759
1760 #[api(
1761     input: {
1762         properties: {
1763             store: {
1764                 schema: DATASTORE_SCHEMA,
1765             },
1766             "backup-type": {
1767                 schema: BACKUP_TYPE_SCHEMA,
1768             },
1769             "backup-id": {
1770                 schema: BACKUP_ID_SCHEMA,
1771             },
1772             "backup-time": {
1773                 schema: BACKUP_TIME_SCHEMA,
1774             },
1775         },
1776     },
1777     access: {
1778         permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_BACKUP, true),
1779     },
1780 )]
1781 /// Get "notes" for a specific backup
1782 pub fn get_notes(
1783     store: String,
1784     backup_type: String,
1785     backup_id: String,
1786     backup_time: i64,
1787     rpcenv: &mut dyn RpcEnvironment,
1788 ) -> Result<String, Error> {
1789     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Read))?;
1790
1791     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
1792     let backup_dir = BackupDir::new(backup_type, backup_id, backup_time)?;
1793
1794     check_priv_or_backup_owner(
1795         &datastore,
1796         backup_dir.group(),
1797         &auth_id,
1798         PRIV_DATASTORE_AUDIT,
1799     )?;
1800
1801     let (manifest, _) = datastore.load_manifest(&backup_dir)?;
1802
1803     let notes = manifest.unprotected["notes"].as_str().unwrap_or("");
1804
1805     Ok(String::from(notes))
1806 }
1807
1808 #[api(
1809     input: {
1810         properties: {
1811             store: {
1812                 schema: DATASTORE_SCHEMA,
1813             },
1814             "backup-type": {
1815                 schema: BACKUP_TYPE_SCHEMA,
1816             },
1817             "backup-id": {
1818                 schema: BACKUP_ID_SCHEMA,
1819             },
1820             "backup-time": {
1821                 schema: BACKUP_TIME_SCHEMA,
1822             },
1823             notes: {
1824                 description: "A multiline text.",
1825             },
1826         },
1827     },
1828     access: {
1829         permission: &Permission::Privilege(&["datastore", "{store}"],
1830                                            PRIV_DATASTORE_MODIFY | PRIV_DATASTORE_BACKUP,
1831                                            true),
1832     },
1833 )]
1834 /// Set "notes" for a specific backup
1835 pub fn set_notes(
1836     store: String,
1837     backup_type: String,
1838     backup_id: String,
1839     backup_time: i64,
1840     notes: String,
1841     rpcenv: &mut dyn RpcEnvironment,
1842 ) -> Result<(), Error> {
1843     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Write))?;
1844
1845     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
1846     let backup_dir = BackupDir::new(backup_type, backup_id, backup_time)?;
1847
1848     check_priv_or_backup_owner(
1849         &datastore,
1850         backup_dir.group(),
1851         &auth_id,
1852         PRIV_DATASTORE_MODIFY,
1853     )?;
1854
1855     datastore
1856         .update_manifest(&backup_dir, |manifest| {
1857             manifest.unprotected["notes"] = notes.into();
1858         })
1859         .map_err(|err| format_err!("unable to update manifest blob - {}", err))?;
1860
1861     Ok(())
1862 }
1863
1864 #[api(
1865     input: {
1866         properties: {
1867             store: {
1868                 schema: DATASTORE_SCHEMA,
1869             },
1870             "backup-type": {
1871                 schema: BACKUP_TYPE_SCHEMA,
1872             },
1873             "backup-id": {
1874                 schema: BACKUP_ID_SCHEMA,
1875             },
1876             "backup-time": {
1877                 schema: BACKUP_TIME_SCHEMA,
1878             },
1879         },
1880     },
1881     access: {
1882         permission: &Permission::Privilege(&["datastore", "{store}"], PRIV_DATASTORE_AUDIT | PRIV_DATASTORE_BACKUP, true),
1883     },
1884 )]
1885 /// Query protection for a specific backup
1886 pub fn get_protection(
1887     store: String,
1888     backup_type: String,
1889     backup_id: String,
1890     backup_time: i64,
1891     rpcenv: &mut dyn RpcEnvironment,
1892 ) -> Result<bool, Error> {
1893     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Read))?;
1894
1895     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
1896     let backup_dir = BackupDir::new(backup_type, backup_id, backup_time)?;
1897
1898     check_priv_or_backup_owner(
1899         &datastore,
1900         backup_dir.group(),
1901         &auth_id,
1902         PRIV_DATASTORE_AUDIT,
1903     )?;
1904
1905     Ok(backup_dir.is_protected(datastore.base_path()))
1906 }
1907
1908 #[api(
1909     input: {
1910         properties: {
1911             store: {
1912                 schema: DATASTORE_SCHEMA,
1913             },
1914             "backup-type": {
1915                 schema: BACKUP_TYPE_SCHEMA,
1916             },
1917             "backup-id": {
1918                 schema: BACKUP_ID_SCHEMA,
1919             },
1920             "backup-time": {
1921                 schema: BACKUP_TIME_SCHEMA,
1922             },
1923             protected: {
1924                 description: "Enable/disable protection.",
1925             },
1926         },
1927     },
1928     access: {
1929         permission: &Permission::Privilege(&["datastore", "{store}"],
1930                                            PRIV_DATASTORE_MODIFY | PRIV_DATASTORE_BACKUP,
1931                                            true),
1932     },
1933 )]
1934 /// En- or disable protection for a specific backup
1935 pub fn set_protection(
1936     store: String,
1937     backup_type: String,
1938     backup_id: String,
1939     backup_time: i64,
1940     protected: bool,
1941     rpcenv: &mut dyn RpcEnvironment,
1942 ) -> Result<(), Error> {
1943     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Write))?;
1944
1945     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
1946     let backup_dir = BackupDir::new(backup_type, backup_id, backup_time)?;
1947
1948     check_priv_or_backup_owner(
1949         &datastore,
1950         backup_dir.group(),
1951         &auth_id,
1952         PRIV_DATASTORE_MODIFY,
1953     )?;
1954
1955     datastore.update_protection(&backup_dir, protected)
1956 }
1957
1958 #[api(
1959     input: {
1960         properties: {
1961             store: {
1962                 schema: DATASTORE_SCHEMA,
1963             },
1964             "backup-type": {
1965                 schema: BACKUP_TYPE_SCHEMA,
1966             },
1967             "backup-id": {
1968                 schema: BACKUP_ID_SCHEMA,
1969             },
1970             "new-owner": {
1971                 type: Authid,
1972             },
1973         },
1974     },
1975     access: {
1976         permission: &Permission::Anybody,
1977         description: "Datastore.Modify on whole datastore, or changing ownership between user and a user's token for owned backups with Datastore.Backup"
1978     },
1979 )]
1980 /// Change owner of a backup group
1981 pub fn set_backup_owner(
1982     store: String,
1983     backup_type: String,
1984     backup_id: String,
1985     new_owner: Authid,
1986     rpcenv: &mut dyn RpcEnvironment,
1987 ) -> Result<(), Error> {
1988     let datastore = DataStore::lookup_datastore(&store, Some(Operation::Write))?;
1989
1990     let backup_group = BackupGroup::new(backup_type, backup_id);
1991
1992     let auth_id: Authid = rpcenv.get_auth_id().unwrap().parse()?;
1993
1994     let user_info = CachedUserInfo::new()?;
1995
1996     let privs = user_info.lookup_privs(&auth_id, &["datastore", &store]);
1997
1998     let allowed = if (privs & PRIV_DATASTORE_MODIFY) != 0 {
1999         // High-privilege user/token
2000         true
2001     } else if (privs & PRIV_DATASTORE_BACKUP) != 0 {
2002         let owner = datastore.get_owner(&backup_group)?;
2003
2004         match (owner.is_token(), new_owner.is_token()) {
2005             (true, true) => {
2006                 // API token to API token, owned by same user
2007                 let owner = owner.user();
2008                 let new_owner = new_owner.user();
2009                 owner == new_owner && Authid::from(owner.clone()) == auth_id
2010             }
2011             (true, false) => {
2012                 // API token to API token owner
2013                 Authid::from(owner.user().clone()) == auth_id && new_owner == auth_id
2014             }
2015             (false, true) => {
2016                 // API token owner to API token
2017                 owner == auth_id && Authid::from(new_owner.user().clone()) == auth_id
2018             }
2019             (false, false) => {
2020                 // User to User, not allowed for unprivileged users
2021                 false
2022             }
2023         }
2024     } else {
2025         false
2026     };
2027
2028     if !allowed {
2029         return Err(http_err!(
2030             UNAUTHORIZED,
2031             "{} does not have permission to change owner of backup group '{}' to {}",
2032             auth_id,
2033             backup_group,
2034             new_owner,
2035         ));
2036     }
2037
2038     if !user_info.is_active_auth_id(&new_owner) {
2039         bail!(
2040             "{} '{}' is inactive or non-existent",
2041             if new_owner.is_token() {
2042                 "API token".to_string()
2043             } else {
2044                 "user".to_string()
2045             },
2046             new_owner
2047         );
2048     }
2049
2050     datastore.set_owner(&backup_group, &new_owner, true)?;
2051
2052     Ok(())
2053 }
2054
2055 #[sortable]
2056 const DATASTORE_INFO_SUBDIRS: SubdirMap = &[
2057     (
2058         "active-operations",
2059         &Router::new().get(&API_METHOD_GET_ACTIVE_OPERATIONS),
2060     ),
2061     ("catalog", &Router::new().get(&API_METHOD_CATALOG)),
2062     (
2063         "change-owner",
2064         &Router::new().post(&API_METHOD_SET_BACKUP_OWNER),
2065     ),
2066     (
2067         "download",
2068         &Router::new().download(&API_METHOD_DOWNLOAD_FILE),
2069     ),
2070     (
2071         "download-decoded",
2072         &Router::new().download(&API_METHOD_DOWNLOAD_FILE_DECODED),
2073     ),
2074     ("files", &Router::new().get(&API_METHOD_LIST_SNAPSHOT_FILES)),
2075     (
2076         "gc",
2077         &Router::new()
2078             .get(&API_METHOD_GARBAGE_COLLECTION_STATUS)
2079             .post(&API_METHOD_START_GARBAGE_COLLECTION),
2080     ),
2081     (
2082         "group-notes",
2083         &Router::new()
2084             .get(&API_METHOD_GET_GROUP_NOTES)
2085             .put(&API_METHOD_SET_GROUP_NOTES),
2086     ),
2087     (
2088         "groups",
2089         &Router::new()
2090             .get(&API_METHOD_LIST_GROUPS)
2091             .delete(&API_METHOD_DELETE_GROUP),
2092     ),
2093     (
2094         "notes",
2095         &Router::new()
2096             .get(&API_METHOD_GET_NOTES)
2097             .put(&API_METHOD_SET_NOTES),
2098     ),
2099     (
2100         "protected",
2101         &Router::new()
2102             .get(&API_METHOD_GET_PROTECTION)
2103             .put(&API_METHOD_SET_PROTECTION),
2104     ),
2105     ("prune", &Router::new().post(&API_METHOD_PRUNE)),
2106     (
2107         "prune-datastore",
2108         &Router::new().post(&API_METHOD_PRUNE_DATASTORE),
2109     ),
2110     (
2111         "pxar-file-download",
2112         &Router::new().download(&API_METHOD_PXAR_FILE_DOWNLOAD),
2113     ),
2114     ("rrd", &Router::new().get(&API_METHOD_GET_RRD_STATS)),
2115     (
2116         "snapshots",
2117         &Router::new()
2118             .get(&API_METHOD_LIST_SNAPSHOTS)
2119             .delete(&API_METHOD_DELETE_SNAPSHOT),
2120     ),
2121     ("status", &Router::new().get(&API_METHOD_STATUS)),
2122     (
2123         "upload-backup-log",
2124         &Router::new().upload(&API_METHOD_UPLOAD_BACKUP_LOG),
2125     ),
2126     ("verify", &Router::new().post(&API_METHOD_VERIFY)),
2127 ];
2128
2129 const DATASTORE_INFO_ROUTER: Router = Router::new()
2130     .get(&list_subdirs_api_method!(DATASTORE_INFO_SUBDIRS))
2131     .subdirs(DATASTORE_INFO_SUBDIRS);
2132
2133 pub const ROUTER: Router = Router::new()
2134     .get(&API_METHOD_GET_DATASTORE_LIST)
2135     .match_all("store", &DATASTORE_INFO_ROUTER);