@xen-orchestra/rest-api 0.29.0 → 0.30.1

package/dist/backup-jobs/backup-job.controller.mjs

@@ -12,9 +12,10 @@ import { inject } from 'inversify';
 import { noSuchObject } from 'xo-common/api-errors.js';
 import { Deprecated, Example, Get, Hidden, Middlewares, Path, Query, Request, Response, Route, Security, Tags, } from 'tsoa';
 import { provide } from 'inversify-binding-decorators';
+import { acl, autoBindService } from '../middlewares/acl.middleware.mjs';
 import { backupLog, backupLogIds, partialBackupLogs } from '../open-api/oa-examples/backup-log.oa-example.mjs';
 import { BackupLogService } from '../backup-logs/backup-log.service.mjs';
-import { badRequestResp, notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
+import { badRequestResp, forbiddenOperationResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
 import { limitAndFilterArray, safeParseComplexMatcher } from '../helpers/utils.helper.mjs';
 import { XoController } from '../abstract-classes/xo-controller.mjs';
@@ -33,24 +34,30 @@ let BackupJobController = class BackupJobController extends XoController {
         const backupJobs = allJobs.filter(job => this.#backupJobService.isBackupJob(job));
         return backupJobs;
     }
-    async getCollectionObject(id) {
-        const job = await this.restApi.xoApp.getJob(id);
-        if (!this.#backupJobService.isBackupJob(job)) {
-            throw noSuchObject(id, 'backup-job');
-        }
-        return job;
+    getCollectionObject(id) {
+        return this.#backupJobService.getBackupJob(id);
     }
     /**
+     * Returns all backup jobs that match the following privilege:
+     * - resource: backup-job, action: read
      *
      * @example fields "name,mode,type,id"
      * @example filter "type:backup"
      * @example limit 42
      */
     async getBackupJobs(req, fields, ndjson, markdown, filter, limit) {
-        const backupJobs = await this.getObjects({ filter, limit });
-        return this.sendObjects(Object.values(backupJobs), req, 'backup-jobs');
+        const backupJobs = await this.getObjects({ filter });
+        return this.sendObjects(Object.values(backupJobs), req, {
+            path: 'backup-jobs',
+            limit,
+            privilege: { action: 'read', resource: 'backup-job' },
+        });
     }
     /**
+     *
+     * Required privilege:
+     * - resource: backup-job, action: read
+     *
      * @example id "d33f3dc1-92b4-469c-ad58-4c2a106a4721"
      */
     getBackupJob(id) {
@@ -61,6 +68,7 @@ __decorate([
     Example(vmBackupJobIds),
     Example(partialVmBackupJobs),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
@@ -70,8 +78,15 @@ __decorate([
 ], BackupJobController.prototype, "getBackupJobs", null);
 __decorate([
     Example(vmBackupJob),
-    Response(notFoundResp.status, notFoundResp.description),
     Get('{id}'),
+    Middlewares(acl({
+        resource: 'backup-job',
+        action: 'read',
+        objectId: 'params.id',
+        getObject: autoBindService(BackupJobService, 'getBackupJob'),
+    })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], BackupJobController.prototype, "getBackupJob", null);
 BackupJobController = __decorate([
@@ -113,6 +128,8 @@ let DeprecatedBackupController = class DeprecatedBackupController extends XoCont
         return backupJob;
     }
     /**
+     * Returns all VM backup jobs that match the following privilege:
+     * - resource: backup-job, action: read
      *
      * @example fields "name,mode,id"
      * @example filter "mode:delta"
@@ -120,7 +137,11 @@ let DeprecatedBackupController = class DeprecatedBackupController extends XoCont
      */
     async getVmBackupJobs(req, fields, ndjson, markdown, filter, limit) {
         const vmBackupJobs = await this.restApi.xoApp.getAllJobs('backup');
-        return this.sendObjects(limitAndFilterArray(vmBackupJobs, { filter, limit }), req, 'backup-jobs');
+        return this.sendObjects(limitAndFilterArray(vmBackupJobs, { filter }), req, {
+            path: 'backup-jobs',
+            limit,
+            privilege: { action: 'read', resource: 'backup-job' },
+        });
     }
     // For compatibility, redirect /backup/jobs/:id to /backup/jobs/vm/:id
     async redirectToVmBackupJob(req, id) {
@@ -134,6 +155,8 @@ let DeprecatedBackupController = class DeprecatedBackupController extends XoCont
         return this.getObject(id, 'backup');
     }
     /**
+     * Returns all metadata backup jobs that match the following privilege:
+     * - resource: backup-job, action: read
      *
      * @example fields "name,xoMetadata,id"
      * @example filter "xoMetadata?"
@@ -141,7 +164,11 @@ let DeprecatedBackupController = class DeprecatedBackupController extends XoCont
      */
     async getMetadataBackupJobs(req, fields, ndjson, markdown, filter, limit) {
         const metadataBackupJobs = await this.restApi.xoApp.getAllJobs('metadataBackup');
-        return this.sendObjects(limitAndFilterArray(metadataBackupJobs, { filter, limit }), req, 'backup-jobs');
+        return this.sendObjects(limitAndFilterArray(metadataBackupJobs, { filter }), req, {
+            path: 'backup-jobs',
+            limit,
+            privilege: { action: 'read', resource: 'backup-job' },
+        });
     }
     /**
      * @example id "b50f95fd-f6b7-4027-87b6-6a02c7dcd5f5"
@@ -150,6 +177,8 @@ let DeprecatedBackupController = class DeprecatedBackupController extends XoCont
         return this.getObject(id, 'metadataBackup');
     }
     /**
+     * Returns all mirror backup jobs that match the following privilege:
+     * - resource: backup-job, action: read
      *
      * @example fields "name,mode,id"
      * @example filter "mode:delta"
@@ -157,7 +186,11 @@ let DeprecatedBackupController = class DeprecatedBackupController extends XoCont
      */
     async getMirrorBackupJobs(req, fields, ndjson, markdown, filter, limit) {
         const mirrorBackupJobs = await this.restApi.xoApp.getAllJobs('mirrorBackup');
-        return this.sendObjects(limitAndFilterArray(mirrorBackupJobs, { filter, limit }), req, 'backup-jobs');
+        return this.sendObjects(limitAndFilterArray(mirrorBackupJobs, { filter }), req, {
+            path: 'backup-jobs',
+            limit,
+            privilege: { action: 'read', resource: 'backup-job' },
+        });
     }
     /**
      * @example id "e680c14c-ab52-45c8-bb0e-bd4ca12ea8f9"
@@ -166,6 +199,9 @@ let DeprecatedBackupController = class DeprecatedBackupController extends XoCont
         return this.getObject(id, 'mirrorBackup');
     }
     /**
+     * Returns all backup logs that match the following privilege:
+     * - resource: backup-log, action: read
+     *
      * @example fields "jobName,status,data"
      * @example filter "status:success"
      * @example limit 42
@@ -178,8 +214,12 @@ let DeprecatedBackupController = class DeprecatedBackupController extends XoCont
             }
             return userFilter(log);
         };
-        const logs = (await this.restApi.xoApp.getBackupNgLogsSorted({ filter: predicate, limit }));
-        return this.sendObjects(logs, req, 'backup-logs');
+        const logs = (await this.restApi.xoApp.getBackupNgLogsSorted({ filter: predicate }));
+        return this.sendObjects(logs, req, {
+            path: 'backup-logs',
+            limit,
+            privilege: { action: 'read', resource: 'backup-log' },
+        });
     }
     /**
      * @example id "1753776067468"
@@ -197,6 +237,7 @@ __decorate([
     Example(partialVmBackupJobs),
     Deprecated(),
     Get('jobs/vm'),
+    Security('*', ['acl']),
     Tags('backup-jobs'),
     __param(0, Request()),
     __param(1, Query()),
@@ -225,6 +266,7 @@ __decorate([
     Example(partialMetadataBackupJobs),
     Deprecated(),
     Get('jobs/metadata'),
+    Security('*', ['acl']),
     Tags('backup-jobs'),
     __param(0, Request()),
     __param(1, Query()),
@@ -246,6 +288,7 @@ __decorate([
     Example(partialMirrorBackupJobs),
     Deprecated(),
     Get('jobs/mirror'),
+    Security('*', ['acl']),
     Tags('backup-jobs'),
     __param(0, Request()),
     __param(1, Query()),
@@ -267,6 +310,7 @@ __decorate([
     Example(partialBackupLogs),
     Deprecated(),
     Get('logs'),
+    Security('*', ['acl']),
     Tags('backup-logs'),
     __param(0, Request()),
     __param(1, Query()),

package/dist/backup-jobs/backup-job.service.mjs

@@ -8,6 +8,13 @@ export class BackupJobService {
     constructor(restApi) {
         this.#restApi = restApi;
     }
+    async getBackupJob(id) {
+        const job = await this.#restApi.xoApp.getJob(id);
+        if (!this.isBackupJob(job)) {
+            throw noSuchObject(id, 'backup-job');
+        }
+        return job;
+    }
     isBackupJob(anyJob) {
         return this.#backupJobTypes.includes(anyJob.type);
     }

package/dist/backup-logs/backup-log.controller.mjs

@@ -7,15 +7,15 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
+import { Example, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
 import { inject } from 'inversify';
-import { noSuchObject } from 'xo-common/api-errors.js';
 import { provide } from 'inversify-binding-decorators';
 import { backupLog, backupLogIds, partialBackupLogs } from '../open-api/oa-examples/backup-log.oa-example.mjs';
 import { BackupLogService } from './backup-log.service.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
-import { badRequestResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
+import { badRequestResp, forbiddenOperationResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { XoController } from '../abstract-classes/xo-controller.mjs';
+import { acl, autoBindService } from '../middlewares/acl.middleware.mjs';
 let BackupLogController = class BackupLogController extends XoController {
     #backupLogService;
     constructor(restApi, backupLogService) {
@@ -25,23 +25,28 @@ let BackupLogController = class BackupLogController extends XoController {
     getAllCollectionObjects() {
         return this.restApi.xoApp.getBackupNgLogsSorted({ filter: this.#backupLogService.isBackupLog });
     }
-    async getCollectionObject(id) {
-        const log = await this.restApi.xoApp.getBackupNgLogs(id);
-        if (!this.#backupLogService.isBackupLog(log)) {
-            throw noSuchObject('backup-log');
-        }
-        return log;
+    getCollectionObject(id) {
+        return this.#backupLogService.getBackupLog(id);
     }
     /**
+     * Returns all backup logs that match the following privilege:
+     * - resource: backup-log, action: read
+     *
      * @example fields "jobName,status,data"
      * @example filter "status:success"
      * @example limit 42
      */
     async getBackupLogs(req, fields, ndjson, markdown, filter, limit) {
-        const backupLogs = await this.getObjects({ filter, limit });
-        return this.sendObjects(Object.values(backupLogs), req);
+        const backupLogs = await this.getObjects({ filter });
+        return this.sendObjects(Object.values(backupLogs), req, {
+            limit,
+            privilege: { action: 'read', resource: 'backup-log' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: backup-log, action: read
+     *
      * @example id "1753776067468"
      */
     getBackupLog(id) {
@@ -52,6 +57,7 @@ __decorate([
     Example(backupLogIds),
     Example(partialBackupLogs),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
@@ -62,6 +68,14 @@ __decorate([
 __decorate([
     Example(backupLog),
     Get('{id}'),
+    Middlewares(acl({
+        resource: 'backup-log',
+        action: 'read',
+        objectId: 'params.id',
+        getObject: autoBindService(BackupLogService, 'getBackupLog'),
+    })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], BackupLogController.prototype, "getBackupLog", null);
 BackupLogController = __decorate([

package/dist/backup-logs/backup-log.service.mjs

@@ -1,7 +1,26 @@
+import { noSuchObject } from 'xo-common/api-errors.js';
 export class BackupLogService {
+    #restApi;
+    constructor(restApi) {
+        this.#restApi = restApi;
+    }
     isBackupLog(log) {
         return log.message === 'backup';
     }
+    async getBackupLog(id) {
+        const log = await this.#restApi.xoApp.getBackupNgLogs(id);
+        if (!this.isBackupLog(log)) {
+            throw noSuchObject('backup-log');
+        }
+        return log;
+    }
+    async getRestoreLog(id) {
+        const log = await this.#restApi.xoApp.getBackupNgLogs(id);
+        if (this.isBackupLog(log)) {
+            throw noSuchObject('restore-log');
+        }
+        return log;
+    }
     getVmBackupTaskLog(log, vmId) {
         return log.tasks?.find(task => task.data?.id === vmId);
     }

package/dist/backup-repositories/backup-repositories.controller.mjs

@@ -7,10 +7,11 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
+import { Example, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
-import { badRequestResp, notFoundResp, unauthorizedResp } from '../open-api/common/response.common.mjs';
+import { acl } from '../middlewares/acl.middleware.mjs';
+import { badRequestResp, forbiddenOperationResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { backupRepositoryIds, partialBackupRepositories, backupRepository, } from '../open-api/oa-examples/backup-repository.oa-example.mjs';
 import { XoController } from '../abstract-classes/xo-controller.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
@@ -26,14 +27,23 @@ let BackupRepositoryController = class BackupRepositoryController extends XoCont
         return this.restApi.xoApp.getRemote(id);
     }
     /**
+     * Returns all backup repositories that match the following privilege:
+     * - resource: backup-repository, action: read
+     *
      * @example fields "id,name,enabled"
      * @example filter "enabled?"
      * @example limit 42
      */
     async getRepositories(req, fields, ndjson, markdown, filter, limit) {
-        return this.sendObjects(Object.values(await this.getObjects({ filter, limit })), req);
+        return this.sendObjects(Object.values(await this.getObjects({ filter })), req, {
+            limit,
+            privilege: { action: 'read', resource: 'backup-repository' },
+        });
     }
     /**
+     * Required privilege:
+     * - resource: backup-repository, action: read
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      */
     getRepository(id) {
@@ -44,6 +54,7 @@ __decorate([
     Example(backupRepositoryIds),
     Example(partialBackupRepositories),
     Get(''),
+    Security('*', ['acl']),
     __param(0, Request()),
     __param(1, Query()),
     __param(2, Query()),
@@ -54,6 +65,13 @@ __decorate([
 __decorate([
     Example(backupRepository),
     Get('{id}'),
+    Middlewares(acl({
+        resource: 'backup-repository',
+        action: 'read',
+        objectId: 'params.id',
+        getObject: ({ restApi }) => restApi.xoApp.getRemote,
+    })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], BackupRepositoryController.prototype, "getRepository", null);

package/dist/events/event.class.mjs

@@ -11,6 +11,7 @@ export class Subscriber {
     #connection;
     #isAlive;
     #cleanupCallbacks = new Set();
+    #userId;
     get id() {
         return this.#id;
     }
@@ -20,13 +21,17 @@ export class Subscriber {
     get connection() {
         return this.#connection;
     }
-    constructor(connection, manager) {
+    get userId() {
+        return this.#userId;
+    }
+    constructor(connection, manager, userId) {
         this.#id = crypto.randomUUID();
         connection.on('close', () => this.clear());
         manager.addSubscriber(this);
         this.#connection = connection;
         this.#manager = manager;
         this.#isAlive = true;
+        this.#userId = userId;
     }
     #safeWrite(payload) {
         const ok = this.#connection.write(payload);
@@ -60,24 +65,23 @@ export class Subscriber {
     }
 }
 export class XoListener extends Listener {
-    #type;
     #alarmService;
     constructor(type, eventEmitter, alarmService) {
-        super(eventEmitter, ['add', 'update', 'remove']);
-        this.#type = type;
+        super(eventEmitter, ['add', 'update', 'remove'], type);
         this.#alarmService = alarmService;
     }
-    handleData({ fields, event }, object, previousObj) {
+    async handleData({ fields, event, subscriber }, object, previousObj) {
         let _object = object;
         let _prevObject = previousObj;
-        if (this.#type === 'alarm' || this.#type === 'message') {
+        ///
+        if (this.type === 'alarm' || this.type === 'message') {
             const isAlarm = (object) => object !== undefined && 'type' in object && object.type === 'message' && this.#alarmService.isAlarm(object);
             const objectIsAlarm = isAlarm(object);
             const prevObjectIsAlarm = isAlarm(previousObj);
             // If we are in an alarm listener and the objects are messages
             // we clean them to ensure they are not sent via the SSE
             // Same if we are in a message listener and the objects are alarms
-            if (this.#type === 'alarm') {
+            if (this.type === 'alarm') {
                 _object = objectIsAlarm ? this.#alarmService.parseAlarm(object) : undefined;
                 _prevObject = prevObjectIsAlarm ? this.#alarmService.parseAlarm(previousObj) : undefined;
             }
@@ -89,6 +93,17 @@ export class XoListener extends Listener {
         if (_object === undefined && _prevObject === undefined) {
             return;
         }
+        const aclEvent = await this.getAclEvent({
+            event,
+            object: _object,
+            previousObject: _prevObject,
+            userId: subscriber.userId,
+        });
+        // If the user has no 'read' privileges for the changes, don't send the update
+        if (aclEvent === undefined) {
+            return;
+        }
+        event = aclEvent;
         if (fields !== '*') {
             if (_object !== undefined) {
                 _object = pick(_object, fields);
@@ -102,7 +117,7 @@ export class XoListener extends Listener {
             return;
         }
         // if _object === undefined, this means we are on a remove event, so _prevObject will not be undefined
-        return { $subscription: this.#type, ...(_object ?? _prevObject) };
+        return { $subscription: this.type, event, ...(_object ?? _prevObject) };
     }
 }
 export class PingListener extends Listener {
@@ -113,7 +128,7 @@ export class PingListener extends Listener {
             this.eventEmitter.emit('ping');
         }, 1000 * 30);
     }
-    handleData() {
+    async handleData() {
         return { ping: Date.now() };
     }
     clear() {

package/dist/events/event.controller.mjs

@@ -70,12 +70,14 @@ let EventController = class EventController extends Controller {
 };
 __decorate([
     Get(''),
+    Security('*', ['acl']),
     SuccessResponse(200, 'OK'),
     __param(0, Request())
 ], EventController.prototype, "openSseConnection", null);
 __decorate([
     Example(addSubscription),
     Post('{id}/subscriptions'),
+    Security('*', ['acl']),
     Middlewares(json()),
     SuccessResponse(createdResp.status, createdResp.description),
     Response(notFoundResp.status, notFoundResp.description),
@@ -84,6 +86,7 @@ __decorate([
 ], EventController.prototype, "addSubscription", null);
 __decorate([
     Delete('{id}/subscriptions/{subscriptionId}'),
+    Security('*', ['acl']),
     SuccessResponse(noContentResp.status, noContentResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path()),

package/dist/events/event.service.mjs

@@ -58,7 +58,8 @@ export class EventService {
                 log.error(error);
             }
         });
-        const subscriber = new Subscriber(connection, this.#subscriberManager);
+        const user = this.#restApi.getCurrentUser();
+        const subscriber = new Subscriber(connection, this.#subscriberManager, user.id);
         subscriber.broadcast('init', { id: subscriber.id });
         this.addListenerFor(subscriber.id, { type: 'ping' });
         log.debug(`new SSE subscriber added: ${subscriber.id}`);