@xen-orchestra/rest-api 0.29.0 → 0.30.0

package/dist/users/user.controller.mjs

@@ -9,11 +9,12 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { Body, Delete, Deprecated, Example, Get, Middlewares, Patch, Path, Post, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
 import { createLogger } from '@xen-orchestra/log';
+import { forbiddenOperation } from 'xo-common/api-errors.js';
 import { inject } from 'inversify';
 import { json } from 'express';
 import { provide } from 'inversify-binding-decorators';
+import { acl, actionIfNotSelfUser, actionsFromBody } from '../middlewares/acl.middleware.mjs';
 import { badRequestResp, createdResp, forbiddenOperationResp, internalServerErrorResp, invalidParameters, noContentResp, notFoundResp, resourceAlreadyExists, unauthorizedResp, } from '../open-api/common/response.common.mjs';
-import { forbiddenOperation } from 'xo-common/api-errors.js';
 import { partialUsers, user, authenticationTokens, userId, userIds, authenticationToken, } from '../open-api/oa-examples/user.oa-example.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
 import { limitAndFilterArray } from '../helpers/utils.helper.mjs';
@@ -22,6 +23,7 @@ import { XoController } from '../abstract-classes/xo-controller.mjs';
 import { groupIds, partialGroups } from '../open-api/oa-examples/group.oa-example.mjs';
 import { partialTasks, taskIds } from '../open-api/oa-examples/task.oa-example.mjs';
 import { redirectMeAlias } from './user.middleware.mjs';
+import { aclPrivilegeIds, partialAclPrivileges } from '../open-api/oa-examples/acl-privilege.oa-example.mjs';
 const log = createLogger('xo:rest-api:user-controller');
 let UserController = class UserController extends XoController {
     #userService;
@@ -37,21 +39,39 @@ let UserController = class UserController extends XoController {
         return this.#userService.getUser(id);
     }
     /**
+     * Returns all users that match the following privilege:
+     * - resource: user, action: read
+     *
      * @example fields "permission,name,id"
      * @example filter "permission:none"
      * @example limit 42
      */
     async getUsers(req, fields, ndjson, markdown, filter, limit) {
-        const users = Object.values(await this.getObjects({ filter, limit }));
-        return this.sendObjects(users, req);
+        const users = Object.values(await this.getObjects({ filter }));
+        return this.sendObjects(users, req, {
+            limit,
+            privilege: { action: 'read', resource: 'user' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: user, action: read (if not self)
+     *
      * @example id "722d17b9-699b-49d2-8193-be1ac573d3de"
      */
     getUser(id) {
         return this.getObject(id);
     }
     /**
+     * You cannot change your own `permission` (even with the right privilege)
+     *
+     * Required privileges:
+     * - resource: user, action: update (grants all fields)
+     * - resource: user, action: update:name (if name is passed)
+     * - resource: user, action: update:password (if password is passed)
+     * - resource: user, action: update:permission (if permission is passed)
+     * - resource: user, action: update:preferences (if preferences is passed)
+     *
      * @example id "722d17b9-699b-49d2-8193-be1ac573d3de"
      * @example body {
      *   "name": "updated user name",
@@ -62,14 +82,8 @@ let UserController = class UserController extends XoController {
      */
     async updateUser(id, body) {
         const currentUser = this.restApi.getCurrentUser();
-        const isAdmin = currentUser.permission === 'admin';
-        if (isAdmin) {
-            if (body.permission !== undefined && currentUser.id === id) {
-                throw forbiddenOperation('update user', 'cannot change own permission');
-            }
-        }
-        else if (body.name !== undefined || body.password !== undefined || body.permission !== undefined) {
-            throw forbiddenOperation('update user', 'cannot change these fields without admin rights');
+        if (body.permission !== undefined && currentUser.id === id) {
+            throw forbiddenOperation('update user', 'cannot change own permission');
         }
         const user = await this.getObject(id);
         if (user.authProviders !== undefined &&
@@ -80,6 +94,9 @@ let UserController = class UserController extends XoController {
         await this.restApi.xoApp.updateUser(user.id, body);
     }
     /**
+     * Required privilege:
+     * - resource: user, action: create
+     *
      * @example body { "name": "new user", "password": "password", "permission": "none" }
      */
     async createUser(body) {
@@ -87,12 +104,18 @@ let UserController = class UserController extends XoController {
         return { id: user.id };
     }
     /**
+     * Required privilege:
+     * - resource: user, action: delete
+     *
      * @example id "722d17b9-699b-49d2-8193-be1ac573d3de"
      */
     async deleteUser(id) {
         await this.restApi.xoApp.deleteUser(id);
     }
     /**
+     * Returns all groups that match the following privilege:
+     * - resource: group, action: read
+     *
      * @example id "722d17b9-699b-49d2-8193-be1ac573d3de"
      * @example fields "name,id,users"
      * @example filter "users:length:>0"
@@ -101,9 +124,15 @@ let UserController = class UserController extends XoController {
     async getUserGroups(req, id, fields, ndjson, markdown, filter, limit) {
         const user = await this.getObject(id);
         const groups = await Promise.all(user.groups.map(group => this.restApi.xoApp.getGroup(group)));
-        return this.sendObjects(limitAndFilterArray(groups, { filter, limit }), req, 'groups');
+        return this.sendObjects(limitAndFilterArray(groups, { filter }), req, {
+            path: 'groups',
+            limit,
+            privilege: { action: 'read', resource: 'group' },
+        });
     }
     /**
+     * You can only see your own authentication tokens
+     *
      * @example id "722d17b9-699b-49d2-8193-be1ac573d3de"
      * @example filter "expiration:>1757371582496"
      * @example limit 42
@@ -118,14 +147,21 @@ let UserController = class UserController extends XoController {
         return limitAndFilterArray(tokens, { filter, limit });
     }
     /**
+     * Returns all tasks that match the following privilege:
+     * - resource: task, action: read
+     *
      * @example id "722d17b9-699b-49d2-8193-be1ac573d3de"
      * @example fields "id,status,properties"
      * @example filter "status:failure"
      * @example limit 42
      */
     async getUserTasks(req, id, fields, ndjson, markdown, filter, limit) {
-        const tasks = await this.getTasksForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(tasks), req, 'tasks');
+        const tasks = await this.getTasksForObject(id, { filter });
+        return this.sendObjects(Object.values(tasks), req, {
+            path: 'tasks',
+            limit,
+            privilege: { action: 'read', resource: 'task' },
+        });
     }
     // ----------- DEPRECATED TO BE REMOVED IN ONE YEAR  (10-13-2026)--------------------
     /**
@@ -142,6 +178,8 @@ let UserController = class UserController extends XoController {
     }
     // ----------- DEPRECATED TO BE REMOVED IN ONE YEAR  (10-13-2026)--------------------
     /**
+     * You can only create authentication token for yourself
+     *
      * @example id "me"
      * @example body {"client": {"id": "my-fav-client"}, "description": "token for CLI usage", "expiresIn": "1 hour"}
      */
@@ -156,11 +194,31 @@ let UserController = class UserController extends XoController {
         });
         return { token };
     }
+    /**
+     * Returns all ACL privileges that match the following privilege:
+     * - resource: acl-privilege, action: read (if not self)
+     *
+     * @example id "me"
+     * @example fields "id,action,resource"
+     * @example filter "action:create"
+     * @example limit 42
+     */
+    async getUserPrivileges(req, id, fields, ndjson, filter, limit) {
+        const user = await this.getObject(id);
+        const currentUser = this.restApi.getCurrentUser();
+        const userPrivileges = (await this.restApi.xoApp.getAclV2UserPrivileges(user.id));
+        return this.sendObjects(limitAndFilterArray(userPrivileges, { filter }), req, {
+            path: 'acl-privileges',
+            limit,
+            privilege: currentUser.id === user.id ? undefined : { action: 'read', resource: 'acl-privilege' },
+        });
+    }
 };
 __decorate([
     Example(userIds),
     Example(partialUsers),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
@@ -171,12 +229,27 @@ __decorate([
 __decorate([
     Example(user),
     Get('{id}'),
+    Middlewares(acl({
+        resource: 'user',
+        action: actionIfNotSelfUser('read'),
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getUser,
+    })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], UserController.prototype, "getUser", null);
 __decorate([
     Patch('{id}'),
-    Middlewares(json()),
+    Middlewares([
+        json(),
+        acl({
+            resource: 'user',
+            actions: actionsFromBody(['update:name', 'update:password', 'update:permission', 'update:preferences']),
+            objectId: 'params.id',
+            getObject: ({ restApi }) => restApi.xoApp.getUser,
+        }),
+    ]),
     SuccessResponse(noContentResp.status, noContentResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(resourceAlreadyExists.status, resourceAlreadyExists.description),
@@ -187,15 +260,23 @@ __decorate([
 __decorate([
     Example(userId),
     Post(''),
-    Middlewares(json()),
+    Middlewares([json(), acl({ resource: 'user', action: 'create', object: ({ req }) => req.body })]),
     SuccessResponse(createdResp.status, createdResp.description),
     Response(unauthorizedResp.status, unauthorizedResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(invalidParameters.status, invalidParameters.description),
     __param(0, Body())
 ], UserController.prototype, "createUser", null);
 __decorate([
     Delete('{id}'),
+    Middlewares(acl({
+        resource: 'user',
+        action: 'delete',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getUser,
+    })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], UserController.prototype, "deleteUser", null);
@@ -203,6 +284,7 @@ __decorate([
     Example(groupIds),
     Example(partialGroups),
     Get('{id}/groups'),
+    Security('*', ['acl']),
     Tags('groups'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -216,6 +298,7 @@ __decorate([
 __decorate([
     Example(authenticationTokens),
     Get('{id}/authentication_tokens'),
+    Security('*', ['acl']),
     Response(notFoundResp.status, notFoundResp.description),
     Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     __param(0, Request()),
@@ -227,6 +310,7 @@ __decorate([
     Example(taskIds),
     Example(partialTasks),
     Get('{id}/tasks'),
+    Security('*', ['acl']),
     Tags('tasks'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -250,12 +334,27 @@ __decorate([
     Example(authenticationToken),
     Post('{id}/authentication_tokens'),
     Middlewares(json()),
+    Security('*', ['acl']),
     SuccessResponse(createdResp.status, createdResp.description),
     Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
     __param(0, Body()),
     __param(1, Path())
 ], UserController.prototype, "postAuthenticationTokens", null);
+__decorate([
+    Example(aclPrivilegeIds),
+    Example(partialAclPrivileges),
+    Get('{id}/acl-privileges'),
+    Security('*', ['acl']),
+    Tags('acls'),
+    Response(notFoundResp.status, notFoundResp.description),
+    __param(0, Request()),
+    __param(1, Path()),
+    __param(2, Query()),
+    __param(3, Query()),
+    __param(4, Query()),
+    __param(5, Query())
+], UserController.prototype, "getUserPrivileges", null);
 UserController = __decorate([
     Route('users'),
     Security('*'),

package/dist/vbds/vbd.controller.mjs

@@ -12,10 +12,11 @@ import { json } from 'express';
 import { inject } from 'inversify';
 import { invalidParameters as invalidParametersError } from 'xo-common/api-errors.js';
 import { provide } from 'inversify-binding-decorators';
+import { acl } from '../middlewares/acl.middleware.mjs';
 import { AlarmService } from '../alarms/alarm.service.mjs';
 import { escapeUnsafeComplexMatcher } from '../helpers/utils.helper.mjs';
 import { genericAlarmsExample } from '../open-api/oa-examples/alarm.oa-example.mjs';
-import { asynchronousActionResp, badRequestResp, createdResp, internalServerErrorResp, invalidParameters, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
+import { asynchronousActionResp, badRequestResp, createdResp, internalServerErrorResp, invalidParameters, noContentResp, forbiddenOperationResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { BASE_URL } from '../index.mjs';
 import { partialVbds, vbd, vbdId, vbdIds } from '../open-api/oa-examples/vbd.oa-example.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
@@ -28,6 +29,29 @@ let VbdController = class VbdController extends XapiXoController {
         super('VBD', restApi);
         this.#alarmService = alarmService;
     }
+    /**
+     * Returns all VBDs that match the following privilege:
+     * - resource: vbd, action: read
+     *
+     * @example fields "device,bootable,uuid"
+     * @example filter "!bootable?"
+     * @example limit 42
+     */
+    getVbds(req, fields, ndjson, markdown, filter, limit) {
+        return this.sendObjects(Object.values(this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'vbd' },
+        });
+    }
+    /**
+     * Required privilege:
+     * - resource: vbd, action: read
+     *
+     * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
+     */
+    getVbd(id) {
+        return this.getObject(id);
+    }
     /**
      * Create a VBD to attach a VDI to a VM
      *
@@ -51,22 +75,6 @@ let VbdController = class VbdController extends XapiXoController {
         this.setHeader('Location', `${BASE_URL}/vbds/${vbdUuid}`);
         return { id: vbdUuid };
     }
-    /**
-     *
-     * @example fields "device,bootable,uuid"
-     * @example filter "!bootable?"
-     * @example limit 42
-     */
-    getVbds(req, fields, ndjson, markdown, filter, limit) {
-        return this.sendObjects(Object.values(this.getObjects({ filter, limit })), req);
-    }
-    /**
-     *
-     * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
-     */
-    getVbd(id) {
-        return this.getObject(id);
-    }
     /**
      * Delete a VBD
      *
@@ -80,6 +88,9 @@ let VbdController = class VbdController extends XapiXoController {
         await xapiVbd.$xapi.VBD_destroy(xapiVbd.$ref);
     }
     /**
+     * Returns all alarms that match the following privilege:
+     * - resource: alarm, action: read
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      * @example fields "id,time"
      * @example filter "time:>1747053793"
@@ -89,29 +100,46 @@ let VbdController = class VbdController extends XapiXoController {
         const vbd = this.getObject(id);
         const alarms = this.#alarmService.getAlarms({
             filter: `${escapeUnsafeComplexMatcher(filter) ?? ''} object:uuid:${vbd.uuid}`,
+        });
+        return this.sendObjects(Object.values(alarms), req, {
+            path: 'alarms',
             limit,
+            privilege: { action: 'read', resource: 'alarm' },
         });
-        return this.sendObjects(Object.values(alarms), req, 'alarms');
     }
     /**
+     * Returns all messages that match the following privilege:
+     * - resource: message, action: read
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      * @example fields "name,id,$object"
      * @example filter "name:VM_STARTED"
      * @example limit 42
      */
     getVbdMessages(req, id, fields, ndjson, markdown, filter, limit) {
-        const messages = this.getMessagesForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(messages), req, 'messages');
+        const messages = this.getMessagesForObject(id, { filter });
+        return this.sendObjects(Object.values(messages), req, {
+            path: 'messages',
+            limit,
+            privilege: { action: 'read', resource: 'message' },
+        });
     }
     /**
+     * Returns all tasks that match the following privilege:
+     * - resource: task, action: read
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      * @example fields "id,status,properties"
      * @example filter "status:failure"
      * @example limit 42
      */
     async getVbdTasks(req, id, fields, ndjson, markdown, filter, limit) {
-        const tasks = await this.getTasksForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(tasks), req, 'tasks');
+        const tasks = await this.getTasksForObject(id, { filter });
+        return this.sendObjects(Object.values(tasks), req, {
+            path: 'tasks',
+            limit,
+            privilege: { action: 'read', resource: 'task' },
+        });
     }
     /**
      * Hotplug the VBD, dynamically attaching it to the running VM
@@ -152,19 +180,11 @@ let VbdController = class VbdController extends XapiXoController {
         });
     }
 };
-__decorate([
-    Example(vbdId),
-    Post(''),
-    Middlewares(json()),
-    SuccessResponse(createdResp.status, createdResp.description),
-    Response(notFoundResp.status, notFoundResp.description),
-    Response(invalidParameters.status, invalidParameters.description),
-    __param(0, Body())
-], VbdController.prototype, "createVbd", null);
 __decorate([
     Example(vbdIds),
     Example(partialVbds),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
@@ -175,9 +195,20 @@ __decorate([
 __decorate([
     Example(vbd),
     Get('{id}'),
+    Middlewares(acl({ resource: 'vbd', action: 'read', objectId: 'params.id' })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], VbdController.prototype, "getVbd", null);
+__decorate([
+    Example(vbdId),
+    Post(''),
+    Middlewares(json()),
+    SuccessResponse(createdResp.status, createdResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
+    Response(invalidParameters.status, invalidParameters.description),
+    __param(0, Body())
+], VbdController.prototype, "createVbd", null);
 __decorate([
     Delete('{id}'),
     SuccessResponse(noContentResp.status, noContentResp.description),
@@ -187,6 +218,7 @@ __decorate([
 __decorate([
     Example(genericAlarmsExample),
     Get('{id}/alarms'),
+    Security('*', ['acl']),
     Tags('alarms'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -201,6 +233,7 @@ __decorate([
     Example(messageIds),
     Example(partialMessages),
     Get('{id}/messages'),
+    Security('*', ['acl']),
     Tags('messages'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -215,6 +248,7 @@ __decorate([
     Example(taskIds),
     Example(partialTasks),
     Get('{id}/tasks'),
+    Security('*', ['acl']),
     Tags('tasks'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),

package/dist/vdi-snapshots/vdi-snapshot.controller.mjs

@@ -29,12 +29,18 @@ let VdiSnapshotController = class VdiSnapshotController extends XapiXoController
         this.#vdiService = vdiService;
     }
     /**
+     * Returns all VDI snapshots that match the following privilege:
+     * - resource: vdi-snapshot, action: read
+     *
      * @example fields "uuid,snapshot_time,$snapshot_of"
      * @example filter "snapshot_time:>1725020038"
      * @example limit 42
      */
     getVdiSnapshots(req, fields, ndjson, markdown, filter, limit) {
-        return this.sendObjects(Object.values(this.getObjects({ filter, limit })), req);
+        return this.sendObjects(Object.values(this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'vdi-snapshot' },
+        });
     }
     /**
      *
@@ -59,6 +65,9 @@ let VdiSnapshotController = class VdiSnapshotController extends XapiXoController
         return this.getObject(id);
     }
     /**
+     * Returns all alarms that match the following privilege:
+     * - resource: alarm, action: read
+     *
      * @example id "d2727772-735b-478f-b6f9-11e7db56dfd0"
      * @example fields "id,time"
      * @example filter "time:>1747053793"
@@ -68,9 +77,12 @@ let VdiSnapshotController = class VdiSnapshotController extends XapiXoController
         const vdiSnapshot = this.getObject(id);
         const alarms = this.#alarmService.getAlarms({
             filter: `${escapeUnsafeComplexMatcher(filter) ?? ''} object:uuid:${vdiSnapshot.uuid}`,
+        });
+        return this.sendObjects(Object.values(alarms), req, {
+            path: 'alarms',
             limit,
+            privilege: { action: 'read', resource: 'alarm' },
         });
-        return this.sendObjects(Object.values(alarms), req, 'alarms');
     }
     /**
      * @example id "d2727772-735b-478f-b6f9-11e7db56dfd0"
@@ -80,24 +92,38 @@ let VdiSnapshotController = class VdiSnapshotController extends XapiXoController
         await xapiVdiSnapshot.$xapi.VDI_destroy(xapiVdiSnapshot.$ref);
     }
     /**
+     * Returns all messages that match the following privilege:
+     * - resource: message, action: read
+     *
      * @example id "d2727772-735b-478f-b6f9-11e7db56dfd0"
      * @example fields "name,id,$object"
      * @example filter "name:VM_STARTED"
      * @example limit 42
      */
     getVdiSnapshotMessages(req, id, fields, ndjson, markdown, filter, limit) {
-        const messages = this.getMessagesForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(messages), req, 'messages');
+        const messages = this.getMessagesForObject(id, { filter });
+        return this.sendObjects(Object.values(messages), req, {
+            path: 'messages',
+            limit,
+            privilege: { action: 'read', resource: 'message' },
+        });
     }
     /**
+     * Returns all tasks that match the following privilege:
+     * - resource: task, action: read
+     *
      * @example id "d2727772-735b-478f-b6f9-11e7db56dfd0"
      * @example fields "id,status,properties"
      * @example filter "status:failure"
      * @example limit 42
      */
     async getVdiSnapshotTasks(req, id, fields, ndjson, markdown, filter, limit) {
-        const tasks = await this.getTasksForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(tasks), req, 'tasks');
+        const tasks = await this.getTasksForObject(id, { filter });
+        return this.sendObjects(Object.values(tasks), req, {
+            path: 'tasks',
+            limit,
+            privilege: { action: 'read', resource: 'task' },
+        });
     }
     /**
      * @example id "d2727772-735b-478f-b6f9-11e7db56dfd0"
@@ -120,6 +146,7 @@ __decorate([
     Example(vdiSnapshotIds),
     Example(partialVdiSnapshots),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
@@ -145,6 +172,7 @@ __decorate([
 __decorate([
     Example(genericAlarmsExample),
     Get('{id}/alarms'),
+    Security('*', ['acl']),
     Tags('alarms'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -165,6 +193,7 @@ __decorate([
     Example(messageIds),
     Example(partialMessages),
     Get('{id}/messages'),
+    Security('*', ['acl']),
     Tags('messages'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -179,6 +208,7 @@ __decorate([
     Example(taskIds),
     Example(partialTasks),
     Get('{id}/tasks'),
+    Security('*', ['acl']),
     Tags('tasks'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),