Administrator/Xen-Orchestra-xen-orchestra-MIRROR
1
0
Fork 1
mirror of https://github.com/vatesfr/xen-orchestra.git synced 2026-09-10 22:14:48 -05:00
Code Issues Packages Projects Releases Wiki Activity

feat(rest-api): add RBAC check for VDIs endpoints (#9908)

Browse Source 
* feat(rest-api): add RBAC check for VDIs endpoints
This commit is contained in:
MlssFrncJrg
2026-06-11 10:27:00 +02:00
committed by GitHub
parent ba5b9ba7f9
commit 21f191b829
5 changed files with 35 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
@xen-orchestra/acl/src/actions/sr.mts
View File

@@ -5,6 +5,7 @@ export default {
vdi: true,
vm: true,
},
'migrate-receive': true,
read: true,
'reclaim-space': true,
scan: true,

1
@xen-orchestra/acl/src/actions/vdi.mts
View File

@@ -4,6 +4,7 @@ export default {
delete: true,
'export-content': true,
'import-content': true,
'migrate-send': true,
read: true,
update: {
tags: true,

28
@xen-orchestra/rest-api/src/vdis/vdi.controller.mts
View File

@@ -213,13 +213,24 @@ export class VdiController extends XapiXoController<XoVdi> {
/**
* Create an empty VDI.
*
* Required privileges:
* - resource: sr, action: import:vdi (on the target SR)
* - resource: vdi, action: create
*
* @example body { "srId": "c4284e12-37c9-7967-b9e8-83ef229c3e03", "virtual_size": 10737418240, "name_label": "test VDI" }
*/
@Example(vdiId)
@Extension('x-mcp-exposure', 'confirm')
@Post('')
@Middlewares(json())
@Middlewares([
json(),
acl([
{ resource: 'sr', action: 'import:vdi', objectId: 'body.srId' },
{ resource: 'vdi', action: 'create', object: ({ req }) => req.body },
]),
])
@SuccessResponse(createdResp.status, createdResp.description)
@Response(forbiddenOperationResp.status, forbiddenOperationResp.description)
@Response(notFoundResp.status, notFoundResp.description)
@Response(internalServerErrorResp.status, internalServerErrorResp.description)
async createVdi(@Body() body: CreateVdiBody): Promise<{ id: string }> {
@@ -331,6 +342,10 @@ export class VdiController extends XapiXoController<XoVdi> {
/**
* Migrate a VDI to another SR.
*
* Required privileges:
* - resource: vdi, action: migrate-send
* - resource: sr, action: migrate-receive (on the target SR)
*
* Note: After migration, the VDI will have a new ID. The new ID is returned in the response.
*
* @example id "c77f9955-c1d2-4b39-aa1c-73cdb2dacb7e"
@@ -340,8 +355,17 @@ export class VdiController extends XapiXoController<XoVdi> {
@Example(vdiId)
@Extension('x-mcp-exposure', 'confirm')
@Post('{id}/actions/migrate')
@Middlewares(json())
@Middlewares([
json(),
// Two separate checks allow independent control: a user can be allowed to migrate a VDI away
// without being allowed to place VDIs on any specific SR, and vice versa.
acl([
{ resource: 'vdi', action: 'migrate-send', objectId: 'params.id' },
{ resource: 'sr', action: 'migrate-receive', objectId: 'body.srId' },
]),
])
@SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description)
@Response(forbiddenOperationResp.status, forbiddenOperationResp.description)
@Response(200, 'Ok')
@Response(notFoundResp.status, notFoundResp.description)
@Response(internalServerErrorResp.status, internalServerErrorResp.description)

2
CHANGELOG.unreleased.md
View File

@@ -35,6 +35,8 @@
- `DELETE /vdi-snapshots/{id}` (PR [#9906](https://github.com/vatesfr/xen-orchestra/pull/9906))
- `PUT /vdi-snapshots/{id}/tags/{tag}` (PR [#9906](https://github.com/vatesfr/xen-orchestra/pull/9906))
- `DELETE /vdi-snapshots/{id}/tags/{tag}` (PR [#9906](https://github.com/vatesfr/xen-orchestra/pull/9906))/vdi-snapshots/{id}.{format}` (PR [#9906](https://github.com/vatesfr/xen-orchestra/pull/9906))
- `POST /vdis` (PR [#9908](https://github.com/vatesfr/xen-orchestra/pull/9908))
- `/vdis/:id/actions/migrate` (PR [#9908](https://github.com/vatesfr/xen-orchestra/pull/9908))
- [XO6] live update XO tasks (PR [#9901](https://github.com/vatesfr/xen-orchestra/pull/9901))
- [XO6/Backup] add progress for backups tasks(PR [#9901](https://github.com/vatesfr/xen-orchestra/pull/9901))

8
docs/docs/xo6/acl-v2.md
View File

@@ -110,14 +110,14 @@ Actions are written using the exact string you pass in a privilege. A parent act
| `vm-snapshot` | `read`, `delete`, `export`, `update:tags` |
| `vm-template` | `read`, `delete`, `export`, `instantiate`, `update:tags` |
| `vm-controller` | `read`, `update:tags` |
| `vdi` | `read`, `create`, `delete`, `boot`, `export-content`, `import-content`, `update:tags` |
| `vdi` | `read`, `create`, `delete`, `boot`, `export-content`, `import-content`, `migrate-send`, `update:tags` |
| `vdi-snapshot` | `read`, `delete`, `export`, `update:tags` |
| `vdi-unmanaged` | `read` |
| `vif` | `connect`, `create`, `delete`, `disconnect`,`read` |
| `vbd` | `read`, `create`, `delete`, `connect`, `disconnect` |
| `sr` | `read`, `delete`, `forget`, `reclaim-space`, `scan`, `import:vdi`, `import:vm`, `update:tags` |
| `host` | `read`, `allow-vm`, `join-pool`, `export:logs`, `update:tags`, `disable`, `enable`, `evacuate` |
| `pool` | `add-host`, `read`, `emergency-shutdown`, `rolling-reboot`, `rolling-update`, `create:network`, `create:vm`, `update:tags` |
| `sr` | `read`, `delete`, `forget`, `migrate-receive`, `reclaim-space`, `scan`, `import:vdi`, `import:vm`, `update:tags` |
| `host` | `read`, `allow-vm`, `join-pool`, `export:logs`, `update:tags`, `disable`, `enable`, `evacuate` |
| `pool` | `add-host`, `read`, `emergency-shutdown`, `rolling-reboot`, `rolling-update`, `create:network`, `create:vm`, `update:tags` |
| `network` | `read`, `create`, `delete`, `update:tags` |
| `pif` | `read`, `update:management` |
| `pbd` | `read`, `plug`, `unplug` |