@xen-orchestra/rest-api 0.28.2 → 0.30.0

package/dist/acl-roles/acl-role.controller.mjs

@@ -0,0 +1,384 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Body, Delete, Example, Get, Middlewares, Patch, Path, Post, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
+import { provide } from 'inversify-binding-decorators';
+import { json } from 'express';
+import { acl, actionsFromBody } from '../middlewares/acl.middleware.mjs';
+import { aclPrivilegeIds, partialAclPrivileges } from '../open-api/oa-examples/acl-privilege.oa-example.mjs';
+import { aclRole, aclRoleIds, partialAclRoles } from '../open-api/oa-examples/acl-role.oa-example.mjs';
+import { asynchronousActionResp, badRequestResp, createdResp, forbiddenOperationResp, invalidParameters, noContentResp, notFoundResp, resourceAlreadyExists, unauthorizedResp, } from '../open-api/common/response.common.mjs';
+import { BASE_URL } from '../index.mjs';
+import { limitAndFilterArray } from '../helpers/utils.helper.mjs';
+import { taskLocation } from '../open-api/oa-examples/task.oa-example.mjs';
+import { XoController } from '../abstract-classes/xo-controller.mjs';
+import { entityId } from '../open-api/oa-examples/common.oa-example.mjs';
+import { inject } from 'inversify';
+import { RestApi } from '../rest-api/rest-api.mjs';
+let AclRoleController = class AclRoleController extends XoController {
+    constructor(restApi) {
+        super('acl-role', restApi);
+    }
+    getAllCollectionObjects() {
+        return this.restApi.xoApp.getAclV2Roles();
+    }
+    getCollectionObject(id) {
+        return this.restApi.xoApp.getAclV2Role(id);
+    }
+    /**
+     * Returns all ACL roles that match the following privilege:
+     * - resource: acl-role, action: read
+     *
+     * @example fields "id,name,isTemplate"
+     * @example filter "name:read only"
+     * @example limit 42
+     */
+    async getAclV2Roles(req, fields, ndjson, filter, limit) {
+        return this.sendObjects(Object.values(await this.getObjects({ filter })), req, {
+            limit,
+            privilege: { resource: 'acl-role', action: 'read' },
+        });
+    }
+    /**
+     * Required privilege:
+     * - resource: acl-role, action: create
+     *
+     * @example body {
+     *  "name": "VMs creator",
+     *  "description": "Allow to create VMs"
+     * }
+     */
+    async createAclV2Role(body) {
+        const newRole = await this.restApi.xoApp.createAclV2Role(body);
+        return { id: newRole.id };
+    }
+    /**
+     * Required privilege:
+     * - resource: acl-role, action: read
+     *
+     * @example id "784bd959-08de-4b26-b575-92ded5aef872"
+     */
+    getAclV2Role(id) {
+        return this.getObject(id);
+    }
+    /**
+     * Required privilege:
+     * - resource: acl-role, action: delete
+     *
+     * @example id "784bd959-08de-4b26-b575-92ded5aef872"
+     */
+    async deleteAclV2Role(id) {
+        await this.restApi.xoApp.deleteAclV2Role(id);
+    }
+    /**
+     * Required privileges:
+     * - resource: acl-role, action: update (grants all fields)
+     * - resource: acl-role, action: update:name (if name is passed)
+     * - resource: acl-role, action: update:description (if description is passed)
+     *
+     * @example id "784bd959-08de-4b26-b575-92ded5aef872"
+     * @example body {
+     *  "name": "VMs creator",
+     *  "description": "Allow to create VMs"
+     * }
+     */
+    async updateAclV2Role(id, body) {
+        await this.restApi.xoApp.updateAclV2Role(id, body);
+    }
+    /**
+     * Copy a role with all its privileges. Possibility to modify the name and description of the copied role.
+     *
+     * Required privileges:
+     * - resource: acl-role, action: create
+     * - resource: acl-privilege, action: create (if copied role has privileges)
+     *
+     * @example id "784bd959-08de-4b26-b575-92ded5aef872"
+     * @example body {"name": "Copied role"}
+     */
+    copyAclV2Role(id, body, sync) {
+        const roleId = id;
+        const action = async () => {
+            const id = await this.restApi.xoApp.copyAclV2Role(roleId, body);
+            if (sync) {
+                this.setHeader('Location', `${BASE_URL}/acl-roles/${id}`);
+            }
+            return { id };
+        };
+        return this.createAction(action, {
+            sync,
+            statusCode: createdResp.status,
+            taskProperties: {
+                args: body,
+                name: 'copy role',
+                objectId: roleId,
+            },
+        });
+    }
+    /**
+     * Returns all ACL privileges that match the following privilege:
+     * - resource: acl-privilege, action: read
+     *
+     * @example id "426622cc-b2db-4545-a2f0-6ec47b3a6450"
+     * @example fields "id,action,resource"
+     * @example filter "action:create"
+     * @example limit 42
+     */
+    async getAclV2RolePrivileges(req, id, fields, ndjson, filter, limit) {
+        const privileges = (await this.restApi.xoApp.getAclV2RolePrivileges(id));
+        return this.sendObjects(limitAndFilterArray(privileges, { filter }), req, {
+            path: 'acl-privileges',
+            limit,
+            privilege: { resource: 'acl-privilege', action: 'read' },
+        });
+    }
+    /**
+     * Attach an ACL V2 role to a group.
+     *
+     * Required privilege:
+     * - resource: acl-role, action: update:groups
+     *
+     * @example id "784bd959-08de-4b26-b575-92ded5aef872"
+     * @example groupId "ee4965bf-d8af-4ca2-aa0e-5f29d0c5f9e2"
+     */
+    async attachAclV2Group(id, groupId) {
+        const roleId = id;
+        // addAclV2GroupRole does not check if the group exists so we get the group here to make sure it exists.
+        const group = await this.restApi.xoApp.getGroup(groupId);
+        await this.restApi.xoApp.addAclV2GroupRole(group.id, roleId);
+    }
+    /**
+     * Detach an ACL V2 role from a group.
+     *
+     * Required privilege:
+     * - resource: acl-role, action: update:groups
+     *
+     * @example id "784bd959-08de-4b26-b575-92ded5aef872"
+     * @example groupId "ee4965bf-d8af-4ca2-aa0e-5f29d0c5f9e2"
+     */
+    async detachAclV2Group(id, groupId) {
+        const roleId = id;
+        // deleteAclV2GroupRole does not check if the group exists so we get the group here to make sure it exists.
+        const group = await this.restApi.xoApp.getGroup(groupId);
+        await this.restApi.xoApp.deleteAclV2GroupRole(group.id, roleId);
+    }
+    /**
+     * Attach an ACL V2 role to a user.
+     *
+     * Required privilege:
+     * - resource: acl-role, action: update:users
+     *
+     * @example id "784bd959-08de-4b26-b575-92ded5aef872"
+     * @example userId "ee4965bf-d8af-4ca2-aa0e-5f29d0c5f9e2"
+     */
+    async attachAclV2User(id, userId) {
+        const roleId = id;
+        // addAclV2UserRole does not check if the user exists so we get the user here to make sure it exists.
+        const user = await this.restApi.xoApp.getUser(userId);
+        await this.restApi.xoApp.addAclV2UserRole(user.id, roleId);
+    }
+    /**
+     * Detach an ACL V2 role from a user.
+     *
+     * Required privilege:
+     * - resource: acl-role, action: update:users
+     *
+     * @example id "784bd959-08de-4b26-b575-92ded5aef872"
+     * @example userId "ee4965bf-d8af-4ca2-aa0e-5f29d0c5f9e2"
+     */
+    async detachAclV2User(id, userId) {
+        const roleId = id;
+        // deleteAclV2UserRole does not check if the user exists so we get the user here to make sure it exists.
+        const user = await this.restApi.xoApp.getUser(userId);
+        await this.restApi.xoApp.deleteAclV2UserRole(user.id, roleId);
+    }
+};
+__decorate([
+    Example(aclRoleIds),
+    Example(partialAclRoles),
+    Get(''),
+    Security('*', ['acl']),
+    __param(0, Request()),
+    __param(1, Query()),
+    __param(2, Query()),
+    __param(3, Query()),
+    __param(4, Query())
+], AclRoleController.prototype, "getAclV2Roles", null);
+__decorate([
+    Example(entityId),
+    Post(''),
+    Middlewares([
+        json(),
+        acl({
+            resource: 'acl-role',
+            action: 'create',
+            object: ({ req }) => req.body,
+        }),
+    ]),
+    SuccessResponse(createdResp.status, createdResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(invalidParameters.status, invalidParameters.description),
+    __param(0, Body())
+], AclRoleController.prototype, "createAclV2Role", null);
+__decorate([
+    Example(aclRole),
+    Get('{id}'),
+    Middlewares(acl({
+        resource: 'acl-role',
+        action: 'read',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getAclV2Role,
+    })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
+    __param(0, Path())
+], AclRoleController.prototype, "getAclV2Role", null);
+__decorate([
+    Delete('{id}'),
+    Middlewares(acl({
+        resource: 'acl-role',
+        action: 'delete',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getAclV2Role,
+    })),
+    SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
+    __param(0, Path())
+], AclRoleController.prototype, "deleteAclV2Role", null);
+__decorate([
+    Patch('{id}'),
+    Middlewares([
+        json(),
+        acl({
+            resource: 'acl-role',
+            actions: actionsFromBody(['update:name', 'update:description']),
+            objectId: 'params.id',
+            getObject: ({ restApi }) => restApi.xoApp.getAclV2Role,
+        }),
+    ]),
+    SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
+    Response(invalidParameters.status, invalidParameters.description),
+    __param(0, Path()),
+    __param(1, Body())
+], AclRoleController.prototype, "updateAclV2Role", null);
+__decorate([
+    Example(taskLocation),
+    Post('{id}/actions/copy'),
+    Middlewares([
+        json(),
+        acl([
+            {
+                resource: 'acl-role',
+                action: 'create',
+                object: async ({ req, restApi }) => {
+                    const model = await restApi.xoApp.getAclV2Role(req.params.id);
+                    return { name: req.body.name ?? model.name, description: req.body.description ?? model.description };
+                },
+            },
+            {
+                resource: 'acl-privilege',
+                action: 'create',
+                objects: async ({ req, restApi }) => {
+                    const privileges = await restApi.xoApp.getAclV2RolePrivileges(req.params.id);
+                    return privileges.map(({ id, ...rest }) => rest);
+                },
+            },
+        ]),
+    ]),
+    SuccessResponse(createdResp.status, createdResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(asynchronousActionResp.status, asynchronousActionResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
+    __param(0, Path()),
+    __param(1, Body()),
+    __param(2, Query())
+], AclRoleController.prototype, "copyAclV2Role", null);
+__decorate([
+    Example(aclPrivilegeIds),
+    Example(partialAclPrivileges),
+    Get('{id}/privileges'),
+    Security('*', ['acl']),
+    Response(notFoundResp.status, notFoundResp.description),
+    __param(0, Request()),
+    __param(1, Path()),
+    __param(2, Query()),
+    __param(3, Query()),
+    __param(4, Query()),
+    __param(5, Query())
+], AclRoleController.prototype, "getAclV2RolePrivileges", null);
+__decorate([
+    Put('{id}/groups/{groupId}'),
+    Middlewares(acl({
+        resource: 'acl-role',
+        action: 'update:groups',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getAclV2Role,
+    })),
+    SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
+    Response(resourceAlreadyExists.status, resourceAlreadyExists.description),
+    __param(0, Path()),
+    __param(1, Path())
+], AclRoleController.prototype, "attachAclV2Group", null);
+__decorate([
+    Delete('{id}/groups/{groupId}'),
+    Middlewares(acl({
+        resource: 'acl-role',
+        action: 'update:groups',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getAclV2Role,
+    })),
+    SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
+    __param(0, Path()),
+    __param(1, Path())
+], AclRoleController.prototype, "detachAclV2Group", null);
+__decorate([
+    Put('{id}/users/{userId}'),
+    Middlewares(acl({
+        resource: 'acl-role',
+        action: 'update:users',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getAclV2Role,
+    })),
+    SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
+    Response(resourceAlreadyExists.status, resourceAlreadyExists.description),
+    __param(0, Path()),
+    __param(1, Path())
+], AclRoleController.prototype, "attachAclV2User", null);
+__decorate([
+    Delete('{id}/users/{userId}'),
+    Middlewares(acl({
+        resource: 'acl-role',
+        action: 'update:users',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getAclV2Role,
+    })),
+    SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
+    __param(0, Path()),
+    __param(1, Path())
+], AclRoleController.prototype, "detachAclV2User", null);
+AclRoleController = __decorate([
+    Route('acl-roles'),
+    Security('*'),
+    Response(badRequestResp.status, badRequestResp.description),
+    Response(unauthorizedResp.status, unauthorizedResp.description),
+    Tags('acls'),
+    provide(AclRoleController),
+    __param(0, inject(RestApi))
+], AclRoleController);
+export { AclRoleController };

package/dist/alarms/alarm.controller.mjs

@@ -7,12 +7,12 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
+import { Example, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
 import { inject } from 'inversify';
-import { noSuchObject } from 'xo-common/api-errors.js';
 import { provide } from 'inversify-binding-decorators';
 import { alarm, alarmIds, partialAlarms } from '../open-api/oa-examples/alarm.oa-example.mjs';
-import { badRequestResp, notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
+import { acl, autoBindService } from '../middlewares/acl.middleware.mjs';
+import { badRequestResp, forbiddenOperationResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
 import { XapiXoController } from '../abstract-classes/xapi-xo-controller.mjs';
 import { AlarmService } from './alarm.service.mjs';
@@ -32,21 +32,26 @@ let AlarmController = class AlarmController extends XapiXoController {
      * Override parent getObject in order to only get `ALARM` message
      */
     getObject(id) {
-        const maybeAlarm = this.restApi.getObject(id, 'message');
-        if (!this.#alarmService.isAlarm(maybeAlarm)) {
-            throw noSuchObject(id, 'alarm');
-        }
-        return this.#alarmService.parseAlarm(maybeAlarm);
+        return this.#alarmService.getAlarm(id);
     }
     /**
+     * Returns all alarms that match the following privilege:
+     * - resource: alarm, action: read
+     *
      * @example fields "body,id,object"
      * @example filter "body:name:physical_utilisation"
      * @example limit 42
      */
-    getAlarms(req, fields, ndjson, filter, limit) {
-        return this.sendObjects(Object.values(this.getObjects({ filter, limit })), req);
+    getAlarms(req, fields, ndjson, markdown, filter, limit) {
+        return this.sendObjects(Object.values(this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'alarm' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: alarm, action: read
+     *
      * @example id "0c98c71c-2f9c-d5c2-b9b6-2c8371730eab"
      */
     getAlarm(id) {
@@ -57,15 +62,24 @@ __decorate([
     Example(alarmIds),
     Example(partialAlarms),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
     __param(3, Query()),
-    __param(4, Query())
+    __param(4, Query()),
+    __param(5, Query())
 ], AlarmController.prototype, "getAlarms", null);
 __decorate([
     Example(alarm),
     Get('{id}'),
+    Middlewares(acl({
+        resource: 'alarm',
+        action: 'read',
+        objectId: 'params.id',
+        getObject: autoBindService(AlarmService, 'getAlarm'),
+    })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], AlarmController.prototype, "getAlarm", null);

package/dist/alarms/alarm.service.mjs

@@ -1,3 +1,4 @@
+import { noSuchObject } from 'xo-common/api-errors.js';
 import { BASE_URL } from '../index.mjs';
 import { safeParseComplexMatcher } from '../helpers/utils.helper.mjs';
 // E.g: 'value: 0.6\nconfig:\n<variable>\n<name value="cpu_usage"/>\n<alarm_trigger_level value="0.4"/>\n<alarm_trigger_period value ="60"/>\n</variable>';
@@ -65,4 +66,11 @@ export class AlarmService {
         }
         return alarms;
     }
+    getAlarm(id) {
+        const maybeAlarm = this.#restApi.getObject(id, 'message');
+        if (!this.isAlarm(maybeAlarm)) {
+            throw noSuchObject(id, 'alarm');
+        }
+        return this.parseAlarm(maybeAlarm);
+    }
 }

package/dist/backup-archives/backup-archive.controller.mjs

@@ -7,19 +7,20 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
+import { Example, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
 import { inject } from 'inversify';
-import { noSuchObject } from 'xo-common/api-errors.js';
 import { provide } from 'inversify-binding-decorators';
-import { badRequestResp, notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
+import { badRequestResp, forbiddenOperationResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { XoController } from '../abstract-classes/xo-controller.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
 import { backupArchive, backupArchiveIds, partialBackupArchives, } from '../open-api/oa-examples/backup-archive.oa-example.mjs';
-// BR uuid/xo-vm-backups/VM uuid/(ISO 8601 compact).json
-const BACKUP_ARCHIVE_ID_REGEX = /^([0-9a-fA-F-]{36})\/+xo-vm-backups\/+([0-9a-fA-F-]{36})\/+(\d{8}T\d{6}Z)\.json$/;
+import { BackupArchiveService } from './backup-archive.service.mjs';
+import { acl, autoBindService } from '../middlewares/acl.middleware.mjs';
 let BackupArchiveController = class BackupArchiveController extends XoController {
-    constructor(restApi) {
+    #backupArchiveService;
+    constructor(restApi, backupArchiveService) {
         super('backup-archive', restApi);
+        this.#backupArchiveService = backupArchiveService;
     }
     async getAllCollectionObjects({ backupRepositories = [], } = {}) {
         const backupRepositoryIds = [];
@@ -40,19 +41,12 @@ let BackupArchiveController = class BackupArchiveController extends XoController
             .flat(2);
         return vmBackupArchives;
     }
-    async getCollectionObject(id) {
-        const match = id.match(BACKUP_ARCHIVE_ID_REGEX);
-        if (match === null) {
-            throw noSuchObject(id, 'backup-archive');
-        }
-        const [, brId, vmId] = match;
-        const backupArchive = (await this.restApi.xoApp.listVmBackupsNg([brId]))[brId]?.[vmId]?.find(ba => ba.id === id);
-        if (backupArchive === undefined) {
-            throw noSuchObject(id, 'backup-archive');
-        }
-        return backupArchive;
+    getCollectionObject(id) {
+        return this.#backupArchiveService.getBackupArchive(id);
     }
     /**
+     * Returns all backup archives that match the following privilege:
+     * - resource: backup-archive, action: read
      *
      * You can use the alias "*" in "backup-repository" to select all backup repositories.
      *
@@ -61,12 +55,18 @@ let BackupArchiveController = class BackupArchiveController extends XoController
      * @example filter "disks:length:>0"
      * @example limit 42
      */
-    async getBackupArchives(req, backupRepositories, fields, ndjson, filter, limit) {
-        const backupArchives = await this.getObjects({ backupRepositories, filter, limit });
-        return this.sendObjects(Object.values(backupArchives), req);
+    async getBackupArchives(req, backupRepositories, fields, ndjson, markdown, filter, limit) {
+        const backupArchives = await this.getObjects({ backupRepositories, filter });
+        return this.sendObjects(Object.values(backupArchives), req, {
+            limit,
+            privilege: { action: 'read', resource: 'backup-archive' },
+        });
     }
     /**
-     * @example id "231264c3-af43-4ec0-a3be-394c5b1fdbfc//xo-vm-backups/6ef7c09e-677b-1e6f-0546-7ab30413c61c/20250801T080832Z.json"
+     * Required privilege:
+     * - resource: backup-archive, action: read
+     *
+     * @example id "231264c3-af43-4ec0-a3be-394c5b1fdbfc/xo-vm-backups/6ef7c09e-677b-1e6f-0546-7ab30413c61c/20250801T080832Z.json"
      */
     async getBackupArchive(id) {
         const backupArchive = await this.getObject(id);
@@ -77,17 +77,26 @@ __decorate([
     Example(backupArchiveIds),
     Example(partialBackupArchives),
     Get(''),
+    Security('*', ['acl']),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
     __param(1, Query('backup-repository')),
     __param(2, Query()),
     __param(3, Query()),
     __param(4, Query()),
-    __param(5, Query())
+    __param(5, Query()),
+    __param(6, Query())
 ], BackupArchiveController.prototype, "getBackupArchives", null);
 __decorate([
     Example(backupArchive),
     Get('{id}'),
+    Middlewares(acl({
+        resource: 'backup-archive',
+        action: 'read',
+        objectId: 'params.id',
+        getObject: autoBindService(BackupArchiveService, 'getBackupArchive'),
+    })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], BackupArchiveController.prototype, "getBackupArchive", null);
@@ -98,6 +107,7 @@ BackupArchiveController = __decorate([
     Response(unauthorizedResp.status, unauthorizedResp.description),
     Tags('backup-archives'),
     provide(BackupArchiveController),
-    __param(0, inject(RestApi))
+    __param(0, inject(RestApi)),
+    __param(1, inject(BackupArchiveService))
 ], BackupArchiveController);
 export { BackupArchiveController };

package/dist/backup-archives/backup-archive.service.mjs

@@ -0,0 +1,21 @@
+import { noSuchObject } from 'xo-common/api-errors.js';
+// BR uuid/xo-vm-backups/VM uuid/(ISO 8601 compact).json
+const BACKUP_ARCHIVE_ID_REGEX = /^([0-9a-fA-F-]{36})\/+xo-vm-backups\/+([0-9a-fA-F-]{36})\/+(\d{8}T\d{6}Z)\.json$/;
+export class BackupArchiveService {
+    #restApi;
+    constructor(restApi) {
+        this.#restApi = restApi;
+    }
+    async getBackupArchive(id) {
+        const match = id.match(BACKUP_ARCHIVE_ID_REGEX);
+        if (match === null) {
+            throw noSuchObject(id, 'backup-archive');
+        }
+        const [, brId, vmId] = match;
+        const backupArchive = (await this.#restApi.xoApp.listVmBackupsNg([brId]))[brId]?.[vmId]?.find(ba => ba.id === id);
+        if (backupArchive === undefined) {
+            throw noSuchObject(id, 'backup-archive');
+        }
+        return backupArchive;
+    }
+}