feat(rbac): add Storage administrator built-in role template (#9963)

CHANGELOG.unreleased.md

@@ -20,6 +20,7 @@
 - [XO6/VDI] Add the possibility to export VDI from detail screen of a VM (PR [#9983](https://github.com/vatesfr/xen-orchestra/pull/9983))
 - [SidePanels] Add and use new `VtsCardObjectTitle` component to display object title and ID in side panels (PR [#9755](https://github.com/vatesfr/xen-orchestra/pull/9755))
 - [i18n] Update Chinese (Simplified Han script), Czech, Dutch, German, Korean, Slovak, Spanish and Swedish translations (PR [#9998](https://github.com/vatesfr/xen-orchestra/pull/9998))
+- [REST API/RBAC] Add a built-in Storage administrator ACL role template to administer SRs, VDIs, VBDs, PBDs and backup repositories (PR [#9963](https://github.com/vatesfr/xen-orchestra/pull/9963))
 
 ### Bug fixes
 

docs/docs/xo6/acl-v2.md

@@ -63,19 +63,20 @@ The reverse is not true: granting `shutdown:clean` does **not** grant `shutdown:
 
 ## Built-in template roles
 
-Xen Orchestra ships with seven ready-to-use role templates. They are **immutable** and automatically kept up to date on startup — they cannot be modified, deleted, or assigned directly.
+Xen Orchestra ships with eight ready-to-use role templates. They are **immutable** and automatically kept up to date on startup — they cannot be modified, deleted, or assigned directly.
 
 To use them, **copy** a template into a new role and assign that copy to your users or groups. This ensures the built-in templates always stay up to date without affecting your custom configuration.
 
-| Role                        | Description                                                                          |
-| --------------------------- | ------------------------------------------------------------------------------------ |
-| **Read only**               | Read access to the entire infrastructure and all XO objects. Cannot modify anything. |
-| **VMs power state manager** | Can start, stop, reboot, pause, suspend, resume, and unpause VMs.                    |
-| **VMs creator**             | Can instantiate VM templates and create VDIs and VIFs.                               |
-| **VMs read only**           | Can only list and view VMs.                                                          |
-| **VMs administrator**       | Full control over VM actions                                                         |
-| **Network administrator**   | Can manage networks and VIFs, read and update PIFs, and view hosts and VMs.          |
-| **Administrator**           | Full access to the entire infrastructure                                             |
+| Role                        | Description                                                                                                                            |
+| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| **Read only**               | Read access to the entire infrastructure and all XO objects. Cannot modify anything.                                                   |
+| **VMs power state manager** | Can start, stop, reboot, pause, suspend, resume, and unpause VMs.                                                                      |
+| **VMs creator**             | Can instantiate VM templates and create VDIs and VIFs.                                                                                 |
+| **VMs read only**           | Can only list and view VMs.                                                                                                            |
+| **VMs administrator**       | Full control over VM actions                                                                                                           |
+| **Network administrator**   | Can manage networks and VIFs, read and update PIFs, and view hosts and VMs.                                                            |
+| **Administrator**           | Full access to the entire infrastructure                                                                                               |
+| **Storage administrator**   | Administer storage resources (SRs, VDIs, VBDs, PBDs) and backup repositories, plus read access to unmanaged VDIs and storage managers. |
 
 ![acl-role copy documented in Swagger](../assets/swagger-role-copy.png)
 

packages/xo-server/src/xo-mixins/acls-v2/index.mjs

@@ -12,6 +12,7 @@ import {
   VMS_READ_ONLY,
   VMS_ADMINISTRATOR,
   NETWORK_ADMINISTRATOR,
+  STORAGE_ADMINISTRATOR,
 } from './template-roles.mjs'
 
 import { Roles } from '../../models/acls-v2/role.mjs'
@@ -61,6 +62,7 @@ const TEMPLATE_ROLES = [
   /** @type {RoleTemplate} */ (VMS_ADMINISTRATOR),
   /** @type {RoleTemplate} */ (ADMINISTRATOR),
   /** @type {RoleTemplate} */ (NETWORK_ADMINISTRATOR),
+  /** @type {RoleTemplate} */ (STORAGE_ADMINISTRATOR),
 ]
 
 export default class {

packages/xo-server/src/xo-mixins/acls-v2/template-roles.mjs

@@ -116,4 +116,21 @@ export const ADMINISTRATOR = {
   name: 'Administrator',
   description: 'Full access to the entire infrastructure.',
   privileges: REAL_ONLY_ALL.privileges.map(privilege => ({ ...privilege, action: '*' })),
-}
+}
+
+// === Storage
+export const STORAGE_ADMINISTRATOR = {
+  roleTemplateId: 8,
+  name: 'Storage administrator',
+  description: 'Full control over storage: SRs, VDIs, VBDs, PBDs and backup repositories',
+  privileges: [
+    // Core storage resources: full control (wildcard is future-proof for new actions)
+    { action: '*', resource: 'sr', effect: 'allow' },
+    { action: '*', resource: 'vdi', effect: 'allow' },
+    { action: '*', resource: 'vbd', effect: 'allow' },
+    { action: '*', resource: 'pbd', effect: 'allow' },
+    { action: '*', resource: 'backup-repository', effect: 'allow' },
+    { action: 'read', resource: 'vdi-unmanaged', effect: 'allow' },
+    { action: 'read', resource: 'sm', effect: 'allow' },
+  ],
+}