api: fix typo in 'GET ticket' description

[pve-access-control.git] / PVE / API2 / AccessControl.pm

diff --git a/PVE/API2/AccessControl.pm b/PVE/API2/AccessControl.pm
index f01180d138863ee50c21c25bf5f32b9868efb00b..318ee1536a47473ac1c4f165d2790232f4eda3fa 100644 (file)
--- a/PVE/API2/AccessControl.pm
+++ b/PVE/API2/AccessControl.pm
@@ -136,73 +136,46 @@ my $compute_api_permission = sub {
 
     my $usercfg = $rpcenv->{user_cfg};
 
-    my $nodelist = PVE::Cluster::get_nodelist();
-    my $vmlist = PVE::Cluster::get_vmlist() || {};
-    my $idlist = $vmlist->{ids} || {};
-
-    my $cfg = PVE::Storage::config();
-    my @sids =  PVE::Storage::storage_ids ($cfg);
-
-    my $res = {
-       vms => {},
-       storage => {},
-       access => {},
-       nodes => {},
-       dc => {},
+    my $res = {};
+    my $priv_re_map = {
+       vms => qr/VM\.|Permissions\.Modify/,
+       access => qr/(User|Group)\.|Permissions\.Modify/,
+       storage => qr/Datastore\./,
+       nodes => qr/Sys\.|Permissions\.Modify/,
+       dc => qr/Sys\.Audit/,
     };
-
-    my $extract_vm_caps = sub {
-       my ($path) = @_;
-       
-       my $perm = $rpcenv->permissions($authuser, $path);
-       foreach my $priv (keys %$perm) {
-           next if !($priv eq 'Permissions.Modify' || $priv =~ m/^VM\./);
-           $res->{vms}->{$priv} = 1;   
-       }
-    };
-
-    foreach my $pool (keys %{$usercfg->{pools}}) {
-       &$extract_vm_caps("/pool/$pool");
-    }
-
-    foreach my $vmid (keys %$idlist, '__phantom__') {
-       &$extract_vm_caps("/vms/$vmid");
-    }
-
-    foreach my $storeid (@sids, '__phantom__') {
-       my $perm = $rpcenv->permissions($authuser, "/storage/$storeid");
-       foreach my $priv (keys %$perm) {
-           next if !($priv eq 'Permissions.Modify' || $priv =~ m/^Datastore\./);
-           $res->{storage}->{$priv} = 1;
-       }
-    }
-
-    foreach my $path (('/access/groups')) {
-       my $perm = $rpcenv->permissions($authuser, $path);
-       foreach my $priv (keys %$perm) {
-           next if $priv !~ m/^(User|Group)\./;
-           $res->{access}->{$priv} = 1;
-       }
-    }
-
-    foreach my $group (keys %{$usercfg->{users}->{$authuser}->{groups}}, '__phantom__') {
-       my $perm = $rpcenv->permissions($authuser, "/access/groups/$group");
-       if ($perm->{'User.Modify'}) {
-           $res->{access}->{'User.Modify'} = 1;
-       }
-    }
-
-    foreach my $node (@$nodelist) {
-       my $perm = $rpcenv->permissions($authuser, "/nodes/$node");
-       foreach my $priv (keys %$perm) {
-           next if $priv !~ m/^Sys\./;
-           $res->{nodes}->{$priv} = 1;
+    map { $res->{$_} = {} } keys %$priv_re_map;
+
+    my $required_paths = ['/', '/nodes', '/access/groups', '/vms', '/storage'];
+
+    my $checked_paths = {};
+    foreach my $path (@$required_paths, keys %{$usercfg->{acl}}) {
+       next if $checked_paths->{$path};
+       $checked_paths->{$path} = 1;
+
+       my $path_perm = $rpcenv->permissions($authuser, $path);
+
+       my $toplevel = ($path =~ /^\/(\w+)/) ? $1 : 'dc';
+       if ($toplevel eq 'pool') {
+           foreach my $priv (keys %$path_perm) {
+               if ($priv =~ m/^VM\./) {
+                   $res->{vms}->{$priv} = 1;
+               } elsif ($priv =~ m/^Datastore\./) {
+                   $res->{storage}->{$priv} = 1;
+               } elsif ($priv eq 'Permissions.Modify') {
+                   $res->{storage}->{$priv} = 1;
+                   $res->{vms}->{$priv} = 1;
+               }
+           }
+       } else {
+           my $priv_regex = $priv_re_map->{$toplevel} // next;
+           foreach my $priv (keys %$path_perm) {
+               next if $priv !~ m/^($priv_regex)/;
+               $res->{$toplevel}->{$priv} = 1;
+           }
        }
     }
 
-    my $perm = $rpcenv->permissions($authuser, "/");
-    $res->{dc}->{'Sys.Audit'} = 1 if $perm->{'Sys.Audit'};
-
     return $res;
 };
 
@@ -211,7 +184,7 @@ __PACKAGE__->register_method ({
     path => 'ticket', 
     method => 'GET',
     permissions => { user => 'world' },
-    description => "Dummy. Useful for formaters which want to priovde a login page.",
+    description => "Dummy. Useful for formaters which want to provide a login page.",
     parameters => {
        additionalProperties => 0,
     },
@@ -235,10 +208,13 @@ __PACKAGE__->register_method ({
                description => "User name",
                type => 'string',
                maxLength => 64,
+               completion => \&PVE::AccessControl::complete_username,
            },
            realm =>  get_standard_option('realm', {
                description => "You can optionally pass the realm using this parameter. Normally the realm is simply added to the username <username>\@<relam>.",
-               optional => 1}),
+               optional => 1,
+               completion => \&PVE::AccessControl::complete_realm,
+           }),
            password => { 
                description => "The secret password. This can also be a valid ticket.",
                type => 'string',
@@ -325,7 +301,9 @@ __PACKAGE__->register_method ({
     parameters => {
        additionalProperties => 0,
        properties => {
-           userid => get_standard_option('userid'),
+           userid => get_standard_option('userid', {
+               completion => \&PVE::AccessControl::complete_username,
+           }),
            password => { 
                description => "The new password.",
                type => 'string',