bump version to 8.1.4

[pve-access-control.git] / src / PVE / API2 / TFA.pm

diff --git a/src/PVE/API2/TFA.pm b/src/PVE/API2/TFA.pm
index 62b9653e24487ac03668c97a91b47b1ecdba4949..62ddd959378008ae3caf6ea92e04d43b489fc358 100644 (file)
--- a/src/PVE/API2/TFA.pm
+++ b/src/PVE/API2/TFA.pm
@@ -18,8 +18,8 @@ use PVE::RESTHandler;
 
 use base qw(PVE::RESTHandler);
 
-my $OPTIONAL_PASSWORD_SCHEMA = {
-    description => "The current password.",
+our $OPTIONAL_PASSWORD_SCHEMA = {
+    description => "The current password of the user performing the change.",
     type => 'string',
     optional => 1, # Only required if not root@pam
     minLength => 5,
@@ -95,36 +95,6 @@ my $TFA_UPDATE_INFO_SCHEMA = {
     },
 };
 
-# Only root may modify root, regular users need to specify their password.
-#
-# Returns the userid returned from `verify_username`.
-# Or ($userid, $realm) in list context.
-my sub root_permission_check : prototype($$$$) {
-    my ($rpcenv, $authuser, $userid, $password) = @_;
-
-    ($userid, undef, my $realm) = PVE::AccessControl::verify_username($userid);
-    $rpcenv->check_user_exist($userid);
-
-    raise_perm_exc() if $userid eq 'root@pam' && $authuser ne 'root@pam';
-
-    # Regular users need to confirm their password to change TFA settings.
-    if ($authuser ne 'root@pam') {
-       raise_param_exc({ 'password' => 'password is required to modify TFA data' })
-           if !defined($password);
-
-       ($authuser, my $auth_username, my $auth_realm) =
-           PVE::AccessControl::verify_username($authuser);
-
-       my $domain_cfg = cfs_read_file('domains.cfg');
-       my $cfg = $domain_cfg->{ids}->{$auth_realm};
-       die "auth domain '$auth_realm' does not exist\n" if !$cfg;
-       my $plugin = PVE::Auth::Plugin->lookup($cfg->{type});
-       $plugin->authenticate_user($cfg, $auth_realm, $auth_username, $password);
-    }
-
-    return wantarray ? ($userid, $realm) : $userid;
-}
-
 # Set TFA to enabled if $tfa_cfg is passed, or to disabled if $tfa_cfg is undef,
 # When enabling we also merge the old user.cfg keys into the $tfa_cfg.
 my sub set_user_tfa_enabled : prototype($$$) {
@@ -176,6 +146,7 @@ __PACKAGE__->register_method ({
        description => "A list of the user's TFA entries.",
        type => 'array',
        items => $TYPED_TFA_ENTRY_SCHEMA,
+       links => [ { rel => 'child', href => "{id}" } ],
     },
     code => sub {
        my ($param) = @_;
@@ -241,12 +212,13 @@ __PACKAGE__->register_method ({
     code => sub {
        my ($param) = @_;
 
-       PVE::AccessControl::assert_new_tfa_config_available();
-       
        my $rpcenv = PVE::RPCEnvironment::get();
        my $authuser = $rpcenv->get_user();
-       my $userid =
-           root_permission_check($rpcenv, $authuser, $param->{userid}, $param->{password});
+       my $userid = $rpcenv->reauth_user_for_user_modification(
+           $authuser,
+           $param->{userid},
+           $param->{password},
+       );
 
        my $has_entries_left = PVE::AccessControl::lock_tfa_config(sub {
            my $tfa_cfg = cfs_read_file('priv/tfa.cfg');
@@ -300,6 +272,7 @@ __PACKAGE__->register_method ({
                },
            },
        },
+       links => [ { rel => 'child', href => "{userid}" } ],
     },
     code => sub {
        my ($param) = @_;
@@ -376,12 +349,13 @@ __PACKAGE__->register_method ({
     code => sub {
        my ($param) = @_;
 
-       PVE::AccessControl::assert_new_tfa_config_available();
-
        my $rpcenv = PVE::RPCEnvironment::get();
        my $authuser = $rpcenv->get_user();
-       my ($userid, $realm) =
-           root_permission_check($rpcenv, $authuser, $param->{userid}, $param->{password});
+       my ($userid, undef, $realm) = $rpcenv->reauth_user_for_user_modification(
+           $authuser,
+           $param->{userid},
+           $param->{password},
+       );
 
        my $type = delete $param->{type};
        my $value = delete $param->{value};
@@ -411,7 +385,7 @@ __PACKAGE__->register_method ({
        });
     }});
 
-sub validate_yubico_otp : prototype($$) {
+sub validate_yubico_otp : prototype($$$) {
     my ($userid, $realm, $value) = @_;
 
     my $domain_cfg = cfs_read_file('domains.cfg');
@@ -471,12 +445,13 @@ __PACKAGE__->register_method ({
     code => sub {
        my ($param) = @_;
 
-       PVE::AccessControl::assert_new_tfa_config_available();
-
        my $rpcenv = PVE::RPCEnvironment::get();
        my $authuser = $rpcenv->get_user();
-       my $userid =
-           root_permission_check($rpcenv, $authuser, $param->{userid}, $param->{password});
+       my $userid = $rpcenv->reauth_user_for_user_modification(
+           $authuser,
+           $param->{userid},
+           $param->{password},
+       );
 
        PVE::AccessControl::lock_tfa_config(sub {
            my $tfa_cfg = cfs_read_file('priv/tfa.cfg');