@xen-orchestra/rest-api 0.29.0 → 0.30.0

package/dist/groups/group.controller.mjs

@@ -20,6 +20,7 @@ import { RestApi } from '../rest-api/rest-api.mjs';
 import { limitAndFilterArray } from '../helpers/utils.helper.mjs';
 import { partialUsers, userIds } from '../open-api/oa-examples/user.oa-example.mjs';
 import { partialTasks, taskIds } from '../open-api/oa-examples/task.oa-example.mjs';
+import { acl, actionFromBody } from '../middlewares/acl.middleware.mjs';
 let GroupController = class GroupController extends XoController {
     #userService;
     constructor(restApi, userService) {
@@ -34,20 +35,35 @@ let GroupController = class GroupController extends XoController {
         return this.restApi.xoApp.getGroup(id);
     }
     /**
+     * Returns all groups that match the following privilege:
+     * - resource: group, action: read
+     *
      * @example fields "name,id,users"
      * @example filter "users:length:>0"
      * @example limit 42
      */
     async getGroups(req, fields, ndjson, markdown, filter, limit) {
-        return this.sendObjects(Object.values(await this.getObjects({ filter, limit })), req);
+        return this.sendObjects(Object.values(await this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'group' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: group, action: read
+     *
      * @example id "7d98fee4-3357-41a7-ac3f-9124212badb7"
      */
     getGroup(id) {
         return this.getObject(id);
     }
     /**
+     * You cannot patch `synchronized` groups (even with the right privilege)
+     *
+     * Required privileges:
+     * - resource: group, action: update (grants all fields)
+     * - resource: group, action: update:name (if name is passed)
+     *
      * @example id "c98395a7-26d8-4e09-b055-d5f0f4a98312"
      * @example body { "name": "new group name" }
      */
@@ -59,6 +75,9 @@ let GroupController = class GroupController extends XoController {
         await this.restApi.xoApp.updateGroup(group.id, body);
     }
     /**
+     * Required privilege:
+     * - resource: group, action: create
+     *
      *  @example body {
      *    "name": "new group"
      *  }
@@ -68,6 +87,9 @@ let GroupController = class GroupController extends XoController {
         return { id: group.id };
     }
     /**
+     * Required privilege:
+     * - resource: group, action: delete
+     *
      * @example id "7d98fee4-3357-41a7-ac3f-9124212badb7"
      */
     async deleteGroup(id) {
@@ -75,6 +97,11 @@ let GroupController = class GroupController extends XoController {
         await this.restApi.xoApp.deleteGroup(groupId);
     }
     /**
+     * You cannot manage users of `synchronized` groups (even with the right privilege)
+     *
+     * Required privilege:
+     * - resource: group, action: update:users
+     *
      * @example id "c98395a7-26d8-4e09-b055-d5f0f4a98312"
      * @example userId "722d17b9-699b-49d2-8193-be1ac573d3de"
      */
@@ -86,6 +113,11 @@ let GroupController = class GroupController extends XoController {
         await this.restApi.xoApp.removeUserFromGroup(userId, group.id);
     }
     /**
+     * You cannot manage users of `synchronized` groups (even with the right privilege)
+     *
+     * Required privilege:
+     * - resource: group, action: update:users
+     *
      * @example id "6c81b5e1-afc1-43ea-8f8d-939ceb5f3f90"
      * @example userId "722d17b9-699b-49d2-8193-be1ac573d3de"
      */
@@ -97,6 +129,9 @@ let GroupController = class GroupController extends XoController {
         await this.restApi.xoApp.addUserToGroup(userId, group.id);
     }
     /**
+     * Returns all users that match the following privilege:
+     * - resource: user, action: read
+     *
      * @example id "6c81b5e1-afc1-43ea-8f8d-939ceb5f3f90"
      * @example fields "permission,name,id"
      * @example filter "permission:none"
@@ -105,23 +140,35 @@ let GroupController = class GroupController extends XoController {
     async getGroupUsers(req, id, fields, ndjson, markdown, filter, limit) {
         const group = await this.getObject(id);
         const users = await Promise.all(group.users.map(id => this.#userService.getUser(id)));
-        return this.sendObjects(limitAndFilterArray(users, { filter, limit }), req, 'users');
+        return this.sendObjects(limitAndFilterArray(users, { filter }), req, {
+            path: 'users',
+            limit,
+            privilege: { action: 'read', resource: 'user' },
+        });
     }
     /**
+     * Returns all tasks that match the following privilege:
+     * - resource: task, action: read
+     *
      * @example id "6c81b5e1-afc1-43ea-8f8d-939ceb5f3f90"
      * @example fields "id,status,properties"
      * @example filter "status:failure"
      * @example limit 42
      */
     async getGroupTasks(req, id, fields, ndjson, markdown, filter, limit) {
-        const tasks = await this.getTasksForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(tasks), req, 'tasks');
+        const tasks = await this.getTasksForObject(id, { filter });
+        return this.sendObjects(Object.values(tasks), req, {
+            path: 'tasks',
+            limit,
+            privilege: { action: 'read', resource: 'task' },
+        });
     }
 };
 __decorate([
     Example(groupIds),
     Example(partialGroups),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
@@ -132,12 +179,27 @@ __decorate([
 __decorate([
     Example(group),
     Get('{id}'),
+    Middlewares(acl({
+        resource: 'group',
+        action: 'read',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getGroup,
+    })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], GroupController.prototype, "getGroup", null);
 __decorate([
     Patch('{id}'),
-    Middlewares(json()),
+    Middlewares([
+        json(),
+        acl({
+            resource: 'group',
+            action: actionFromBody('update:name'),
+            objectId: 'params.id',
+            getObject: ({ restApi }) => restApi.xoApp.getGroup,
+        }),
+    ]),
     SuccessResponse(noContentResp.status, noContentResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(resourceAlreadyExists.status, resourceAlreadyExists.description),
@@ -148,20 +210,34 @@ __decorate([
 __decorate([
     Example(groupId),
     Post(''),
-    Middlewares(json()),
+    Middlewares([json(), acl({ resource: 'group', action: 'create', object: ({ req }) => req.body })]),
     SuccessResponse(createdResp.status, createdResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(invalidParameters.status, invalidParameters.description),
     Response(resourceAlreadyExists.status, resourceAlreadyExists.description),
     __param(0, Body())
 ], GroupController.prototype, "createGroup", null);
 __decorate([
     Delete('{id}'),
+    Middlewares(acl({
+        resource: 'group',
+        action: 'delete',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getGroup,
+    })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], GroupController.prototype, "deleteGroup", null);
 __decorate([
     Delete('{id}/users/{userId}'),
+    Middlewares(acl({
+        resource: 'group',
+        action: 'update:users',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getGroup,
+    })),
     SuccessResponse(noContentResp.status, noContentResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
@@ -170,6 +246,12 @@ __decorate([
 ], GroupController.prototype, "removeUserFromGroup", null);
 __decorate([
     Put('{id}/users/{userId}'),
+    Middlewares(acl({
+        resource: 'group',
+        action: 'update:users',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getGroup,
+    })),
     SuccessResponse(noContentResp.status, noContentResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
@@ -180,6 +262,7 @@ __decorate([
     Example(userIds),
     Example(partialUsers),
     Get('{id}/users'),
+    Security('*', ['acl']),
     Tags('users'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -194,6 +277,7 @@ __decorate([
     Example(taskIds),
     Example(partialTasks),
     Get('{id}/tasks'),
+    Security('*', ['acl']),
     Tags('tasks'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),

package/dist/hosts/host.controller.mjs

@@ -15,13 +15,14 @@ import { inject } from 'inversify';
 import { invalidParameters } from 'xo-common/api-errors.js';
 import { pipeline } from 'node:stream/promises';
 import { provide } from 'inversify-binding-decorators';
+import { acl } from '../middlewares/acl.middleware.mjs';
 import { AlarmService } from '../alarms/alarm.service.mjs';
 import { escapeUnsafeComplexMatcher } from '../helpers/utils.helper.mjs';
 import { genericAlarmsExample } from '../open-api/oa-examples/alarm.oa-example.mjs';
 import { host, hostIds, hostSmt, hostMissingPatches, hostStats, partialHosts, } from '../open-api/oa-examples/host.oa-example.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
 import { XapiXoController } from '../abstract-classes/xapi-xo-controller.mjs';
-import { asynchronousActionResp, badRequestResp, featureUnauthorized, internalServerErrorResp, invalidParameters as invalidParametersResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
+import { asynchronousActionResp, badRequestResp, featureUnauthorized, forbiddenOperationResp, internalServerErrorResp, invalidParameters as invalidParametersResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { HostService } from './host.service.mjs';
 import { messageIds, partialMessages } from '../open-api/oa-examples/message.oa-example.mjs';
 import { partialTasks, taskIds, taskLocation } from '../open-api/oa-examples/task.oa-example.mjs';
@@ -34,20 +35,32 @@ let HostController = class HostController extends XapiXoController {
         this.#hostService = hostService;
     }
     /**
+     * Returns all hosts that match the following privilege:
+     * - resource: host, action: read
+     *
      * @example fields "id,name_label,productBrand"
      * @example filter "productBrand:XCP-ng"
      * @example limit 42
      */
     getHosts(req, fields, ndjson, markdown, filter, limit) {
-        return this.sendObjects(Object.values(this.getObjects({ filter, limit })), req);
+        return this.sendObjects(Object.values(this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'host' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: host, action: read
+     *
      * @example id "b61a5c92-700e-4966-a13b-00633f03eea8"
      */
     getHost(id) {
         return this.getObject(id);
     }
     /**
+     * Required privilege:
+     * - resource: host, action: read
+     *
      * Host must be running
      * @example id "b61a5c92-700e-4966-a13b-00633f03eea8"
      */
@@ -55,6 +68,9 @@ let HostController = class HostController extends XapiXoController {
         return this.restApi.xoApp.getXapiHostStats(id, granularity);
     }
     /**
+     * Required privilege:
+     * - resource: host, action: export:logs
+     *
      * Host must be running
      *
      * Download the audit log of a host.
@@ -75,6 +91,9 @@ let HostController = class HostController extends XapiXoController {
         await pipeline(response.body, this.maybeCompressResponse(req, res));
     }
     /**
+     * Required privilege:
+     * - resource: host, action: export:logs
+     *
      * Host must be running
      *
      * Download all logs of a host.
@@ -90,6 +109,9 @@ let HostController = class HostController extends XapiXoController {
         await pipeline(response.body, res);
     }
     /**
+     * Returns all alarms that match the following privilege:
+     * - resource: alarm, action: read
+     *
      * @example id "b61a5c92-700e-4966-a13b-00633f03eea8"
      * @example fields "id,time"
      * @example filter "time:>1747053793"
@@ -99,11 +121,17 @@ let HostController = class HostController extends XapiXoController {
         const host = this.getObject(id);
         const alarms = this.#alarmService.getAlarms({
             filter: `${escapeUnsafeComplexMatcher(filter) ?? ''} object:uuid:${host.uuid}`,
+        });
+        return this.sendObjects(Object.values(alarms), req, {
+            path: 'alarms',
             limit,
+            privilege: { action: 'read', resource: 'alarm' },
         });
-        return this.sendObjects(Object.values(alarms), req, 'alarms');
     }
     /**
+     * Required privilege:
+     * - resource: host, action: read
+     *
      * Returns a boolean indicating whether SMT (Simultaneous Multi-Threading) is enabled
      *
      * @example id "b61a5c92-700e-4966-a13b-00633f03eea8"
@@ -115,6 +143,9 @@ let HostController = class HostController extends XapiXoController {
         return { enabled };
     }
     /**
+     * Required privilege:
+     * - resource: host, action: read
+     *
      * Host must be running
      *
      * @example id "b61a5c92-700e-4966-a13b-00633f03eea8"
@@ -124,26 +155,43 @@ let HostController = class HostController extends XapiXoController {
         return missingPatches;
     }
     /**
+     * Returns all messages that match the following privilege:
+     * - resource: message, action: read
+     *
      * @example id "b61a5c92-700e-4966-a13b-00633f03eea8"
      * @example fields "name,id,$object"
      * @example filter "name:PBD_PLUG_FAILED_ON_SERVER_START"
      * @example limit 42
      */
     getHostMessages(req, id, fields, ndjson, markdown, filter, limit) {
-        const messages = this.getMessagesForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(messages), req, 'messages');
+        const messages = this.getMessagesForObject(id, { filter });
+        return this.sendObjects(Object.values(messages), req, {
+            path: 'messages',
+            limit,
+            privilege: { action: 'read', resource: 'message' },
+        });
     }
     /**
+     * Returns all tasks that match the following privilege:
+     * - resource: task, action: read
+     *
      * @example id "b61a5c92-700e-4966-a13b-00633f03eea8"
      * @example fields "id,status,properties"
      * @example filter "status:failure"
      * @example limit 42
      */
     async getHostTasks(req, id, fields, ndjson, markdown, filter, limit) {
-        const tasks = await this.getTasksForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(tasks), req, 'tasks');
+        const tasks = await this.getTasksForObject(id, { filter });
+        return this.sendObjects(Object.values(tasks), req, {
+            path: 'tasks',
+            limit,
+            privilege: { action: 'read', resource: 'task' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: host, action: update:tags
+     *
      * @example id "b61a5c92-700e-4966-a13b-00633f03eea8"
      * @example tag "from-rest-api"
      */
@@ -152,6 +200,9 @@ let HostController = class HostController extends XapiXoController {
         await host.$call('add_tags', tag);
     }
     /**
+     * Required privilege:
+     * - resource: host, action: update:tags
+     *
      * @example id "b61a5c92-700e-4966-a13b-00633f03eea8"
      * @example tag "from-rest-api"
      */
@@ -257,6 +308,7 @@ __decorate([
     Example(hostIds),
     Example(partialHosts),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
@@ -267,12 +319,16 @@ __decorate([
 __decorate([
     Example(host),
     Get('{id}'),
+    Middlewares(acl({ resource: 'host', action: 'read', objectId: 'params.id' })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], HostController.prototype, "getHost", null);
 __decorate([
     Example(hostStats),
     Get('{id}/stats'),
+    Middlewares(acl({ resource: 'host', action: 'read', objectId: 'params.id' })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(422, 'Invalid granularity'),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
@@ -281,7 +337,9 @@ __decorate([
 ], HostController.prototype, "getHostStats", null);
 __decorate([
     Get('{id}/audit.txt'),
+    Middlewares(acl({ resource: 'host', action: 'export:logs', objectId: 'params.id' })),
     SuccessResponse(200, 'Download started', 'application/octet-stream'),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
     __param(0, Request()),
@@ -289,7 +347,9 @@ __decorate([
 ], HostController.prototype, "getAuditLog", null);
 __decorate([
     Get('{id}/logs.tgz'),
+    Middlewares(acl({ resource: 'host', action: 'export:logs', objectId: 'params.id' })),
     SuccessResponse(200, 'Download started', 'application/gzip'),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
     __param(0, Request()),
@@ -298,6 +358,7 @@ __decorate([
 __decorate([
     Example(genericAlarmsExample),
     Get('{id}/alarms'),
+    Security('*', ['acl']),
     Tags('alarms'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -311,6 +372,8 @@ __decorate([
 __decorate([
     Example(hostSmt),
     Get('{id}/smt'),
+    Middlewares(acl({ resource: 'host', action: 'read', objectId: 'params.id' })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
     __param(0, Path())
@@ -318,6 +381,8 @@ __decorate([
 __decorate([
     Example(hostMissingPatches),
     Get('{id}/missing_patches'),
+    Middlewares(acl({ resource: 'host', action: 'read', objectId: 'params.id' })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(featureUnauthorized.status, featureUnauthorized.description),
     __param(0, Path())
@@ -326,6 +391,7 @@ __decorate([
     Example(messageIds),
     Example(partialMessages),
     Get('{id}/messages'),
+    Security('*', ['acl']),
     Tags('messages'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -340,6 +406,7 @@ __decorate([
     Example(taskIds),
     Example(partialTasks),
     Get('{id}/tasks'),
+    Security('*', ['acl']),
     Tags('tasks'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -352,14 +419,18 @@ __decorate([
 ], HostController.prototype, "getHostTasks", null);
 __decorate([
     Put('{id}/tags/{tag}'),
+    Middlewares(acl({ resource: 'host', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path()),
     __param(1, Path())
 ], HostController.prototype, "putHostTag", null);
 __decorate([
     Delete('{id}/tags/{tag}'),
+    Middlewares(acl({ resource: 'host', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path()),
     __param(1, Path())

package/dist/ioc/ioc.mjs

@@ -13,10 +13,11 @@ import { BackupJobService } from '../backup-jobs/backup-job.service.mjs';
 import { BackupLogService } from '../backup-logs/backup-log.service.mjs';
 import { EventService } from '../events/event.service.mjs';
 import { NetworkService } from '../networks/network.service.mjs';
+import { BackupArchiveService } from '../backup-archives/backup-archive.service.mjs';
 const iocContainer = new Container();
-decorate(injectable(), Controller);
-iocContainer.load(buildProviderModule());
 export function setupContainer(xoApp) {
+    decorate(injectable(), Controller);
+    iocContainer.load(buildProviderModule());
     if (iocContainer.isBound(RestApi)) {
         iocContainer.unbind(RestApi);
     }
@@ -82,8 +83,9 @@ export function setupContainer(xoApp) {
         .inSingletonScope();
     iocContainer
         .bind(BackupLogService)
-        .toDynamicValue(() => {
-        return new BackupLogService();
+        .toDynamicValue(ctx => {
+        const restApi = ctx.container.get(RestApi);
+        return new BackupLogService(restApi);
     })
         .inSingletonScope();
     iocContainer
@@ -100,5 +102,12 @@ export function setupContainer(xoApp) {
         return new NetworkService(restApi);
     })
         .inSingletonScope();
+    iocContainer
+        .bind(BackupArchiveService)
+        .toDynamicValue(ctx => {
+        const restApi = ctx.container.get(RestApi);
+        return new BackupArchiveService(restApi);
+    })
+        .inSingletonScope();
 }
 export { iocContainer };

package/dist/messages/message.controller.mjs

@@ -7,16 +7,24 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
+import { Example, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
 import { inject } from 'inversify';
 import { noSuchObject } from 'xo-common/api-errors.js';
 import { provide } from 'inversify-binding-decorators';
+import { acl } from '../middlewares/acl.middleware.mjs';
 import { alarmPredicate } from '../alarms/alarm.service.mjs';
 import { message, messageIds, partialMessages } from '../open-api/oa-examples/message.oa-example.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
-import { badRequestResp, notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
+import { badRequestResp, forbiddenOperationResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { XapiXoController } from '../abstract-classes/xapi-xo-controller.mjs';
 import { safeParseComplexMatcher } from '../helpers/utils.helper.mjs';
+function getMessage(restApi, id) {
+    const message = restApi.getObject(id, 'message');
+    if (alarmPredicate(message)) {
+        throw noSuchObject(id, 'message');
+    }
+    return message;
+}
 let MessageController = class MessageController extends XapiXoController {
     constructor(restapi) {
         super('message', restapi);
@@ -36,21 +44,26 @@ let MessageController = class MessageController extends XapiXoController {
      * Override parent getObject in order to exclude`ALARM` message
      */
     getObject(id) {
-        const message = super.getObject(id);
-        if (alarmPredicate(message)) {
-            throw noSuchObject(id, 'message');
-        }
-        return message;
+        return getMessage(this.restApi, id);
     }
     /**
+     * Returns all messages that match the following privilege:
+     * - resource: message, action: read
+     *
      * @example fields "name,body,id,$object"
      * @example filter "name:VM_STARTED"
      * @example limit 42
      */
     getMessages(req, fields, ndjson, markdown, filter, limit) {
-        return this.sendObjects(Object.values(this.getObjects({ filter, limit })), req);
+        return this.sendObjects(Object.values(this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'message' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: message, action: read
+     *
      * @example id "f775eaeb-abe5-94e0-9682-14c37c3a1dfe"
      */
     getMessage(id) {
@@ -61,6 +74,7 @@ __decorate([
     Example(messageIds),
     Example(partialMessages),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
@@ -71,6 +85,13 @@ __decorate([
 __decorate([
     Example(message),
     Get('{id}'),
+    Middlewares(acl({
+        resource: 'message',
+        action: 'read',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => id => getMessage(restApi, id),
+    })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], MessageController.prototype, "getMessage", null);