markmorado/pvemanager
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases 3 Wiki Activity

refactor(rbac): migrate API permission checks to resource:action format

Browse Source 
Replace all legacy dotted permission codes (vms.view, proxmox.manage, ...)
in PermissionChecker/has_permission across app/api with the new
resource:action format (vm:view, server:manage, ...), per LEGACY_PERMISSION_MAP.
All 33 codes used by the API are now registered in the permission registry.

Also switch the /api/auth/me admin branch to get_all_permissions_v2 so the
endpoint emits permissions in the new format only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Dilshod Rasulov
2026-06-20 02:07:48 +05:00
parent 57513c4dc9
commit de967c35e0
19 changed files with 220 additions and 220 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
backend/app/api/proxmox/_helpers.py
View File

@@ -37,7 +37,7 @@ def check_vm_access(db: Session, current_user: User, server_id: int, vmid: int)
if current_user.role and current_user.role.permissions:
perms = current_user.role.permissions
# If user has full vms:view, they can access all VMs
has_full_view = perms.get('vms.view', False) or perms.get('vms:view', False)
has_full_view = perms.get('vm:view', False) or perms.get('vms:view', False)
has_own_only = perms.get('vms:view:own', False) or perms.get('vms.view.own', False)
if has_full_view and not has_own_only: