@xen-orchestra/rest-api 0.28.2 → 0.30.0

package/dist/schedules/schedule.controller.mjs

@@ -7,10 +7,11 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Path, Post, Query, Request, Response, Route, Security, SuccessResponse, Tags } from 'tsoa';
+import { Example, Get, Middlewares, Path, Post, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
-import { asynchronousActionResp, badRequestResp, featureUnauthorized, internalServerErrorResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
+import { acl } from '../middlewares/acl.middleware.mjs';
+import { asynchronousActionResp, badRequestResp, featureUnauthorized, forbiddenOperationResp, internalServerErrorResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { partialSchedules, schedule, scheduleIds } from '../open-api/oa-examples/schedule.oa-example.mjs';
 import { taskLocation } from '../open-api/oa-examples/task.oa-example.mjs';
 import { XoController } from '../abstract-classes/xo-controller.mjs';
@@ -27,20 +28,34 @@ let ScheduleController = class ScheduleController extends XoController {
         return this.restApi.xoApp.getSchedule(id);
     }
     /**
+     * Returns all schedules that match the following privilege:
+     * - resource: schedule, action: read
+     *
      * @example fields "enabled,jobId,cron,id"
      * @example filter "enabled?"
      * @example limit 42
      */
-    async getSchedules(req, fields, ndjson, filter, limit) {
-        return this.sendObjects(Object.values(await this.getObjects({ filter, limit })), req);
+    async getSchedules(req, fields, ndjson, markdown, filter, limit) {
+        return this.sendObjects(Object.values(await this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'schedule' },
+        });
     }
     /**
+     *
+     * Required privilege:
+     * - resource: schedule, action: read
+     *
      * @example id "cf7249f8-d20b-494f-97f4-b1f32f94e780"
      */
     async getSchedule(id) {
         return this.getObject(id);
     }
     /**
+     *
+     * Required privilege:
+     * - resource: schedule, action: run
+     *
      * @example id "cf7249f8-d20b-494f-97f4-b1f32f94e780"
      */
     async runSchedule(id, sync) {
@@ -62,24 +77,40 @@ __decorate([
     Example(scheduleIds),
     Example(partialSchedules),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
     __param(3, Query()),
-    __param(4, Query())
+    __param(4, Query()),
+    __param(5, Query())
 ], ScheduleController.prototype, "getSchedules", null);
 __decorate([
     Example(schedule),
     Get('{id}'),
+    Middlewares(acl({
+        resource: 'schedule',
+        action: 'read',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => id => restApi.xoApp.getSchedule(id),
+    })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], ScheduleController.prototype, "getSchedule", null);
 __decorate([
     Example(taskLocation),
     Post('{id}/actions/run'),
+    Middlewares(acl({
+        resource: 'schedule',
+        action: 'run',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => id => restApi.xoApp.getSchedule(id),
+    })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
     Response(noContentResp.status, noContentResp.description),
     Response(featureUnauthorized.status, featureUnauthorized.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
     __param(0, Path()),

package/dist/servers/server.controller.mjs

@@ -11,7 +11,8 @@ import { Body, Delete, Example, Get, Middlewares, Path, Post, Query, Request, Re
 import { json } from 'express';
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
-import { asynchronousActionResp, badRequestResp, createdResp, invalidParameters, noContentResp, notFoundResp, resourceAlreadyExists, unauthorizedResp, } from '../open-api/common/response.common.mjs';
+import { acl } from '../middlewares/acl.middleware.mjs';
+import { asynchronousActionResp, badRequestResp, createdResp, forbiddenOperationResp, invalidParameters, noContentResp, notFoundResp, resourceAlreadyExists, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { partialServers, server, serverId, serverIds } from '../open-api/oa-examples/server.oa-example.mjs';
 import { partialTasks, taskIds, taskLocation } from '../open-api/oa-examples/task.oa-example.mjs';
 import { XoController } from '../abstract-classes/xo-controller.mjs';
@@ -28,26 +29,41 @@ let ServerController = class ServerController extends XoController {
         return this.restApi.xoApp.getXenServer(id);
     }
     /**
+     * Returns all servers that match the following privilege:
+     * - resource: server, action: read
+     *
      * @example fields "status,id"
      * @example filter "status:/^connected$/"
      * @example limit 42
      */
-    async getServers(req, fields, ndjson, filter, limit) {
-        return this.sendObjects(Object.values(await this.getObjects({ filter, limit })), req);
+    async getServers(req, fields, ndjson, markdown, filter, limit) {
+        return this.sendObjects(Object.values(await this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'server' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: server, action: read
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     getServer(id) {
         return this.getObject(id);
     }
     /**
+     * Required privilege:
+     * - resource: server, action: delete
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     async deleteServer(id) {
         await this.restApi.xoApp.unregisterXenServer(id);
     }
     /**
+     * Required privilege:
+     * - resource: server, action: create
+     *
      * @example body {
      *   "allowUnauthorized": true,
      *   "host": "192.168.1.10",
@@ -61,6 +77,9 @@ let ServerController = class ServerController extends XoController {
         return { id: server.id };
     }
     /**
+     * Required privilege:
+     * - resource: server, action: connect
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     connectServer(id, sync) {
@@ -75,6 +94,9 @@ let ServerController = class ServerController extends XoController {
         });
     }
     /**
+     * Required privilege:
+     * - resource: server, action: disconnect
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     disconnectServer(id, sync) {
@@ -89,43 +111,67 @@ let ServerController = class ServerController extends XoController {
         });
     }
     /**
+     * Returns all tasks that match the following privilege:
+     * - resource: task, action: read
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      * @example fields "id,status,properties"
      * @example filter "status:failure"
      * @example limit 42
      */
-    async getServerTasks(req, id, fields, ndjson, filter, limit) {
-        const tasks = await this.getTasksForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(tasks), req, 'tasks');
+    async getServerTasks(req, id, fields, ndjson, markdown, filter, limit) {
+        const tasks = await this.getTasksForObject(id, { filter });
+        return this.sendObjects(Object.values(tasks), req, {
+            path: 'tasks',
+            limit,
+            privilege: { action: 'read', resource: 'task' },
+        });
     }
 };
 __decorate([
     Example(serverIds),
     Example(partialServers),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
     __param(3, Query()),
-    __param(4, Query())
+    __param(4, Query()),
+    __param(5, Query())
 ], ServerController.prototype, "getServers", null);
 __decorate([
     Example(server),
     Get('{id}'),
+    Middlewares(acl({
+        resource: 'server',
+        action: 'read',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getXenServer,
+    })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], ServerController.prototype, "getServer", null);
 __decorate([
     Delete('{id}'),
+    Middlewares(acl({
+        resource: 'server',
+        action: 'delete',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getXenServer,
+    })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], ServerController.prototype, "deleteServer", null);
 __decorate([
     Example(serverId),
     Post(''),
-    Middlewares(json()),
+    Middlewares([json(), acl({ resource: 'server', action: 'create', object: ({ req }) => req.body })]),
     SuccessResponse(createdResp.status, createdResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(resourceAlreadyExists.status, resourceAlreadyExists.description),
     Response(invalidParameters.status, invalidParameters.description),
     __param(0, Body())
@@ -133,8 +179,15 @@ __decorate([
 __decorate([
     Example(taskLocation),
     Post('{id}/actions/connect'),
+    Middlewares(acl({
+        resource: 'server',
+        action: 'connect',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getXenServer,
+    })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
     Response(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(409, 'The server is already connected'),
     __param(0, Path()),
@@ -143,8 +196,15 @@ __decorate([
 __decorate([
     Example(taskLocation),
     Post('{id}/actions/disconnect'),
+    Middlewares(acl({
+        resource: 'server',
+        action: 'disconnect',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getXenServer,
+    })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
     Response(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(409, 'The server is already disconnected'),
     __param(0, Path()),
@@ -154,6 +214,7 @@ __decorate([
     Example(taskIds),
     Example(partialTasks),
     Get('{id}/tasks'),
+    Security('*', ['acl']),
     Tags('tasks'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -161,7 +222,8 @@ __decorate([
     __param(2, Query()),
     __param(3, Query()),
     __param(4, Query()),
-    __param(5, Query())
+    __param(5, Query()),
+    __param(6, Query())
 ], ServerController.prototype, "getServerTasks", null);
 ServerController = __decorate([
     Route('servers'),

package/dist/sms/sm.controller.mjs

@@ -7,9 +7,10 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
+import { Example, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
+import { acl } from '../middlewares/acl.middleware.mjs';
 import { badRequestResp, notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
 import { partialSms, sm, smIds } from '../open-api/oa-examples/sm.oa-example.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
@@ -19,14 +20,23 @@ let SmController = class SmController extends XapiXoController {
         super('SM', restApi);
     }
     /**
+     * Returns all SMs that match the following privilege:
+     * - resource: sm, action: read
+     *
      * @example fields "uuid,name_label,SM_type"
      * @example filter "SM_type:ext"
      * @example limit 42
      */
-    getSrs(req, fields, ndjson, filter, limit) {
-        return this.sendObjects(Object.values(this.getObjects({ filter, limit })), req);
+    getSrs(req, fields, ndjson, markdown, filter, limit) {
+        return this.sendObjects(Object.values(this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'sm' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: sm, action: read
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      */
     getSr(id) {
@@ -37,15 +47,18 @@ __decorate([
     Example(smIds),
     Example(partialSms),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
     __param(3, Query()),
-    __param(4, Query())
+    __param(4, Query()),
+    __param(5, Query())
 ], SmController.prototype, "getSrs", null);
 __decorate([
     Example(sm),
     Get('{id}'),
+    Middlewares(acl({ resource: 'sm', action: 'read', objectId: 'params.id' })),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], SmController.prototype, "getSr", null);

package/dist/srs/sr.controller.mjs

@@ -7,15 +7,16 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Delete, Example, Get, Path, Post, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
+import { Delete, Example, Get, Middlewares, Path, Post, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
 import { SUPPORTED_VDI_FORMAT } from '@vates/types';
+import { acl } from '../middlewares/acl.middleware.mjs';
 import { AlarmService } from '../alarms/alarm.service.mjs';
 import { BASE_URL } from '../index.mjs';
 import { escapeUnsafeComplexMatcher } from '../helpers/utils.helper.mjs';
 import { genericAlarmsExample } from '../open-api/oa-examples/alarm.oa-example.mjs';
-import { asynchronousActionResp, badRequestResp, createdResp, internalServerErrorResp, invalidParameters as invalidParametersResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
+import { asynchronousActionResp, badRequestResp, createdResp, internalServerErrorResp, invalidParameters as invalidParametersResp, forbiddenOperationResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { partialSrs, sr, srIds } from '../open-api/oa-examples/sr.oa-example.mjs';
 import { vdiId } from '../open-api/oa-examples/vdi.oa-example.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
@@ -29,35 +30,54 @@ let SrController = class SrController extends XapiXoController {
         this.#alarmService = alarmService;
     }
     /**
+     * Returns all SRs that match the following privilege:
+     * - resource: sr, action: read
+     *
      * @example fields "uuid,name_label,allocationStrategy"
      * @example filter "allocationStrategy:thin"
      * @example limit 42
      */
-    getSrs(req, fields, ndjson, filter, limit) {
-        return this.sendObjects(Object.values(this.getObjects({ filter, limit })), req);
+    getSrs(req, fields, ndjson, markdown, filter, limit) {
+        return this.sendObjects(Object.values(this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'sr' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: sr, action: read
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      */
     getSr(id) {
         return this.getObject(id);
     }
     /**
+     * Returns all alarms that match the following privilege:
+     * - resource: alarm, action: read
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      * @example fields "id,time"
      * @example filter "time:>1747053793"
      * @example limit 42
      */
-    getSrAlarms(req, id, fields, ndjson, filter, limit) {
+    getSrAlarms(req, id, fields, ndjson, markdown, filter, limit) {
         const sr = this.getObject(id);
         const alarms = this.#alarmService.getAlarms({
             filter: `${escapeUnsafeComplexMatcher(filter) ?? ''} object:uuid:${sr.uuid}`,
+        });
+        return this.sendObjects(Object.values(alarms), req, {
+            path: 'alarms',
             limit,
+            privilege: { action: 'read', resource: 'alarm' },
         });
-        return this.sendObjects(Object.values(alarms), req, 'alarms');
     }
     /**
      * Import an exported VDI
+     *
+     * Required privilege:
+     * - resource: sr, action: import:vdi
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      * @example name_label "VDI_foo_import"
      * @example name_description "VDI imported by the REST API"
@@ -79,26 +99,43 @@ let SrController = class SrController extends XapiXoController {
         return { id: vdiId };
     }
     /**
+     * Returns all messages that match the following privilege:
+     * - resource: message, action: read
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      * @example fields "name,id,$object"
      * @example filter "name:VM_STARTED"
      * @example limit 42
      */
-    getSrMessages(req, id, fields, ndjson, filter, limit) {
-        const messages = this.getMessagesForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(messages), req, 'messages');
+    getSrMessages(req, id, fields, ndjson, markdown, filter, limit) {
+        const messages = this.getMessagesForObject(id, { filter });
+        return this.sendObjects(Object.values(messages), req, {
+            path: 'messages',
+            limit,
+            privilege: { action: 'read', resource: 'message' },
+        });
     }
     /**
+     * Returns all tasks that match the following privilege:
+     * - resource: task, action: read
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      * @example fields "id,status,properties"
      * @example filter "status:failure"
      * @example limit 42
      */
-    async getSrTasks(req, id, fields, ndjson, filter, limit) {
-        const tasks = await this.getTasksForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(tasks), req, 'tasks');
+    async getSrTasks(req, id, fields, ndjson, markdown, filter, limit) {
+        const tasks = await this.getTasksForObject(id, { filter });
+        return this.sendObjects(Object.values(tasks), req, {
+            path: 'tasks',
+            limit,
+            privilege: { action: 'read', resource: 'task' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: sr, action: update:tags
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      * @example tag "from-rest-api"
      */
@@ -107,6 +144,9 @@ let SrController = class SrController extends XapiXoController {
         await sr.$call('add_tags', tag);
     }
     /**
+     * Required privilege:
+     * - resource: sr, action: update:tags
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      * @example tag "from-rest-api"
      */
@@ -173,21 +213,26 @@ __decorate([
     Example(srIds),
     Example(partialSrs),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
     __param(3, Query()),
-    __param(4, Query())
+    __param(4, Query()),
+    __param(5, Query())
 ], SrController.prototype, "getSrs", null);
 __decorate([
     Example(sr),
     Get('{id}'),
+    Middlewares(acl({ resource: 'sr', action: 'read', objectId: 'params.id' })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], SrController.prototype, "getSr", null);
 __decorate([
     Example(genericAlarmsExample),
     Get('{id}/alarms'),
+    Security('*', ['acl']),
     Tags('alarms'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -195,13 +240,16 @@ __decorate([
     __param(2, Query()),
     __param(3, Query()),
     __param(4, Query()),
-    __param(5, Query())
+    __param(5, Query()),
+    __param(6, Query())
 ], SrController.prototype, "getSrAlarms", null);
 __decorate([
     Example(vdiId),
     Post('{id}/vdis'),
+    Middlewares(acl({ resource: 'sr', action: 'import:vdi', objectId: 'params.id' })),
     Tags('vdis'),
     SuccessResponse(createdResp.status, 'VDI imported'),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
     __param(1, Path()),
@@ -213,6 +261,7 @@ __decorate([
     Example(messageIds),
     Example(partialMessages),
     Get('{id}/messages'),
+    Security('*', ['acl']),
     Tags('messages'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -220,12 +269,14 @@ __decorate([
     __param(2, Query()),
     __param(3, Query()),
     __param(4, Query()),
-    __param(5, Query())
+    __param(5, Query()),
+    __param(6, Query())
 ], SrController.prototype, "getSrMessages", null);
 __decorate([
     Example(taskIds),
     Example(partialTasks),
     Get('{id}/tasks'),
+    Security('*', ['acl']),
     Tags('tasks'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -233,19 +284,24 @@ __decorate([
     __param(2, Query()),
     __param(3, Query()),
     __param(4, Query()),
-    __param(5, Query())
+    __param(5, Query()),
+    __param(6, Query())
 ], SrController.prototype, "getSrTasks", null);
 __decorate([
+    Put('{id}/tags/{tag}'),
+    Middlewares(acl({ resource: 'sr', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
-    Put('{id}/tags/{tag}'),
     __param(0, Path()),
     __param(1, Path())
 ], SrController.prototype, "putSrTag", null);
 __decorate([
+    Delete('{id}/tags/{tag}'),
+    Middlewares(acl({ resource: 'sr', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
-    Delete('{id}/tags/{tag}'),
     __param(0, Path()),
     __param(1, Path())
 ], SrController.prototype, "deleteSrTag", null);