@xen-orchestra/rest-api 0.32.0 → 0.34.0

package/dist/vms/vm.controller.mjs

@@ -7,13 +7,14 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Body, Delete, Example, Extension, Get, Middlewares, Path, Post, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
+import { Body, Delete, Example, Extension, Get, Middlewares, Patch, Path, Post, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
 import { json } from 'express';
 import { inject } from 'inversify';
 import { incorrectState, invalidParameters } from 'xo-common/api-errors.js';
 import { provide } from 'inversify-binding-decorators';
 import { PassThrough } from 'node:stream';
-import { acl } from '../middlewares/acl.middleware.mjs';
+import { SUPPORTED_ACTIONS_BY_RESOURCE } from '@xen-orchestra/acl';
+import { acl, actionsFromBody } from '../middlewares/acl.middleware.mjs';
 import { asynchronousActionResp, badRequestResp, createdResp, forbiddenOperationResp, incorrectStateResp, internalServerErrorResp, invalidParameters as invalidParametersResp, noContentResp, notFoundResp, unauthorizedResp, } from '../open-api/common/response.common.mjs';
 import { BASE_URL } from '../index.mjs';
 import { limitAndFilterArray, NDJSON_CONTENT_TYPE } from '../helpers/utils.helper.mjs';
@@ -27,7 +28,13 @@ import { BackupJobService } from '../backup-jobs/backup-job.service.mjs';
 import { partialVmBackupJobs, vmBackupJobIds } from '../open-api/oa-examples/backup-job.oa-example.mjs';
 import { messageIds, partialMessages } from '../open-api/oa-examples/message.oa-example.mjs';
 import { Task } from '@vates/task';
+import { vmExportCompressDeprecated } from '../middlewares/deprecated.middleware.mjs';
 const IGNORED_VDIS_TAG = '[NOSNAP]';
+// `datasources` is managed through the dedicated `/vms/{id}/stats/data_source`
+// endpoints, not as a direct VM property, so it cannot be updated via PATCH /vms.
+const UPDATE_VM_ACTIONS = Object.keys(SUPPORTED_ACTIONS_BY_RESOURCE.vm.update)
+    .filter(action => action !== 'datasources')
+    .map(k => `update:${k}`);
 let VmController = class VmController extends XapiXoController {
     #vmService;
     #backupJobService;
@@ -74,6 +81,29 @@ let VmController = class VmController extends XapiXoController {
     getVm(id) {
         return this.getObject(id);
     }
+    /**
+     * Partial update of a VM. Only the fields present in the body are modified;
+     * everything else is left untouched.
+     *
+     * Operations are applied sequentially: if one fails, previously applied
+     * changes are not rolled back.
+     *
+     * Required privilege per field provided in the body:
+     * - resource: vm, action: update:<field> (e.g. update:nameLabel, update:cpus, ...)
+     *
+     * Special fields:
+     * - `xenStoreData` keys are automatically prefixed with `vm-data/` when missing
+     *
+     * @example id "f07ab729-c0e8-721c-45ec-f11276377030"
+     * @example body {
+     *    "nameLabel": "web-prod-01",
+     *    "nameDescription": "Production web frontend — managed by n8n",
+     *    "notes": "Docker containers: nginx, app-1, app-2"
+     * }
+     */
+    async updateVm(id, body) {
+        await this.#vmService.updateVm(id, body);
+    }
     /**
      * Required privilege:
      * - resource: vm, action: delete
@@ -418,6 +448,8 @@ let VmController = class VmController extends XapiXoController {
         });
     }
     /**
+     * Required privilege:
+     * - resource: vm, action: clone
      *
      * - For fast clone on the same SR, omit `srId` and set `fast` to `true`.
      * - For full copy on the same SR, omit `srId` and set `fast` to `false`.
@@ -601,6 +633,10 @@ let VmController = class VmController extends XapiXoController {
         }
     }
     /**
+     * Required privileges:
+     * - resource: vm, action: migrate-send
+     * - resource: host, action: migrate-receive (on the destination host)
+     *
      * VIF mapping is not allowed for intra-pool migration
      *
      * Networks and SRs must belong to the same pool as the destination host
@@ -620,6 +656,7 @@ let VmController = class VmController extends XapiXoController {
                 migrationNetworkId: migrationNetworkId,
                 sr: 'srId' in body ? body.srId : undefined,
             });
+            return;
         };
         return this.createAction(action, {
             sync,
@@ -644,7 +681,7 @@ __decorate([
 __decorate([
     Extension('x-mcp-exposure', 'deny'),
     Get('{id}.{format}'),
-    Middlewares(acl({ resource: 'vm', action: 'export', objectId: 'params.id' })),
+    Middlewares([acl({ resource: 'vm', action: 'export', objectId: 'params.id' }), vmExportCompressDeprecated]),
     SuccessResponse(200, 'Download started', 'application/octet-stream'),
     Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(notFoundResp.status, notFoundResp.description),
@@ -663,6 +700,24 @@ __decorate([
     Response(notFoundResp.status, notFoundResp.description),
     __param(0, Path())
 ], VmController.prototype, "getVm", null);
+__decorate([
+    Patch('{id}'),
+    Middlewares([
+        json(),
+        acl({
+            resource: 'vm',
+            actions: actionsFromBody(UPDATE_VM_ACTIONS),
+            objectId: 'params.id',
+        }),
+    ]),
+    SuccessResponse(noContentResp.status, noContentResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
+    Response(notFoundResp.status, notFoundResp.description),
+    Response(invalidParametersResp.status, invalidParametersResp.description),
+    Response(internalServerErrorResp.status, internalServerErrorResp.description),
+    __param(0, Path()),
+    __param(1, Body())
+], VmController.prototype, "updateVm", null);
 __decorate([
     Extension('x-mcp-exposure', 'confirm'),
     Delete('{id}'),
@@ -872,8 +927,9 @@ __decorate([
     Example(taskLocation),
     Extension('x-mcp-exposure', 'confirm'),
     Post('{id}/actions/clone'),
-    Middlewares(json()),
+    Middlewares([json(), acl({ resource: 'vm', action: 'clone', objectId: 'params.id' })]),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(createdResp.status, createdResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(internalServerErrorResp.status, internalServerErrorResp.description),
@@ -994,8 +1050,17 @@ __decorate([
     Example(taskLocation),
     Extension('x-mcp-exposure', 'confirm'),
     Post('{id}/actions/migrate'),
-    Middlewares(json()),
+    Middlewares([
+        json(),
+        // Two separate checks allow independent control so a user can be allowed to migrate a VM away
+        // without being allowed to place VMs on any specific host, and vice versa.
+        acl([
+            { resource: 'vm', action: 'migrate-send', objectId: 'params.id' },
+            { resource: 'host', action: 'migrate-receive', objectId: 'body.hostId' },
+        ]),
+    ]),
     SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description),
+    Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
     Response(noContentResp.status, noContentResp.description),
     Response(notFoundResp.status, notFoundResp.description),
     Response(invalidParametersResp.status, invalidParametersResp.description),

package/dist/vms/vm.service.mjs

@@ -120,7 +120,7 @@ export class VmService {
         }
         return vdis;
     }
-    async export(id, vmType, { compress, format, response }) {
+    async export(id, vmType, { compress, format, response, }) {
         const xapiVm = this.#restApi.getXapiObject(id, vmType);
         let stream;
         if (format === 'xva') {
@@ -146,6 +146,23 @@ export class VmService {
         });
         return alarms;
     }
+    async updateVm(id, body) {
+        const { resourceSet, share, ...editProps } = body;
+        // Touch the object so 404 is raised before any side effect.
+        void this.#restApi.getObject(id, 'VM');
+        const xoApp = this.#restApi.xoApp;
+        if (resourceSet !== undefined) {
+            await xoApp.setVmResourceSet(id, resourceSet, true);
+        }
+        else if (share) {
+            // `share: false` is a no-op.
+            await xoApp.shareVmResourceSet(id);
+        }
+        if (Object.keys(editProps).length === 0) {
+            return;
+        }
+        await xoApp.getXapi(id).editVm(id, editProps);
+    }
     #getDashboardQuickInfo(id) {
         const { power_state, uuid, name_description, CPUs, mainIpAddress, os_version, memory, creation, $pool, virtualizationMode, tags, $container, startTime, pvDriversDetected, pvDriversVersion, pvDriversUpToDate, } = this.#restApi.getObject(id, 'VM');
         return {
@@ -179,23 +196,24 @@ export class VmService {
     }
     #getLastReplication(id) {
         const vm = this.#restApi.getObject(id, 'VM');
-        const replicatedVms = this.#restApi.getObjectsByType('VM', {
-            filter: obj => obj.other['xo:backup:vm'] === vm.id,
+        const snapshotReplicas = this.#restApi.getObjectsByType('VM-snapshot', {
+            filter: obj => obj.other['xo:backup:vm'] === vm.id && obj.$snapshot_of !== vm.id,
         });
         let lastTimestamp;
-        let lastReplica;
-        for (const id in replicatedVms) {
-            const replica = replicatedVms[id];
-            const timestamp = parseDateTime(replica.other['xo:backup:datetime']);
+        let lastReplicaId;
+        for (const id in snapshotReplicas) {
+            const snapshot = snapshotReplicas[id];
+            const timestamp = parseDateTime(snapshot.other['xo:backup:datetime']);
             if (lastTimestamp === undefined || lastTimestamp < timestamp) {
                 lastTimestamp = timestamp;
-                lastReplica = replica;
+                lastReplicaId = snapshot.$snapshot_of;
             }
         }
-        if (lastReplica === undefined) {
+        if (lastReplicaId === undefined) {
             return {};
         }
-        const vdis = this.getVmVdis(id, 'VM');
+        const replica = this.#restApi.getObject(lastReplicaId, 'VM');
+        const vdis = this.getVmVdis(replica.id, 'VM');
         let sr = undefined;
         for (const vdi of vdis) {
             if (sr === undefined) {
@@ -209,7 +227,7 @@ export class VmService {
             }
         }
         return {
-            id: lastReplica.id,
+            id: replica.id,
             timestamp: lastTimestamp * 1000,
             sr,
         };