feat(rest-api): expose groups/:id/acl-roles

@vates/types/src/xo-app.mts

@@ -248,6 +248,7 @@ export type XoApp = {
   getAclV2RolePrivileges(roleId: XoAclRole['id']): Promise<XoAclBasePrivilege[]>
   getAclV2Role(id: XoAclRole['id']): Promise<XoAclRole>
   deleteAclV2UserRole(userId: XoUser['id'], roleId: XoAclRole['id']): Promise<boolean>
+  getAclV2GroupRoles(groupId: XoGroup['id']): Promise<Exclude<XoAclRole, { isTemplate: true }>[]>
   getAclV2Roles(): Promise<XoAclRole[]>
   getAclV2UserPrivileges(userId: XoUser['id']): Promise<XoAclBasePrivilege[]>
   getAllGroups(): Promise<XoGroup[]>

@xen-orchestra/rest-api/src/groups/group.controller.mts

@@ -20,7 +20,7 @@ import {
 import { inject } from 'inversify'
 import { json, type Request as ExRequest } from 'express'
 import { provide } from 'inversify-binding-decorators'
-import type { XoGroup, XoTask, XoUser } from '@vates/types'
+import type { XoAclRole, XoGroup, XoTask, XoUser } from '@vates/types'
 
 import { forbiddenOperation } from 'xo-common/api-errors.js'
 import {
@@ -44,6 +44,7 @@ import { limitAndFilterArray } from '../helpers/utils.helper.mjs'
 import { partialUsers, userIds } from '../open-api/oa-examples/user.oa-example.mjs'
 import { partialTasks, taskIds } from '../open-api/oa-examples/task.oa-example.mjs'
 import { acl, actionFromBody } from '../middlewares/acl.middleware.mjs'
+import { aclRoleIds, partialAclRoles } from '../open-api/oa-examples/acl-role.oa-example.mjs'
 
 @Route('groups')
 @Security('*')
@@ -328,4 +329,39 @@ export class GroupController extends XoController<XoGroup> {
       privilege: { action: 'read', resource: 'task' },
     })
   }
+
+  /**
+   * Returns all acl-roles that match the following privilege:
+   * - resource: acl-role, action: read
+   *
+   * @example id "6c81b5e1-afc1-43ea-8f8d-939ceb5f3f90"
+   * @example fields "id,name,isTemplate"
+   * @example filter "name:read only"
+   * @example limit 42
+   */
+  @Example(aclRoleIds)
+  @Example(partialAclRoles)
+  @Extension('x-mcp-exposure', 'allow')
+  @Get('{id}/acl-roles')
+  @Security('*', ['acl'])
+  @Tags('rbacs')
+  @Response(notFoundResp.status, notFoundResp.description)
+  async getGroupAclRoles(
+    @Request() req: ExRequest,
+    @Path() id: string,
+    @Query() fields?: string,
+    @Query() ndjson?: boolean,
+    @Query() markdown?: boolean,
+    @Query() filter?: string,
+    @Query() limit?: number
+  ): SendObjects<Partial<Unbrand<Exclude<XoAclRole, { isTemplate: true }>>>> {
+    const group = await this.getObject(id as XoGroup['id'])
+    const roles = await Promise.all(group.aclRoleIds.map(roleId => this.restApi.xoApp.getAclV2Role(roleId)))
+
+    return this.sendObjects(limitAndFilterArray(roles, { filter }), req, {
+      path: 'acl-roles',
+      limit,
+      privilege: { action: 'read', resource: 'acl-role' },
+    })
+  }
 }

CHANGELOG.unreleased.md

@@ -38,6 +38,7 @@
 - [REST API] Possibility to set the HA restart priority (`high_availability`) when creating a VM (PR [#10070](https://github.com/vatesfr/xen-orchestra/pull/10070))
 - [XO6/Traffic rules] Show only traffic rules of VMs. Don't include vm-snapshots or vm-templates. In the VM selector, disable VMs that don't have any VIF (PR [#9977](https://github.com/vatesfr/xen-orchestra/pull/9977))
 - [Pool] Add new VM and disconnect actions to the pool infrastructure tree (PR [#10046](https://github.com/vatesfr/xen-orchestra/pull/10046))
+- [REST API] Expose `/rest/v0/groups/:id/acl-roles` (PR [#10085](https://github.com/vatesfr/xen-orchestra/pull/10085))
 
 ### Bug fixes
 

packages/xo-server/src/xo-mixins/acls-v2/index.mjs

@@ -610,7 +610,7 @@ export default class {
 
   /**
    * @param {XoGroup['id']} groupId
-   * @returns {Promise<XoAclRole[]>}
+   * @returns {Promise<Exclude<XoAclRole, {isTemplate: true}>[]>}
    */
   async getAclV2GroupRoles(groupId) {
     await this._app.checkFeatureAuthorization('RBAC')