user white/blacklist: allow multiple entries for adding/deleting

[pmg-api.git] / PMG / RESTEnvironment.pm

diff --git a/PMG/RESTEnvironment.pm b/PMG/RESTEnvironment.pm
index 0ad725a99cf4456c7d56ac0c2bc0849e54218b54..3875720e40f9776eb8a20708f525960d37fca855 100644 (file)
--- a/PMG/RESTEnvironment.pm
+++ b/PMG/RESTEnvironment.pm
@@ -5,6 +5,7 @@ use warnings;
 
 use PVE::INotify;
 use PVE::RESTEnvironment;
+use PVE::Exception qw(raise_perm_exc);
 
 use PMG::Cluster;
 use PMG::ClusterConfig;
@@ -36,10 +37,33 @@ sub init_request {
     $self->SUPER::init_request(%params);
     
     $self->{ticket} = undef;
+    $self->{role} = undef;
+    $self->{format} = undef;
     $self->{cinfo} = PVE::INotify::read_file("cluster.conf");
     $self->{usercfg} = PVE::INotify::read_file("pmg-user.conf");
 }
 
+sub setup_default_cli_env {
+    my ($class, $username) = @_;
+
+    $class->SUPER::setup_default_cli_env($username);
+
+    my $rest_env = $class->get();
+    $rest_env->set_role('root');
+}
+
+sub set_format {
+    my ($self, $ticket) = @_;
+
+    $self->{format} = $ticket;
+}
+
+sub get_format {
+    my ($self) = @_;
+
+    return $self->{format} // 'json';
+}
+
 sub set_ticket {
     my ($self, $ticket) = @_;
 
@@ -52,6 +76,18 @@ sub get_ticket {
     return $self->{ticket};
 }
 
+sub set_role {
+    my ($self, $user) = @_;
+
+    $self->{role} = $user;
+}
+
+sub get_role {
+    my ($self) = @_;
+
+    return $self->{role};
+}
+
 sub check_node_is_master {
     my ($self, $noerr);
 
@@ -65,7 +101,9 @@ sub check_node_is_master {
 }
 
 sub check_api2_permissions {
-    my ($self, $perm, $username, $uri_param) = @_;
+    my ($self, $perm, $uri_param) = @_;
+
+    my $username = $self->get_user(1);
 
     return 1 if !$username && $perm->{user} && $perm->{user} eq 'world';
 
@@ -77,9 +115,14 @@ sub check_api2_permissions {
 
     return 1 if $perm->{user} && $perm->{user} eq 'all';
 
-    my $role = PMG::AccessControl::check_user_enabled($self->{usercfg}, $username);
+    my $role = $self->{role};
 
     if (my $allowed_roles = $perm->{check}) {
+       if ($role eq 'helpdesk') {
+           # helpdesk is qmanager + audit
+           return 1 if grep { $_ eq 'audit' } @$allowed_roles;
+           return 1 if grep { $_ eq 'qmanager' } @$allowed_roles;
+       }
        return 1 if grep { $_ eq $role } @$allowed_roles;
     }