@xen-orchestra/rest-api 0.32.0 → 0.33.0

package/dist/vms/vm.controller.mjs

@@ -7,13 +7,14 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Body, Delete, Example, Extension, Get, Middlewares, Path, Post, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
+import { Body, Delete, Example, Extension, Get, Middlewares, Patch, Path, Post, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
 import { json } from 'express';
 import { inject } from 'inversify';
 import { incorrectState, invalidParameters } from 'xo-common/api-errors.js';
 import { provide } from 'inversify-binding-decorators';
 import { PassThrough } from 'node:stream';
-import { acl } from '../middlewares/acl.middleware.mjs';
+import { SUPPORTED_ACTIONS_BY_RESOURCE } from '@xen-orchestra/acl';
+import { acl, actionsFromBody } from '../middlewares/acl.middleware.mjs';
 import { asynchronousActionResp, badRequestResp, createdResp, forbiddenOperationResp, incorrectStateResp, internalServerErrorResp, invalidParameters as invalidParametersResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { BASE_URL } from '../index.mjs';
 import { limitAndFilterArray, NDJSON_CONTENT_TYPE } from '../helpers/utils.helper.mjs';
@@ -28,6 +29,11 @@ import { partialVmBackupJobs, vmBackupJobIds } from '../open-api/oa-examples/bac
 import { messageIds, partialMessages } from '../open-api/oa-examples/message.oa-example.mjs';
 import { Task } from '@vates/task';
 const IGNORED_VDIS_TAG = '[NOSNAP]';
+// `datasources` is managed through the dedicated `/vms/{id}/stats/data_source`
+// endpoints, not as a direct VM property, so it cannot be updated via PATCH /vms.
+const UPDATE_VM_ACTIONS = Object.keys(SUPPORTED_ACTIONS_BY_RESOURCE.vm.update)
+    .filter(action => action !== 'datasources')
+    .map(k => `update:${k}`);
 let VmController = class VmController extends XapiXoController {
     #vmService;
     #backupJobService;
@@ -74,6 +80,29 @@ let VmController = class VmController extends XapiXoController {
     getVm(id) {
         return this.getObject(id);
     }
+    /**
+     * Partial update of a VM. Only the fields present in the body are modified;
+     * everything else is left untouched.
+     *
+     * Operations are applied sequentially: if one fails, previously applied
+     * changes are not rolled back.
+     *
+     * Required privilege per field provided in the body:
+     * - resource: vm, action: update:<field> (e.g. update:nameLabel, update:cpus, ...)
+     *
+     * Special fields:
+     * - `xenStoreData` keys are automatically prefixed with `vm-data/` when missing
+     *
+     * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
+     * @example body {
+     *    "nameLabel": "web-prod-01",
+     *    "nameDescription": "Production web frontend — managed by n8n",
+     *    "notes": "Docker containers: nginx, app-1, app-2"
+     * }
+     */
+    async updateVm(id, body) {
+        await this.#vmService.updateVm(id, body);
+    }
     /**
      * Required privilege:
      * - resource: vm, action: delete
@@ -663,6 +692,24 @@ __decorate([
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], VmController.prototype, "getVm", null);
+__decorate([
+    Patch('{id}'),
+    Middlewares([
+        json(),
+        acl({
+            resource: 'vm',
+            actions: actionsFromBody(UPDATE_VM_ACTIONS),
+            objectId: 'params.id',
+        }),
+    ]),
+    SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
+    Response(invalidParametersResp.status, invalidParametersResp.description),
+    Response(internalServerErrorResp.status, internalServerErrorResp.description),
+    __param(0, Path()),
+    __param(1, Body())
+], VmController.prototype, "updateVm", null);
 __decorate([
     Extension('x-mcp-exposure', 'confirm'),
     Delete('{id}'),

package/dist/vms/vm.service.mjs

@@ -146,6 +146,23 @@ export class VmService {
         });
         return alarms;
     }
+    async updateVm(id, body) {
+        const { resourceSet, share, ...editProps } = body;
+        // Touch the object so 404 is raised before any side effect.
+        void this.#restApi.getObject(id, 'VM');
+        const xoApp = this.#restApi.xoApp;
+        if (resourceSet !== undefined) {
+            await xoApp.setVmResourceSet(id, resourceSet, true);
+        }
+        else if (share) {
+            // `share: false` is a no-op.
+            await xoApp.shareVmResourceSet(id);
+        }
+        if (Object.keys(editProps).length === 0) {
+            return;
+        }
+        await xoApp.getXapi(id).editVm(id, editProps);
+    }
     #getDashboardQuickInfo(id) {
         const { power_state, uuid, name_description, CPUs, mainIpAddress, os_version, memory, creation, $pool, virtualizationMode, tags, $container, startTime, pvDriversDetected, pvDriversVersion, pvDriversUpToDate, } = this.#restApi.getObject(id, 'VM');
         return {