Administrator/Xen-Orchestra-xen-orchestra-MIRROR
1
0
Fork 1
mirror of https://github.com/vatesfr/xen-orchestra.git synced 2026-09-12 23:19:48 -05:00
Code Issues Packages Projects Releases Wiki Activity

feat(rest-api): add RBAC check for vif endpoints (#9889)

Browse Source
This commit is contained in:
Grandalf
2026-06-04 15:36:33 +02:00
committed by GitHub
parent f4a7b708c1
commit ebb337b786
4 changed files with 34 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
@xen-orchestra/acl/src/actions/vif.mts
View File

@@ -1,4 +1,7 @@
export default {
read: true,
connect: true,
create: true,
delete: true,
disconnect: true,
read: true,
}

27
@xen-orchestra/rest-api/src/vifs/vif.controller.mts
View File

@@ -227,12 +227,15 @@ export class VifController extends XapiXoController<XoVif> {
}
/**
* Required privilege:
* - resource: vif, action: create
*
* @example body {
* "networkId": "6b6ca0f5-6611-0636-4b0a-1fb1c1e96414",
* "vmId": "613f541c-4bed-fc77-7ca8-2db6b68f079c",
* "other_config": {
*"ethtool-tx": "false"
* },
* "other_config": {
* "ethtool-tx": "false"
* },
* "qos_algorithm_params": {
* "kbps": "42"
* },
@@ -242,9 +245,10 @@ export class VifController extends XapiXoController<XoVif> {
@Example(vifId)
@Extension('x-mcp-exposure', 'confirm')
@Post('')
@Middlewares(json())
@Middlewares([json(), acl({ resource: 'vif', action: 'create', object: ({ req }) => req.body })])
@SuccessResponse(createdResp.status, createdResp.description)
@Response(notFoundResp.status, notFoundResp.description)
@Response(forbiddenOperationResp.status, forbiddenOperationResp.description)
@Response(internalServerErrorResp.status, internalServerErrorResp.description)
@Response(invalidParametersResp.status, invalidParametersResp.description)
async createVif(
@@ -277,11 +281,16 @@ export class VifController extends XapiXoController<XoVif> {
}
/**
* Required privilege:
* - resource: vif, action: delete
*
* @example id "6b6ca0f5-6611-0636-4b0a-1fb1c1e96414"
*/
@Extension('x-mcp-exposure', 'confirm')
@Delete('{id}')
@SuccessResponse(noContentResp.status, noContentResp.description)
@Middlewares(acl({ resource: 'vif', action: 'delete', objectId: 'params.id' }))
@Response(forbiddenOperationResp.status, forbiddenOperationResp.description)
@Response(notFoundResp.status, notFoundResp.description)
@Response(internalServerErrorResp.status, internalServerErrorResp.description)
async destroyVif(@Path() id: string): Promise<void> {
@@ -293,13 +302,18 @@ export class VifController extends XapiXoController<XoVif> {
* Hotplug the VIF, dynamically attaching it to the running VM
* Requires PV drivers to be installed on the VM
*
* Required privilege:
* - resource: vif, action: connect
*
* @example id "f07ab729-c0e8-721c-45ec-f11276377030"
*/
@Example(taskLocation)
@Extension('x-mcp-exposure', 'confirm')
@Middlewares(acl({ resource: 'vif', action: 'connect', objectId: 'params.id' }))
@Post('{id}/actions/connect')
@SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description)
@Response(noContentResp.status, noContentResp.description)
@Response(forbiddenOperationResp.status, forbiddenOperationResp.description)
@Response(notFoundResp.status, notFoundResp.description)
@Response(internalServerErrorResp.status, internalServerErrorResp.description)
async connectVif(@Path() id: string, @Query() sync?: boolean): CreateActionReturnType<void> {
@@ -324,13 +338,18 @@ export class VifController extends XapiXoController<XoVif> {
* Hot-unplug the VIF, dynamically detaching it from the running VM
* Requires PV drivers to be installed on the VM
*
* Required privilege:
* - resource: vif, action: disconnect
*
* @example id "f07ab729-c0e8-721c-45ec-f11276377030"
*/
@Example(taskLocation)
@Extension('x-mcp-exposure', 'confirm')
@Post('{id}/actions/disconnect')
@Middlewares(acl({ resource: 'vif', action: 'disconnect', objectId: 'params.id' }))
@SuccessResponse(asynchronousActionResp.status, asynchronousActionResp.description)
@Response(noContentResp.status, noContentResp.description)
@Response(forbiddenOperationResp.status, forbiddenOperationResp.description)
@Response(notFoundResp.status, notFoundResp.description)
@Response(internalServerErrorResp.status, internalServerErrorResp.description)
async disconnectVif(@Path() id: string, @Query() sync?: boolean): CreateActionReturnType<void> {

8
CHANGELOG.unreleased.md
View File

@@ -15,8 +15,12 @@
- **RBAC** check for REST API endpoints:
- `POST /vbds` (PR [#9904](https://github.com/vatesfr/xen-orchestra/pull/9904))
- `DELETE /vbds/:id` (PR [#9904](https://github.com/vatesfr/xen-orchestra/pull/9904))
- `vbds/:id/actions/connect` (PR [#9904](https://github.com/vatesfr/xen-orchestra/pull/9904))
- `vbds/:id/actions/disconnect` (PR [#9904](https://github.com/vatesfr/xen-orchestra/pull/9904))
- `POST vbds/:id/actions/connect` (PR [#9904](https://github.com/vatesfr/xen-orchestra/pull/9904))
- `POST vbds/:id/actions/disconnect` (PR [#9904](https://github.com/vatesfr/xen-orchestra/pull/9904))
- `POST /vifs` (PR [#9889](https://github.com/vatesfr/xen-orchestra/pull/9889))
- `DELETE /vifs/:id` (PR [#9889](https://github.com/vatesfr/xen-orchestra/pull/9889))
- `POST /vifs/:id/actions/connect` (PR [#9889](https://github.com/vatesfr/xen-orchestra/pull/9889))
- `POST /vifs/:id/actions/disconnect` (PR [#9889](https://github.com/vatesfr/xen-orchestra/pull/9889))
### Bug fixes

2
docs/docs/xo6/acl-v2.md
View File

@@ -113,7 +113,7 @@ Actions are written using the exact string you pass in a privilege. A parent act
| `vdi` | `read`, `create`, `delete`, `boot`, `export-content`, `import-content`, `update:tags` |
| `vdi-snapshot` | `read` |
| `vdi-unmanaged` | `read` |
| `vif` | `read`, `create` |
| `vif` | `connect`, `create`, `delete`, `disconnect`,`read` |
| `vbd` | `read`, `create`, `delete`, `connect`, `disconnect` |
| `sr` | `read`, `delete`, `import:vdi`, `import:vm`, `update:tags` |
| `host` | `read`, `allow-vm`, `export:logs`, `update:tags`, `disable`, `enable`, `evacuate` |