@xen-orchestra/rest-api 0.29.0 → 0.30.1

package/dist/vms/vm.controller.mjs

@@ -13,6 +13,7 @@ import { inject } from 'inversify';
 import { incorrectState, invalidParameters } from 'xo-common/api-errors.js';
 import { provide } from 'inversify-binding-decorators';
 import { PassThrough } from 'node:stream';
+import { acl } from '../middlewares/acl.middleware.mjs';
 import { asynchronousActionResp, badRequestResp, createdResp, forbiddenOperationResp, incorrectStateResp, internalServerErrorResp, invalidParameters as invalidParametersResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { BASE_URL } from '../index.mjs';
 import { limitAndFilterArray, NDJSON_CONTENT_TYPE } from '../helpers/utils.helper.mjs';
@@ -35,18 +36,26 @@ let VmController = class VmController extends XapiXoController {
         this.#backupJobService = backupJobService;
     }
     /**
+     * Returns all VMs that match the following privilege:
+     * - resource: vm, action: read
      *
      * @example fields "name_label,power_state,uuid"
      * @example filter "power_state:Running"
      * @example limit 42
      */
     getVms(req, fields, ndjson, markdown, filter, limit) {
-        return this.sendObjects(Object.values(this.getObjects({ filter, limit })), req);
+        return this.sendObjects(Object.values(this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'vm' },
+        });
     }
     /**
      *
      * Export VM. Compress is only used for XVA format
      *
+     * Required privilege:
+     * - resource: vm, action: export
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     async exportVm(req, id, format, compress) {
@@ -56,6 +65,8 @@ let VmController = class VmController extends XapiXoController {
         return stream;
     }
     /**
+     * Required privilege:
+     * - resource: vm, action: read
      *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
@@ -63,6 +74,9 @@ let VmController = class VmController extends XapiXoController {
         return this.getObject(id);
     }
     /**
+     * Required privilege:
+     * - resource: vm, action: delete
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     async deleteVm(id) {
@@ -73,6 +87,9 @@ let VmController = class VmController extends XapiXoController {
      *
      *  VM must be running
      *
+     * Required privilege:
+     * - resource: vm, action: read
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     async getVmStats(id, granularity) {
@@ -117,6 +134,10 @@ let VmController = class VmController extends XapiXoController {
      * - **vif_#_tx** : Bytes per second transmitted on virtual interface vif. Enabled by default. *Condition*: VIF vif exists.
      * - **vif_#_rx_errors** : Receive errors per second on virtual interface vif. Enabled by default. *Condition*: VIF vif exists.
      * - **vif_#_tx_errors** : Transmit errors per second on virtual interface vif. Enabled by default. *Condition*: VIF vif exists.
+     *
+     * Required privilege:
+     * - resource: vm, action: update:datasources
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      * @example dataSource "cpu0"
      */
@@ -128,6 +149,9 @@ let VmController = class VmController extends XapiXoController {
      *
      * For a list of possible data sources, see the endpoint documentation: `GET {id}/stats/data_source/{data_source}`
      *
+     * Required privilege:
+     * - resource: vm, action: update:datasources
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      * @example dataSource "cpu0"
      */
@@ -137,6 +161,10 @@ let VmController = class VmController extends XapiXoController {
     /**
      * The VM must be halted
      *
+     * Required privileges:
+     * - resource: vm, action: start
+     * - resource: host, action: allow-vm (if an hostId is specified)
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      * @example body { "hostId": "b61a5c92-700e-4966-a13b-00633f03eea8" }
      */
@@ -157,6 +185,10 @@ let VmController = class VmController extends XapiXoController {
     }
     /**
      * Requires guest tools to be installed
+     *
+     * Required privilege:
+     * - resource: vm, action: shutdown:clean
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     async cleanShutdownVm(id, sync) {
@@ -175,6 +207,10 @@ let VmController = class VmController extends XapiXoController {
     }
     /**
      * Requires guest tools to be installed
+     *
+     * Required privilege:
+     * - resource: vm, action: reboot:clean
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     async cleanRebootVm(id, sync) {
@@ -192,6 +228,9 @@ let VmController = class VmController extends XapiXoController {
         });
     }
     /**
+     * Required privilege:
+     * - resource: vm, action: shutdown:hard
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     async hardShutdownVm(id, sync) {
@@ -209,6 +248,9 @@ let VmController = class VmController extends XapiXoController {
         });
     }
     /**
+     * Required privilege:
+     * - resource: vm, action: reboot:hard
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     async hardRebootVm(id, sync) {
@@ -228,6 +270,9 @@ let VmController = class VmController extends XapiXoController {
     /**
      * The VM must be running
      *
+     * Required privilege:
+     * - resource: vm, action: pause
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     async pauseVm(id, sync) {
@@ -247,6 +292,9 @@ let VmController = class VmController extends XapiXoController {
     /**
      * The VM must be running
      *
+     * Required privilege:
+     * - resource: vm, action: suspend
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     async suspendVm(id, sync) {
@@ -266,6 +314,9 @@ let VmController = class VmController extends XapiXoController {
     /**
      * The VM must be suspended
      *
+     * Required privilege:
+     * - resource: vm, action: resume
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     async resumeVm(id, sync) {
@@ -285,6 +336,9 @@ let VmController = class VmController extends XapiXoController {
     /**
      * The VM must be paused
      *
+     * Required privilege:
+     * - resource: vm, action: unpause
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     async unpauseVm(id, sync) {
@@ -302,6 +356,9 @@ let VmController = class VmController extends XapiXoController {
         });
     }
     /**
+     * Required privilege:
+     * - resource: vm, action: snapshot
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      * @example body { "name_label": "my_awesome_snapshot" }
      */
@@ -371,16 +428,26 @@ let VmController = class VmController extends XapiXoController {
         });
     }
     /**
+     * Returns all alarms that match the following privilege:
+     * - resource: alarm, action: read
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      * @example fields "id,time"
      * @example filter "time:>1747053793"
      * @example limit 42
      */
     getVmAlarms(req, id, fields, ndjson, markdown, filter, limit) {
-        const alarms = this.#vmService.getVmAlarms(id, { filter, limit });
-        return this.sendObjects(Object.values(alarms), req, 'alarms');
+        const alarms = this.#vmService.getVmAlarms(id, { filter });
+        return this.sendObjects(Object.values(alarms), req, {
+            path: 'alarms',
+            limit,
+            privilege: { action: 'read', resource: 'alarm' },
+        });
     }
     /**
+     * Returns all VDIs that match the following privilege:
+     * - resource: vdi, action: read
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      * @example fields "VDI_type,id,name_label"
      * @example filter "VDI_type:user"
@@ -388,9 +455,16 @@ let VmController = class VmController extends XapiXoController {
      */
     getVmVdis(req, id, fields, ndjson, markdown, filter, limit) {
         const vdis = this.#vmService.getVmVdis(id, 'VM');
-        return this.sendObjects(limitAndFilterArray(vdis, { filter, limit }), req, obj => obj.type.toLowerCase() + 's');
+        return this.sendObjects(limitAndFilterArray(vdis, { filter }), req, {
+            path: obj => obj.type.toLowerCase() + 's',
+            limit,
+            privilege: { action: 'read', resource: 'vdi' },
+        });
     }
     /**
+     * Returns all backup jobs that match the following privilege:
+     * - resource: backup-job, action: read
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      * @example fields "mode,name,type,id"
      * @example filter "mode:full"
@@ -404,29 +478,50 @@ let VmController = class VmController extends XapiXoController {
                 vmBackupJobs.push(backupJob);
             }
         }
-        return this.sendObjects(limitAndFilterArray(vmBackupJobs, { filter, limit }), req, '/backup-jobs');
+        return this.sendObjects(limitAndFilterArray(vmBackupJobs, { filter }), req, {
+            path: '/backup-jobs',
+            limit,
+            privilege: { action: 'read', resource: 'backup-job' },
+        });
     }
     /**
+     * Returns all messages that match the following privilege:
+     * - resource: message, action: read
+     *
      * @example id "cef5f68c-61ae-3831-d2e6-1590d4934acf"
      * @example fields "name,id,$object"
      * @example filter "name:VM_STARTED"
      * @example limit 42
      */
     getVmMessages(req, id, fields, ndjson, markdown, filter, limit) {
-        const messages = this.getMessagesForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(messages), req, 'messages');
+        const messages = this.getMessagesForObject(id, { filter });
+        return this.sendObjects(Object.values(messages), req, {
+            path: 'messages',
+            limit,
+            privilege: { action: 'read', resource: 'message' },
+        });
     }
     /**
+     * Returns all tasks that match the following privilege:
+     * - resource: task, action: read
+     *
      * @example id "613f541c-4bed-fc77-7ca8-2db6b68f079c"
      * @example fields "id,status,properties"
      * @example filter "status:failure"
      * @example limit 42
      */
     async getVmTasks(req, id, fields, ndjson, markdown, filter, limit) {
-        const tasks = await this.getTasksForObject(id, { filter, limit });
-        return this.sendObjects(Object.values(tasks), req, 'tasks');
+        const tasks = await this.getTasksForObject(id, { filter });
+        return this.sendObjects(Object.values(tasks), req, {
+            path: 'tasks',
+            limit,
+            privilege: { action: 'read', resource: 'task' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: vm, action: update:tags
+     *
      * @example id "613f541c-4bed-fc77-7ca8-2db6b68f079c"
      * @example tag "from-rest-api"
      */
@@ -435,6 +530,9 @@ let VmController = class VmController extends XapiXoController {
         await vm.$call('add_tags', tag);
     }
     /**
+     * Required privilege:
+     * - resource: vm, action: update:tags
+     *
      * @example id "613f541c-4bed-fc77-7ca8-2db6b68f079c"
      * @example tag "from-rest-api"
      */
@@ -443,6 +541,9 @@ let VmController = class VmController extends XapiXoController {
         await vm.$call('remove_tags', tag);
     }
     /**
+     * Required privilege:
+     * - resource: vm, action: read
+     *
      * @example id "613f541c-4bed-fc77-7ca8-2db6b68f079c"
      */
     async getVmDashboard(req, id, ndjson) {
@@ -496,6 +597,7 @@ __decorate([
     Example(vmIds),
     Example(partialVms),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
@@ -505,7 +607,9 @@ __decorate([
 ], VmController.prototype, "getVms", null);
 __decorate([
     Get('{id}.{format}'),
+    Middlewares(acl({ resource: 'vm', action: 'export', objectId: 'params.id' })),
     SuccessResponse(200, 'Download started', 'application/octet-stream'),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(422, 'Invalid format, Invalid compress'),
     __param(0, Request()),
@@ -516,11 +620,14 @@ __decorate([
 __decorate([
     Example(vm),
     Get('{id}'),
+    Middlewares(acl({ resource: 'vm', action: 'read', objectId: 'params.id' })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], VmController.prototype, "getVm", null);
 __decorate([
     Delete('{id}'),
+    Middlewares(acl({ resource: 'vm', action: 'delete', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
@@ -530,32 +637,45 @@ __decorate([
 __decorate([
     Example(vmStatsExample),
     Get('{id}/stats'),
+    Middlewares(acl({ resource: 'vm', action: 'read', objectId: 'params.id' })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(422, 'Invalid granularity, VM is halted or host could not be found'),
     __param(0, Path()),
     __param(1, Query())
 ], VmController.prototype, "getVmStats", null);
 __decorate([
+    Put('{id}/stats/data_source/{data_source}'),
+    Middlewares(acl({ resource: 'vm', action: 'update:datasources', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
-    Put('{id}/stats/data_source/{data_source}'),
     __param(0, Path()),
     __param(1, Path('data_source'))
 ], VmController.prototype, "addDataSource", null);
 __decorate([
+    Delete('{id}/stats/data_source/{data_source}'),
+    Middlewares(acl({ resource: 'vm', action: 'update:datasources', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
-    Delete('{id}/stats/data_source/{data_source}'),
     __param(0, Path()),
     __param(1, Path('data_source'))
 ], VmController.prototype, "deleteDataSource", null);
 __decorate([
     Example(taskLocation),
     Post('{id}/actions/start'),
-    Middlewares(json()),
+    Middlewares([
+        json(),
+        acl([
+            { resource: 'vm', action: 'start', objectId: 'params.id' },
+            { resource: 'host', action: 'allow-vm', objectId: 'body.hostId' },
+        ]),
+    ]),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(noContentResp.status, noContentResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
@@ -566,8 +686,10 @@ __decorate([
 __decorate([
     Example(taskLocation),
     Post('{id}/actions/clean_shutdown'),
+    Middlewares(acl({ resource: 'vm', action: 'shutdown:clean', objectId: 'params.id' })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
     Response(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
     __param(0, Path()),
@@ -576,13 +698,20 @@ __decorate([
 __decorate([
     Example(taskLocation),
     Post('{id}/actions/clean_reboot'),
+    Middlewares(acl({ resource: 'vm', action: 'reboot:clean', objectId: 'params.id' })),
+    SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
+    Response(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path()),
     __param(1, Query())
 ], VmController.prototype, "cleanRebootVm", null);
 __decorate([
     Example(taskLocation),
     Post('{id}/actions/hard_shutdown'),
+    Middlewares(acl({ resource: 'vm', action: 'shutdown:hard', objectId: 'params.id' })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(noContentResp.status, noContentResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
@@ -592,7 +721,9 @@ __decorate([
 __decorate([
     Example(taskLocation),
     Post('{id}/actions/hard_reboot'),
+    Middlewares(acl({ resource: 'vm', action: 'reboot:hard', objectId: 'params.id' })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(noContentResp.status, noContentResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
@@ -602,7 +733,9 @@ __decorate([
 __decorate([
     Example(taskLocation),
     Post('{id}/actions/pause'),
+    Middlewares(acl({ resource: 'vm', action: 'pause', objectId: 'params.id' })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(noContentResp.status, noContentResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
@@ -612,7 +745,9 @@ __decorate([
 __decorate([
     Example(taskLocation),
     Post('{id}/actions/suspend'),
+    Middlewares(acl({ resource: 'vm', action: 'suspend', objectId: 'params.id' })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(noContentResp.status, noContentResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
@@ -622,7 +757,9 @@ __decorate([
 __decorate([
     Example(taskLocation),
     Post('{id}/actions/resume'),
+    Middlewares(acl({ resource: 'vm', action: 'resume', objectId: 'params.id' })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(noContentResp.status, noContentResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
@@ -632,7 +769,9 @@ __decorate([
 __decorate([
     Example(taskLocation),
     Post('{id}/actions/unpause'),
+    Middlewares(acl({ resource: 'vm', action: 'unpause', objectId: 'params.id' })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(noContentResp.status, noContentResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
@@ -642,7 +781,9 @@ __decorate([
 __decorate([
     Example(taskLocation),
     Post('{id}/actions/snapshot'),
+    Middlewares([json(), acl({ resource: 'vm', action: 'snapshot', objectId: 'params.id' })]),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(createdResp.status, 'Snapshot created'),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
@@ -666,6 +807,7 @@ __decorate([
 __decorate([
     Example(genericAlarmsExample),
     Get('{id}/alarms'),
+    Security('*', ['acl']),
     Tags('alarms'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -679,6 +821,7 @@ __decorate([
 __decorate([
     Example(vmVdis),
     Get('{id}/vdis'),
+    Security('*', ['acl']),
     Tags('vdis'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -693,6 +836,7 @@ __decorate([
     Example(vmBackupJobIds),
     Example(partialVmBackupJobs),
     Get('{id}/backup-jobs'),
+    Security('*', ['acl']),
     Tags('backup-jobs'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -707,6 +851,7 @@ __decorate([
     Example(messageIds),
     Example(partialMessages),
     Get('{id}/messages'),
+    Security('*', ['acl']),
     Tags('messages'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -721,6 +866,7 @@ __decorate([
     Example(taskIds),
     Example(partialTasks),
     Get('{id}/tasks'),
+    Security('*', ['acl']),
     Tags('tasks'),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Request()),
@@ -733,14 +879,18 @@ __decorate([
 ], VmController.prototype, "getVmTasks", null);
 __decorate([
     Put('{id}/tags/{tag}'),
+    Middlewares(acl({ resource: 'vm', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path()),
     __param(1, Path())
 ], VmController.prototype, "putVmTag", null);
 __decorate([
     Delete('{id}/tags/{tag}'),
+    Middlewares(acl({ resource: 'vm', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path()),
     __param(1, Path())
@@ -748,6 +898,8 @@ __decorate([
 __decorate([
     Example(vmDashboard),
     Get('{id}/dashboard'),
+    Middlewares(acl({ resource: 'vm', action: 'read', objectId: 'params.id' })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     __param(0, Request()),
     __param(1, Path()),
     __param(2, Query())