@xen-orchestra/rest-api 0.29.0 → 0.30.0

package/dist/servers/server.controller.mjs

@@ -11,7 +11,8 @@ import { Body, Delete, Example, Get, Middlewares, Path, Post, Query, Request, Re
 import { json } from 'express';
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
-import { asynchronousActionResp, badRequestResp, createdResp, invalidParameters, noContentResp, notFoundResp, resourceAlreadyExists, unauthorizedResp, } from '../open-api/common/response.common.mjs';
+import { acl } from '../middlewares/acl.middleware.mjs';
+import { asynchronousActionResp, badRequestResp, createdResp, forbiddenOperationResp, invalidParameters, noContentResp, notFoundResp, resourceAlreadyExists, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { partialServers, server, serverId, serverIds } from '../open-api/oa-examples/server.oa-example.mjs';
 import { partialTasks, taskIds, taskLocation } from '../open-api/oa-examples/task.oa-example.mjs';
 import { XoController } from '../abstract-classes/xo-controller.mjs';
@@ -28,26 +29,41 @@ let ServerController = class ServerController extends XoController {
         return this.restApi.xoApp.getXenServer(id);
     }
     /**
+     * Returns all servers that match the following privilege:
+     * - resource: server, action: read
+     *
      * @example fields "status,id"
      * @example filter "status:/^connected$/"
      * @example limit 42
      */
     async getServers(req, fields, ndjson, markdown, filter, limit) {
-        return this.sendObjects(Object.values(await this.getObjects({ filter, limit })), req);
+        return this.sendObjects(Object.values(await this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'server' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: server, action: read
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     getServer(id) {
         return this.getObject(id);
     }
     /**
+     * Required privilege:
+     * - resource: server, action: delete
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     async deleteServer(id) {
         await this.restApi.xoApp.unregisterXenServer(id);
     }
     /**
+     * Required privilege:
+     * - resource: server, action: create
+     *
      * @example body {
      *   "allowUnauthorized": true,
      *   "host": "192.168.1.10",
@@ -61,6 +77,9 @@ let ServerController = class ServerController extends XoController {
         return { id: server.id };
     }
     /**
+     * Required privilege:
+     * - resource: server, action: connect
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     connectServer(id, sync) {
@@ -75,6 +94,9 @@ let ServerController = class ServerController extends XoController {
         });
     }
     /**
+     * Required privilege:
+     * - resource: server, action: disconnect
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     disconnectServer(id, sync) {
@@ -89,20 +111,28 @@ let ServerController = class ServerController extends XoController {
         });
     }
     /**
+     * Returns all tasks that match the following privilege:
+     * - resource: task, action: read
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      * @example fields "id,status,properties"
      * @example filter "status:failure"
      * @example limit 42
      */
     async getServerTasks(req, id, fields, ndjson, markdown, filter, limit) {
-        const tasks = await this.getTasksForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(tasks), req, 'tasks');
+        const tasks = await this.getTasksForObject(id, { filter });
+        return this.sendObjects(Object.values(tasks), req, {
+            path: 'tasks',
+            limit,
+            privilege: { action: 'read', resource: 'task' },
+        });
     }
 };
 __decorate([
     Example(serverIds),
     Example(partialServers),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
@@ -113,20 +143,35 @@ __decorate([
 __decorate([
     Example(server),
     Get('{id}'),
+    Middlewares(acl({
+        resource: 'server',
+        action: 'read',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getXenServer,
+    })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], ServerController.prototype, "getServer", null);
 __decorate([
     Delete('{id}'),
+    Middlewares(acl({
+        resource: 'server',
+        action: 'delete',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getXenServer,
+    })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], ServerController.prototype, "deleteServer", null);
 __decorate([
     Example(serverId),
     Post(''),
-    Middlewares(json()),
+    Middlewares([json(), acl({ resource: 'server', action: 'create', object: ({ req }) => req.body })]),
     SuccessResponse(createdResp.status, createdResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(resourceAlreadyExists.status, resourceAlreadyExists.description),
     Response(invalidParameters.status, invalidParameters.description),
     __param(0, Body())
@@ -134,8 +179,15 @@ __decorate([
 __decorate([
     Example(taskLocation),
     Post('{id}/actions/connect'),
+    Middlewares(acl({
+        resource: 'server',
+        action: 'connect',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getXenServer,
+    })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
     Response(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(409, 'The server is already connected'),
     __param(0, Path()),
@@ -144,8 +196,15 @@ __decorate([
 __decorate([
     Example(taskLocation),
     Post('{id}/actions/disconnect'),
+    Middlewares(acl({
+        resource: 'server',
+        action: 'disconnect',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getXenServer,
+    })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
     Response(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(409, 'The server is already disconnected'),
     __param(0, Path()),
@@ -155,6 +214,7 @@ __decorate([
     Example(taskIds),
     Example(partialTasks),
     Get('{id}/tasks'),
+    Security('*', ['acl']),
     Tags('tasks'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),

package/dist/sms/sm.controller.mjs

@@ -7,9 +7,10 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
+import { Example, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
+import { acl } from '../middlewares/acl.middleware.mjs';
 import { badRequestResp, notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
 import { partialSms, sm, smIds } from '../open-api/oa-examples/sm.oa-example.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
@@ -19,14 +20,23 @@ let SmController = class SmController extends XapiXoController {
         super('SM', restApi);
     }
     /**
+     * Returns all SMs that match the following privilege:
+     * - resource: sm, action: read
+     *
      * @example fields "uuid,name_label,SM_type"
      * @example filter "SM_type:ext"
      * @example limit 42
      */
     getSrs(req, fields, ndjson, markdown, filter, limit) {
-        return this.sendObjects(Object.values(this.getObjects({ filter, limit })), req);
+        return this.sendObjects(Object.values(this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'sm' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: sm, action: read
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      */
     getSr(id) {
@@ -37,6 +47,7 @@ __decorate([
     Example(smIds),
     Example(partialSms),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
@@ -47,6 +58,7 @@ __decorate([
 __decorate([
     Example(sm),
     Get('{id}'),
+    Middlewares(acl({ resource: 'sm', action: 'read', objectId: 'params.id' })),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], SmController.prototype, "getSr", null);

package/dist/srs/sr.controller.mjs

@@ -7,15 +7,16 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Delete, Example, Get, Path, Post, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
+import { Delete, Example, Get, Middlewares, Path, Post, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
 import { SUPPORTED_VDI_FORMAT } from '@vates/types';
+import { acl } from '../middlewares/acl.middleware.mjs';
 import { AlarmService } from '../alarms/alarm.service.mjs';
 import { BASE_URL } from '../index.mjs';
 import { escapeUnsafeComplexMatcher } from '../helpers/utils.helper.mjs';
 import { genericAlarmsExample } from '../open-api/oa-examples/alarm.oa-example.mjs';
-import { asynchronousActionResp, badRequestResp, createdResp, internalServerErrorResp, invalidParameters as invalidParametersResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
+import { asynchronousActionResp, badRequestResp, createdResp, internalServerErrorResp, invalidParameters as invalidParametersResp, forbiddenOperationResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { partialSrs, sr, srIds } from '../open-api/oa-examples/sr.oa-example.mjs';
 import { vdiId } from '../open-api/oa-examples/vdi.oa-example.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
@@ -29,20 +30,32 @@ let SrController = class SrController extends XapiXoController {
         this.#alarmService = alarmService;
     }
     /**
+     * Returns all SRs that match the following privilege:
+     * - resource: sr, action: read
+     *
      * @example fields "uuid,name_label,allocationStrategy"
      * @example filter "allocationStrategy:thin"
      * @example limit 42
      */
     getSrs(req, fields, ndjson, markdown, filter, limit) {
-        return this.sendObjects(Object.values(this.getObjects({ filter, limit })), req);
+        return this.sendObjects(Object.values(this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'sr' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: sr, action: read
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      */
     getSr(id) {
         return this.getObject(id);
     }
     /**
+     * Returns all alarms that match the following privilege:
+     * - resource: alarm, action: read
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      * @example fields "id,time"
      * @example filter "time:>1747053793"
@@ -52,12 +65,19 @@ let SrController = class SrController extends XapiXoController {
         const sr = this.getObject(id);
         const alarms = this.#alarmService.getAlarms({
             filter: `${escapeUnsafeComplexMatcher(filter) ?? ''} object:uuid:${sr.uuid}`,
+        });
+        return this.sendObjects(Object.values(alarms), req, {
+            path: 'alarms',
             limit,
+            privilege: { action: 'read', resource: 'alarm' },
         });
-        return this.sendObjects(Object.values(alarms), req, 'alarms');
     }
     /**
      * Import an exported VDI
+     *
+     * Required privilege:
+     * - resource: sr, action: import:vdi
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      * @example name_label "VDI_foo_import"
      * @example name_description "VDI imported by the REST API"
@@ -79,26 +99,43 @@ let SrController = class SrController extends XapiXoController {
         return { id: vdiId };
     }
     /**
+     * Returns all messages that match the following privilege:
+     * - resource: message, action: read
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      * @example fields "name,id,$object"
      * @example filter "name:VM_STARTED"
      * @example limit 42
      */
     getSrMessages(req, id, fields, ndjson, markdown, filter, limit) {
-        const messages = this.getMessagesForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(messages), req, 'messages');
+        const messages = this.getMessagesForObject(id, { filter });
+        return this.sendObjects(Object.values(messages), req, {
+            path: 'messages',
+            limit,
+            privilege: { action: 'read', resource: 'message' },
+        });
     }
     /**
+     * Returns all tasks that match the following privilege:
+     * - resource: task, action: read
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      * @example fields "id,status,properties"
      * @example filter "status:failure"
      * @example limit 42
      */
     async getSrTasks(req, id, fields, ndjson, markdown, filter, limit) {
-        const tasks = await this.getTasksForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(tasks), req, 'tasks');
+        const tasks = await this.getTasksForObject(id, { filter });
+        return this.sendObjects(Object.values(tasks), req, {
+            path: 'tasks',
+            limit,
+            privilege: { action: 'read', resource: 'task' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: sr, action: update:tags
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      * @example tag "from-rest-api"
      */
@@ -107,6 +144,9 @@ let SrController = class SrController extends XapiXoController {
         await sr.$call('add_tags', tag);
     }
     /**
+     * Required privilege:
+     * - resource: sr, action: update:tags
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      * @example tag "from-rest-api"
      */
@@ -173,6 +213,7 @@ __decorate([
     Example(srIds),
     Example(partialSrs),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
@@ -183,12 +224,15 @@ __decorate([
 __decorate([
     Example(sr),
     Get('{id}'),
+    Middlewares(acl({ resource: 'sr', action: 'read', objectId: 'params.id' })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], SrController.prototype, "getSr", null);
 __decorate([
     Example(genericAlarmsExample),
     Get('{id}/alarms'),
+    Security('*', ['acl']),
     Tags('alarms'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -202,8 +246,10 @@ __decorate([
 __decorate([
     Example(vdiId),
     Post('{id}/vdis'),
+    Middlewares(acl({ resource: 'sr', action: 'import:vdi', objectId: 'params.id' })),
     Tags('vdis'),
     SuccessResponse(createdResp.status, 'VDI imported'),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
     __param(1, Path()),
@@ -215,6 +261,7 @@ __decorate([
     Example(messageIds),
     Example(partialMessages),
     Get('{id}/messages'),
+    Security('*', ['acl']),
     Tags('messages'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -229,6 +276,7 @@ __decorate([
     Example(taskIds),
     Example(partialTasks),
     Get('{id}/tasks'),
+    Security('*', ['acl']),
     Tags('tasks'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -240,16 +288,20 @@ __decorate([
     __param(6, Query())
 ], SrController.prototype, "getSrTasks", null);
 __decorate([
+    Put('{id}/tags/{tag}'),
+    Middlewares(acl({ resource: 'sr', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
-    Put('{id}/tags/{tag}'),
     __param(0, Path()),
     __param(1, Path())
 ], SrController.prototype, "putSrTag", null);
 __decorate([
+    Delete('{id}/tags/{tag}'),
+    Middlewares(acl({ resource: 'sr', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
-    Delete('{id}/tags/{tag}'),
     __param(0, Path()),
     __param(1, Path())
 ], SrController.prototype, "deleteSrTag", null);

package/dist/tasks/task.controller.mjs

@@ -8,8 +8,9 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { XoController } from '../abstract-classes/xo-controller.mjs';
-import { Get, Path, Query, Request, Route, Security, Tags, Response, Example, Delete, Post, SuccessResponse, } from 'tsoa';
-import { asynchronousActionResp, badRequestResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
+import { Get, Path, Query, Request, Route, Security, Tags, Response, Example, Delete, Post, SuccessResponse, Middlewares, } from 'tsoa';
+import { acl } from '../middlewares/acl.middleware.mjs';
+import { asynchronousActionResp, badRequestResp, forbiddenOperationResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
 import { partialTasks, task, taskIds, taskLocation } from '../open-api/oa-examples/task.oa-example.mjs';
@@ -19,6 +20,7 @@ import { Transform } from 'node:stream';
 import { makeObjectMapper } from '../helpers/object-wrapper.helper.mjs';
 import { safeParseComplexMatcher } from '../helpers/utils.helper.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
+import { hasPrivilegeOn } from '@xen-orchestra/acl';
 let TaskController = class TaskController extends XoController {
     constructor(restApi) {
         super('task', restApi);
@@ -34,6 +36,8 @@ let TaskController = class TaskController extends XoController {
         return this.restApi.tasks.get(id);
     }
     /**
+     * Returns all tasks that match the following privilege:
+     * - resource: task, action: read
      *
      * If watch is true, ndjson must also be true
      *
@@ -63,21 +67,36 @@ let TaskController = class TaskController extends XoController {
             process.on('SIGTERM', () => {
                 req.destroy();
             });
-            function update(task) {
-                if (userFilter === undefined || userFilter(task)) {
+            const userId = this.restApi.getCurrentUser().id;
+            const update = async (task) => {
+                const user = await this.restApi.xoApp.getUser(userId);
+                const userPrivileges = (await this.restApi.xoApp.getAclV2UserPrivileges(user.id));
+                if (hasPrivilegeOn({ user, userPrivileges, action: 'read', resource: 'task', objects: task }) &&
+                    (userFilter === undefined || userFilter(task))) {
                     stream.write(['update', task]);
                 }
-            }
-            function remove(task) {
-                stream.write(['remove', { id: task.id }]);
-            }
+            };
+            const remove = async (task) => {
+                const user = await this.restApi.xoApp.getUser(userId);
+                const userPrivileges = (await this.restApi.xoApp.getAclV2UserPrivileges(user.id));
+                if (hasPrivilegeOn({ user, userPrivileges, action: 'read', resource: 'task', objects: task }) &&
+                    (userFilter === undefined || userFilter(task))) {
+                    stream.write(['remove', { id: task.id }]);
+                }
+            };
             this.restApi.tasks.on('update', update).on('remove', remove);
             return stream;
         }
-        const tasks = Object.values(await this.getObjects({ filter, limit }));
-        return this.sendObjects(tasks, req);
+        const tasks = Object.values(await this.getObjects({ filter }));
+        return this.sendObjects(tasks, req, {
+            limit,
+            privilege: { action: 'read', resource: 'task' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: task, action: read
+     *
      * @example id "0mdd1basu"
      */
     async getTask(req, id, wait) {
@@ -95,10 +114,25 @@ let TaskController = class TaskController extends XoController {
         }
         return this.getObject(taskId);
     }
+    /**
+     * Deletes all tasks the current user has the following privilege on:
+     * - resource: task, action: delete
+     */
     async deleteTasks() {
-        await this.restApi.tasks.clearLogs();
+        const user = this.restApi.getCurrentUser();
+        const userPrivileges = (await this.restApi.xoApp.getAclV2UserPrivileges(user.id));
+        const deletePromises = [];
+        for await (const task of this.restApi.tasks.list()) {
+            if (hasPrivilegeOn({ user, userPrivileges, resource: 'task', action: 'delete', objects: task })) {
+                deletePromises.push(this.restApi.tasks.deleteLog(task.id));
+            }
+        }
+        await Promise.all(deletePromises);
     }
     /**
+     * Required privilege:
+     * - resource: task, action: delete
+     *
      * @example id "0mdd1basu"
      */
     async deleteTask(id) {
@@ -106,6 +140,9 @@ let TaskController = class TaskController extends XoController {
         await this.restApi.tasks.deleteLog(task.id);
     }
     /**
+     * Required privilege:
+     * - resource: task, action: abort
+     *
      * @example id "0mdd1basu"
      */
     async abortTask(id, sync) {
@@ -127,6 +164,7 @@ __decorate([
     Example(taskIds),
     Example(partialTasks),
     Get(''),
+    Security('*', ['acl']),
     Response(badRequestResp.status, badRequestResp.description),
     __param(0, Request()),
     __param(1, Query()),
@@ -139,6 +177,13 @@ __decorate([
 __decorate([
     Example(task),
     Get('{id}'),
+    Middlewares(acl({
+        resource: 'task',
+        action: 'read',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.tasks.get.bind(restApi.xoApp.tasks),
+    })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
     __param(1, Path()),
@@ -146,19 +191,34 @@ __decorate([
 ], TaskController.prototype, "getTask", null);
 __decorate([
     Delete(''),
+    Security('*', ['acl']),
     SuccessResponse(noContentResp.status, noContentResp.description)
 ], TaskController.prototype, "deleteTasks", null);
 __decorate([
     Delete('{id}'),
+    Middlewares(acl({
+        resource: 'task',
+        action: 'delete',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.tasks.get.bind(restApi.xoApp.tasks),
+    })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], TaskController.prototype, "deleteTask", null);
 __decorate([
     Example(taskLocation),
     Post('{id}/actions/abort'),
+    Middlewares(acl({
+        resource: 'task',
+        action: 'abort',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.tasks.get.bind(restApi.xoApp.tasks),
+    })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
     Response(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path()),
     __param(1, Query())