@xen-orchestra/acl 1.0.0

package/dist/actions/task.mjs

@@ -0,0 +1,5 @@
+export default {
+    abort: true,
+    delete: true,
+    read: true,
+};

package/dist/actions/user.d.mts

@@ -0,0 +1,12 @@
+declare const _default: {
+    create: boolean;
+    delete: boolean;
+    read: boolean;
+    update: {
+        name: boolean;
+        password: boolean;
+        permission: boolean;
+        preferences: boolean;
+    };
+};
+export default _default;

package/dist/actions/user.mjs

@@ -0,0 +1,11 @@
+export default {
+    create: true,
+    delete: true,
+    read: true,
+    update: {
+        name: true,
+        password: true,
+        permission: true,
+        preferences: true,
+    },
+};

package/dist/actions/vbd.d.mts

@@ -0,0 +1,4 @@
+declare const _default: {
+    read: boolean;
+};
+export default _default;

package/dist/actions/vbd.mjs

@@ -0,0 +1,3 @@
+export default {
+    read: true,
+};

package/dist/actions/vdi-snapshot.d.mts

@@ -0,0 +1,4 @@
+declare const _default: {
+    read: boolean;
+};
+export default _default;

package/dist/actions/vdi-snapshot.mjs

@@ -0,0 +1,3 @@
+export default {
+    read: true,
+};

package/dist/actions/vdi-unmanaged.d.mts

@@ -0,0 +1,4 @@
+declare const _default: {
+    read: boolean;
+};
+export default _default;

package/dist/actions/vdi-unmanaged.mjs

@@ -0,0 +1,3 @@
+export default {
+    read: true,
+};

package/dist/actions/vdi.d.mts

@@ -0,0 +1,12 @@
+declare const _default: {
+    boot: boolean;
+    create: boolean;
+    delete: boolean;
+    'export-content': boolean;
+    'import-content': boolean;
+    read: boolean;
+    update: {
+        tags: boolean;
+    };
+};
+export default _default;

package/dist/actions/vdi.mjs

@@ -0,0 +1,11 @@
+export default {
+    boot: true,
+    create: true,
+    delete: true,
+    'export-content': true,
+    'import-content': true,
+    read: true,
+    update: {
+        tags: true,
+    },
+};

package/dist/actions/vgpu.d.mts

@@ -0,0 +1,4 @@
+declare const _default: {
+    read: boolean;
+};
+export default _default;

package/dist/actions/vgpu.mjs

@@ -0,0 +1,3 @@
+export default {
+    read: true,
+};

package/dist/actions/vgpuType.d.mts

@@ -0,0 +1,4 @@
+declare const _default: {
+    read: boolean;
+};
+export default _default;

package/dist/actions/vgpuType.mjs

@@ -0,0 +1,3 @@
+export default {
+    read: true,
+};

package/dist/actions/vif.d.mts

@@ -0,0 +1,5 @@
+declare const _default: {
+    read: boolean;
+    create: boolean;
+};
+export default _default;

package/dist/actions/vif.mjs

@@ -0,0 +1,4 @@
+export default {
+    read: true,
+    create: true,
+};

package/dist/actions/vm-controller.d.mts

@@ -0,0 +1,7 @@
+declare const _default: {
+    read: boolean;
+    update: {
+        tags: boolean;
+    };
+};
+export default _default;

package/dist/actions/vm-controller.mjs

@@ -0,0 +1,6 @@
+export default {
+    read: true,
+    update: {
+        tags: true,
+    },
+};

package/dist/actions/vm-snapshot.d.mts

@@ -0,0 +1,9 @@
+declare const _default: {
+    delete: boolean;
+    export: boolean;
+    read: boolean;
+    update: {
+        tags: boolean;
+    };
+};
+export default _default;

package/dist/actions/vm-snapshot.mjs

@@ -0,0 +1,8 @@
+export default {
+    delete: true,
+    export: true,
+    read: true,
+    update: {
+        tags: true,
+    },
+};

package/dist/actions/vm-template.d.mts

@@ -0,0 +1,10 @@
+declare const _default: {
+    delete: boolean;
+    export: boolean;
+    instantiate: boolean;
+    read: boolean;
+    update: {
+        tags: boolean;
+    };
+};
+export default _default;

package/dist/actions/vm-template.mjs

@@ -0,0 +1,9 @@
+export default {
+    delete: true,
+    export: true,
+    instantiate: true,
+    read: true,
+    update: {
+        tags: true,
+    },
+};

package/dist/actions/vm.d.mts

@@ -0,0 +1,24 @@
+declare const _default: {
+    delete: boolean;
+    export: boolean;
+    pause: boolean;
+    read: boolean;
+    reboot: {
+        clean: boolean;
+        hard: boolean;
+    };
+    resume: boolean;
+    shutdown: {
+        clean: boolean;
+        hard: boolean;
+    };
+    snapshot: boolean;
+    start: boolean;
+    suspend: boolean;
+    unpause: boolean;
+    update: {
+        datasources: boolean;
+        tags: boolean;
+    };
+};
+export default _default;

package/dist/actions/vm.mjs

@@ -0,0 +1,23 @@
+export default {
+    delete: true,
+    export: true,
+    pause: true,
+    read: true,
+    reboot: {
+        clean: true,
+        hard: true,
+    },
+    resume: true,
+    shutdown: {
+        clean: true,
+        hard: true,
+    },
+    snapshot: true,
+    start: true,
+    suspend: true,
+    unpause: true,
+    update: {
+        datasources: true,
+        tags: true,
+    },
+};

package/dist/actions/vtpm.d.mts

@@ -0,0 +1,4 @@
+declare const _default: {
+    read: boolean;
+};
+export default _default;

package/dist/actions/vtpm.mjs

@@ -0,0 +1,3 @@
+export default {
+    read: true,
+};

package/dist/class/privilege.d.mts

@@ -0,0 +1,25 @@
+import type { XoAclPrivilege, XoAclSupportedActions, XoAclSupportedResource } from '@vates/types/lib/xen-orchestra/acl';
+import { SUPPORTED_ACTIONS_BY_RESOURCE } from '../actions/index.mjs';
+export type SupportedActionsByResource = typeof SUPPORTED_ACTIONS_BY_RESOURCE;
+export type SupportedResource = XoAclSupportedResource<SupportedActionsByResource>;
+export type SupportedActions<T extends SupportedResource> = XoAclSupportedActions<SupportedActionsByResource, T>;
+export type TPrivilege<T extends SupportedResource> = XoAclPrivilege<SupportedActionsByResource, T>;
+export declare class Privilege<T extends SupportedResource> {
+    #private;
+    constructor({ action, selector, resource, effect, }: {
+        action: TPrivilege<T>['action'];
+        selector?: TPrivilege<T>['selector'];
+        resource: TPrivilege<T>['resource'];
+        effect: TPrivilege<T>['effect'];
+    });
+    get effect(): "allow" | "deny";
+    match<Resource extends SupportedResource = T>(constraint: {
+        action: SupportedActions<Resource>;
+        resource: Resource;
+        object: object;
+    }): boolean;
+    /**
+     * Throw if action not supported
+     */
+    static checkActionIsValid<T extends SupportedResource>(resource: T, action: SupportedActions<T>): void;
+}

package/dist/class/privilege.mjs

@@ -0,0 +1,76 @@
+import * as CM from 'complex-matcher';
+import { SUPPORTED_ACTIONS_BY_RESOURCE } from '../actions/index.mjs';
+export class Privilege {
+    #action;
+    #selector;
+    #resource;
+    #effect;
+    constructor({ action, selector, resource, effect, }) {
+        Privilege.checkActionIsValid(resource, action);
+        this.#action = action;
+        this.#selector = selector !== undefined ? CM.parse(selector).createPredicate() : undefined;
+        this.#resource = resource;
+        this.#effect = effect;
+    }
+    get effect() {
+        return this.#effect;
+    }
+    #matchAction(action) {
+        // read:name_label - read:name_label
+        if (this.#action === action) {
+            return true;
+        }
+        const [namespaceToMatch, actionToMatch] = action.split(':');
+        const [thisNamespace, thisAction] = this.#action.split(':');
+        if (thisNamespace === '*') {
+            return true;
+        }
+        // update:vm - read:name_label
+        if (thisNamespace !== namespaceToMatch) {
+            return false;
+        }
+        // read - read:name_label
+        if (thisAction === undefined) {
+            return true;
+        }
+        // read:name_decription - read:name_label
+        if (thisAction !== actionToMatch) {
+            return false;
+        }
+        throw new Error(`Unable to verify if ${this.#action} match ${action} `);
+    }
+    #matchSelector(object) {
+        if (this.#selector === undefined) {
+            return true;
+        }
+        return this.#selector(object);
+    }
+    #matchResource(resource) {
+        return resource === this.#resource;
+    }
+    match(constraint) {
+        return (this.#matchResource(constraint.resource) &&
+            this.#matchAction(constraint.action) &&
+            this.#matchSelector(constraint.object));
+    }
+    /**
+     * Throw if action not supported
+     */
+    static checkActionIsValid(resource, action) {
+        const supportedActions = SUPPORTED_ACTIONS_BY_RESOURCE[resource];
+        if (supportedActions === undefined) {
+            throw new Error(`${resource} resource not supported`);
+        }
+        if (action === '*') {
+            return;
+        }
+        const segments = action.split(':');
+        let _action = undefined;
+        segments.forEach(segment => {
+            _action = (_action ?? supportedActions)[segment];
+            if (_action === undefined) {
+                throw new Error(`${action} action not supported for the resource: ${resource}. See ${JSON.stringify(supportedActions)}`);
+            }
+        });
+    }
+}