@xen-orchestra/rest-api 0.30.0 → 0.30.1

package/README.md

@@ -102,8 +102,6 @@ It is sometimes necessary to check ACLs based on the body of the request sent by
 
 ##### Example: Resource creation
 
-When creating a resource (which doesn't exist yet), pass the object being created as the target:
-
 ```ts
 /**
   * Create a new VDI
@@ -112,10 +110,7 @@ When creating a resource (which doesn't exist yet), pass the object being create
   * - resource: vdi, action: create
   */
  @Post('/')
- @Middlewares(acl({resource: 'vdi', action: 'create', object: ({req}) => {
-  const {srId,...rest} = req.body
-  return {$SR: srId, ...rest}
- }}))
+ @Middlewares(acl({resource: 'vdi', action: 'create', object: ({req}) => req.body }))
  @Response(403)
  createVdi(@Body() body: VdiConfig) {
    const {srId, ...rest}
@@ -127,8 +122,6 @@ When creating a resource (which doesn't exist yet), pass the object being create
 
 ##### Example: Resource update
 
-When creating a resource (which doesn't exist yet), pass the object being created as the target:
-
 ```ts
 /**
  * Update a VM

package/dist/abstract-classes/base-controller.mjs

@@ -22,7 +22,9 @@ export class BaseController extends Controller {
         const mapper = makeObjectMapper(req, opts?.path);
         const mappedObjects = [];
         const user = this.restApi.getCurrentUser();
-        const userPrivileges = (opts?.privilege !== undefined ? await this.restApi.xoApp.getAclV2UserPrivileges(user.id) : []);
+        const userPrivileges = (opts?.privilege !== undefined && user.permission !== 'admin'
+            ? await this.restApi.xoApp.getAclV2UserPrivileges(user.id)
+            : []);
         let limit = opts?.limit ?? Infinity;
         for (const object of objects) {
             if (limit === 0) {

package/dist/middlewares/acl.middleware.mjs

@@ -180,6 +180,10 @@ export function acl(acls) {
         if (Object.keys(invalidFields).length > 0) {
             return next(new ValidateError(invalidFields, 'invalid parameters'));
         }
+        if (user.permission === 'admin') {
+            // Administrator users do not need to go further
+            return next();
+        }
         let userPrivileges;
         try {
             userPrivileges = (await restApi.xoApp.getAclV2UserPrivileges(user.id));

package/dist/tasks/task.controller.mjs

@@ -70,7 +70,9 @@ let TaskController = class TaskController extends XoController {
             const userId = this.restApi.getCurrentUser().id;
             const update = async (task) => {
                 const user = await this.restApi.xoApp.getUser(userId);
-                const userPrivileges = (await this.restApi.xoApp.getAclV2UserPrivileges(user.id));
+                const userPrivileges = user.permission === 'admin'
+                    ? []
+                    : (await this.restApi.xoApp.getAclV2UserPrivileges(user.id));
                 if (hasPrivilegeOn({ user, userPrivileges, action: 'read', resource: 'task', objects: task }) &&
                     (userFilter === undefined || userFilter(task))) {
                     stream.write(['update', task]);
@@ -78,7 +80,9 @@ let TaskController = class TaskController extends XoController {
             };
             const remove = async (task) => {
                 const user = await this.restApi.xoApp.getUser(userId);
-                const userPrivileges = (await this.restApi.xoApp.getAclV2UserPrivileges(user.id));
+                const userPrivileges = user.permission === 'admin'
+                    ? []
+                    : (await this.restApi.xoApp.getAclV2UserPrivileges(user.id));
                 if (hasPrivilegeOn({ user, userPrivileges, action: 'read', resource: 'task', objects: task }) &&
                     (userFilter === undefined || userFilter(task))) {
                     stream.write(['remove', { id: task.id }]);
@@ -120,7 +124,7 @@ let TaskController = class TaskController extends XoController {
      */
     async deleteTasks() {
         const user = this.restApi.getCurrentUser();
-        const userPrivileges = (await this.restApi.xoApp.getAclV2UserPrivileges(user.id));
+        const userPrivileges = user.permission === 'admin' ? [] : (await this.restApi.xoApp.getAclV2UserPrivileges(user.id));
         const deletePromises = [];
         for await (const task of this.restApi.tasks.list()) {
             if (hasPrivilegeOn({ user, userPrivileges, resource: 'task', action: 'delete', objects: task })) {

package/open-api/spec/swagger.json

@@ -18395,7 +18395,7 @@
 	},
 	"info": {
 		"title": "@xen-orchestra/rest-api",
-		"version": "0.30.0",
+		"version": "0.30.1",
 		"description": "REST API to manage your XOA",
 		"license": {
 			"name": "AGPL-3.0-or-later"

package/package.json

@@ -6,7 +6,7 @@
   "main": "./dist/index.mjs",
   "name": "@xen-orchestra/rest-api",
   "homepage": "https://github.com/vatesfr/xen-orchestra/tree/master/@xen-orchestra/rest-api",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "description": "REST API to manage your XOA",
   "license": "AGPL-3.0-or-later",
   "private": false,