@xen-orchestra/rest-api 0.28.2 → 0.30.0

package/dist/vbds/vbd.controller.mjs

@@ -12,10 +12,11 @@ import { json } from 'express';
 import { inject } from 'inversify';
 import { invalidParameters as invalidParametersError } from 'xo-common/api-errors.js';
 import { provide } from 'inversify-binding-decorators';
+import { acl } from '../middlewares/acl.middleware.mjs';
 import { AlarmService } from '../alarms/alarm.service.mjs';
 import { escapeUnsafeComplexMatcher } from '../helpers/utils.helper.mjs';
 import { genericAlarmsExample } from '../open-api/oa-examples/alarm.oa-example.mjs';
-import { asynchronousActionResp, badRequestResp, createdResp, internalServerErrorResp, invalidParameters, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
+import { asynchronousActionResp, badRequestResp, createdResp, internalServerErrorResp, invalidParameters, noContentResp, forbiddenOperationResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { BASE_URL } from '../index.mjs';
 import { partialVbds, vbd, vbdId, vbdIds } from '../open-api/oa-examples/vbd.oa-example.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
@@ -28,6 +29,29 @@ let VbdController = class VbdController extends XapiXoController {
         super('VBD', restApi);
         this.#alarmService = alarmService;
     }
+    /**
+     * Returns all VBDs that match the following privilege:
+     * - resource: vbd, action: read
+     *
+     * @example fields "device,bootable,uuid"
+     * @example filter "!bootable?"
+     * @example limit 42
+     */
+    getVbds(req, fields, ndjson, markdown, filter, limit) {
+        return this.sendObjects(Object.values(this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'vbd' },
+        });
+    }
+    /**
+     * Required privilege:
+     * - resource: vbd, action: read
+     *
+     * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
+     */
+    getVbd(id) {
+        return this.getObject(id);
+    }
     /**
      * Create a VBD to attach a VDI to a VM
      *
@@ -51,22 +75,6 @@ let VbdController = class VbdController extends XapiXoController {
         this.setHeader('Location', `${BASE_URL}/vbds/${vbdUuid}`);
         return { id: vbdUuid };
     }
-    /**
-     *
-     * @example fields "device,bootable,uuid"
-     * @example filter "!bootable?"
-     * @example limit 42
-     */
-    getVbds(req, fields, ndjson, filter, limit) {
-        return this.sendObjects(Object.values(this.getObjects({ filter, limit })), req);
-    }
-    /**
-     *
-     * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
-     */
-    getVbd(id) {
-        return this.getObject(id);
-    }
     /**
      * Delete a VBD
      *
@@ -80,38 +88,58 @@ let VbdController = class VbdController extends XapiXoController {
         await xapiVbd.$xapi.VBD_destroy(xapiVbd.$ref);
     }
     /**
+     * Returns all alarms that match the following privilege:
+     * - resource: alarm, action: read
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      * @example fields "id,time"
      * @example filter "time:>1747053793"
      * @example limit 42
      */
-    getVbdAlarms(req, id, fields, ndjson, filter, limit) {
+    getVbdAlarms(req, id, fields, ndjson, markdown, filter, limit) {
         const vbd = this.getObject(id);
         const alarms = this.#alarmService.getAlarms({
             filter: `${escapeUnsafeComplexMatcher(filter) ?? ''} object:uuid:${vbd.uuid}`,
+        });
+        return this.sendObjects(Object.values(alarms), req, {
+            path: 'alarms',
             limit,
+            privilege: { action: 'read', resource: 'alarm' },
         });
-        return this.sendObjects(Object.values(alarms), req, 'alarms');
     }
     /**
+     * Returns all messages that match the following privilege:
+     * - resource: message, action: read
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      * @example fields "name,id,$object"
      * @example filter "name:VM_STARTED"
      * @example limit 42
      */
-    getVbdMessages(req, id, fields, ndjson, filter, limit) {
-        const messages = this.getMessagesForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(messages), req, 'messages');
+    getVbdMessages(req, id, fields, ndjson, markdown, filter, limit) {
+        const messages = this.getMessagesForObject(id, { filter });
+        return this.sendObjects(Object.values(messages), req, {
+            path: 'messages',
+            limit,
+            privilege: { action: 'read', resource: 'message' },
+        });
     }
     /**
+     * Returns all tasks that match the following privilege:
+     * - resource: task, action: read
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      * @example fields "id,status,properties"
      * @example filter "status:failure"
      * @example limit 42
      */
-    async getVbdTasks(req, id, fields, ndjson, filter, limit) {
-        const tasks = await this.getTasksForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(tasks), req, 'tasks');
+    async getVbdTasks(req, id, fields, ndjson, markdown, filter, limit) {
+        const tasks = await this.getTasksForObject(id, { filter });
+        return this.sendObjects(Object.values(tasks), req, {
+            path: 'tasks',
+            limit,
+            privilege: { action: 'read', resource: 'task' },
+        });
     }
     /**
      * Hotplug the VBD, dynamically attaching it to the running VM
@@ -152,31 +180,35 @@ let VbdController = class VbdController extends XapiXoController {
         });
     }
 };
-__decorate([
-    Example(vbdId),
-    Post(''),
-    Middlewares(json()),
-    SuccessResponse(createdResp.status, createdResp.description),
-    Response(notFoundResp.status, notFoundResp.description),
-    Response(invalidParameters.status, invalidParameters.description),
-    __param(0, Body())
-], VbdController.prototype, "createVbd", null);
 __decorate([
     Example(vbdIds),
     Example(partialVbds),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
     __param(3, Query()),
-    __param(4, Query())
+    __param(4, Query()),
+    __param(5, Query())
 ], VbdController.prototype, "getVbds", null);
 __decorate([
     Example(vbd),
     Get('{id}'),
+    Middlewares(acl({ resource: 'vbd', action: 'read', objectId: 'params.id' })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], VbdController.prototype, "getVbd", null);
+__decorate([
+    Example(vbdId),
+    Post(''),
+    Middlewares(json()),
+    SuccessResponse(createdResp.status, createdResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
+    Response(invalidParameters.status, invalidParameters.description),
+    __param(0, Body())
+], VbdController.prototype, "createVbd", null);
 __decorate([
     Delete('{id}'),
     SuccessResponse(noContentResp.status, noContentResp.description),
@@ -186,6 +218,7 @@ __decorate([
 __decorate([
     Example(genericAlarmsExample),
     Get('{id}/alarms'),
+    Security('*', ['acl']),
     Tags('alarms'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -193,12 +226,14 @@ __decorate([
     __param(2, Query()),
     __param(3, Query()),
     __param(4, Query()),
-    __param(5, Query())
+    __param(5, Query()),
+    __param(6, Query())
 ], VbdController.prototype, "getVbdAlarms", null);
 __decorate([
     Example(messageIds),
     Example(partialMessages),
     Get('{id}/messages'),
+    Security('*', ['acl']),
     Tags('messages'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -206,12 +241,14 @@ __decorate([
     __param(2, Query()),
     __param(3, Query()),
     __param(4, Query()),
-    __param(5, Query())
+    __param(5, Query()),
+    __param(6, Query())
 ], VbdController.prototype, "getVbdMessages", null);
 __decorate([
     Example(taskIds),
     Example(partialTasks),
     Get('{id}/tasks'),
+    Security('*', ['acl']),
     Tags('tasks'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -219,7 +256,8 @@ __decorate([
     __param(2, Query()),
     __param(3, Query()),
     __param(4, Query()),
-    __param(5, Query())
+    __param(5, Query()),
+    __param(6, Query())
 ], VbdController.prototype, "getVbdTasks", null);
 __decorate([
     Example(taskLocation),

package/dist/vdi-snapshots/vdi-snapshot.controller.mjs

@@ -29,12 +29,18 @@ let VdiSnapshotController = class VdiSnapshotController extends XapiXoController
         this.#vdiService = vdiService;
     }
     /**
+     * Returns all VDI snapshots that match the following privilege:
+     * - resource: vdi-snapshot, action: read
+     *
      * @example fields "uuid,snapshot_time,$snapshot_of"
      * @example filter "snapshot_time:>1725020038"
      * @example limit 42
      */
-    getVdiSnapshots(req, fields, ndjson, filter, limit) {
-        return this.sendObjects(Object.values(this.getObjects({ filter, limit })), req);
+    getVdiSnapshots(req, fields, ndjson, markdown, filter, limit) {
+        return this.sendObjects(Object.values(this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'vdi-snapshot' },
+        });
     }
     /**
      *
@@ -59,18 +65,24 @@ let VdiSnapshotController = class VdiSnapshotController extends XapiXoController
         return this.getObject(id);
     }
     /**
+     * Returns all alarms that match the following privilege:
+     * - resource: alarm, action: read
+     *
      * @example id "d2727772-735b-478f-b6f9-11e7db56dfd0"
      * @example fields "id,time"
      * @example filter "time:>1747053793"
      * @example limit 42
      */
-    getVdiSnapshotAlarms(req, id, fields, ndjson, filter, limit) {
+    getVdiSnapshotAlarms(req, id, fields, ndjson, markdown, filter, limit) {
         const vdiSnapshot = this.getObject(id);
         const alarms = this.#alarmService.getAlarms({
             filter: `${escapeUnsafeComplexMatcher(filter) ?? ''} object:uuid:${vdiSnapshot.uuid}`,
+        });
+        return this.sendObjects(Object.values(alarms), req, {
+            path: 'alarms',
             limit,
+            privilege: { action: 'read', resource: 'alarm' },
         });
-        return this.sendObjects(Object.values(alarms), req, 'alarms');
     }
     /**
      * @example id "d2727772-735b-478f-b6f9-11e7db56dfd0"
@@ -80,24 +92,38 @@ let VdiSnapshotController = class VdiSnapshotController extends XapiXoController
         await xapiVdiSnapshot.$xapi.VDI_destroy(xapiVdiSnapshot.$ref);
     }
     /**
+     * Returns all messages that match the following privilege:
+     * - resource: message, action: read
+     *
      * @example id "d2727772-735b-478f-b6f9-11e7db56dfd0"
      * @example fields "name,id,$object"
      * @example filter "name:VM_STARTED"
      * @example limit 42
      */
-    getVdiSnapshotMessages(req, id, fields, ndjson, filter, limit) {
-        const messages = this.getMessagesForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(messages), req, 'messages');
+    getVdiSnapshotMessages(req, id, fields, ndjson, markdown, filter, limit) {
+        const messages = this.getMessagesForObject(id, { filter });
+        return this.sendObjects(Object.values(messages), req, {
+            path: 'messages',
+            limit,
+            privilege: { action: 'read', resource: 'message' },
+        });
     }
     /**
+     * Returns all tasks that match the following privilege:
+     * - resource: task, action: read
+     *
      * @example id "d2727772-735b-478f-b6f9-11e7db56dfd0"
      * @example fields "id,status,properties"
      * @example filter "status:failure"
      * @example limit 42
      */
-    async getVdiSnapshotTasks(req, id, fields, ndjson, filter, limit) {
-        const tasks = await this.getTasksForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(tasks), req, 'tasks');
+    async getVdiSnapshotTasks(req, id, fields, ndjson, markdown, filter, limit) {
+        const tasks = await this.getTasksForObject(id, { filter });
+        return this.sendObjects(Object.values(tasks), req, {
+            path: 'tasks',
+            limit,
+            privilege: { action: 'read', resource: 'task' },
+        });
     }
     /**
      * @example id "d2727772-735b-478f-b6f9-11e7db56dfd0"
@@ -120,11 +146,13 @@ __decorate([
     Example(vdiSnapshotIds),
     Example(partialVdiSnapshots),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
     __param(3, Query()),
-    __param(4, Query())
+    __param(4, Query()),
+    __param(5, Query())
 ], VdiSnapshotController.prototype, "getVdiSnapshots", null);
 __decorate([
     Get('{id}.{format}'),
@@ -144,6 +172,7 @@ __decorate([
 __decorate([
     Example(genericAlarmsExample),
     Get('{id}/alarms'),
+    Security('*', ['acl']),
     Tags('alarms'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -151,7 +180,8 @@ __decorate([
     __param(2, Query()),
     __param(3, Query()),
     __param(4, Query()),
-    __param(5, Query())
+    __param(5, Query()),
+    __param(6, Query())
 ], VdiSnapshotController.prototype, "getVdiSnapshotAlarms", null);
 __decorate([
     Delete('{id}'),
@@ -163,6 +193,7 @@ __decorate([
     Example(messageIds),
     Example(partialMessages),
     Get('{id}/messages'),
+    Security('*', ['acl']),
     Tags('messages'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -170,12 +201,14 @@ __decorate([
     __param(2, Query()),
     __param(3, Query()),
     __param(4, Query()),
-    __param(5, Query())
+    __param(5, Query()),
+    __param(6, Query())
 ], VdiSnapshotController.prototype, "getVdiSnapshotMessages", null);
 __decorate([
     Example(taskIds),
     Example(partialTasks),
     Get('{id}/tasks'),
+    Security('*', ['acl']),
     Tags('tasks'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -183,7 +216,8 @@ __decorate([
     __param(2, Query()),
     __param(3, Query()),
     __param(4, Query()),
-    __param(5, Query())
+    __param(5, Query()),
+    __param(6, Query())
 ], VdiSnapshotController.prototype, "getVdiSnapshotTasks", null);
 __decorate([
     Put('{id}/tags/{tag}'),

package/dist/vdis/vdi.controller.mjs

@@ -11,10 +11,11 @@ import { Body, Delete, Example, Get, Middlewares, Path, Post, Put, Query, Reques
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
 import { json } from 'express';
+import { acl } from '../middlewares/acl.middleware.mjs';
 import { AlarmService } from '../alarms/alarm.service.mjs';
 import { escapeUnsafeComplexMatcher } from '../helpers/utils.helper.mjs';
 import { genericAlarmsExample } from '../open-api/oa-examples/alarm.oa-example.mjs';
-import { asynchronousActionResp, badRequestResp, createdResp, internalServerErrorResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
+import { asynchronousActionResp, badRequestResp, createdResp, forbiddenOperationResp, internalServerErrorResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { BASE_URL } from '../index.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
 import { XapiXoController } from '../abstract-classes/xapi-xo-controller.mjs';
@@ -31,17 +32,26 @@ let VdiController = class VdiController extends XapiXoController {
         this.#vdiService = vdiService;
     }
     /**
+     * Returns all VDIs that match the following privilege:
+     * - resource: vdi, action: read
+     *
      * @example fields "*"
      * @example filter "snapshots:length:>2"
      * @example limit 42
      */
-    getVdis(req, fields, ndjson, filter, limit) {
-        return this.sendObjects(Object.values(this.getObjects({ filter, limit })), req);
+    getVdis(req, fields, ndjson, markdown, filter, limit) {
+        return this.sendObjects(Object.values(this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'vdi' },
+        });
     }
     /**
      *
      * Export VDI content
      *
+     * Required privilege:
+     * - resource: vdi, action: export-content
+     *
      * @example id "c77f9955-c1d2-4b39-aa1c-73cdb2dacb7e"
      */
     async exportVdiContent(req, id, format) {
@@ -55,6 +65,9 @@ let VdiController = class VdiController extends XapiXoController {
      *
      * Import VDI content
      *
+     * Required privilege:
+     * - resource: vdi, action: import-content
+     *
      * @example id "c77f9955-c1d2-4b39-aa1c-73cdb2dacb7e"
      */
     async importVdiContent(req, id, format) {
@@ -66,27 +79,36 @@ let VdiController = class VdiController extends XapiXoController {
         await xapiVdi.$xapi.VDI_importContent(xapiVdi.$ref, req, { format });
     }
     /**
+     * Required privilege:
+     * - resource: vdi, action: read
+     *
      * @example id "c77f9955-c1d2-4b39-aa1c-73cdb2dacb7e"
      */
     getVdi(id) {
         return this.getObject(id);
     }
     /**
+     * Returns all alarms that match the following privilege:
+     * - resource: alarm, action: read
+     *
      * @example id "c77f9955-c1d2-4b39-aa1c-73cdb2dacb7e"
      * @example fields "id,time"
      * @example filter "time:>1747053793"
      * @example limit 42
      */
-    getVdiAlarms(req, id, fields, ndjson, filter, limit) {
+    getVdiAlarms(req, id, fields, ndjson, markdown, filter, limit) {
         const vdi = this.getObject(id);
         const alarms = this.#alarmService.getAlarms({
             filter: `${escapeUnsafeComplexMatcher(filter) ?? ''} object:uuid:${vdi.uuid}`,
+        });
+        return this.sendObjects(Object.values(alarms), req, {
+            path: 'alarms',
             limit,
+            privilege: { action: 'read', resource: 'alarm' },
         });
-        return this.sendObjects(Object.values(alarms), req, 'alarms');
     }
     /**
-     * Create an empty VDI on the given SR.
+     * Create an empty VDI.
      *
      * @example body { "srId": "c4284e12-37c9-7967-b9e8-83ef229c3e03", "virtual_size": 10737418240, "name_label": "test VDI" }
      */
@@ -105,6 +127,9 @@ let VdiController = class VdiController extends XapiXoController {
         return { id: vdiUuid };
     }
     /**
+     * Required privilege:
+     * - resource: vdi, action: delete
+     *
      * @example id "c77f9955-c1d2-4b39-aa1c-73cdb2dacb7e"
      */
     async deleteVdi(id) {
@@ -112,24 +137,38 @@ let VdiController = class VdiController extends XapiXoController {
         await xapiVdi.$xapi.VDI_destroy(xapiVdi.$ref);
     }
     /**
+     * Returns all messages that match the following privilege:
+     * - resource: message, action: read
+     *
      * @example id "c77f9955-c1d2-4b39-aa1c-73cdb2dacb7e"
      * @example fields "name,id,$object"
      * @example filter "name:VM_STARTED"
      * @example limit 42
      */
-    getVdiMessages(req, id, fields, ndjson, filter, limit) {
-        const messages = this.getMessagesForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(messages), req, 'messages');
+    getVdiMessages(req, id, fields, ndjson, markdown, filter, limit) {
+        const messages = this.getMessagesForObject(id, { filter });
+        return this.sendObjects(Object.values(messages), req, {
+            path: 'messages',
+            limit,
+            privilege: { action: 'read', resource: 'message' },
+        });
     }
     /**
+     * Returns all tasks that match the following privilege:
+     * - resource: task, action: read
+     *
      * @example id "c77f9955-c1d2-4b39-aa1c-73cdb2dacb7e"
      * @example fields "id,status,properties"
      * @example filter "status:failure"
      * @example limit 42
      */
-    async getVdiTasks(req, id, fields, ndjson, filter, limit) {
-        const tasks = await this.getTasksForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(tasks), req, 'tasks');
+    async getVdiTasks(req, id, fields, ndjson, markdown, filter, limit) {
+        const tasks = await this.getTasksForObject(id, { filter });
+        return this.sendObjects(Object.values(tasks), req, {
+            path: 'tasks',
+            limit,
+            privilege: { action: 'read', resource: 'task' },
+        });
     }
     /**
      * Migrate a VDI to another SR.
@@ -153,6 +192,9 @@ let VdiController = class VdiController extends XapiXoController {
         });
     }
     /**
+     * Required privilege:
+     * - resource: vdi, action: update:tags
+     *
      * @example id "c77f9955-c1d2-4b39-aa1c-73cdb2dacb7e"
      * @example tag "from-rest-api"
      */
@@ -161,6 +203,9 @@ let VdiController = class VdiController extends XapiXoController {
         await vdi.$call('add_tags', tag);
     }
     /**
+     * Required privilege:
+     * - resource: vdi, action: update:tags
+     *
      * @example id "c77f9955-c1d2-4b39-aa1c-73cdb2dacb7e"
      * @example tag "from-rest-api"
      */
@@ -173,15 +218,19 @@ __decorate([
     Example(vdiIds),
     Example(partialVdis),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
     __param(3, Query()),
-    __param(4, Query())
+    __param(4, Query()),
+    __param(5, Query())
 ], VdiController.prototype, "getVdis", null);
 __decorate([
     Get('{id}.{format}'),
+    Middlewares(acl({ resource: 'vdi', action: 'export-content', objectId: 'params.id' })),
     SuccessResponse(200, 'Download started', 'application/octet-stream'),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(422, 'Invalid format'),
     __param(0, Request()),
@@ -190,7 +239,9 @@ __decorate([
 ], VdiController.prototype, "exportVdiContent", null);
 __decorate([
     Put('{id}.{format}'),
+    Middlewares(acl({ resource: 'vdi', action: 'import-content', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(422, 'Invalid format'),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
@@ -201,12 +252,15 @@ __decorate([
 __decorate([
     Example(vdi),
     Get('{id}'),
+    Middlewares(acl({ resource: 'vdi', action: 'read', objectId: 'params.id' })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], VdiController.prototype, "getVdi", null);
 __decorate([
     Example(genericAlarmsExample),
     Get('{id}/alarms'),
+    Security('*', ['acl']),
     Tags('alarms'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -214,7 +268,8 @@ __decorate([
     __param(2, Query()),
     __param(3, Query()),
     __param(4, Query()),
-    __param(5, Query())
+    __param(5, Query()),
+    __param(6, Query())
 ], VdiController.prototype, "getVdiAlarms", null);
 __decorate([
     Example(vdiId),
@@ -227,7 +282,9 @@ __decorate([
 ], VdiController.prototype, "createVdi", null);
 __decorate([
     Delete('{id}'),
+    Middlewares(acl({ resource: 'vdi', action: 'delete', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], VdiController.prototype, "deleteVdi", null);
@@ -235,6 +292,7 @@ __decorate([
     Example(messageIds),
     Example(partialMessages),
     Get('{id}/messages'),
+    Security('*', ['acl']),
     Tags('messages'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -242,12 +300,14 @@ __decorate([
     __param(2, Query()),
     __param(3, Query()),
     __param(4, Query()),
-    __param(5, Query())
+    __param(5, Query()),
+    __param(6, Query())
 ], VdiController.prototype, "getVdiMessages", null);
 __decorate([
     Example(taskIds),
     Example(partialTasks),
     Get('{id}/tasks'),
+    Security('*', ['acl']),
     Tags('tasks'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -255,7 +315,8 @@ __decorate([
     __param(2, Query()),
     __param(3, Query()),
     __param(4, Query()),
-    __param(5, Query())
+    __param(5, Query()),
+    __param(6, Query())
 ], VdiController.prototype, "getVdiTasks", null);
 __decorate([
     Example(taskLocation),
@@ -272,14 +333,18 @@ __decorate([
 ], VdiController.prototype, "migrateVdi", null);
 __decorate([
     Put('{id}/tags/{tag}'),
+    Middlewares(acl({ resource: 'vdi', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path()),
     __param(1, Path())
 ], VdiController.prototype, "putVdiTag", null);
 __decorate([
     Delete('{id}/tags/{tag}'),
+    Middlewares(acl({ resource: 'vdi', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path()),
     __param(1, Path())