@xen-orchestra/rest-api 0.28.2 → 0.30.0

package/dist/backup-jobs/backup-job.controller.mjs

@@ -12,9 +12,10 @@ import { inject } from 'inversify';
 import { noSuchObject } from 'xo-common/api-errors.js';
 import { Deprecated, Example, Get, Hidden, Middlewares, Path, Query, Request, Response, Route, Security, Tags, } from 'tsoa';
 import { provide } from 'inversify-binding-decorators';
+import { acl, autoBindService } from '../middlewares/acl.middleware.mjs';
 import { backupLog, backupLogIds, partialBackupLogs } from '../open-api/oa-examples/backup-log.oa-example.mjs';
 import { BackupLogService } from '../backup-logs/backup-log.service.mjs';
-import { badRequestResp, notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
+import { badRequestResp, forbiddenOperationResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
 import { limitAndFilterArray, safeParseComplexMatcher } from '../helpers/utils.helper.mjs';
 import { XoController } from '../abstract-classes/xo-controller.mjs';
@@ -33,24 +34,30 @@ let BackupJobController = class BackupJobController extends XoController {
         const backupJobs = allJobs.filter(job => this.#backupJobService.isBackupJob(job));
         return backupJobs;
     }
-    async getCollectionObject(id) {
-        const job = await this.restApi.xoApp.getJob(id);
-        if (!this.#backupJobService.isBackupJob(job)) {
-            throw noSuchObject(id, 'backup-job');
-        }
-        return job;
+    getCollectionObject(id) {
+        return this.#backupJobService.getBackupJob(id);
     }
     /**
+     * Returns all backup jobs that match the following privilege:
+     * - resource: backup-job, action: read
      *
      * @example fields "name,mode,type,id"
      * @example filter "type:backup"
      * @example limit 42
      */
-    async getBackupJobs(req, fields, ndjson, filter, limit) {
-        const backupJobs = await this.getObjects({ filter, limit });
-        return this.sendObjects(Object.values(backupJobs), req, 'backup-jobs');
+    async getBackupJobs(req, fields, ndjson, markdown, filter, limit) {
+        const backupJobs = await this.getObjects({ filter });
+        return this.sendObjects(Object.values(backupJobs), req, {
+            path: 'backup-jobs',
+            limit,
+            privilege: { action: 'read', resource: 'backup-job' },
+        });
     }
     /**
+     *
+     * Required privilege:
+     * - resource: backup-job, action: read
+     *
      * @example id "d33f3dc1-92b4-469c-ad58-4c2a106a4721"
      */
     getBackupJob(id) {
@@ -61,16 +68,25 @@ __decorate([
     Example(vmBackupJobIds),
     Example(partialVmBackupJobs),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
     __param(3, Query()),
-    __param(4, Query())
+    __param(4, Query()),
+    __param(5, Query())
 ], BackupJobController.prototype, "getBackupJobs", null);
 __decorate([
     Example(vmBackupJob),
-    Response(notFoundResp.status, notFoundResp.description),
     Get('{id}'),
+    Middlewares(acl({
+        resource: 'backup-job',
+        action: 'read',
+        objectId: 'params.id',
+        getObject: autoBindService(BackupJobService, 'getBackupJob'),
+    })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], BackupJobController.prototype, "getBackupJob", null);
 BackupJobController = __decorate([
@@ -112,14 +128,20 @@ let DeprecatedBackupController = class DeprecatedBackupController extends XoCont
         return backupJob;
     }
     /**
+     * Returns all VM backup jobs that match the following privilege:
+     * - resource: backup-job, action: read
      *
      * @example fields "name,mode,id"
      * @example filter "mode:delta"
      * @example limit 42
      */
-    async getVmBackupJobs(req, fields, ndjson, filter, limit) {
+    async getVmBackupJobs(req, fields, ndjson, markdown, filter, limit) {
         const vmBackupJobs = await this.restApi.xoApp.getAllJobs('backup');
-        return this.sendObjects(limitAndFilterArray(vmBackupJobs, { filter, limit }), req, 'backup-jobs');
+        return this.sendObjects(limitAndFilterArray(vmBackupJobs, { filter }), req, {
+            path: 'backup-jobs',
+            limit,
+            privilege: { action: 'read', resource: 'backup-job' },
+        });
     }
     // For compatibility, redirect /backup/jobs/:id to /backup/jobs/vm/:id
     async redirectToVmBackupJob(req, id) {
@@ -133,14 +155,20 @@ let DeprecatedBackupController = class DeprecatedBackupController extends XoCont
         return this.getObject(id, 'backup');
     }
     /**
+     * Returns all metadata backup jobs that match the following privilege:
+     * - resource: backup-job, action: read
      *
      * @example fields "name,xoMetadata,id"
      * @example filter "xoMetadata?"
      * @example limit 42
      */
-    async getMetadataBackupJobs(req, fields, ndjson, filter, limit) {
+    async getMetadataBackupJobs(req, fields, ndjson, markdown, filter, limit) {
         const metadataBackupJobs = await this.restApi.xoApp.getAllJobs('metadataBackup');
-        return this.sendObjects(limitAndFilterArray(metadataBackupJobs, { filter, limit }), req, 'backup-jobs');
+        return this.sendObjects(limitAndFilterArray(metadataBackupJobs, { filter }), req, {
+            path: 'backup-jobs',
+            limit,
+            privilege: { action: 'read', resource: 'backup-job' },
+        });
     }
     /**
      * @example id "b50f95fd-f6b7-4027-87b6-6a02c7dcd5f5"
@@ -149,14 +177,20 @@ let DeprecatedBackupController = class DeprecatedBackupController extends XoCont
         return this.getObject(id, 'metadataBackup');
     }
     /**
+     * Returns all mirror backup jobs that match the following privilege:
+     * - resource: backup-job, action: read
      *
      * @example fields "name,mode,id"
      * @example filter "mode:delta"
      * @example limit 42
      */
-    async getMirrorBackupJobs(req, fields, ndjson, filter, limit) {
+    async getMirrorBackupJobs(req, fields, ndjson, markdown, filter, limit) {
         const mirrorBackupJobs = await this.restApi.xoApp.getAllJobs('mirrorBackup');
-        return this.sendObjects(limitAndFilterArray(mirrorBackupJobs, { filter, limit }), req, 'backup-jobs');
+        return this.sendObjects(limitAndFilterArray(mirrorBackupJobs, { filter }), req, {
+            path: 'backup-jobs',
+            limit,
+            privilege: { action: 'read', resource: 'backup-job' },
+        });
     }
     /**
      * @example id "e680c14c-ab52-45c8-bb0e-bd4ca12ea8f9"
@@ -165,11 +199,14 @@ let DeprecatedBackupController = class DeprecatedBackupController extends XoCont
         return this.getObject(id, 'mirrorBackup');
     }
     /**
+     * Returns all backup logs that match the following privilege:
+     * - resource: backup-log, action: read
+     *
      * @example fields "jobName,status,data"
      * @example filter "status:success"
      * @example limit 42
      */
-    async getDeprecatedBackupLogs(req, fields, ndjson, filter, limit) {
+    async getDeprecatedBackupLogs(req, fields, ndjson, markdown, filter, limit) {
         const userFilter = filter === undefined ? () => true : safeParseComplexMatcher(filter).createPredicate();
         const predicate = (log) => {
             if (!this.#backupLogService.isBackupLog(log)) {
@@ -177,8 +214,12 @@ let DeprecatedBackupController = class DeprecatedBackupController extends XoCont
             }
             return userFilter(log);
         };
-        const logs = (await this.restApi.xoApp.getBackupNgLogsSorted({ filter: predicate, limit }));
-        return this.sendObjects(logs, req, 'backup-logs');
+        const logs = (await this.restApi.xoApp.getBackupNgLogsSorted({ filter: predicate }));
+        return this.sendObjects(logs, req, {
+            path: 'backup-logs',
+            limit,
+            privilege: { action: 'read', resource: 'backup-log' },
+        });
     }
     /**
      * @example id "1753776067468"
@@ -196,12 +237,14 @@ __decorate([
     Example(partialVmBackupJobs),
     Deprecated(),
     Get('jobs/vm'),
+    Security('*', ['acl']),
     Tags('backup-jobs'),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
     __param(3, Query()),
-    __param(4, Query())
+    __param(4, Query()),
+    __param(5, Query())
 ], DeprecatedBackupController.prototype, "getVmBackupJobs", null);
 __decorate([
     Hidden(),
@@ -223,12 +266,14 @@ __decorate([
     Example(partialMetadataBackupJobs),
     Deprecated(),
     Get('jobs/metadata'),
+    Security('*', ['acl']),
     Tags('backup-jobs'),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
     __param(3, Query()),
-    __param(4, Query())
+    __param(4, Query()),
+    __param(5, Query())
 ], DeprecatedBackupController.prototype, "getMetadataBackupJobs", null);
 __decorate([
     Example(metadataBackupJob),
@@ -243,12 +288,14 @@ __decorate([
     Example(partialMirrorBackupJobs),
     Deprecated(),
     Get('jobs/mirror'),
+    Security('*', ['acl']),
     Tags('backup-jobs'),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
     __param(3, Query()),
-    __param(4, Query())
+    __param(4, Query()),
+    __param(5, Query())
 ], DeprecatedBackupController.prototype, "getMirrorBackupJobs", null);
 __decorate([
     Example(mirrorBackupJob),
@@ -263,12 +310,14 @@ __decorate([
     Example(partialBackupLogs),
     Deprecated(),
     Get('logs'),
+    Security('*', ['acl']),
     Tags('backup-logs'),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
     __param(3, Query()),
-    __param(4, Query())
+    __param(4, Query()),
+    __param(5, Query())
 ], DeprecatedBackupController.prototype, "getDeprecatedBackupLogs", null);
 __decorate([
     Example(backupLog),

package/dist/backup-jobs/backup-job.service.mjs

@@ -8,6 +8,13 @@ export class BackupJobService {
     constructor(restApi) {
         this.#restApi = restApi;
     }
+    async getBackupJob(id) {
+        const job = await this.#restApi.xoApp.getJob(id);
+        if (!this.isBackupJob(job)) {
+            throw noSuchObject(id, 'backup-job');
+        }
+        return job;
+    }
     isBackupJob(anyJob) {
         return this.#backupJobTypes.includes(anyJob.type);
     }

package/dist/backup-logs/backup-log.controller.mjs

@@ -7,15 +7,15 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
+import { Example, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
 import { inject } from 'inversify';
-import { noSuchObject } from 'xo-common/api-errors.js';
 import { provide } from 'inversify-binding-decorators';
 import { backupLog, backupLogIds, partialBackupLogs } from '../open-api/oa-examples/backup-log.oa-example.mjs';
 import { BackupLogService } from './backup-log.service.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
-import { badRequestResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
+import { badRequestResp, forbiddenOperationResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { XoController } from '../abstract-classes/xo-controller.mjs';
+import { acl, autoBindService } from '../middlewares/acl.middleware.mjs';
 let BackupLogController = class BackupLogController extends XoController {
     #backupLogService;
     constructor(restApi, backupLogService) {
@@ -25,23 +25,28 @@ let BackupLogController = class BackupLogController extends XoController {
     getAllCollectionObjects() {
         return this.restApi.xoApp.getBackupNgLogsSorted({ filter: this.#backupLogService.isBackupLog });
     }
-    async getCollectionObject(id) {
-        const log = await this.restApi.xoApp.getBackupNgLogs(id);
-        if (!this.#backupLogService.isBackupLog(log)) {
-            throw noSuchObject('backup-log');
-        }
-        return log;
+    getCollectionObject(id) {
+        return this.#backupLogService.getBackupLog(id);
     }
     /**
+     * Returns all backup logs that match the following privilege:
+     * - resource: backup-log, action: read
+     *
      * @example fields "jobName,status,data"
      * @example filter "status:success"
      * @example limit 42
      */
-    async getBackupLogs(req, fields, ndjson, filter, limit) {
-        const backupLogs = await this.getObjects({ filter, limit });
-        return this.sendObjects(Object.values(backupLogs), req);
+    async getBackupLogs(req, fields, ndjson, markdown, filter, limit) {
+        const backupLogs = await this.getObjects({ filter });
+        return this.sendObjects(Object.values(backupLogs), req, {
+            limit,
+            privilege: { action: 'read', resource: 'backup-log' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: backup-log, action: read
+     *
      * @example id "1753776067468"
      */
     getBackupLog(id) {
@@ -52,15 +57,25 @@ __decorate([
     Example(backupLogIds),
     Example(partialBackupLogs),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
     __param(3, Query()),
-    __param(4, Query())
+    __param(4, Query()),
+    __param(5, Query())
 ], BackupLogController.prototype, "getBackupLogs", null);
 __decorate([
     Example(backupLog),
     Get('{id}'),
+    Middlewares(acl({
+        resource: 'backup-log',
+        action: 'read',
+        objectId: 'params.id',
+        getObject: autoBindService(BackupLogService, 'getBackupLog'),
+    })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], BackupLogController.prototype, "getBackupLog", null);
 BackupLogController = __decorate([

package/dist/backup-logs/backup-log.service.mjs

@@ -1,7 +1,26 @@
+import { noSuchObject } from 'xo-common/api-errors.js';
 export class BackupLogService {
+    #restApi;
+    constructor(restApi) {
+        this.#restApi = restApi;
+    }
     isBackupLog(log) {
         return log.message === 'backup';
     }
+    async getBackupLog(id) {
+        const log = await this.#restApi.xoApp.getBackupNgLogs(id);
+        if (!this.isBackupLog(log)) {
+            throw noSuchObject('backup-log');
+        }
+        return log;
+    }
+    async getRestoreLog(id) {
+        const log = await this.#restApi.xoApp.getBackupNgLogs(id);
+        if (this.isBackupLog(log)) {
+            throw noSuchObject('restore-log');
+        }
+        return log;
+    }
     getVmBackupTaskLog(log, vmId) {
         return log.tasks?.find(task => task.data?.id === vmId);
     }

package/dist/backup-repositories/backup-repositories.controller.mjs

@@ -7,10 +7,11 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
+import { Example, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
-import { badRequestResp, notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
+import { acl } from '../middlewares/acl.middleware.mjs';
+import { badRequestResp, forbiddenOperationResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { backupRepositoryIds, partialBackupRepositories, backupRepository, } from '../open-api/oa-examples/backup-repository.oa-example.mjs';
 import { XoController } from '../abstract-classes/xo-controller.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
@@ -26,14 +27,23 @@ let BackupRepositoryController = class BackupRepositoryController extends XoCont
         return this.restApi.xoApp.getRemote(id);
     }
     /**
+     * Returns all backup repositories that match the following privilege:
+     * - resource: backup-repository, action: read
+     *
      * @example fields "id,name,enabled"
      * @example filter "enabled?"
      * @example limit 42
      */
-    async getRepositories(req, fields, ndjson, filter, limit) {
-        return this.sendObjects(Object.values(await this.getObjects({ filter, limit })), req);
+    async getRepositories(req, fields, ndjson, markdown, filter, limit) {
+        return this.sendObjects(Object.values(await this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'backup-repository' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: backup-repository, action: read
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      */
     getRepository(id) {
@@ -44,15 +54,24 @@ __decorate([
     Example(backupRepositoryIds),
     Example(partialBackupRepositories),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
     __param(3, Query()),
-    __param(4, Query())
+    __param(4, Query()),
+    __param(5, Query())
 ], BackupRepositoryController.prototype, "getRepositories", null);
 __decorate([
     Example(backupRepository),
     Get('{id}'),
+    Middlewares(acl({
+        resource: 'backup-repository',
+        action: 'read',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getRemote,
+    })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], BackupRepositoryController.prototype, "getRepository", null);

package/dist/events/event.class.mjs

@@ -10,6 +10,8 @@ export class Subscriber {
     #manager;
     #connection;
     #isAlive;
+    #cleanupCallbacks = new Set();
+    #userId;
     get id() {
         return this.#id;
     }
@@ -19,13 +21,17 @@ export class Subscriber {
     get connection() {
         return this.#connection;
     }
-    constructor(connection, manager) {
+    get userId() {
+        return this.#userId;
+    }
+    constructor(connection, manager, userId) {
         this.#id = crypto.randomUUID();
         connection.on('close', () => this.clear());
         manager.addSubscriber(this);
         this.#connection = connection;
         this.#manager = manager;
         this.#isAlive = true;
+        this.#userId = userId;
     }
     #safeWrite(payload) {
         const ok = this.#connection.write(payload);
@@ -34,6 +40,10 @@ export class Subscriber {
             this.clear();
         }
     }
+    onClear(callback) {
+        this.#cleanupCallbacks.add(callback);
+        return () => this.#cleanupCallbacks.delete(callback);
+    }
     broadcast(event, data) {
         if (!this.#isAlive) {
             log.warn('broadcast called on a subscriber that is not alive, but still in memory! Force clear and do nothing');
@@ -44,32 +54,34 @@ export class Subscriber {
         this.#safeWrite(payload);
     }
     clear() {
-        this.#isAlive = false;
-        if (!this.#connection.closed || !this.#connection.destroyed) {
-            this.#connection.destroy();
+        if (!this.#isAlive) {
+            return;
         }
+        this.#isAlive = false;
+        this.#connection.destroy();
+        this.#cleanupCallbacks.forEach(cb => cb());
+        this.#cleanupCallbacks.clear();
         this.#manager.removeSubscriber(this.id);
     }
 }
 export class XoListener extends Listener {
-    #type;
     #alarmService;
     constructor(type, eventEmitter, alarmService) {
-        super(eventEmitter, ['add', 'update', 'remove']);
-        this.#type = type;
+        super(eventEmitter, ['add', 'update', 'remove'], type);
         this.#alarmService = alarmService;
     }
-    handleData({ fields, event }, object, previousObj) {
+    async handleData({ fields, event, subscriber }, object, previousObj) {
         let _object = object;
         let _prevObject = previousObj;
-        if (this.#type === 'alarm' || this.#type === 'message') {
+        ///
+        if (this.type === 'alarm' || this.type === 'message') {
             const isAlarm = (object) => object !== undefined && 'type' in object && object.type === 'message' && this.#alarmService.isAlarm(object);
             const objectIsAlarm = isAlarm(object);
             const prevObjectIsAlarm = isAlarm(previousObj);
             // If we are in an alarm listener and the objects are messages
             // we clean them to ensure they are not sent via the SSE
             // Same if we are in a message listener and the objects are alarms
-            if (this.#type === 'alarm') {
+            if (this.type === 'alarm') {
                 _object = objectIsAlarm ? this.#alarmService.parseAlarm(object) : undefined;
                 _prevObject = prevObjectIsAlarm ? this.#alarmService.parseAlarm(previousObj) : undefined;
             }
@@ -81,6 +93,17 @@ export class XoListener extends Listener {
         if (_object === undefined && _prevObject === undefined) {
             return;
         }
+        const aclEvent = await this.getAclEvent({
+            event,
+            object: _object,
+            previousObject: _prevObject,
+            userId: subscriber.userId,
+        });
+        // If the user has no 'read' privileges for the changes, don't send the update
+        if (aclEvent === undefined) {
+            return;
+        }
+        event = aclEvent;
         if (fields !== '*') {
             if (_object !== undefined) {
                 _object = pick(_object, fields);
@@ -94,7 +117,7 @@ export class XoListener extends Listener {
             return;
         }
         // if _object === undefined, this means we are on a remove event, so _prevObject will not be undefined
-        return { $subscription: this.#type, ...(_object ?? _prevObject) };
+        return { $subscription: this.type, event, ...(_object ?? _prevObject) };
     }
 }
 export class PingListener extends Listener {
@@ -105,7 +128,7 @@ export class PingListener extends Listener {
             this.eventEmitter.emit('ping');
         }, 1000 * 30);
     }
-    handleData() {
+    async handleData() {
         return { ping: Date.now() };
     }
     clear() {
@@ -132,11 +155,6 @@ export class SubscriberManager {
         this.#subscribers.delete(id);
     }
     clear() {
-        this.#subscribers.forEach(subscriber => {
-            if (!subscriber.connection.closed) {
-                subscriber.connection.destroy();
-            }
-            this.#subscribers.delete(subscriber.id);
-        });
+        this.#subscribers.forEach(subscriber => subscriber.clear());
     }
 }

package/dist/events/event.controller.mjs

@@ -70,12 +70,14 @@ let EventController = class EventController extends Controller {
 };
 __decorate([
     Get(''),
+    Security('*', ['acl']),
     SuccessResponse(200, 'OK'),
     __param(0, Request())
 ], EventController.prototype, "openSseConnection", null);
 __decorate([
     Example(addSubscription),
     Post('{id}/subscriptions'),
+    Security('*', ['acl']),
     Middlewares(json()),
     SuccessResponse(createdResp.status, createdResp.description),
     Response(notFoundResp.status, notFoundResp.description),
@@ -84,6 +86,7 @@ __decorate([
 ], EventController.prototype, "addSubscription", null);
 __decorate([
     Delete('{id}/subscriptions/{subscriptionId}'),
+    Security('*', ['acl']),
     SuccessResponse(noContentResp.status, noContentResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path()),

package/dist/events/event.service.mjs

@@ -1,4 +1,3 @@
-import os from 'node:os';
 import { createLogger } from '@xen-orchestra/log';
 import { PassThrough, pipeline } from 'node:stream';
 import { PingListener, Subscriber, SubscriberManager, XoListener } from './event.class.mjs';
@@ -50,16 +49,17 @@ export class EventService {
             'Cache-Control': 'no-cache, no-transform',
         });
         res.setHeaders(headers);
-        const maxRam = this.#restApi.xoApp.config.get('rest-api.percentOfRamAllocatedPerSseClient');
+        const maxRam = this.#restApi.xoApp.config.get('rest-api.maxRamAllocatedPerSseClient');
         const connection = new PassThrough({
-            highWaterMark: Math.round(os.totalmem() * (maxRam / 100)),
+            highWaterMark: Math.round(1024 * 1024 * maxRam),
         });
         pipeline(connection, res, error => {
             if (error?.code !== 'ERR_STREAM_PREMATURE_CLOSE') {
                 log.error(error);
             }
         });
-        const subscriber = new Subscriber(connection, this.#subscriberManager);
+        const user = this.#restApi.getCurrentUser();
+        const subscriber = new Subscriber(connection, this.#subscriberManager, user.id);
         subscriber.broadcast('init', { id: subscriber.id });
         this.addListenerFor(subscriber.id, { type: 'ping' });
         log.debug(`new SSE subscriber added: ${subscriber.id}`);