markmorado/pvemanager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

fix(workspaces): grant server access via workspace membership alone

Browse Source 
Non-privileged users previously needed a server to be both directly
assigned AND inside one of their workspaces (intersection) to see or use
it. Adding a user to a workspace should be sufficient on its own to let
them create instances on that workspace's servers, so the two access
paths are now unioned instead of intersected.
This commit is contained in:
markmorado
2026-07-23 21:59:09 +05:00
parent 203ae8bdd6
commit 761bd7bca8
2 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
backend/app/api/proxmox/servers.py
View File

@@ -77,7 +77,11 @@ def list_proxmox_servers(
_attach_workspaces(db, servers)
return servers
# Non-privileged user: must be directly assigned AND server must be in one of their workspaces
# Non-privileged user: access is granted either by a direct server
# assignment OR by membership in a workspace that contains the server.
# Adding a user to a workspace is therefore sufficient to let them create
# instances on that workspace's servers — no separate direct assignment
# is required.
assigned_ids = {s.id for s in current_user.assigned_servers}
# Collect server IDs accessible through user's workspaces
@@ -95,8 +99,8 @@ def list_proxmox_servers(
else:
ws_server_ids = set()
# Intersect: directly assigned AND within user's workspaces
effective_ids = assigned_ids & ws_server_ids
# Union: directly assigned OR within user's workspaces
effective_ids = assigned_ids | ws_server_ids
# Also apply active-workspace header filter on top
ws_filter = get_workspace_server_ids(request, db, current_user)

10
backend/tests/test_api_servers.py
View File

@@ -60,16 +60,16 @@ class TestAPIServers:
db_session.add(workspace)
db_session.commit()
# Link the assigned server and the standard user to the workspace
# Link the assigned server and the standard user to the workspace.
# Note: no direct assigned_servers link — workspace membership alone
# must be enough to grant access (so the user can create instances).
ws_server = WorkspaceServer(workspace_id=workspace.id, server_id=server_assigned.id)
ws_user = WorkspaceUser(workspace_id=workspace.id, user_id=seed_users["user"].id)
db_session.add_all([ws_server, ws_user])
# Directly assign the server to the user as well
seed_users["user"].assigned_servers.append(server_assigned)
db_session.commit()
# Now standard user should see only the assigned server in their workspace
# Now standard user should see the workspace server without any direct
# assignment, but not the unassigned server outside their workspaces.
response2 = client.get("/proxmox/api/servers", headers=user_headers)
assert response2.status_code == 200
servers = response2.json()