@xen-orchestra/rest-api 0.32.0 → 0.34.0

package/dist/pbds/pbd.controller.mjs

@@ -44,6 +44,9 @@ let PbdController = class PbdController extends XapiXoController {
         return this.getObject(id);
     }
     /**
+     * Required privilege:
+     * - resource: pbd, action: plug
+     *
      * @example id "b61a5c92-700e-4966-a13b-00633f03eea8"
      */
     async plugPbd(id, sync) {
@@ -62,6 +65,9 @@ let PbdController = class PbdController extends XapiXoController {
         });
     }
     /**
+     * Required privilege:
+     * - resource: pbd, action: unplug
+     *
      * @example id "b61a5c92-700e-4966-a13b-00633f03eea8"
      */
     async unplugPbd(id, sync) {
@@ -106,8 +112,10 @@ __decorate([
     Example(taskLocation),
     Extension('x-mcp-exposure', 'confirm'),
     Post('{id}/actions/plug'),
+    Middlewares(acl({ resource: 'pbd', action: 'plug', objectId: 'params.id' })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
     Response(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(invalidParametersResp.status, invalidParametersResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
@@ -118,8 +126,10 @@ __decorate([
     Example(taskLocation),
     Extension('x-mcp-exposure', 'confirm'),
     Post('{id}/actions/unplug'),
+    Middlewares(acl({ resource: 'pbd', action: 'unplug', objectId: 'params.id' })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
     Response(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(invalidParametersResp.status, invalidParametersResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),

package/dist/pools/pool.controller.mjs

@@ -423,6 +423,33 @@ let PoolController = class PoolController extends XapiXoController {
             },
         });
     }
+    /**
+     * Required privileges:
+     * - resource: pool, action: add-host
+     * - resource: host, action: join-pool
+     *
+     * Add a host to the pool.
+     *
+     * @example id "355ee47d-ff4c-4924-3db2-fd86ae629676"
+     * @example body { "host": "c787b75c-3e0d-70fa-d0c3-cbfd382d7e33", "force": "false" }
+     */
+    addHost(id, body, sync) {
+        const poolId = id;
+        const action = async () => {
+            const { _auth: { user, password }, _url: { hostnameRaw }, } = this.restApi.xoApp.getXapi(poolId);
+            const hostXapi = this.restApi.xoApp.getXapi(body.host);
+            await hostXapi.joinPool(hostnameRaw, user, password, body.force);
+        };
+        return this.createAction(action, {
+            sync,
+            statusCode: noContentResp.status,
+            taskProperties: {
+                name: 'add host',
+                objectId: poolId,
+                params: body,
+            },
+        });
+    }
 };
 __decorate([
     Example(poolIds),
@@ -729,6 +756,27 @@ __decorate([
     __param(1, Body()),
     __param(2, Query())
 ], PoolController.prototype, "managementReconfigure", null);
+__decorate([
+    Example(taskLocation),
+    Post('{id}/actions/add_host'),
+    Middlewares([
+        json(),
+        acl([
+            { resource: 'pool', action: 'add-host', objectId: 'params.id' },
+            { resource: 'host', action: 'join-pool', objectId: 'body.host' },
+        ]),
+    ]),
+    SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
+    Response(noContentResp.status, noContentResp.description),
+    Response(badRequestResp.status, badRequestResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
+    Response(invalidParametersResp.status, invalidParametersResp.description),
+    Response(internalServerErrorResp.status, internalServerErrorResp.description),
+    __param(0, Path()),
+    __param(1, Body()),
+    __param(2, Query())
+], PoolController.prototype, "addHost", null);
 PoolController = __decorate([
     Route('pools'),
     Security('*'),

package/dist/srs/sr.controller.mjs

@@ -158,6 +158,9 @@ let SrController = class SrController extends XapiXoController {
         await sr.$call('remove_tags', tag);
     }
     /**
+     * Required privilege:
+     * - resource: sr, action: reclaim-space
+     *
      * @example id "b61a5c92-700e-4966-a13b-00633f03eea8"
      */
     async reclaimSpaceSr(id, sync) {
@@ -176,6 +179,9 @@ let SrController = class SrController extends XapiXoController {
         });
     }
     /**
+     * Required privilege:
+     * - resource: sr, action: scan
+     *
      * @example id "b61a5c92-700e-4966-a13b-00633f03eea8"
      */
     async scanSr(id, sync) {
@@ -194,6 +200,9 @@ let SrController = class SrController extends XapiXoController {
         });
     }
     /**
+     * Required privilege:
+     * - resource: sr, action: forget
+     *
      * @example id "c4284e12-37c9-7967-b9e8-83ef229c3e03"
      */
     async forgetSr(id, sync) {
@@ -329,8 +338,10 @@ __decorate([
     Example(taskLocation),
     Extension('x-mcp-exposure', 'confirm'),
     Post('{id}/actions/reclaim_space'),
+    Middlewares(acl({ resource: 'sr', action: 'reclaim-space', objectId: 'params.id' })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
     Response(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(invalidParametersResp.status, invalidParametersResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
@@ -341,8 +352,10 @@ __decorate([
     Example(taskLocation),
     Extension('x-mcp-exposure', 'confirm'),
     Post('{id}/actions/scan'),
+    Middlewares(acl({ resource: 'sr', action: 'scan', objectId: 'params.id' })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
     Response(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(invalidParametersResp.status, invalidParametersResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
@@ -353,8 +366,10 @@ __decorate([
     Example(taskLocation),
     Extension('x-mcp-exposure', 'confirm'),
     Post('{id}/actions/forget'),
+    Middlewares(acl({ resource: 'sr', action: 'forget', objectId: 'params.id' })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
     Response(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(invalidParametersResp.status, invalidParametersResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),

package/dist/vbds/vbd.controller.mjs

@@ -53,6 +53,9 @@ let VbdController = class VbdController extends XapiXoController {
         return this.getObject(id);
     }
     /**
+     * Required privilege:
+     * - resource: vbd, action: create
+     *
      * Create a VBD to attach a VDI to a VM
      *
      * @example body { "VM": "4fe90510-8da4-1530-38e2-a7876ef374c7", "VDI": "656052a2-2e3e-467b-88ba-63a9ea5e4a54", "bootable": false, "mode": "RW" }
@@ -76,6 +79,9 @@ let VbdController = class VbdController extends XapiXoController {
         return { id: vbdUuid };
     }
     /**
+     * Required privilege:
+     * - resource: vbd, action: delete
+     *
      * Delete a VBD
      *
      * Removes the virtual block device, detaching the VDI from the VM.
@@ -142,6 +148,9 @@ let VbdController = class VbdController extends XapiXoController {
         });
     }
     /**
+     * Required privilege:
+     * - resource: vbd, action: connect
+     *
      * Hotplug the VBD, dynamically attaching it to the running VM
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
@@ -161,6 +170,9 @@ let VbdController = class VbdController extends XapiXoController {
         });
     }
     /**
+     * Required privilege:
+     * - resource: vbd, action: disconnect
+     *
      * Hot-unplug the VBD, dynamically detaching it from the running VM
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
@@ -206,8 +218,9 @@ __decorate([
     Example(vbdId),
     Extension('x-mcp-exposure', 'confirm'),
     Post(''),
-    Middlewares(json()),
+    Middlewares([json(), acl({ resource: 'vbd', action: 'create', object: ({ req }) => req.body })]),
     SuccessResponse(createdResp.status, createdResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(invalidParameters.status, invalidParameters.description),
     __param(0, Body())
@@ -215,7 +228,9 @@ __decorate([
 __decorate([
     Extension('x-mcp-exposure', 'confirm'),
     Delete('{id}'),
+    Middlewares(acl({ resource: 'vbd', action: 'delete', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], VbdController.prototype, "deleteVbd", null);
@@ -270,8 +285,10 @@ __decorate([
     Example(taskLocation),
     Extension('x-mcp-exposure', 'confirm'),
     Post('{id}/actions/connect'),
+    Middlewares(acl({ resource: 'vbd', action: 'connect', objectId: 'params.id' })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
     Response(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
     __param(0, Path()),
@@ -281,8 +298,10 @@ __decorate([
     Example(taskLocation),
     Extension('x-mcp-exposure', 'confirm'),
     Post('{id}/actions/disconnect'),
+    Middlewares(acl({ resource: 'vbd', action: 'disconnect', objectId: 'params.id' })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
     Response(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
     __param(0, Path()),

package/dist/vdi-snapshots/vdi-snapshot.controller.mjs

@@ -7,11 +7,12 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Delete, Example, Extension, Get, Path, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
+import { Delete, Example, Extension, Get, Middlewares, Path, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
+import { acl } from '../middlewares/acl.middleware.mjs';
 import { escapeUnsafeComplexMatcher } from '../helpers/utils.helper.mjs';
-import { badRequestResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
+import { badRequestResp, forbiddenOperationResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { RestApi } from '../rest-api/rest-api.mjs';
 import { partialVdiSnapshots, vdiSnapshot, vdiSnapshotIds } from '../open-api/oa-examples/vdi-snapshot.oa-example.mjs';
 import { XapiXoController } from '../abstract-classes/xapi-xo-controller.mjs';
@@ -43,6 +44,8 @@ let VdiSnapshotController = class VdiSnapshotController extends XapiXoController
         });
     }
     /**
+     * Required privilege:
+     * - resource: vdi-snapshot, action: export
      *
      * Export VDI-snapshot content
      *
@@ -59,6 +62,9 @@ let VdiSnapshotController = class VdiSnapshotController extends XapiXoController
         return stream;
     }
     /**
+     * Required privilege:
+     * - resource: vdi-snapshot, action: read
+     *
      * @example id "d2727772-735b-478f-b6f9-11e7db56dfd0"
      */
     getVdiSnapshot(id) {
@@ -85,6 +91,9 @@ let VdiSnapshotController = class VdiSnapshotController extends XapiXoController
         });
     }
     /**
+     * Required privilege:
+     * - resource: vdi-snapshot, action: delete
+     *
      * @example id "d2727772-735b-478f-b6f9-11e7db56dfd0"
      */
     async deleteVdiSnapshot(id) {
@@ -126,6 +135,9 @@ let VdiSnapshotController = class VdiSnapshotController extends XapiXoController
         });
     }
     /**
+     * Required privilege:
+     * - resource: vdi-snapshot, action: update:tags
+     *
      * @example id "d2727772-735b-478f-b6f9-11e7db56dfd0"
      * @example tag "from-rest-api"
      */
@@ -134,6 +146,9 @@ let VdiSnapshotController = class VdiSnapshotController extends XapiXoController
         await vdiSnapshot.$call('add_tags', tag);
     }
     /**
+     * Required privilege:
+     * - resource: vdi-snapshot, action: update:tags
+     *
      * @example id "d2727772-735b-478f-b6f9-11e7db56dfd0"
      * @example tag "from-rest-api"
      */
@@ -158,7 +173,9 @@ __decorate([
 __decorate([
     Extension('x-mcp-exposure', 'deny'),
     Get('{id}.{format}'),
+    Middlewares(acl({ resource: 'vdi-snapshot', action: 'export', objectId: 'params.id' })),
     SuccessResponse(200, 'Download started', 'application/octet-stream'),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(422, 'Invalid format'),
     __param(0, Request()),
@@ -169,6 +186,8 @@ __decorate([
     Example(vdiSnapshot),
     Extension('x-mcp-exposure', 'allow'),
     Get('{id}'),
+    Middlewares(acl({ resource: 'vdi-snapshot', action: 'read', objectId: 'params.id' })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], VdiSnapshotController.prototype, "getVdiSnapshot", null);
@@ -190,7 +209,9 @@ __decorate([
 __decorate([
     Extension('x-mcp-exposure', 'confirm'),
     Delete('{id}'),
+    Middlewares(acl({ resource: 'vdi-snapshot', action: 'delete', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], VdiSnapshotController.prototype, "deleteVdiSnapshot", null);
@@ -229,7 +250,9 @@ __decorate([
 __decorate([
     Extension('x-mcp-exposure', 'confirm'),
     Put('{id}/tags/{tag}'),
+    Middlewares(acl({ resource: 'vdi-snapshot', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path()),
     __param(1, Path())
@@ -237,7 +260,9 @@ __decorate([
 __decorate([
     Extension('x-mcp-exposure', 'confirm'),
     Delete('{id}/tags/{tag}'),
+    Middlewares(acl({ resource: 'vdi-snapshot', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path()),
     __param(1, Path())

package/dist/vdis/vdi.controller.mjs

@@ -110,6 +110,10 @@ let VdiController = class VdiController extends XapiXoController {
     /**
      * Create an empty VDI.
      *
+     * Required privileges:
+     * - resource: sr, action: import:vdi (on the target SR)
+     * - resource: vdi, action: create
+     *
      * @example body { "srId": "c4284e12-37c9-7967-b9e8-83ef229c3e03", "virtual_size": 10737418240, "name_label": "test VDI" }
      */
     async createVdi(body) {
@@ -173,6 +177,10 @@ let VdiController = class VdiController extends XapiXoController {
     /**
      * Migrate a VDI to another SR.
      *
+     * Required privileges:
+     * - resource: vdi, action: migrate-send
+     * - resource: sr, action: migrate-receive (on the target SR)
+     *
      * Note: After migration, the VDI will have a new ID. The new ID is returned in the response.
      *
      * @example id "c77f9955-c1d2-4b39-aa1c-73cdb2dacb7e"
@@ -280,8 +288,15 @@ __decorate([
     Example(vdiId),
     Extension('x-mcp-exposure', 'confirm'),
     Post(''),
-    Middlewares(json()),
+    Middlewares([
+        json(),
+        acl([
+            { resource: 'sr', action: 'import:vdi', objectId: 'body.srId' },
+            { resource: 'vdi', action: 'create', object: ({ req }) => req.body },
+        ]),
+    ]),
     SuccessResponse(createdResp.status, createdResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
     __param(0, Body())
@@ -332,8 +347,17 @@ __decorate([
     Example(vdiId),
     Extension('x-mcp-exposure', 'confirm'),
     Post('{id}/actions/migrate'),
-    Middlewares(json()),
+    Middlewares([
+        json(),
+        // Two separate checks allow independent control: a user can be allowed to migrate a VDI away
+        // without being allowed to place VDIs on any specific SR, and vice versa.
+        acl([
+            { resource: 'vdi', action: 'migrate-send', objectId: 'params.id' },
+            { resource: 'sr', action: 'migrate-receive', objectId: 'body.srId' },
+        ]),
+    ]),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(200, 'Ok'),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),

package/dist/vifs/vif.controller.mjs

@@ -7,10 +7,11 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Body, Delete, Example, Extension, Get, Middlewares, Path, Post, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
+import { Body, Delete, Example, Extension, Get, Middlewares, Patch, Path, Post, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
 import { inject } from 'inversify';
 import { json } from 'express';
-import { acl } from '../middlewares/acl.middleware.mjs';
+import { SUPPORTED_ACTIONS_BY_RESOURCE } from '@xen-orchestra/acl';
+import { acl, actionsFromBody } from '../middlewares/acl.middleware.mjs';
 import { escapeUnsafeComplexMatcher } from '../helpers/utils.helper.mjs';
 import { provide } from 'inversify-binding-decorators';
 import { RestApi } from '../rest-api/rest-api.mjs';
@@ -22,6 +23,7 @@ import { genericAlarmsExample } from '../open-api/oa-examples/alarm.oa-example.m
 import { AlarmService } from '../alarms/alarm.service.mjs';
 import { messageIds, partialMessages } from '../open-api/oa-examples/message.oa-example.mjs';
 import { taskIds, partialTasks, taskLocation } from '../open-api/oa-examples/task.oa-example.mjs';
+const UPDATE_VIF_ACTIONS = Object.keys(SUPPORTED_ACTIONS_BY_RESOURCE.vif.update).map(k => `update:${k}`);
 let VifController = class VifController extends XapiXoController {
     #alarmService;
     constructor(restApi, alarmService) {
@@ -51,6 +53,39 @@ let VifController = class VifController extends XapiXoController {
     getVif(id) {
         return this.getObject(id);
     }
+    /**
+     * Partial update of a VIF: only the fields present in the body are modified.
+     * Setting the allowed IPs to a non-empty list switches the locking mode to `locked`.
+     * `rateLimit` is expressed in kB/s (kilobytes per second).
+     *
+     * Required privilege per field provided in the body:
+     * - resource: vif, action: update:<field>
+     *
+     * @example id "f028c5d4-578a-332c-394e-087aaca32dd3"
+     * @example body { "lockingMode": "locked", "allowedIpv4Addresses": ["192.168.0.42"], "rateLimit": 1000 }
+     */
+    async updateVif(id, body) {
+        const vifId = id;
+        const { allowedIpv4Addresses, allowedIpv6Addresses, lockingMode, rateLimit, txChecksumming } = body;
+        // resolve first so a missing VIF 404s before any side effect
+        const vif = this.getObject(vifId);
+        if (Object.keys(body).length === 0) {
+            return;
+        }
+        // keep XO's IP-pool accounting in sync when the allowed IPs change
+        if (allowedIpv4Addresses !== undefined || allowedIpv6Addresses !== undefined) {
+            const oldIpAddresses = vif.allowedIpv4Addresses.concat(vif.allowedIpv6Addresses);
+            const newIpAddresses = (allowedIpv4Addresses ?? vif.allowedIpv4Addresses).concat(allowedIpv6Addresses ?? vif.allowedIpv6Addresses);
+            await this.restApi.xoApp.allocIpAddresses(vifId, newIpAddresses.filter(address => !oldIpAddresses.includes(address)), oldIpAddresses.filter(address => !newIpAddresses.includes(address)));
+        }
+        await this.getXapi(vifId).editVif(vifId, {
+            ipv4Allowed: allowedIpv4Addresses,
+            ipv6Allowed: allowedIpv6Addresses,
+            lockingMode,
+            rateLimit,
+            txChecksumming,
+        });
+    }
     /**
      * Returns all alarms that match the following privilege:
      * - resource: alarm, action: read
@@ -106,12 +141,15 @@ let VifController = class VifController extends XapiXoController {
         });
     }
     /**
+     * Required privilege:
+     * - resource: vif, action: create
+     *
      * @example body {
      *  "networkId": "6b6ca0f5-6611-0636-4b0a-1fb1c1e96414",
      *  "vmId": "613f541c-4bed-fc77-7ca8-2db6b68f079c",
-     *   "other_config": {
-     *"ethtool-tx": "false"
-     *    },
+     *  "other_config": {
+     *    "ethtool-tx": "false"
+     *   },
      *  "qos_algorithm_params": {
      *    "kbps": "42"
      *  },
@@ -137,6 +175,9 @@ let VifController = class VifController extends XapiXoController {
         return { id: xapiVif.uuid };
     }
     /**
+     * Required privilege:
+     * - resource: vif, action: delete
+     *
      * @example id "6b6ca0f5-6611-0636-4b0a-1fb1c1e96414"
      */
     async destroyVif(id) {
@@ -147,6 +188,9 @@ let VifController = class VifController extends XapiXoController {
      * Hotplug the VIF, dynamically attaching it to the running VM
      * Requires PV drivers to be installed on the VM
      *
+     * Required privilege:
+     * - resource: vif, action: connect
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     async connectVif(id, sync) {
@@ -168,6 +212,9 @@ let VifController = class VifController extends XapiXoController {
      * Hot-unplug the VIF, dynamically detaching it from the running VM
      * Requires PV drivers to be installed on the VM
      *
+     * Required privilege:
+     * - resource: vif, action: disconnect
+     *
      * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
      */
     async disconnectVif(id, sync) {
@@ -208,6 +255,25 @@ __decorate([
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], VifController.prototype, "getVif", null);
+__decorate([
+    Extension('x-mcp-exposure', 'confirm'),
+    Patch('{id}'),
+    Middlewares([
+        json(),
+        acl({
+            resource: 'vif',
+            actions: actionsFromBody(UPDATE_VIF_ACTIONS),
+            objectId: 'params.id',
+        }),
+    ]),
+    SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
+    Response(invalidParametersResp.status, invalidParametersResp.description),
+    Response(internalServerErrorResp.status, internalServerErrorResp.description),
+    __param(0, Path()),
+    __param(1, Body())
+], VifController.prototype, "updateVif", null);
 __decorate([
     Example(genericAlarmsExample),
     Extension('x-mcp-exposure', 'allow'),
@@ -259,9 +325,10 @@ __decorate([
     Example(vifId),
     Extension('x-mcp-exposure', 'confirm'),
     Post(''),
-    Middlewares(json()),
+    Middlewares([json(), acl({ resource: 'vif', action: 'create', object: ({ req }) => req.body })]),
     SuccessResponse(createdResp.status, createdResp.description),
     Response(notFoundResp.status, notFoundResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
     Response(invalidParametersResp.status, invalidParametersResp.description),
     __param(0, Body())
@@ -270,6 +337,8 @@ __decorate([
     Extension('x-mcp-exposure', 'confirm'),
     Delete('{id}'),
     SuccessResponse(noContentResp.status, noContentResp.description),
+    Middlewares(acl({ resource: 'vif', action: 'delete', objectId: 'params.id' })),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
     __param(0, Path())
@@ -277,9 +346,11 @@ __decorate([
 __decorate([
     Example(taskLocation),
     Extension('x-mcp-exposure', 'confirm'),
+    Middlewares(acl({ resource: 'vif', action: 'connect', objectId: 'params.id' })),
     Post('{id}/actions/connect'),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
     Response(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
     __param(0, Path()),
@@ -289,8 +360,10 @@ __decorate([
     Example(taskLocation),
     Extension('x-mcp-exposure', 'confirm'),
     Post('{id}/actions/disconnect'),
+    Middlewares(acl({ resource: 'vif', action: 'disconnect', objectId: 'params.id' })),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
     Response(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
     __param(0, Path()),

package/dist/vm-snapshots/vm-snapshot.controller.mjs

@@ -21,6 +21,7 @@ import { provide } from 'inversify-binding-decorators';
 import { partialVmSnapshots, vmSnapshot, vmSnapshotIds, vmSnapshotVdis, } from '../open-api/oa-examples/vm-snapshot.oa-example.mjs';
 import { VmService } from '../vms/vm.service.mjs';
 import { messageIds, partialMessages } from '../open-api/oa-examples/message.oa-example.mjs';
+import { vmExportCompressDeprecated } from '../middlewares/deprecated.middleware.mjs';
 let VmSnapshotController = class VmSnapshotController extends XapiXoController {
     #alarmService;
     #vmService;
@@ -191,7 +192,7 @@ __decorate([
 __decorate([
     Extension('x-mcp-exposure', 'deny'),
     Get('{id}.{format}'),
-    Middlewares(acl({ resource: 'vm-snapshot', action: 'export', objectId: 'params.id' })),
+    Middlewares([acl({ resource: 'vm-snapshot', action: 'export', objectId: 'params.id' }), vmExportCompressDeprecated]),
     SuccessResponse(200, 'Download started', 'application/octet-stream'),
     Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),

package/dist/vm-templates/vm-template.controller.mjs

@@ -21,6 +21,7 @@ import { partialVmTemplates, vmTemplate, vmTemplateIds, vmTemplateVdis, } from '
 import { VmService } from '../vms/vm.service.mjs';
 import { messageIds, partialMessages } from '../open-api/oa-examples/message.oa-example.mjs';
 import { partialTasks, taskIds } from '../open-api/oa-examples/task.oa-example.mjs';
+import { vmExportCompressDeprecated } from '../middlewares/deprecated.middleware.mjs';
 let VmTemplateController = class VmTemplateController extends XapiXoController {
     #alarmService;
     #vmService;
@@ -191,7 +192,7 @@ __decorate([
 __decorate([
     Extension('x-mcp-exposure', 'deny'),
     Get('{id}.{format}'),
-    Middlewares(acl({ resource: 'vm-template', action: 'export', objectId: 'params.id' })),
+    Middlewares([acl({ resource: 'vm-template', action: 'export', objectId: 'params.id' }), vmExportCompressDeprecated]),
     SuccessResponse(200, 'Download started', 'application/octet-stream'),
     Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),