PVE/API2/User.pm

   1 package PVE::API2::User;
   2
   3 use strict;
   4 use warnings;
   5 use PVE::Exception qw(raise raise_perm_exc raise_param_exc);
   6 use PVE::Cluster qw (cfs_read_file cfs_write_file);
   7 use PVE::Tools qw(split_list extract_param);
   8 use PVE::AccessControl;
   9 use PVE::JSONSchema qw(get_standard_option register_standard_option);
  10 use PVE::TokenConfig;
  11
  12 use PVE::SafeSyslog;
  13
  14 use PVE::RESTHandler;
  15
  16 use base qw(PVE::RESTHandler);
  17
  18 register_standard_option('user-enable', {
  19     description => "Enable the account (default). You can set this to '0' to disable the account",
  20     type => 'boolean',
  21     optional => 1,
  22     default => 1,
  23 });
  24 register_standard_option('user-expire', {
  25     description => "Account expiration date (seconds since epoch). '0' means no expiration date.",
  26     type => 'integer',
  27     minimum => 0,
  28     optional => 1,
  29 });
  30 register_standard_option('user-firstname', { type => 'string', optional => 1 });
  31 register_standard_option('user-lastname', { type => 'string', optional => 1 });
  32 register_standard_option('user-email', { type => 'string', optional => 1, format => 'email-opt' });
  33 register_standard_option('user-comment', { type => 'string', optional => 1 });
  34 register_standard_option('user-keys', {
  35     description => "Keys for two factor auth (yubico).",
  36     type => 'string',
  37     optional => 1,
  38 });
  39 register_standard_option('group-list', {
  40     type => 'string', format => 'pve-groupid-list',
  41     optional => 1,
  42     completion => \&PVE::AccessControl::complete_group,
  43 });
  44 register_standard_option('token-subid', {
  45     type => 'string',
  46     pattern => $PVE::AccessControl::token_subid_regex,
  47     description => 'User-specific token identifier.',
  48 });
  49 register_standard_option('token-expire', {
  50     description => "API token expiration date (seconds since epoch). '0' means no expiration date.",
  51     type => 'integer',
  52     minimum => 0,
  53     optional => 1,
  54     default => 'same as user',
  55 });
  56 register_standard_option('token-privsep', {
  57     description => "Restrict API token privileges with separate ACLs (default), or give full privileges of corresponding user.",
  58     type => 'boolean',
  59     optional => 1,
  60     default => 1,
  61 });
  62 register_standard_option('token-comment', { type => 'string', optional => 1 });
  63 register_standard_option('token-info', {
  64     type => 'object',
  65     properties => {
  66         expire => get_standard_option('token-expire'),
  67         privsep => get_standard_option('token-privsep'),
  68         comment => get_standard_option('token-comment'),
  69     }
  70 });
  71
  72 my $token_info_extend = sub {
  73     my ($props) = @_;
  74
  75     my $obj = get_standard_option('token-info');
  76     my $base_props = $obj->{properties};
  77     $obj->{properties} = {};
  78
  79     foreach my $prop (keys %$base_props) {
  80         $obj->{properties}->{$prop} = $base_props->{$prop};
  81     }
  82
  83     foreach my $add_prop (keys %$props) {
  84         $obj->{properties}->{$add_prop} = $props->{$add_prop};
  85     }
  86
  87     return $obj;
  88 };
  89
  90 my $extract_user_data = sub {
  91     my ($data, $full) = @_;
  92
  93     my $res = {};
  94
  95     foreach my $prop (qw(enable expire firstname lastname email comment keys)) {
  96         $res->{$prop} = $data->{$prop} if defined($data->{$prop});
  97     }
  98
  99     return $res if !$full;
 100
 101     $res->{groups} = $data->{groups} ? [ keys %{$data->{groups}} ] : [];
 102     $res->{tokens} = $data->{tokens};
 103
 104     return $res;
 105 };
 106
 107 __PACKAGE__->register_method ({
 108     name => 'index',
 109     path => '',
 110     method => 'GET',
 111     description => "User index.",
 112     permissions => {
 113         description => "The returned list is restricted to users where you have 'User.Modify' or 'Sys.Audit' permissions on '/access/groups' or on a group the user belongs too. But it always includes the current (authenticated) user.",
 114         user => 'all',
 115     },
 116     parameters => {
 117         additionalProperties => 0,
 118         properties => {
 119             enabled => {
 120                 type => 'boolean',
 121                 description => "Optional filter for enable property.",
 122                 optional => 1,
 123             },
 124             full => {
 125                 type => 'boolean',
 126                 description => "Include group and token information.",
 127                 optional => 1,
 128                 default => 0,
 129             }
 130         },
 131     },
 132     returns => {
 133         type => 'array',
 134         items => {
 135             type => "object",
 136             properties => {
 137                 userid => get_standard_option('userid-completed'),
 138                 enable => get_standard_option('user-enable'),
 139                 expire => get_standard_option('user-expire'),
 140                 firstname => get_standard_option('user-firstname'),
 141                 lastname => get_standard_option('user-lastname'),
 142                 email => get_standard_option('user-email'),
 143                 comment => get_standard_option('user-comment'),
 144                 keys => get_standard_option('user-keys'),
 145                 groups => get_standard_option('group-list'),
 146                 tokens => {
 147                     type => 'array',
 148                     optional => 1,
 149                     items => $token_info_extend->({
 150                         tokenid => get_standard_option('token-subid'),
 151                     }),
 152                 }
 153             },
 154         },
 155         links => [ { rel => 'child', href => "{userid}" } ],
 156     },
 157     code => sub {
 158         my ($param) = @_;
 159
 160         my $rpcenv = PVE::RPCEnvironment::get();
 161         my $usercfg = $rpcenv->{user_cfg};
 162         my $authuser = $rpcenv->get_user();
 163
 164         my $res = [];
 165
 166         my $privs = [ 'User.Modify', 'Sys.Audit' ];
 167         my $canUserMod = $rpcenv->check_any($authuser, "/access/groups", $privs, 1);
 168         my $groups = $rpcenv->filter_groups($authuser, $privs, 1);
 169         my $allowed_users = $rpcenv->group_member_join([keys %$groups]);
 170
 171         foreach my $user (keys %{$usercfg->{users}}) {
 172             if (!($canUserMod || $user eq $authuser)) {
 173                 next if !$allowed_users->{$user};
 174             }
 175
 176             my $entry = &$extract_user_data($usercfg->{users}->{$user}, $param->{full});
 177
 178             if (defined($param->{enabled})) {
 179                 next if $entry->{enable} && !$param->{enabled};
 180                 next if !$entry->{enable} && $param->{enabled};
 181             }
 182
 183             $entry->{groups} = join(',', @{$entry->{groups}}) if $entry->{groups};
 184             $entry->{tokens} = [ map { { tokenid => $_, %{$entry->{tokens}->{$_}} } } sort keys %{$entry->{tokens}} ]
 185                 if defined($entry->{tokens});
 186
 187             $entry->{userid} = $user;
 188             push @$res, $entry;
 189         }
 190
 191         return $res;
 192     }});
 193
 194 __PACKAGE__->register_method ({
 195     name => 'create_user',
 196     protected => 1,
 197     path => '',
 198     method => 'POST',
 199     permissions => {
 200         description => "You need 'Realm.AllocateUser' on '/access/realm/<realm>' on the realm of user <userid>, and 'User.Modify' permissions to '/access/groups/<group>' for any group specified (or 'User.Modify' on '/access/groups' if you pass no groups.",
 201         check => [ 'and',
 202                    [ 'userid-param', 'Realm.AllocateUser'],
 203                    [ 'userid-group', ['User.Modify'], groups_param => 1],
 204             ],
 205     },
 206     description => "Create new user.",
 207     parameters => {
 208         additionalProperties => 0,
 209         properties => {
 210             userid => get_standard_option('userid-completed'),
 211             enable => get_standard_option('user-enable'),
 212             expire => get_standard_option('user-expire'),
 213             firstname => get_standard_option('user-firstname'),
 214             lastname => get_standard_option('user-lastname'),
 215             email => get_standard_option('user-email'),
 216             comment => get_standard_option('user-comment'),
 217             keys => get_standard_option('user-keys'),
 218             password => {
 219                 description => "Initial password.",
 220                 type => 'string',
 221                 optional => 1,
 222                 minLength => 5,
 223                 maxLength => 64
 224             },
 225             groups => get_standard_option('group-list'),
 226         },
 227     },
 228     returns => { type => 'null' },
 229     code => sub {
 230         my ($param) = @_;
 231
 232         PVE::AccessControl::lock_user_config(
 233             sub {
 234
 235                 my ($username, $ruid, $realm) = PVE::AccessControl::verify_username($param->{userid});
 236
 237                 my $usercfg = cfs_read_file("user.cfg");
 238
 239                 die "user '$username' already exists\n"
 240                     if $usercfg->{users}->{$username};
 241
 242                 PVE::AccessControl::domain_set_password($realm, $ruid, $param->{password})
 243                     if defined($param->{password});
 244
 245                 my $enable = defined($param->{enable}) ? $param->{enable} : 1;
 246                 $usercfg->{users}->{$username} = { enable => $enable };
 247                 $usercfg->{users}->{$username}->{expire} = $param->{expire} if $param->{expire};
 248
 249                 if ($param->{groups}) {
 250                     foreach my $group (split_list($param->{groups})) {
 251                         if ($usercfg->{groups}->{$group}) {
 252                             PVE::AccessControl::add_user_group($username, $usercfg, $group);
 253                         } else {
 254                             die "no such group '$group'\n";
 255                         }
 256                     }
 257                 }
 258
 259                 $usercfg->{users}->{$username}->{firstname} = $param->{firstname} if $param->{firstname};
 260                 $usercfg->{users}->{$username}->{lastname} = $param->{lastname} if $param->{lastname};
 261                 $usercfg->{users}->{$username}->{email} = $param->{email} if $param->{email};
 262                 $usercfg->{users}->{$username}->{comment} = $param->{comment} if $param->{comment};
 263                 $usercfg->{users}->{$username}->{keys} = $param->{keys} if $param->{keys};
 264
 265                 cfs_write_file("user.cfg", $usercfg);
 266             }, "create user failed");
 267
 268         return undef;
 269     }});
 270
 271 __PACKAGE__->register_method ({
 272     name => 'read_user',
 273     path => '{userid}',
 274     method => 'GET',
 275     description => "Get user configuration.",
 276     permissions => {
 277         check => ['userid-group', ['User.Modify', 'Sys.Audit']],
 278     },
 279     parameters => {
 280         additionalProperties => 0,
 281         properties => {
 282             userid => get_standard_option('userid-completed'),
 283         },
 284     },
 285     returns => {
 286         additionalProperties => 0,
 287         properties => {
 288             enable => get_standard_option('user-enable'),
 289             expire => get_standard_option('user-expire'),
 290             firstname => get_standard_option('user-firstname'),
 291             lastname => get_standard_option('user-lastname'),
 292             email => get_standard_option('user-email'),
 293             comment => get_standard_option('user-comment'),
 294             keys => get_standard_option('user-keys'),
 295             groups => {
 296                 type => 'array',
 297                 optional => 1,
 298                 items => {
 299                     type => 'string',
 300                     format => 'pve-groupid',
 301                 },
 302             },
 303             tokens => {
 304                 optional => 1,
 305                 type => 'object',
 306             },
 307         },
 308         type => "object"
 309     },
 310     code => sub {
 311         my ($param) = @_;
 312
 313         my ($username, undef, $domain) =
 314             PVE::AccessControl::verify_username($param->{userid});
 315
 316         my $usercfg = cfs_read_file("user.cfg");
 317
 318         my $data = PVE::AccessControl::check_user_exist($usercfg, $username);
 319
 320         return &$extract_user_data($data, 1);
 321     }});
 322
 323 __PACKAGE__->register_method ({
 324     name => 'update_user',
 325     protected => 1,
 326     path => '{userid}',
 327     method => 'PUT',
 328     permissions => {
 329         check => ['userid-group', ['User.Modify'], groups_param => 1 ],
 330     },
 331     description => "Update user configuration.",
 332     parameters => {
 333         additionalProperties => 0,
 334         properties => {
 335             userid => get_standard_option('userid-completed'),
 336             enable => get_standard_option('user-enable'),
 337             expire => get_standard_option('user-expire'),
 338             firstname => get_standard_option('user-firstname'),
 339             lastname => get_standard_option('user-lastname'),
 340             email => get_standard_option('user-email'),
 341             comment => get_standard_option('user-comment'),
 342             keys => get_standard_option('user-keys'),
 343             groups => get_standard_option('group-list'),
 344             append => {
 345                 type => 'boolean',
 346                 optional => 1,
 347                 requires => 'groups',
 348             },
 349         },
 350     },
 351     returns => { type => 'null' },
 352     code => sub {
 353         my ($param) = @_;
 354
 355         my ($username, $ruid, $realm) =
 356             PVE::AccessControl::verify_username($param->{userid});
 357
 358         PVE::AccessControl::lock_user_config(
 359             sub {
 360
 361                 my $usercfg = cfs_read_file("user.cfg");
 362
 363                 PVE::AccessControl::check_user_exist($usercfg, $username);
 364
 365                 $usercfg->{users}->{$username}->{enable} = $param->{enable} if defined($param->{enable});
 366
 367                 $usercfg->{users}->{$username}->{expire} = $param->{expire} if defined($param->{expire});
 368
 369                 PVE::AccessControl::delete_user_group($username, $usercfg)
 370                     if (!$param->{append} && defined($param->{groups}));
 371
 372                 if ($param->{groups}) {
 373                     foreach my $group (split_list($param->{groups})) {
 374                         if ($usercfg->{groups}->{$group}) {
 375                             PVE::AccessControl::add_user_group($username, $usercfg, $group);
 376                         } else {
 377                             die "no such group '$group'\n";
 378                         }
 379                     }
 380                 }
 381
 382                 $usercfg->{users}->{$username}->{firstname} = $param->{firstname} if defined($param->{firstname});
 383                 $usercfg->{users}->{$username}->{lastname} = $param->{lastname} if defined($param->{lastname});
 384                 $usercfg->{users}->{$username}->{email} = $param->{email} if defined($param->{email});
 385                 $usercfg->{users}->{$username}->{comment} = $param->{comment} if defined($param->{comment});
 386                 $usercfg->{users}->{$username}->{keys} = $param->{keys} if defined($param->{keys});
 387
 388                 cfs_write_file("user.cfg", $usercfg);
 389             }, "update user failed");
 390
 391         return undef;
 392     }});
 393
 394 __PACKAGE__->register_method ({
 395     name => 'delete_user',
 396     protected => 1,
 397     path => '{userid}',
 398     method => 'DELETE',
 399     description => "Delete user.",
 400     permissions => {
 401         check => [ 'and',
 402                    [ 'userid-param', 'Realm.AllocateUser'],
 403                    [ 'userid-group', ['User.Modify']],
 404             ],
 405     },
 406     parameters => {
 407         additionalProperties => 0,
 408         properties => {
 409             userid => get_standard_option('userid-completed'),
 410         }
 411     },
 412     returns => { type => 'null' },
 413     code => sub {
 414         my ($param) = @_;
 415
 416         my $rpcenv = PVE::RPCEnvironment::get();
 417         my $authuser = $rpcenv->get_user();
 418
 419         my ($userid, $ruid, $realm) =
 420             PVE::AccessControl::verify_username($param->{userid});
 421
 422         PVE::AccessControl::lock_user_config(
 423             sub {
 424
 425                 my $usercfg = cfs_read_file("user.cfg");
 426
 427                 my $domain_cfg = cfs_read_file('domains.cfg');
 428                 if (my $cfg = $domain_cfg->{ids}->{$realm}) {
 429                     my $plugin = PVE::Auth::Plugin->lookup($cfg->{type});
 430                     $plugin->delete_user($cfg, $realm, $ruid);
 431                 }
 432
 433                 # Remove TFA data before removing the user entry as the user entry tells us whether
 434                 # we need ot update priv/tfa.cfg.
 435                 PVE::AccessControl::user_set_tfa($userid, $realm, undef, undef, $usercfg, $domain_cfg);
 436
 437                 delete $usercfg->{users}->{$userid};
 438
 439                 PVE::AccessControl::delete_user_group($userid, $usercfg);
 440                 PVE::AccessControl::delete_user_acl($userid, $usercfg);
 441                 cfs_write_file("user.cfg", $usercfg);
 442             }, "delete user failed");
 443
 444         return undef;
 445     }});
 446
 447 __PACKAGE__->register_method ({
 448     name => 'read_user_tfa_type',
 449     path => '{userid}/tfa',
 450     method => 'GET',
 451     protected => 1,
 452     description => "Get user TFA types (Personal and Realm).",
 453     permissions => {
 454         check => [ 'or',
 455             ['userid-param', 'self'],
 456             ['userid-group', ['User.Modify', 'Sys.Audit']],
 457         ],
 458     },
 459     parameters => {
 460         additionalProperties => 0,
 461         properties => {
 462             userid => get_standard_option('userid-completed'),
 463         },
 464     },
 465     returns => {
 466         additionalProperties => 0,
 467         properties => {
 468             realm => {
 469                 type => 'string',
 470                 enum => [qw(oath yubico)],
 471                 description => "The type of TFA the users realm has set, if any.",
 472                 optional => 1,
 473             },
 474             user => {
 475                 type => 'string',
 476                 enum => [qw(oath u2f)],
 477                 description => "The type of TFA the user has set, if any.",
 478                 optional => 1,
 479             },
 480         },
 481         type => "object"
 482     },
 483     code => sub {
 484         my ($param) = @_;
 485
 486         my ($username, undef, $realm) = PVE::AccessControl::verify_username($param->{userid});
 487
 488
 489         my $domain_cfg = cfs_read_file('domains.cfg');
 490         my $realm_cfg = $domain_cfg->{ids}->{$realm};
 491         die "auth domain '$realm' does not exist\n" if !$realm_cfg;
 492
 493         my $realm_tfa = {};
 494         $realm_tfa = PVE::Auth::Plugin::parse_tfa_config($realm_cfg->{tfa})
 495             if $realm_cfg->{tfa};
 496
 497         my $tfa_cfg = cfs_read_file('priv/tfa.cfg');
 498         my $tfa = $tfa_cfg->{users}->{$username};
 499
 500         my $res = {};
 501         $res->{realm} = $realm_tfa->{type} if $realm_tfa->{type};
 502         $res->{user} = $tfa->{type} if $tfa->{type};
 503         return $res;
 504     }});
 505
 506 __PACKAGE__->register_method ({
 507     name => 'token_index',
 508     path => '{userid}/token',
 509     method => 'GET',
 510     description => "Get user API tokens.",
 511     permissions => {
 512         check => ['or',
 513                     ['userid-param', 'self'],
 514                     ['perm', '/access/users/{userid}', ['User.Modify']],
 515         ],
 516     },
 517     parameters => {
 518         additionalProperties => 0,
 519         properties => {
 520             userid => get_standard_option('userid-completed'),
 521         },
 522     },
 523     returns => {
 524         type => "array",
 525         items => $token_info_extend->({
 526                     tokenid => get_standard_option('token-subid'),
 527         }),
 528         links => [ { rel => 'child', href => "{tokenid}" } ],
 529     },
 530     code => sub {
 531         my ($param) = @_;
 532
 533         my $userid = PVE::AccessControl::verify_username($param->{userid});
 534         my $usercfg = cfs_read_file("user.cfg");
 535
 536         my $user = PVE::AccessControl::check_user_exist($usercfg, $userid);
 537
 538         my $tokens = $user->{tokens} // {};
 539         return [ map { $tokens->{$_}->{tokenid} = $_; $tokens->{$_} } keys %$tokens];
 540     }});
 541
 542 __PACKAGE__->register_method ({
 543     name => 'read_token',
 544     path => '{userid}/token/{tokenid}',
 545     method => 'GET',
 546     description => "Get specific API token information.",
 547     permissions => {
 548         check => ['or',
 549                     ['userid-param', 'self'],
 550                     ['perm', '/access/users/{userid}', ['User.Modify']],
 551         ],
 552     },
 553     parameters => {
 554         additionalProperties => 0,
 555         properties => {
 556             userid => get_standard_option('userid-completed'),
 557             tokenid => get_standard_option('token-subid'),
 558         },
 559     },
 560     returns => get_standard_option('token-info'),
 561     code => sub {
 562         my ($param) = @_;
 563
 564         my $userid = PVE::AccessControl::verify_username($param->{userid});
 565         my $tokenid = $param->{tokenid};
 566
 567         my $usercfg = cfs_read_file("user.cfg");
 568
 569         return PVE::AccessControl::check_token_exist($usercfg, $userid, $tokenid);
 570     }});
 571
 572 __PACKAGE__->register_method ({
 573     name => 'generate_token',
 574     path => '{userid}/token/{tokenid}',
 575     method => 'POST',
 576     description => "Generate a new API token for a specific user. NOTE: returns API token value, which needs to be stored as it cannot be retrieved afterwards!",
 577     protected => 1,
 578     permissions => {
 579         check => ['or',
 580                     ['userid-param', 'self'],
 581                     ['perm', '/access/users/{userid}', ['User.Modify']],
 582         ],
 583     },
 584     parameters => {
 585         additionalProperties => 0,
 586         properties => {
 587             userid => get_standard_option('userid-completed'),
 588             tokenid => get_standard_option('token-subid'),
 589             expire => get_standard_option('token-expire'),
 590             privsep => get_standard_option('token-privsep'),
 591             comment => get_standard_option('token-comment'),
 592         },
 593     },
 594     returns => {
 595         additionalProperties => 0,
 596         type => "object",
 597         properties => {
 598             info => get_standard_option('token-info'),
 599             value => {
 600                 type => 'string',
 601                 description => 'API token value used for authentication.',
 602             },
 603         },
 604     },
 605     code => sub {
 606         my ($param) = @_;
 607
 608         my $userid = PVE::AccessControl::verify_username(extract_param($param, 'userid'));
 609         my $tokenid = extract_param($param, 'tokenid');
 610
 611         my $usercfg = cfs_read_file("user.cfg");
 612
 613         my $token = PVE::AccessControl::check_token_exist($usercfg, $userid, $tokenid, 1);
 614         my $value;
 615
 616         PVE::AccessControl::check_user_exist($usercfg, $userid);
 617         raise_param_exc({ 'tokenid' => 'Token already exists.' }) if defined($token);
 618
 619         my $generate_and_add_token = sub {
 620             $usercfg = cfs_read_file("user.cfg");
 621             PVE::AccessControl::check_user_exist($usercfg, $userid);
 622             die "Token already exists.\n" if defined(PVE::AccessControl::check_token_exist($usercfg, $userid, $tokenid, 1));
 623
 624             my $full_tokenid = PVE::AccessControl::join_tokenid($userid, $tokenid);
 625             $value = PVE::TokenConfig::generate_token($full_tokenid);
 626
 627             $token = {};
 628             $token->{privsep} = defined($param->{privsep}) ? $param->{privsep} : 1;
 629             $token->{expire} = $param->{expire} if defined($param->{expire});
 630             $token->{comment} = $param->{comment} if $param->{comment};
 631
 632             $usercfg->{users}->{$userid}->{tokens}->{$tokenid} = $token;
 633             cfs_write_file("user.cfg", $usercfg);
 634         };
 635
 636         PVE::AccessControl::lock_user_config($generate_and_add_token, 'generating token failed');
 637
 638         return { info => $token, value => $value };
 639     }});
 640
 641
 642 __PACKAGE__->register_method ({
 643     name => 'update_token_info',
 644     path => '{userid}/token/{tokenid}',
 645     method => 'PUT',
 646     description => "Update API token for a specific user.",
 647     protected => 1,
 648     permissions => {
 649         check => ['or',
 650                     ['userid-param', 'self'],
 651                     ['perm', '/access/users/{userid}', ['User.Modify']],
 652         ],
 653     },
 654     parameters => {
 655         additionalProperties => 0,
 656         properties => {
 657             userid => get_standard_option('userid-completed'),
 658             tokenid => get_standard_option('token-subid'),
 659             expire => get_standard_option('token-expire'),
 660             privsep => get_standard_option('token-privsep'),
 661             comment => get_standard_option('token-comment'),
 662         },
 663     },
 664     returns => get_standard_option('token-info', { description => "Updated token information." }),
 665     code => sub {
 666         my ($param) = @_;
 667
 668         my $userid = PVE::AccessControl::verify_username(extract_param($param, 'userid'));
 669         my $tokenid = extract_param($param, 'tokenid');
 670
 671         my $usercfg = cfs_read_file("user.cfg");
 672         my $token = PVE::AccessControl::check_token_exist($usercfg, $userid, $tokenid);
 673
 674         my $update_token = sub {
 675             $usercfg = cfs_read_file("user.cfg");
 676             $token = PVE::AccessControl::check_token_exist($usercfg, $userid, $tokenid);
 677
 678             my $full_tokenid = PVE::AccessControl::join_tokenid($userid, $tokenid);
 679
 680             $token->{privsep} = $param->{privsep} if defined($param->{privsep});
 681             $token->{expire} = $param->{expire} if defined($param->{expire});
 682             $token->{comment} = $param->{comment} if $param->{comment};
 683
 684             $usercfg->{users}->{$userid}->{tokens}->{$tokenid} = $token;
 685             cfs_write_file("user.cfg", $usercfg);
 686         };
 687
 688         PVE::AccessControl::lock_user_config($update_token, 'updating token info failed');
 689
 690         return $token;
 691     }});
 692
 693
 694 __PACKAGE__->register_method ({
 695     name => 'remove_token',
 696     path => '{userid}/token/{tokenid}',
 697     method => 'DELETE',
 698     description => "Remove API token for a specific user.",
 699     protected => 1,
 700     permissions => {
 701         check => ['or',
 702                     ['userid-param', 'self'],
 703                     ['perm', '/access/users/{userid}', ['User.Modify']],
 704         ],
 705     },
 706     parameters => {
 707         additionalProperties => 0,
 708         properties => {
 709             userid => get_standard_option('userid-completed'),
 710             tokenid => get_standard_option('token-subid'),
 711         },
 712     },
 713     returns => { type => 'null' },
 714     code => sub {
 715         my ($param) = @_;
 716
 717         my $userid = PVE::AccessControl::verify_username(extract_param($param, 'userid'));
 718         my $tokenid = extract_param($param, 'tokenid');
 719
 720         my $usercfg = cfs_read_file("user.cfg");
 721         my $token = PVE::AccessControl::check_token_exist($usercfg, $userid, $tokenid);
 722
 723         my $update_token = sub {
 724             $usercfg = cfs_read_file("user.cfg");
 725
 726             PVE::AccessControl::check_token_exist($usercfg, $userid, $tokenid);
 727
 728             my $full_tokenid = PVE::AccessControl::join_tokenid($userid, $tokenid);
 729             PVE::TokenConfig::delete_token($full_tokenid);
 730             delete $usercfg->{users}->{$userid}->{tokens}->{$tokenid};
 731
 732             cfs_write_file("user.cfg", $usercfg);
 733         };
 734
 735         PVE::AccessControl::lock_user_config($update_token, 'deleting token failed');
 736
 737         return;
 738     }});
 739 1;