ticket: add comments about auth key mtime

[pve-access-control.git] / PVE / API2 / User.pm

diff --git a/PVE/API2/User.pm b/PVE/API2/User.pm
index 89c83430165e1ce84b2dbe051b48cae0c8c06d63..fb5b22a8525bc60000b1ffd325eeda62aa7a21cf 100644 (file)
--- a/PVE/API2/User.pm
+++ b/PVE/API2/User.pm
@@ -15,7 +15,6 @@ use PVE::RESTHandler;
 use base qw(PVE::RESTHandler);
 
 register_standard_option('user-enable', {
-    title => "Enable",
     description => "Enable the account (default). You can set this to '0' to disable the account",
     type => 'boolean',
     optional => 1,
@@ -356,15 +355,77 @@ __PACKAGE__->register_method ({
                    $plugin->delete_user($cfg, $realm, $ruid);
                }
 
+               # Remove TFA data before removing the user entry as the user entry tells us whether
+               # we need ot update priv/tfa.cfg.
+               PVE::AccessControl::user_set_tfa($userid, $realm, undef, undef, $usercfg, $domain_cfg);
+
                delete $usercfg->{users}->{$userid};
 
                PVE::AccessControl::delete_user_group($userid, $usercfg);
                PVE::AccessControl::delete_user_acl($userid, $usercfg);
-
                cfs_write_file("user.cfg", $usercfg);
            }, "delete user failed");
 
        return undef;
     }});
 
+__PACKAGE__->register_method ({
+    name => 'read_user_tfa_type',
+    path => '{userid}/tfa',
+    method => 'GET',
+    protected => 1,
+    description => "Get user TFA types (Personal and Realm).",
+    permissions => {
+       check => [ 'or',
+           ['userid-param', 'self'],
+           ['userid-group', ['User.Modify', 'Sys.Audit']],
+       ],
+    },
+    parameters => {
+       additionalProperties => 0,
+       properties => {
+           userid => get_standard_option('userid-completed'),
+       },
+    },
+    returns => {
+       additionalProperties => 0,
+       properties => {
+           realm => {
+               type => 'string',
+               enum => [qw(oath yubico)],
+               description => "The type of TFA the users realm has set, if any.",
+               optional => 1,
+           },
+           user => {
+               type => 'string',
+               enum => [qw(oath u2f)],
+               description => "The type of TFA the user has set, if any.",
+               optional => 1,
+           },
+       },
+       type => "object"
+    },
+    code => sub {
+       my ($param) = @_;
+
+       my ($username, undef, $realm) = PVE::AccessControl::verify_username($param->{userid});
+
+
+       my $domain_cfg = cfs_read_file('domains.cfg');
+       my $realm_cfg = $domain_cfg->{ids}->{$realm};
+       die "auth domain '$realm' does not exist\n" if !$realm_cfg;
+
+       my $realm_tfa = {};
+       $realm_tfa = PVE::Auth::Plugin::parse_tfa_config($realm_cfg->{tfa})
+           if $realm_cfg->{tfa};
+
+       my $tfa_cfg = cfs_read_file('priv/tfa.cfg');
+       my $tfa = $tfa_cfg->{users}->{$username};
+
+       my $res = {};
+       $res->{realm} = $realm_tfa->{type} if $realm_tfa->{type};
+       $res->{user} = $tfa->{type} if $tfa->{type};
+       return $res;
+    }});
+
 1;