@xen-orchestra/rest-api 0.29.0 → 0.30.1

package/dist/vm-snapshots/vm-snapshot.controller.mjs

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Delete, Example, Get, Path, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags } from 'tsoa';
+import { Delete, Example, Get, Path, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, Middlewares, } from 'tsoa';
 import { inject } from 'inversify';
 import { AlarmService } from '../alarms/alarm.service.mjs';
 import { escapeUnsafeComplexMatcher, limitAndFilterArray } from '../helpers/utils.helper.mjs';
@@ -16,6 +16,7 @@ import { partialTasks, taskIds } from '../open-api/oa-examples/task.oa-example.m
 import { badRequestResp, forbiddenOperationResp, incorrectStateResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
 import { XapiXoController } from '../abstract-classes/xapi-xo-controller.mjs';
+import { acl } from '../middlewares/acl.middleware.mjs';
 import { provide } from 'inversify-binding-decorators';
 import { partialVmSnapshots, vmSnapshot, vmSnapshotIds, vmSnapshotVdis, } from '../open-api/oa-examples/vm-snapshot.oa-example.mjs';
 import { VmService } from '../vms/vm.service.mjs';
@@ -29,18 +30,26 @@ let VmSnapshotController = class VmSnapshotController extends XapiXoController {
         this.#vmService = vmService;
     }
     /**
+     * Returns all VM snapshots that match the following privilege:
+     * - resource: vm-snapshot, action: read
      *
      * @example fields "uuid,snapshot_time,$snapshot_of"
      * @example filter "snapshot_time:>1725020038"
      * @example limit 42
      */
     getVmSnapshots(req, fields, ndjson, markdown, filter, limit) {
-        return this.sendObjects(Object.values(this.getObjects({ filter, limit })), req);
+        return this.sendObjects(Object.values(this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'vm-snapshot' },
+        });
     }
     /**
      *
      * Export VM-snapshot. Compress is only used for XVA format
      *
+     * Required privilege:
+     * - resource: vm-snapshot, action: export
+     *
      * @example id "d68fca2c-41e6-be87-d790-105c1642a090"
      */
     async exportVmSnapshot(req, id, format, compress) {
@@ -54,12 +63,18 @@ let VmSnapshotController = class VmSnapshotController extends XapiXoController {
         return stream;
     }
     /**
+     * Required privilege:
+     * - resource: vm-snapshot, action: read
+     *
      * @example id "d68fca2c-41e6-be87-d790-105c1642a090"
      */
     getVmSnapshot(id) {
         return this.getObject(id);
     }
     /**
+     * Required privilege:
+     * - resource: vm-snapshot, action: delete
+     *
      * @example id "d68fca2c-41e6-be87-d790-105c1642a090"
      */
     async deleteVmSnapshot(id) {
@@ -67,6 +82,9 @@ let VmSnapshotController = class VmSnapshotController extends XapiXoController {
         await xapiVmSnapshot.$xapi.VM_destroy(xapiVmSnapshot.$ref);
     }
     /**
+     * Returns all alarms that match the following privilege:
+     * - resource: alarm, action: read
+     *
      * @example id "d68fca2c-41e6-be87-d790-105c1642a090"
      * @example fields "id,time"
      * @example filter "time:>1747053793"
@@ -76,11 +94,17 @@ let VmSnapshotController = class VmSnapshotController extends XapiXoController {
         const vmSnapshot = this.getObject(id);
         const alarms = this.#alarmService.getAlarms({
             filter: `${escapeUnsafeComplexMatcher(filter) ?? ''} object:uuid:${vmSnapshot.uuid}`,
+        });
+        return this.sendObjects(Object.values(alarms), req, {
+            path: 'alarms',
             limit,
+            privilege: { action: 'read', resource: 'alarm' },
         });
-        return this.sendObjects(Object.values(alarms), req, 'alarms');
     }
     /**
+     * Returns all VDIs that match the following privilege:
+     * - resource: vdi, action: read
+     *
      * @example id "d68fca2c-41e6-be87-d790-105c1642a090"
      * @example fields "VDI_type,id,name_label"
      * @example filter "VDI_type:user"
@@ -88,29 +112,50 @@ let VmSnapshotController = class VmSnapshotController extends XapiXoController {
      */
     getVmSnapshotVdis(req, id, fields, ndjson, markdown, filter, limit) {
         const vdis = this.#vmService.getVmVdis(id, 'VM-snapshot');
-        return this.sendObjects(limitAndFilterArray(vdis, { filter, limit }), req, obj => obj.type.toLowerCase() + 's');
+        return this.sendObjects(limitAndFilterArray(vdis, { filter }), req, {
+            path: obj => obj.type.toLowerCase() + 's',
+            limit,
+            privilege: { action: 'read', resource: 'vdi' },
+        });
     }
     /**
+     * Returns all messages that match the following privilege:
+     * - resource: message, action: read
+     *
      * @example id "d68fca2c-41e6-be87-d790-105c1642a090"
      * @example fields "name,id,$object"
      * @example filter "name:VM_STARTED"
      * @example limit 42
      */
     getVmSnapshotsMessages(req, id, fields, ndjson, markdown, filter, limit) {
-        const messages = this.getMessagesForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(messages), req, 'messages');
+        const messages = this.getMessagesForObject(id, { filter });
+        return this.sendObjects(Object.values(messages), req, {
+            path: 'messages',
+            limit,
+            privilege: { action: 'read', resource: 'message' },
+        });
     }
     /**
+     * Returns all tasks that match the following privilege:
+     * - resource: task, action: read
+     *
      * @example id "d68fca2c-41e6-be87-d790-105c1642a090"
      * @example fields "id,status,properties"
      * @example filter "status:failure"
      * @example limit 42
      */
     async getVmSnapshotTasks(req, id, fields, ndjson, markdown, filter, limit) {
-        const tasks = await this.getTasksForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(tasks), req, 'tasks');
+        const tasks = await this.getTasksForObject(id, { filter });
+        return this.sendObjects(Object.values(tasks), req, {
+            path: 'tasks',
+            limit,
+            privilege: { action: 'read', resource: 'task' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: vm-snapshot, action: update:tags
+     *
      * @example id "d68fca2c-41e6-be87-d790-105c1642a090"
      * @example tag "from-rest-api"
      */
@@ -119,6 +164,9 @@ let VmSnapshotController = class VmSnapshotController extends XapiXoController {
         await vmSnapshot.$call('add_tags', tag);
     }
     /**
+     * Required privilege:
+     * - resource: vm-snapshot, action: update:tags
+     *
      * @example id "d68fca2c-41e6-be87-d790-105c1642a090"
      * @example tag "from-rest-api"
      */
@@ -131,6 +179,7 @@ __decorate([
     Example(vmSnapshotIds),
     Example(partialVmSnapshots),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
@@ -140,7 +189,9 @@ __decorate([
 ], VmSnapshotController.prototype, "getVmSnapshots", null);
 __decorate([
     Get('{id}.{format}'),
+    Middlewares(acl({ resource: 'vm-snapshot', action: 'export', objectId: 'params.id' })),
     SuccessResponse(200, 'Download started', 'application/octet-stream'),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(422, 'Invalid format, Invalid compress'),
     __param(0, Request()),
@@ -151,11 +202,14 @@ __decorate([
 __decorate([
     Example(vmSnapshot),
     Get('{id}'),
+    Middlewares(acl({ resource: 'vm-snapshot', action: 'read', objectId: 'params.id' })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], VmSnapshotController.prototype, "getVmSnapshot", null);
 __decorate([
     Delete('{id}'),
+    Middlewares(acl({ resource: 'vm-snapshot', action: 'delete', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
@@ -165,6 +219,7 @@ __decorate([
 __decorate([
     Example(genericAlarmsExample),
     Get('{id}/alarms'),
+    Security('*', ['acl']),
     Tags('alarms'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -178,6 +233,7 @@ __decorate([
 __decorate([
     Example(vmSnapshotVdis),
     Get('{id}/vdis'),
+    Security('*', ['acl']),
     Tags('vdis'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -192,6 +248,7 @@ __decorate([
     Example(messageIds),
     Example(partialMessages),
     Get('{id}/messages'),
+    Security('*', ['acl']),
     Tags('messages'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -206,6 +263,7 @@ __decorate([
     Example(taskIds),
     Example(partialTasks),
     Get('{id}/tasks'),
+    Security('*', ['acl']),
     Tags('tasks'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -218,14 +276,18 @@ __decorate([
 ], VmSnapshotController.prototype, "getVmSnapshotTasks", null);
 __decorate([
     Put('{id}/tags/{tag}'),
+    Middlewares(acl({ resource: 'vm-snapshot', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path()),
     __param(1, Path())
 ], VmSnapshotController.prototype, "putVmSnapshotTag", null);
 __decorate([
     Delete('{id}/tags/{tag}'),
+    Middlewares(acl({ resource: 'vm-snapshot', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path()),
     __param(1, Path())

package/dist/vm-templates/vm-template.controller.mjs

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Security, Query, Request, Response, Route, Tags, Path, Delete, SuccessResponse, Put } from 'tsoa';
+import { Example, Get, Security, Query, Request, Response, Route, Tags, Path, Delete, SuccessResponse, Put, Middlewares, } from 'tsoa';
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
 import { AlarmService } from '../alarms/alarm.service.mjs';
@@ -16,6 +16,7 @@ import { genericAlarmsExample } from '../open-api/oa-examples/alarm.oa-example.m
 import { badRequestResp, forbiddenOperationResp, incorrectStateResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
 import { XapiXoController } from '../abstract-classes/xapi-xo-controller.mjs';
+import { acl } from '../middlewares/acl.middleware.mjs';
 import { partialVmTemplates, vmTemplate, vmTemplateIds, vmTemplateVdis, } from '../open-api/oa-examples/vm-template.oa-example.mjs';
 import { VmService } from '../vms/vm.service.mjs';
 import { messageIds, partialMessages } from '../open-api/oa-examples/message.oa-example.mjs';
@@ -29,17 +30,26 @@ let VmTemplateController = class VmTemplateController extends XapiXoController {
         this.#vmService = vmService;
     }
     /**
+     * Returns all VM templates that match the following privilege:
+     * - resource: vm-template, action: read
+     *
      * @example fields "id,isDefaultTemplate,name_label"
      * @example filter "isDefaultTemplate?"
      * @example limit 42
      * */
     getVmTemplates(req, fields, ndjson, markdown, filter, limit) {
-        return this.sendObjects(Object.values(this.getObjects({ filter, limit })), req);
+        return this.sendObjects(Object.values(this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'vm-template' },
+        });
     }
     /**
      *
      * Export VM-template. Compress is only used for XVA format
      *
+     * Required privilege:
+     * - resource: vm-template, action: export
+     *
      * @example id "b7569d99-30f8-178a-7d94-801de3e29b5b-f873abe0-b138-4995-8f6f-498b423d234d"
      */
     async exportVmTemplate(req, id, format, compress) {
@@ -53,12 +63,18 @@ let VmTemplateController = class VmTemplateController extends XapiXoController {
         return stream;
     }
     /**
+     * Required privilege:
+     * - resource: vm-template, action: read
+     *
      * @example id "b7569d99-30f8-178a-7d94-801de3e29b5b-f873abe0-b138-4995-8f6f-498b423d234d"
      * */
     getVmTemplate(id) {
         return this.getObject(id);
     }
     /**
+     * Required privilege:
+     * - resource: vm-template, action: delete
+     *
      * @example id "6d50ba76-0f11-1ff1-4f6a-b502afc31b8e"
      */
     async deleteVmTemplate(id) {
@@ -66,6 +82,9 @@ let VmTemplateController = class VmTemplateController extends XapiXoController {
         await xapiVmTemplate.$xapi.VM_destroy(xapiVmTemplate.$ref);
     }
     /**
+     * Returns all alarms that match the following privilege:
+     * - resource: alarm, action: read
+     *
      * @example id "b7569d99-30f8-178a-7d94-801de3e29b5b-f873abe0-b138-4995-8f6f-498b423d234d"
      * @example fields "id,time"
      * @example filter "time:>1747053793"
@@ -75,11 +94,17 @@ let VmTemplateController = class VmTemplateController extends XapiXoController {
         const vmTemplate = this.getObject(id);
         const alarms = this.#alarmService.getAlarms({
             filter: `${escapeUnsafeComplexMatcher(filter) ?? ''} object:uuid:${vmTemplate.uuid}`,
+        });
+        return this.sendObjects(Object.values(alarms), req, {
+            path: 'alarms',
             limit,
+            privilege: { action: 'read', resource: 'alarm' },
         });
-        return this.sendObjects(Object.values(alarms), req, 'alarms');
     }
     /**
+     * Returns all VDIs that match the following privilege:
+     * - resource: vdi, action: read
+     *
      * @example id "6d50ba76-0f11-1ff1-4f6a-b502afc31b8e"
      * @example fields "VDI_type,id,name_label"
      * @example filter "VDI_type:user"
@@ -87,29 +112,50 @@ let VmTemplateController = class VmTemplateController extends XapiXoController {
      */
     getVmTemplateVdis(req, id, fields, ndjson, markdown, filter, limit) {
         const vdis = this.#vmService.getVmVdis(id, 'VM-template');
-        return this.sendObjects(limitAndFilterArray(vdis, { filter, limit }), req, obj => obj.type.toLowerCase() + 's');
+        return this.sendObjects(limitAndFilterArray(vdis, { filter }), req, {
+            path: obj => obj.type.toLowerCase() + 's',
+            limit,
+            privilege: { action: 'read', resource: 'vdi' },
+        });
     }
     /**
+     * Returns all messages that match the following privilege:
+     * - resource: message, action: read
+     *
      * @example id "6d50ba76-0f11-1ff1-4f6a-b502afc31b8e"
      * @example fields "name,id,$object"
      * @example filter "name:VM_STARTED"
      * @example limit 42
      */
     getVmTemplateMessages(req, id, fields, ndjson, markdown, filter, limit) {
-        const messages = this.getMessagesForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(messages), req, 'messages');
+        const messages = this.getMessagesForObject(id, { filter });
+        return this.sendObjects(Object.values(messages), req, {
+            path: 'messages',
+            limit,
+            privilege: { action: 'read', resource: 'message' },
+        });
     }
     /**
+     * Returns all tasks that match the following privilege:
+     * - resource: task, action: read
+     *
      * @example id "613f541c-4bed-fc77-7ca8-2db6b68f079c"
      * @example fields "id,status,properties"
      * @example filter "status:failure"
      * @example limit 42
      */
     async getVmTemplateTasks(req, id, fields, ndjson, markdown, filter, limit) {
-        const tasks = await this.getTasksForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(tasks), req, 'tasks');
+        const tasks = await this.getTasksForObject(id, { filter });
+        return this.sendObjects(Object.values(tasks), req, {
+            path: 'tasks',
+            limit,
+            privilege: { action: 'read', resource: 'task' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: vm-template, action: update:tags
+     *
      * @example id "613f541c-4bed-fc77-7ca8-2db6b68f079c"
      * @example tag "from-rest-api"
      */
@@ -118,6 +164,9 @@ let VmTemplateController = class VmTemplateController extends XapiXoController {
         await vmTemplate.$call('add_tags', tag);
     }
     /**
+     * Required privilege:
+     * - resource: vm-template, action: update:tags
+     *
      * @example id "613f541c-4bed-fc77-7ca8-2db6b68f079c"
      * @example tag "from-rest-api"
      */
@@ -130,6 +179,7 @@ __decorate([
     Example(vmTemplateIds),
     Example(partialVmTemplates),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
@@ -139,7 +189,9 @@ __decorate([
 ], VmTemplateController.prototype, "getVmTemplates", null);
 __decorate([
     Get('{id}.{format}'),
+    Middlewares(acl({ resource: 'vm-template', action: 'export', objectId: 'params.id' })),
     SuccessResponse(200, 'Download started', 'application/octet-stream'),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(422, 'Invalid format, Invalid compress'),
     __param(0, Request()),
@@ -150,11 +202,14 @@ __decorate([
 __decorate([
     Example(vmTemplate),
     Get('{id}'),
+    Middlewares(acl({ resource: 'vm-template', action: 'read', objectId: 'params.id' })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], VmTemplateController.prototype, "getVmTemplate", null);
 __decorate([
     Delete('{id}'),
+    Middlewares(acl({ resource: 'vm-template', action: 'delete', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
@@ -164,6 +219,7 @@ __decorate([
 __decorate([
     Example(genericAlarmsExample),
     Get('{id}/alarms'),
+    Security('*', ['acl']),
     Tags('alarms'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -177,6 +233,7 @@ __decorate([
 __decorate([
     Example(vmTemplateVdis),
     Get('{id}/vdis'),
+    Security('*', ['acl']),
     Tags('vdis'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -191,6 +248,7 @@ __decorate([
     Example(messageIds),
     Example(partialMessages),
     Get('{id}/messages'),
+    Security('*', ['acl']),
     Tags('messages'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -205,6 +263,7 @@ __decorate([
     Example(taskIds),
     Example(partialTasks),
     Get('{id}/tasks'),
+    Security('*', ['acl']),
     Tags('tasks'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -217,14 +276,18 @@ __decorate([
 ], VmTemplateController.prototype, "getVmTemplateTasks", null);
 __decorate([
     Put('{id}/tags/{tag}'),
+    Middlewares(acl({ resource: 'vm-template', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path()),
     __param(1, Path())
 ], VmTemplateController.prototype, "putVmTemplateTag", null);
 __decorate([
     Delete('{id}/tags/{tag}'),
+    Middlewares(acl({ resource: 'vm-template', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path()),
     __param(1, Path())