feat(acl): add plugin for creating and managing ACLs
This commit is contained in:
plugins
77
plugins/module_utils/proxmox_datacenter_acl.py
Normal file
77
plugins/module_utils/proxmox_datacenter_acl.py
Normal file
@ -0,0 +1,77 @@
|
||||
import dataclasses
|
||||
from dataclasses import dataclass, field
|
||||
from typing import List, Tuple
|
||||
|
||||
from ansible_collections.finallycoffee.proxmox.plugins.module_utils.common import _proxmox_request, ProxmoxAuthInfo
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class ProxmoxACL:
|
||||
path: str
|
||||
role: str
|
||||
propagate: bool = True
|
||||
user: str = None
|
||||
group: str = None
|
||||
token: str = None
|
||||
|
||||
|
||||
def get_acls(auth_info: ProxmoxAuthInfo) -> List['ProxmoxACL']:
|
||||
acl_answer = _proxmox_request('get', '/access/acl', auth_info).json()
|
||||
return list(map(
|
||||
lambda r: ProxmoxACL(r['path'], r['roleid'], r['propagate'],
|
||||
(r['ugid'] if (r['type'] == 'user') else None),
|
||||
(r['ugid'] if (r['type'] == 'group') else None),
|
||||
(r['ugid'] if (r['type'] == 'token') else None)),
|
||||
acl_answer['data']
|
||||
))
|
||||
|
||||
|
||||
def set_acl(auth_info: ProxmoxAuthInfo, acl: ProxmoxACL, dry_run: bool, state: str = 'present') -> Tuple[dict, dict]:
|
||||
existing_acls = get_acls(auth_info)
|
||||
# find existing acl matching the specified one
|
||||
try:
|
||||
existing_acl = [x for x in existing_acls if x == acl][0]
|
||||
except:
|
||||
existing_acl = None
|
||||
|
||||
if state == 'present':
|
||||
acl_spec = _acl_to_dict(acl) | {
|
||||
'propagate': acl.propagate
|
||||
}
|
||||
if not dry_run:
|
||||
acl_res = _proxmox_request('put', f"/access/acl", auth_info, data=acl_spec)
|
||||
acl_res.raise_for_status()
|
||||
if acl_res.ok and acl_res.json()['success'] == 1:
|
||||
new_acl = acl
|
||||
else:
|
||||
new_acl = acl
|
||||
elif state == 'exact':
|
||||
# Also match on propagate and remove ACLs which match in all fields except propagation
|
||||
pass
|
||||
else:
|
||||
# ACL to be removed
|
||||
if not dry_run:
|
||||
acl_spec = _acl_to_dict(acl) | {
|
||||
'delete': 1
|
||||
}
|
||||
acl_res = _proxmox_request('put', '/access/acl', auth_info, data=acl_spec)
|
||||
acl_res.raise_for_status()
|
||||
if acl_res.ok:
|
||||
new_acl = None
|
||||
else:
|
||||
new_acl = None
|
||||
return dataclasses.asdict(existing_acl) if existing_acl else None, dataclasses.asdict(new_acl) if new_acl else None
|
||||
|
||||
|
||||
def _acl_to_dict(acl: ProxmoxACL) -> dict:
|
||||
acl_spec = {
|
||||
'path': acl.path,
|
||||
'roles': acl.role,
|
||||
}
|
||||
if acl.user:
|
||||
acl_spec['users'] = acl.user
|
||||
if acl.group:
|
||||
acl_spec['groups'] = acl.group
|
||||
if acl.token:
|
||||
acl_spec['tokens'] = acl.token
|
||||
return acl_spec
|
Reference in New Issue
Block a user