fix instance create pool error mesage

update user allowed nodes format,
add get user ct templates route

.eslintrc.json

@@ -0,0 +1,42 @@
+{
+	"env": {
+		"es2021": true,
+		"node": true
+	},
+	"extends": "standard",
+	"parserOptions": {
+		"ecmaVersion": "latest",
+		"sourceType": "module"
+	},
+	"rules": {
+		"no-tabs": [
+			"error",
+			{
+				"allowIndentationTabs": true
+			}
+		],
+		"indent": [
+			"error",
+			"tab"
+		],
+		"linebreak-style": [
+			"error",
+			"unix"
+		],
+		"quotes": [
+			"error",
+			"double"
+		],
+		"semi": [
+			"error",
+			"always"
+		],
+		"brace-style": [
+			"error",
+			"stroustrup",
+			{
+				"allowSingleLine": false
+			}
+		]
+	}
+}

.gitignore

@@ -2,5 +2,4 @@
 **/node_modules
 **/localdb.json
 **/docs
-**/config.json
-.vscode/*
+**/config.json

README.md

@@ -11,43 +11,60 @@ ProxmoxAAS API provides functionality for the Dashboard by providing a proxy API
 - Server with NodeJS (v18.0+) and NPM installed
 
 ### Configuring API Token and Permissions
-In the Proxmox web GUI, perform the following steps:
+In Proxmox VE, follow the following steps:
 1. Add a new user `proxmoxaas-api` to Proxmox VE
 2. Create a new API token for the user `proxmoxaas-api` and copy the secret key to a safe location
 3. Create a new role `proxmoxaas-api` with at least the following permissions: 
-    - VM.* except VM.Clone, VM.Console, VM.Monitor, VM.PowerMgmt, VM.Snapshot, VM.Snapshot.Rollback
-    - Datastore.Allocate, Datastore.AllocateSpace, Datastore.AllocateTemplate, Datastore.Audit
+    - VM.* except VM.Audit, VM.Backup, VM.Clone, VM.Console, VM.Monitor, VM.PowerMgmt, VM.Snapshot, VM.Snapshot.Rollback
+    - Datastore.Allocate, Datastore.AllocateSpace, Datastore.Audit
     - User.Modify
 	- Pool.Audit
-	- SDN.Use (if instances use SDN networks)
-	- Sys.Audit
 4. Add a new API Token Permission with path: `/`, select the API token created previously, and role: `proxmoxaas-api`
 5. Add a new User Permission with  path: `/`, select the `proxmoxaas-api` user, and role: `proxmoxaas-api`
-6. To prevent users from bypassing the API provided methods, create a new role `PAAS-Client` with only the following permssions:
-	- Datastore.Audit
-	- Pool.Audit
-	- VM.Audit
-	- VM.Console
-	- VM.PowerMgmt
 
 ### Installation - API
-1. Clone this repo onto the `ProxmoxAAS-API` host
+1. Clone this repo onto `Dashboard Host`
 2. Run `npm install` to initiaze the package requirements
 3. Copy `template.config.json` as `config.json` and modify the following values:
-	1. In `application`:
-		- hostname - the ProxmoxAAS-Dashboard URL, ie `paas.domain.net`
-		- domain - the base domain for the dashboard and proxmox, ie `domain.net`
-    	- listenPort - the port you want the API to listen on, ie `8081`
 	1. In `backends/pve/config`:
-		- url: the URI to the Proxmox API, ie `https://pve.domain.net/api2/json`
-		- fabric: the URL to the ProxmoxAAS-Fabric, ie `https://fabric.local`
-		- token: the `proxmoxaas-api` user(name), authentication realm (pam), token id, and token secrey key (uuid)
+		- url: the URI to the Proxmox API, ie `http://<proxmoxhost>:8006/api2/json` or `http://<proxmox URL>/api2/json` if Proxmox VE is behind a reverse proxy. 
+		- token: the user(name), authentication realm (pam), token id, and token secrey key (uuid)
 		- root (**Optional**): In order to allow users to customize instance pcie devices, the API must use the root credentials for privilege elevation. Provide the root username, ie. `root@pam`, and root user password
-	2. In `backends/access_manager/config`:
-		- url: url to a access-mamanger-api server API ie. `http://access.local`
-	4. In `useriso`:
+	2. In `backends/paasldap/config` (**Optional**):
+		- url: url to a PAAS-LDAP server API ie. `http://<paasldap-host>:8082`
+	3. In `handlers/auth`:
+		- Add any authentication handlers to be used by the API. Add the realm name (ie. `pve`) as the key and the handler name as provided in `backends`. For example, a PAAS-LDAP handler could be added as `"paas-ldap": "paasldap"` and users in the realm `user@paas-ldap` will use this handler to perform auth actions. Refer to [backends](#Backends)
+	4. In `application`:
+		- hostname - the ProxmoxAAS-Dashboard URL, ie `host.domain.tld`
+		- domain - the base domain for the dashboard and proxmox, ie `domain.tld`
+    	- listenPort - the port you want the API to listen on, ie `8081`
+	5. In `useriso`:
 		- node: host of storage with user accessible iso files
 		- storage: name of storage with user accessible iso files
-	5. In `backups`:
-		- storage: name of storage for instance backups
-4. Start the service using `node .`, or call the provided shell script, or use the provided systemctl service script
+4. Start the service using `node .`, or call the provided shell script, or use the provided systemctl service script
+
+### Installation - Reverse Proxy
+1. Configure nginx or preferred reverse proxy to reverse proxy the dashboard. The configuration should include at least the following:
+```
+server {
+	listen 443 ssl;
+	server_name paas.<FQDN>;
+	location / {
+		return 301 "/dashboard/";
+	}
+	location /dashboard/ {
+		proxy_pass http://proxmoxaas.dmz:8080/;
+		proxy_redirect default;
+	}
+	location /api/ {
+		proxy_pass http://proxmoxaas.dmz:80/api/;
+		proxy_redirect default;
+	}
+}
+```
+2. Start nginx with the new configurations
+
+### Result
+After these steps, the ProxmoxAAS Dashboard should be available and fully functional at `paas.<FQDN>` or `paas.<FQDN>/dashboard/`.
+
+# Backends

config/template.config.json

@@ -1,15 +1,9 @@
 {
-	"application": {
-		"hostname": "paas.mydomain.example",
-		"domain": "mydomain.example",
-		"listenPort": 8081
-	},
 	"backends": {
 		"pve": {
 			"import": "pve.js",
 			"config": {
 				"url": "https://pve.mydomain.example/api2/json",
-				"fabric": "http://localhost:8082",
 				"token": {
 					"user": "proxmoxaas-api",
 					"realm": "pam",
@@ -22,30 +16,40 @@
 				}
 			}
 		},
-		"access_manager": {
-			"import": "access_manager.js",
+		"localdb": {
+			"import": "localdb.js",
 			"config": {
-				"url": "http://localhost:8083"
+				"dbfile": "localdb.json"
+			}
+		},
+		"paasldap": {
+			"import": "paasldap.js",
+			"config": {
+				"url": "http://paasldap.mydomain.example"
 			}
 		}
 	},
 	"handlers": {
-		"instance": "pve",
-		"users": "access_manager"
+		"pve": "pve",
+		"db": "localdb",
+		"auth": {
+			"pve": "pve"
+		}
+	},
+	"application": {
+		"hostname": "paas.mydomain.example",
+		"domain": "mydomain.example",
+		"listenPort": 8081
 	},
 	"useriso": {
 		"node": "examplenode1",
 		"storage": "cephfs"
 	},
-	"backups": {
-		"storage": "cephfs"
-	},
 	"resources": {
 		"cpu": {
 			"type": "list",
 			"whitelist": true,
-			"display": false,
-			"category": ""
+			"display": false
 		},
 		"cores": {
 			"name": "vCPU",
@@ -54,28 +58,25 @@
 			"base": 1024,
 			"compact": false,
 			"unit": "Cores",
-			"display": true,
-			"category": ""
+			"display": true
 		},
 		"memory": {
 			"name": "RAM",
 			"type": "numeric",
-			"multiplier": 1,
+			"multiplier": 1048576,
 			"base": 1024,
 			"compact": true,
 			"unit": "B",
-			"display": true,
-			"category": ""
+			"display": true
 		},
 		"swap": {
 			"name": "SWAP",
 			"type": "numeric",
-			"multiplier": 1,
+			"multiplier": 1048576,
 			"base": 1024,
 			"compact": true,
 			"unit": "B",
-			"display": true,
-			"category": ""
+			"display": true
 		},
 		"local": {
 			"name": "local",
@@ -88,11 +89,9 @@
 				"rootfs",
 				"mp",
 				"sata",
-				"scsi",
 				"unused"
 			],
-			"display": true,
-			"category": "Storage"
+			"display": true
 		},
 		"cephpl": {
 			"name": "cephpl",
@@ -105,11 +104,9 @@
 				"rootfs",
 				"mp",
 				"sata",
-				"scsi",
 				"unused"
 			],
-			"display": true,
-			"category": "Storage"
+			"display": true
 		},
 		"network": {
 			"name": "Network",
@@ -117,15 +114,13 @@
 			"multiplier": 1000000,
 			"base": 1000,
 			"compact": true,
-			"unit": "b/s",
-			"display": true,
-			"category": ""
+			"unit": "B/s",
+			"display": true
 		},
 		"pci": {
 			"type": "list",
 			"whitelist": true,
-			"display": true,
-			"category": "Devices"
+			"display": true
 		}
 	},
 	"clientsync": {
@@ -147,5 +142,81 @@
 				"enabled": true
 			}
 		}
+	},
+	"defaultuser": {
+		"resources": {
+			"cpu": {
+				"global": [],
+				"nodes": {}
+			},
+			"cores": {
+				"global": {
+					"max": 0
+				},
+				"nodes": {}
+			},
+			"memory": {
+				"global": {
+					"max": 0
+				},
+				"nodes": {}
+			},
+			"swap": {
+				"global": {
+					"max": 0
+				},
+				"nodes": {}
+			},
+			"local": {
+				"global": {
+					"max": 0
+				},
+				"nodes": {}
+			},
+			"cephpl": {
+				"global": {
+					"max": 0
+				},
+				"nodes": {}
+			},
+			"network": {
+				"global": {
+					"max": 0
+				},
+				"nodes": {}
+			},
+			"pci": {
+				"global": [],
+				"nodes": {}
+			}
+		},
+		"nodes": [],
+		"cluster": {
+			"vmid": {
+				"min": -1,
+				"max": -1
+			},
+			"pool": ""
+		},
+		"templates": {
+			"instances": {
+				"lxc": {},
+				"qemu": {}
+			}
+		},
+		"network": {
+			"lxc": {
+				"type": "veth",
+				"bridge": "vmbr0",
+				"vlan": 10,
+				"ip": "dhcp",
+				"ip6": "dhcp"
+			},
+			"qemu": {
+				"type": "virtio",
+				"bridge": "vmbr0",
+				"vlan": 10
+			}
+		}
 	}
 }

dev_config/eslint.config.mjs

@@ -1,32 +0,0 @@
-import { defineConfig } from "eslint/config";
-import globals from "globals";
-import js from "@eslint/js";
-
-export default defineConfig([{
-	plugins: {
-		js,
-	},
-	extends: ["js/recommended"],
-	languageOptions: {
-		globals: {
-			...globals.node
-		},
-		ecmaVersion: "latest",
-		sourceType: "module"
-	},
-	rules: {
-		"no-tabs": ["error", { allowIndentationTabs: true }],
-		"indent": ["error", "tab"],
-		"linebreak-style": ["error", "unix"],
-		"quotes": ["error", "double"],
-		"semi": ["error", "always"],
-		"brace-style": ["error", "stroustrup", { allowSingleLine: false }],
-		"no-unused-vars": ["warn", { 
-			"argsIgnorePattern": "^_",
-			"varsIgnorePattern": "^_",
-			"caughtErrorsIgnorePattern": "^_"
-		}],
-		"prefer-const": ["error"],
-		"eqeqeq": ["error"]
-	}
-}]);

package.json

@@ -1,13 +1,13 @@
 {
 	"name": "proxmoxaas-api",
-	"version": "2.0.0",
+	"version": "0.0.1",
 	"description": "REST API for ProxmoxAAS",
 	"main": "src/main.js",
 	"type": "module",
 	"dependencies": {
 		"axios": "^1.3.2",
 		"body-parser": "^1.20.1",
-		"cookie": "^1.0.2",
+		"cookie": "^0.5.0",
 		"cookie-parser": "^1.4.6",
 		"cors": "^2.8.5",
 		"express": "^4.18.2",
@@ -17,12 +17,13 @@
 		"ws": "^8.13.0"
 	},
 	"devDependencies": {
-		"@eslint/eslintrc": "^3.3.5",
-		"@eslint/js": "^9.39.4",
-		"eslint": "^10.1.0",
-		"globals": "^17.4.0"
+		"eslint": "^8.43.0",
+		"eslint-config-standard": "^17.1.0",
+		"eslint-plugin-import": "^2.27.5",
+		"eslint-plugin-n": "^16.0.1",
+		"eslint-plugin-promise": "^6.1.1"
 	},
 	"scripts": {
-		"lint": "DEBUG=eslint:cli-engine eslint --config dev_config/eslint.config.mjs --fix ."
+		"lint": "DEBUG=eslint:cli-engine eslint --fix ."
 	}
 }

src/backends/access_manager.js

@@ -1,163 +0,0 @@
-import axios from "axios";
-import { ACCESS_BACKEND } from "./backends.js";
-import * as setCookie from "set-cookie-parser";
-
-export default class ACCESS_MANAGER_API extends ACCESS_BACKEND {
-	#apiURL = null;
-
-	constructor (config) {
-		super();
-		this.#apiURL = config.url;
-	}
-
-	/**
-	 * Send HTTP request to paas-LDAP API.
-	 * @param {*} path  HTTP path, prepended with the paas-LDAP API base url
-	 * @param {*} method HTTP method
-	 * @param {*} auth HTTP auth cookies
-	 * @param {*} body body parameters and data to be sent. Optional.
-	 * @returns {Object} HTTP response object
-	 */
-	async #requestAPI (path, method, auth = null, body = null) {
-		const url = `${this.#apiURL}${path}`;
-		const content = {
-			method,
-			mode: "cors",
-			credentials: "include",
-			headers: {
-				"Content-Type": "application/json"
-			},
-			data: body
-		};
-
-		if (auth) {
-			content.headers.Cookie = `PAASAccessManagerTicket=${auth.PAASAccessManagerTicket};`;
-		}
-
-		try {
-			const result = await axios.request(url, content);
-			return {
-				ok: result.status === 200,
-				status: result.status,
-				data: result.data,
-				headers: result.headers
-			};
-		}
-		catch (error) {
-			console.log(`access: error ocuured in access.requestAPI: ${method} ${path} resulted in ${error}`);
-			const result = error.response;
-			result.ok = result.status === 200;
-			return result;
-		}
-	}
-
-	async openSession (user, password) {
-		const credentials = { username: `${user.id}@${user.realm}`, password };
-		const response = await this.#requestAPI("/ticket", "POST", null, credentials);
-		if (response.ok) {
-			const cookies = setCookie.parse(response.headers["set-cookie"]);
-			cookies.forEach((e) => {
-				e.expiresMSFromNow = e.expires - Date.now();
-			});
-			return {
-				ok: true,
-				status: response.status,
-				message: "",
-				cookies
-			};
-		}
-		else {
-			return {
-				ok: false,
-				status: response.status,
-				message: response.data.error,
-				cookies: []
-			};
-		}
-	}
-
-	async closeSession(tokens) {
-		const response = await this.#requestAPI("/ticket", "DELETE", tokens);
-		return response;
-	}
-
-	async addUser (user, attributes, params) {}
-
-	async getUser (user, params) {
-		const response = await this.#requestAPI(`/users/${user.id}@${user.realm}`, "GET", params);
-		if (response.ok) { // if ok, return user data
-			return {
-				ok: true,
-				status: response.status,
-				user: response.data.user
-			};
-		}
-		else { // else return null
-			return {
-				ok: false,
-				status: response.status,
-				message: response.data.error
-			};
-		}
-	}
-
-	async setUser (user, attributes, params) {}
-
-	async delUser (user, params) {}
-
-	async addGroup (group, attributes, params) {}
-
-	async getGroup (group, params) {
-		const response = await this.#requestAPI(`/groups/${group.id}-${group.realm}`, "GET", params);
-		if (response.ok) { // if ok, return user data
-			return {
-				ok: true,
-				status: response.status,
-				group: response.data.group
-			};
-		}
-		else { // else return null
-			return {
-				ok: false,
-				status: response.status,
-				message: response.data.error
-			};
-		}
-	}
-
-	async setGroup (group, attributes, params) {}
-
-	async delGroup (group, attributes, params) {}
-
-	async addUserToGroup (user, group, params) {}
-
-	async delUserFromGroup (user, group, params) {}
-
-	async addPool (pool, attributes, params) {}
-
-	async getPool (pool, params) {
-		const response = await this.#requestAPI(`/pools/${pool}`, "GET", params);
-		if (response.ok) { // if ok, return user data
-			return {
-				ok: true,
-				status: response.status,
-				pool: response.data.pool
-			};
-		}
-		else { // else return null
-			return {
-				ok: false,
-				status: response.status,
-				message: response.data.error
-			};
-		}
-	}
-
-	async setPool (pool, attributes, params) {}
-
-	async delPool (pool, params) {}
-
-	async addGroupToPool (group, pool, params) {}
-
-	async delGroupFromPool (group, pool, params) {}
-}

src/backends/backends.js

@@ -2,7 +2,7 @@ import path from "path";
 import url from "url";
 
 export default async () => {
-	global.backends = {};
+	const backends = {};
 	for (const name in global.config.backends) {
 		// get files and config
 		const target = global.config.backends[name].import;
@@ -14,50 +14,33 @@ export default async () => {
 		const importPath = `./${path.relative(thisPath, targetPath)}`;
 		// import and add to list of imported handlers
 		const Backend = (await import(importPath)).default;
-		global.backends[name] = new Backend(config);
+		backends[name] = new Backend(config);
 		console.log(`backends: initialized backend ${name} from ${importPath}`);
 	}
-	global.pve = global.backends[global.config.handlers.instance];
-	global.access = global.backends[global.config.handlers.users];
+	// assign backends to handlers by type
+	const handlers = global.config.handlers;
+	global.pve = backends[handlers.pve];
+	global.db = backends[handlers.db];
+	global.auth = handlers.auth;
+	Object.keys(global.auth).forEach((e) => {
+		global.auth[e] = backends[global.auth[e]];
+	});
 };
 
-export class AtomicChange {
-	constructor (valid, delta, callback, status = { ok: true, status: 200, message: "" }) {
-		this.valid = valid;
-		this.delta = delta;
-		this.callback = callback;
-		this.status = status;
-	}
-
-	/**
-	 * Execute the change using the saved delta using the callback function
-	 */
-	async commit () {
-		const res = await this.callback(this.delta);
-		return res;
-	}
-}
-
-export function doNothingCallback (delta) {
-	return { ok: true, status: 200, message: "" };
-}
-
 /**
  * Interface for all backend types. Contains only two methods for opening and closing a session with the backend.
  * Users will recieve tokens from all backends when first authenticating and will delete tokens when logging out.
  */
-export class BACKEND {
+class BACKEND {
 	/**
 	 * Opens a session with the backend and creates session tokens if needed
-	 * @param {{id: string, realm: string}} user object containing id and realm
-	 * @param {string} password
-	 * @returns {{ok: boolean, status: number, message: string, cookies: {name: string, value: string}[]}} response like object with list of session token objects with token name and value
+	 * @param {{username: string, password: string}} credentials object containing username and password fields
+	 * @returns {{ok: boolean, status: number, cookies: {name: string, value: string}[]}} response like object with list of session token objects with token name and value
 	 */
-	async openSession (user, password) {
+	openSession (credentials) {
 		return {
 			ok: true,
 			status: 200,
-			message: "",
 			cookies: []
 		};
 	}
@@ -67,7 +50,7 @@ export class BACKEND {
 	 * @param {{name: string, value: string}[]} token list of session token objects with token name and value, may include irrelevant tokens for a specific backend
 	 * @returns {boolean} true if session was closed successfully, false otherwise
 	 */
-	async closeSession (tokens) {
+	closeSession (tokens) {
 		return {
 			ok: true,
 			status: 200
@@ -76,228 +59,91 @@ export class BACKEND {
 }
 
 /**
- * Interface for backend types that store/interact with user, group, and pool data.
+ * Interface for backend types that store/interact with user & group data.
  * Not all backends need to implement all interface methods.
  */
-export class ACCESS_BACKEND extends BACKEND {
+class USER_BACKEND extends BACKEND {
 	/**
-	 * Validate an add user operation with the following parameters.
-	 * Returns whether the change is valid and a delta object to be used in the operation.
+	 * Add user to backend
 	 * @param {{id: string, realm: string}} user
 	 * @param {Object} attributes user attributes
 	 * @param {Object} params authentication params, usually req.cookies
-	 * @returns {AtomicChange} atomic change object
 	 */
-	async addUser (user, attributes, params) {}
-
+	addUser (user, attributes, params = null) {}
 	/**
 	 * Get user from backend
 	 * @param {{id: string, realm: string}} user
 	 * @param {Object} params authentication params, usually req.cookies
-	 * @returns {Object} containing user data from this backend, null if user does not exist
 	 */
-	async getUser (user, params) {}
-
+	getUser (user, params = null) {}
 	/**
-	 * Validate a set user operation with the following parameters.
-	 * Returns whether the change is valid and a delta object to be used in the operation.
+	 * Modify user in backend
 	 * @param {{id: string, realm: string}} user
 	 * @param {Object} attributes new user attributes to modify
 	 * @param {Object} params authentication params, usually req.cookies
-	 * @returns {AtomicChange} atomic change object
 	 */
-	async setUser (user, attributes, params) {}
-
+	setUser (user, attributes, params = null) {}
 	/**
-	 * Validate a delete user operation with the following parameters.
-	 * Returns whether the change is valid and a delta object to be used in the operation.
+	 * Delete user from backend
 	 * @param {{id: string, realm: string}} user
 	 * @param {Object} params authentication params, usually req.cookies
-	 * @returns {AtomicChange} atomic change object
 	 */
-	async delUser (user, params) {}
+	deluser (user, params = null) {}
 
 	/**
-	 * Validate an add group operation with the following parameters.
-	 * Returns whether the change is valid and a delta object to be used in the operation.
-	 * @param {{id: string, realm: string}} group
+	 * Add group to backend
+	 * @param {{id: string}} group
 	 * @param {Object} attributes group attributes
 	 * @param {Object} params authentication params, usually req.cookies
-	 * @returns {AtomicChange} atomic change object
 	 */
-	async addGroup (group, attributes, params) {}
-
+	addGroup (group, attributes, params = null) {}
 	/**
 	 * Get group from backend
-	 * @param {{id: string, realm: string}} group
+	 * @param {{id: string}} group
 	 * @param {Object} params authentication params, usually req.cookies
-	 * @returns {Object} containing group data from this backend, null if user does not exist
 	 */
-	async getGroup (group, params) {}
+	getGroup (group, params = null) {}
+	/**
+	 * Modify group in backend
+	 * @param {{id: string}} group
+	 * @param {Object} attributes new group attributes to modify
+	 * @param {Object} params authentication params, usually req.cookies
+	 */
+	setGroup (group, attributes, params = null) {}
+	/**
+	 * Delete group from backend
+	 * @param {{id: string}} group
+	 * @param {Object} params authentication params, usually req.cookies
+	 */
+	delGroup (group, params = null) {}
 
 	/**
-	 * Validate a set group operation with the following parameters.
-	 * Returns whether the change is valid and a delta object to be used in the operation.
-	 * @param {{id: string, realm: string}} group
-	 * @param {Object} attributes group attributes
-	 * @param {Object} params authentication params, usually req.cookies
-	 * @returns {AtomicChange} atomic change object
-	 */
-	async setGroup (group, attributes, params) {}
-
-	/**
-	 * Validate a del group operation with the following parameters.
-	 * Returns whether the change is valid and a delta object to be used in the operation.
-	 * @param {{id: string, realm: string}} group
-	 * @param {Object} params authentication params, usually req.cookies
-	 * @returns {AtomicChange} atomic change object
-	 */
-	async delGroup (group, attributes, params) {}
-
-	/**
-	 * Validate an add user to group operation with the following parameters.
-	 * Returns whether the change is valid and a delta object to be used in the operation.
+	 * Add user to group
 	 * @param {{id: string, realm: string}} user
-	 * @param {{id: string, realm: string}} group
+	 * @param {{id: string}} group
 	 * @param {Object} params authentication params, usually req.cookies
-	 * @returns {AtomicChange} atomic change object
 	 */
-	async addUserToGroup (user, group, params) {}
-
+	addUserToGroup (user, group, params = null) {}
 	/**
-	 * Validate a remove user from group operation with the following parameters.
-	 * Returns whether the change is valid and a delta object to be used in the operation.
+	 * Remove user from group
 	 * @param {{id: string, realm: string}} user
-	 * @param {{id: string, realm: string}} group
+	 * @param {{id: string}} group
 	 * @param {Object} params authentication params, usually req.cookies
-	 * @returns {AtomicChange} atomic change object
 	 */
-	async delUserFromGroup (user, group, params) {}
-
-	/**
-	 * Validate an add pool operation with the following parameters.
-	 * Returns whether the change is valid and a delta object to be used in the operation.
-	 * @param {{id: string, realm: string}} pool
-	 * @param {Object} attributes pool attributes
-	 * @param {Object} params authentication params, usually req.cookies
-	 * @returns {AtomicChange} atomic change object
-	 */
-	async addPool (pool, attributes, params) {}
-	
-	/**
-	 * Get pool from backend
-	 * @param {string} pool
-	 * @param {Object} params authentication params, usually req.cookies
-	 * @returns {Object} containing pool data from this backend, null if poll does not exist
-	 */
-	async getPool (pool, params) {}
-
-	/**
-	 * Validate a set pool operation with the following parameters.
-	 * Returns whether the change is valid and a delta object to be used in the operation.
-	 * @param {string} pool
-	 * @param {Object} attributes pool attributes
-	 * @param {Object} params authentication params, usually req.cookies
-	 * @returns {AtomicChange} atomic change object
-	 */
-	async setPool (pool, attributes, params) {}
-
-	/**
-	 * Validate a del pool operation with the following parameters.
-	 * Returns whether the change is valid and a delta object to be used in the operation.
-	 * @param {string} pool
-	 * @param {Object} params authentication params, usually req.cookies
-	 * @returns {AtomicChange} atomic change object
-	 */
-	async delPool (pool, params) {}
-
-	/**
-	 * Validate an add group to pool operation with the following parameters.
-	 * Returns whether the change is valid and a delta object to be used in the operation.
-	 * @param {{id: string, realm: string}} group
-	 * @param {string} pool
-	 * @param {Object} params authentication params, usually req.cookies
-	 * @returns {AtomicChange} atomic change object
-	 */
-	async addGroupToPool (group, pool, params) {}
-	
-	/**
-	 * Validate a remove group from pool operation with the following parameters.
-	 * Returns whether the change is valid and a delta object to be used in the operation.
-	 * @param {{id: string, realm: string}} group
-	 * @param {string} pool
-	 * @param {Object} params authentication params, usually req.cookies
-	 * @returns {AtomicChange} atomic change object
-	 */
-	async delGroupFromPool (group, pool, params) {}
+	delUserFromGroup (user, group, params = null) {}
 }
 
 /**
  * Interface for proxmox api backends.
  */
-export class PVE_BACKEND extends BACKEND {
-	/**
-	 * Get and return node data.
-	 * Returns the node data or null if the node does not exist.
-	 * @param {string} node node id
-	 * @returns {}
-	 */
-	async getNode (node) {}
+export class PVE_BACKEND extends BACKEND {}
 
-	/**
-	 * Send a signal to synchronize a node after some change has been made.
-	 * * @param {string} node node id
-	 */
-	async syncNode (node) {}
+/**
+ * Interface for user database backends.
+ */
+export class DB_BACKEND extends USER_BACKEND {}
 
-	/**
-	 * Get and return instance data.
-	 * Returns the instance data or null if the instance does not exist.
-	 * @param {string} node node id
-	 * @param {string} type instance type
-	 * @param {string} vmid instance id
-	 */
-	async getInstance (node, type, instance) {}
-
-	/**
-	 * Send a signal to synchronize an instance after some change has been made.
-	 * @param {string} node node id
-	 * @param {string} instance instance id
-	 */
-	async syncInstance (node, instance) {}
-
-	/**
-	 * Get meta data for a specific disk. Adds info that is not normally available in a instance's config.
-	 * @param {string} node containing the query disk.
-	 * @param {string} instance with query disk.
-	 * @param {string} disk name of the query disk, ie. sata0.
-	 * @returns {Objetc} k-v pairs of specific disk data, including storage and size of unused disks.
-	 */
-	async getDisk (node, instance, disk) {}
-
-	/**
-	 * Get meta data for a specific net. Adds info that is not normally available in a instance's config.
-	 * @param {string} node containing the query net.
-	 * @param {string} instance with query net.
-	 * @param {string} netid id number of the query net, ie. 0 -> net0.
-	 * @returns {Objetc} k-v pairs of specific net data, including rate and vlan.
-	 */
-	async getNet (node, instance, netid) {}
-
-	/**
-	 * Get meta data for a specific device. Adds info that is not normally available in a instance's config.
-	 * @param {string} node containing the query device.
-	 * @param {string} instance with query device.
-	 * @param {string} deviceid id number of the query device, ie. 0 -> pci0.
-	 * @returns {Objetc} k-v pairs of specific device data, including name and manfacturer.
-	 */
-	async getDevice (node, instance, deviceid) {}
-
-	/**
-	 * Get pool resource data including used, available, and maximum resources.
-	 * @param {string} pool 
-	 * @param {Object} cookies object containing k-v store of cookies
-	 * @returns {{used: Object, avail: Object, max: Object, resources: Object}} used, available, maximum, and resource metadata for the specified user.
-	 */
-	async getPoolResources (user, cookies) {}
-}
+/**
+ * Interface for user auth backends.
+ */
+export class AUTH_BACKEND extends USER_BACKEND {}

src/backends/localdb.js

@@ -0,0 +1,108 @@
+import { readFileSync, writeFileSync } from "fs";
+import { exit } from "process";
+import { DB_BACKEND } from "./backends.js";
+
+export default class LocalDB extends DB_BACKEND {
+	#path = null;
+	#data = null;
+	#defaultuser = null;
+
+	constructor (config) {
+		super();
+		const path = config.dbfile;
+		try {
+			this.#path = path;
+			this.#load();
+			this.#defaultuser = global.config.defaultuser;
+		}
+		catch {
+			console.log(`error: ${path} was not found. Please follow the directions in the README to initialize localdb.json.`);
+			exit(1);
+		}
+	}
+
+	/**
+	 * Load db from local file system. Reads from file path store in path.
+	 */
+	#load () {
+		this.#data = JSON.parse(readFileSync(this.#path));
+	}
+
+	/**
+	 * Save db to local file system. Saves to file path stored in path.
+	 */
+	#save () {
+		writeFileSync(this.#path, JSON.stringify(this.#data));
+	}
+
+	addUser (user, attributes, params = null) {
+		const username = `${user.id}@${user.realm}`;
+		attributes = attributes || this.#defaultuser;
+		this.#data.users[username] = attributes;
+		this.#save();
+	}
+
+	getUser (user, params = null) {
+		const username = `${user.id}@${user.realm}`;
+		if (this.#data.users[username]) {
+			return this.#data.users[username];
+		}
+		else {
+			return null;
+		}
+	}
+
+	setUser (user, attributes, params = null) {
+		const username = `${user.id}@${user.realm}`;
+		if (this.#data.users[username]) {
+			this.#data.users[username] = attributes;
+			this.#save();
+			return true;
+		}
+		else {
+			return false;
+		}
+	}
+
+	delUser (user, params = null) {
+		const username = `${user.id}@${user.realm}`;
+		if (this.#data.users[username]) {
+			delete this.#data.users[username];
+			this.#save();
+			return true;
+		}
+		else {
+			return false;
+		}
+	}
+
+	// group methods not implemented because db backend does not store groups
+	addGroup (group, atrributes, params = null) {}
+	getGroup (group, params = null) {}
+	setGroup (group, attributes, params = null) {}
+	delGroup (group, params = null) {}
+
+	// assume that adding to group also adds to group's pool
+	addUserToGroup (user, group, params = null) {
+		const username = `${user.id}@${user.realm}`;
+		if (this.#data.users[username]) {
+			this.#data.users[username].cluster.pools[group.id] = true;
+			return true;
+		}
+		else {
+			return false;
+		}
+	}
+
+	// assume that adding to group also adds to group's pool
+	delUserFromGroup (user, group, params = null) {
+		const username = `${user.id}@${user.realm}`;
+		if (this.#data.users[username] && this.#data.users[username].cluster.pools[group.id]) {
+			delete this.#data.users[username].cluster.pools[group.id];
+			return true;
+		}
+		else {
+			return false;
+		}
+	}
+}

src/backends/paasldap.js

@@ -0,0 +1,111 @@
+import axios from "axios";
+import { AUTH_BACKEND } from "./backends.js";
+import * as setCookie from "set-cookie-parser";
+
+export default class PAASLDAP extends AUTH_BACKEND {
+	#url = null;
+
+	constructor (config) {
+		super();
+		this.#url = config.url;
+	}
+
+	/**
+	 * Send HTTP request to paas-LDAP API.
+	 * @param {*} path  HTTP path, prepended with the paas-LDAP API base url
+	 * @param {*} method HTTP method
+	 * @param {*} body body parameters and data to be sent. Optional.
+	 * @returns {Object} HTTP response object or HTTP error object.
+	 */
+	async #request (path, method, auth = null, body = null) {
+		const url = `${this.#url}${path}`;
+		const content = {
+			method,
+			mode: "cors",
+			credentials: "include",
+			headers: {
+				"Content-Type": "application/x-www-form-urlencoded"
+			},
+			data: body
+		};
+
+		if (auth) {
+			content.headers.Cookie = `PAASLDAPAuthTicket=${auth.PAASLDAPAuthTicket};`;
+		}
+
+		try {
+			const result = await axios.request(url, content);
+			result.ok = result.status === 200;
+			return result;
+		}
+		catch (error) {
+			error.ok = false;
+			error.status = 500;
+			error.data = {
+				error: error.code
+			};
+			return error;
+		}
+	}
+
+	async openSession (credentials) {
+		const userRealm = credentials.username.split("@").at(-1);
+		const uid = credentials.username.replace(`@${userRealm}`, "");
+		const content = { uid, password: credentials.password };
+		const result = await this.#request("/ticket", "POST", null, content);
+		if (result.ok) {
+			const cookies = setCookie.parse(result.headers["set-cookie"]);
+			cookies.forEach((e) => {
+				e.expiresMSFromNow = e.expires - Date.now();
+			});
+			return {
+				ok: true,
+				status: result.status,
+				cookies
+			};
+		}
+		else {
+			return result;
+		}
+	}
+
+	async addUser (user, attributes, params = null) {
+		return await this.#request(`/users/${user.id}`, "POST", params, attributes);
+	}
+
+	async getUser (user, params = null) {
+		return await this.#request(`/users/${user.id}`, "GET", params);
+	}
+
+	async setUser (user, attributes, params = null) {
+		return await this.#request(`/users/${user.id}`, "POST", params, attributes);
+	}
+
+	async delUser (user, params = null) {
+		return await this.#request(`/users/${user.id}`, "DELETE", params);
+	}
+
+	async addGroup (group, attributes, params = null) {
+		return await this.#request(`/groups/${group.id}`, "POST", params);
+	}
+
+	async getGroup (group, params = null) {
+		return await this.#request(`/groups/${group.id}`, "GET", params);
+	}
+
+	async setGroup (group, attributes, params = null) {
+		// not implemented, LDAP groups do not have any attributes to change
+	}
+
+	async delGroup (group, params = null) {
+		return await this.#request(`/groups/${group.id}`, "DELETE", params);
+	}
+
+	async addUserToGroup (user, group, params = null) {
+		return await this.#request(`/groups/${group.id}/members/${user.id}`, "POST", params);
+	}
+
+	async delUserFromGroup (user, group, params = null) {
+		return await this.#request(`/groups/${group.id}/members/${user.id}`, "DELETE", params);
+	}
+}

src/backends/pve.js

@@ -5,29 +5,21 @@ export default class PVE extends PVE_BACKEND {
 	#pveAPIURL = null;
 	#pveAPIToken = null;
 	#pveRoot = null;
-	#paasFabric = null;
 
 	constructor (config) {
 		super();
 		this.#pveAPIURL = config.url;
 		this.#pveAPIToken = config.token;
 		this.#pveRoot = config.root;
-		this.#paasFabric = config.fabric;
 	}
 
-	async openSession (user, password) {
-		const credentials = { username: `${user.id}@${user.realm}`, password };
+	async openSession (credentials) {
 		const response = await global.pve.requestPVE("/access/ticket", "POST", null, credentials);
 		if (!(response.status === 200)) {
-			return {
-				ok: false,
-				status: response.status,
-				message: "Authorization failed",
-				cookies: []
-			};
+			return response;
 		}
-		const ticket = response.data.ticket;
-		const csrftoken = response.data.CSRFPreventionToken;
+		const ticket = response.data.data.ticket;
+		const csrftoken = response.data.data.CSRFPreventionToken;
 		return {
 			ok: true,
 			status: response.status,
@@ -66,68 +58,20 @@ export default class PVE extends PVE_BACKEND {
 			data: body
 		};
 
-		if (auth && auth.cookies) { // user cookie credentials
+		if (auth && auth.cookies) {
 			content.headers.CSRFPreventionToken = auth.cookies.CSRFPreventionToken;
 			content.headers.Cookie = `PVEAuthCookie=${auth.cookies.PVEAuthCookie}; CSRFPreventionToken=${auth.cookies.CSRFPreventionToken}`;
 		}
-		else if (auth && auth.token) { // upgraded request as api
+		else if (auth && auth.token) {
 			const token = this.#pveAPIToken;
 			content.headers.Authorization = `PVEAPIToken=${token.user}@${token.realm}!${token.id}=${token.uuid}`;
 		}
-		else if (auth && auth.root) { // upgraded request as root
-			const rootauth = await this.requestPVE("/access/ticket", "POST", null, this.#pveRoot);
-			if (!(rootauth.status === 200)) {
-				return rootauth.response;
-			}
-			const rootcookie = rootauth.data.ticket;
-			const rootcsrf = rootauth.data.CSRFPreventionToken;
-			content.headers.CSRFPreventionToken = rootcsrf;
-			content.headers.Cookie = `PVEAuthCookie=${rootcookie}; CSRFPreventionToken=${rootcsrf}`;
-		}
-
-		try {
-			const result = await axios.request(url, content);
-			return {
-				ok: result.ok,
-				status: result.status,
-				data: result.data.data, // pve returns {data: {data: {...}}}, unwrap here to conform to standard {data: {...}} format
-				headers: result.headers
-			};
-		}
-		catch (error) {
-			console.log(`pve: error ocuured in pve.requestPVE: ${method} ${path} resulted in ${error}`);
-			const result = error.response;
-			result.ok = result.status === 200;
-			return result;
-		}
-	}
-
-	/**
-	 * Send HTTP request to PAAS Fabric
-	 * @param {string} path HTTP path, prepended with the proxmox API base url.
-	 * @param {string} method HTTP method.
-	 * @param {Object} auth authentication method. Set auth.cookies with user cookies or auth.token with PVE API Token. Optional.
-	 * @param {string} body body parameters and data to be sent. Optional.
-	 * @returns {Object} HTTP response object or HTTP error object.
-	 */
-	async requestFabric (path, method, body = null) {
-		const url = `${this.#paasFabric}${path}`;
-		const content = {
-			method,
-			mode: "cors",
-			credentials: "include",
-			headers: {
-				"Content-Type": "application/x-www-form-urlencoded"
-			},
-			data: body
-		};
 
 		try {
 			return await axios.request(url, content);
 		}
 		catch (error) {
-			console.log(`pve: error ocuured in pve.requestFabric: ${method} ${path} resulted in ${error}`);
-			return error;
+			return error.response;
 		}
 	}
 
@@ -141,28 +85,24 @@ export default class PVE extends PVE_BACKEND {
 	 */
 	async handleResponse (node, result, res) {
 		const waitFor = delay => new Promise(resolve => setTimeout(resolve, delay));
-		if (result.status !== 200) {
-			res.status(result.status).send({ error: result.statusText });
-			res.end();
-		}
-		else if (result.data && typeof (result.data) === "string" && result.data.startsWith("UPID:")) {
-			const upid = result.data;
+		if (result.data.data && typeof (result.data.data) === "string" && result.data.data.startsWith("UPID:")) {
+			const upid = result.data.data;
 			let taskStatus = await this.requestPVE(`/nodes/${node}/tasks/${upid}/status`, "GET", { token: true });
-			while (taskStatus.data.status !== "stopped") {
-				await waitFor(100);
+			while (taskStatus.data.data.status !== "stopped") {
+				await waitFor(1000);
 				taskStatus = await this.requestPVE(`/nodes/${node}/tasks/${upid}/status`, "GET", { token: true });
 			}
-			if (taskStatus.data.exitstatus === "OK") {
-				const result = taskStatus.data;
+			if (taskStatus.data.data.exitstatus === "OK") {
+				const result = taskStatus.data.data;
 				const taskLog = await this.requestPVE(`/nodes/${node}/tasks/${upid}/log`, "GET", { token: true });
-				result.log = taskLog.data;
+				result.log = taskLog.data.data;
 				res.status(200).send(result);
 				res.end();
 			}
 			else {
-				const result = taskStatus.data;
+				const result = taskStatus.data.data;
 				const taskLog = await this.requestPVE(`/nodes/${node}/tasks/${upid}/log`, "GET", { token: true });
-				result.log = taskLog.data;
+				result.log = taskLog.data.data;
 				res.status(500).send(result);
 				res.end();
 			}
@@ -173,97 +113,83 @@ export default class PVE extends PVE_BACKEND {
 		}
 	}
 
-	async getNode (node) {
-		const res = await this.requestFabric(`/nodes/${node}`, "GET");
-		if (res.status !== 200) {
-			console.error(res);
-			return null;
+	/**
+	 * Get meta data for a specific disk. Adds info that is not normally available in a instance's config.
+	 * @param {string} node containing the query disk.
+	 * @param {string} config of instance with query disk.
+	 * @param {string} disk name of the query disk, ie. sata0.
+	 * @returns {Objetc} k-v pairs of specific disk data, including storage and size of unused disks.
+	 */
+	async getDiskInfo (node, config, disk) {
+		try {
+			const storageID = config[disk].split(":")[0];
+			const volID = config[disk].split(",")[0];
+			const volInfo = await this.requestPVE(`/nodes/${node}/storage/${storageID}/content/${volID}`, "GET", { token: true });
+			volInfo.data.data.storage = storageID;
+			return volInfo.data.data;
 		}
-
-		return res.data.node;
-	}
-
-	async syncNode (node) {
-		this.requestFabric(`/nodes/${node}/sync`, "POST");
-	}
-
-	async getInstance (node, instance) {
-		const res = await this.requestFabric(`/nodes/${node}/instances/${instance}`, "GET");
-		if (res.status !== 200) {
-			console.error(res);
-			return null;
-		}
-
-		return res.data.instance;
-	}
-
-	async syncInstance (node, vmid) {
-		this.requestFabric(`/nodes/${node}/instances/${vmid}/sync`, "POST");
-	}
-
-	async getDisk (node, instance, disk) {
-		const config = await this.getInstance(node, instance);
-		if (config !== null && config.volumes[disk] !== null) {
-			return config.volumes[disk];
-		}
-		else {
+		catch {
 			return null;
 		}
 	}
 
-	async getNet (node, instance, netid) {
-		const config = await this.getInstance(node, instance);
-		if (config !== null && config.nets[netid] !== null) {
-			return config.nets[netid];
-		}
-		else {
-			return null;
-		}
-	}
-
-	async getDevice (node, instance, deviceid) {
-		const config = await this.getInstance(node, instance);
-		if (config !== null && config.devices[deviceid] !== null) {
-			return config.devices[deviceid];
-		}
-		else {
-			return null;
-		}
-	}
-
-	async getPoolResources (cookies, pool) {
-		// get pool resources
-		const res = await this.requestPVE(`/pools/?poolid=${pool}`, "GET", { cookies });
-		if (res.status !== 200) {
-			return null;
-		}
-		const data = res.data;
-		if (data.length !== 1) {
-			return null;
-		}
-		const poolPVE = data[0];
-		if (poolPVE.poolid !== pool) {
-			return null;
-		}
-
-		const poolPVEResources = poolPVE.members;
-		const resources = {};
-
-		// for each resource, add to the object
-		for (const resource of poolPVEResources) {
-			// only add type if it is vm or ct (ie has vmid)
-			if (resource.vmid) {
-				const instance = await this.getInstance(resource.node, resource.vmid);
-				if (instance === null) {
-					return null;
+	/**
+	 * Get meta data for a specific pci device. Adds info that is not normally available in a instance's config.
+	 * @param {string} node containing the query device.
+	 * @param {string} qid pci bus id number of the query device, ie. 89ab:cd:ef.0.
+	 * @returns {Object} k-v pairs of specific device data, including device name and manufacturer.
+	 */
+	async getDeviceInfo (node, qid) {
+		try {
+			const result = (await this.requestPVE(`/nodes/${node}/hardware/pci`, "GET", { token: true })).data.data;
+			const deviceData = [];
+			result.forEach((element) => {
+				if (element.id.startsWith(qid)) {
+					deviceData.push(element);
 				}
-				else {
-					instance.node = resource.node;
-					resources[resource.vmid] = instance;
-				}
-			}
+			});
+			deviceData.sort((a, b) => {
+				return a.id < b.id;
+			});
+			const device = deviceData[0];
+			device.subfn = structuredClone(deviceData.slice(1));
+			return device;
 		}
-		
-		return resources;
+		catch {
+			return null;
+		}
+	}
+
+	/**
+	 * Get available devices on specific node.
+	 * @param {string} node to get devices from.
+	 * @returns {Array.<Object>} array of k-v pairs of specific device data, including device name and manufacturer, which are available on the specified node.
+	 */
+	async getNodeAvailDevices (node) {
+		// get node pci devices
+		let nodeAvailPci = this.requestPVE(`/nodes/${node}/hardware/pci`, "GET", { token: true });
+		// for each node container, get its config and remove devices which are already used
+		const vms = (await this.requestPVE(`/nodes/${node}/qemu`, "GET", { token: true })).data.data;
+
+		const promises = [];
+		for (const vm of vms) {
+			promises.push(this.requestPVE(`/nodes/${node}/qemu/${vm.vmid}/config`, "GET", { token: true }));
+		}
+		const configs = await Promise.all(promises);
+		configs.forEach((e, i) => {
+			configs[i] = e.data.data;
+		});
+
+		nodeAvailPci = (await nodeAvailPci).data.data;
+
+		for (const config of configs) {
+			Object.keys(config).forEach((key) => {
+				if (key.startsWith("hostpci")) {
+					const deviceID = config[key].split(",")[0];
+					nodeAvailPci = nodeAvailPci.filter(element => !element.id.includes(deviceID));
+				}
+			});
+		}
+		return nodeAvailPci;
 	}
 }

src/main.js

@@ -41,3 +41,12 @@ global.utils.recursiveImportRoutes(app, "/api", "routes");
 app.get("/api/version", (req, res) => {
 	res.status(200).send({ version: global.package.version });
 });
+
+/**
+ * GET - echo request
+ * responses:
+ * - 200: {body: request.body, cookies: request.cookies}
+ */
+app.get("/api/echo", (req, res) => {
+	res.status(200).send({ body: req.body, cookies: req.cookies });
+});

src/routes/access/groups.js

@@ -1,37 +0,0 @@
-import { Router } from "express";
-export const router = Router({ mergeParams: true });
-
-/**
- * GET - get specific group
- * request:
- * - groupname: name of group to get
- * responses:
- * - 200: {auth: true, group: Object}
- * - 401: {auth: false}
- */
-router.get("/:groupname", async (req, res) => {
-	const params = {
-		groupname: req.params.groupname
-	};
-	// check auth
-	const auth = await global.utils.checkAuth(req.cookies, res);
-	if (!auth) {
-		return;
-	}
-
-	// attempt to parse group from groupname
-	const groupObj = global.utils.getGroupObjFromGroupname(params.groupname);
-	if (groupObj === null) {
-		res.status(400).send({ auth: true, error:`Groupname ${params.groupname} does not match format gid-realm or gid.` });
-	}
-	
-	// get group
-	const g = await global.access.getGroup(groupObj, req.cookies);
-	if (g.ok !== true) {
-		res.status(g.status).send({ auth:true, error:g });
-		return;
-	}
-	const group = g.group;
-
-	res.status(200).send({ auth:true, group });
-});

src/routes/access/pools.js

@@ -1,78 +0,0 @@
-import { Router } from "express";
-export const router = Router({ mergeParams: true });
-
-/**
- * GET - get all available cluster pools
- * returns only pool IDs
- * responses:
- * - 200: List of pools
- * - PVE error
- */
-router.get("/", async (req, res) => {
-	// check auth
-	const auth = await global.utils.checkAuth(req.cookies, res);
-	if (!auth) {
-		return;
-	}
-
-	// get user object
-	const userObj = global.utils.getUserObjFromUsername(req.cookies.username);
-
-	// get all pool names using api token
-	const poolnames = await global.pve.requestPVE("/pools", "GET", { token: true });
-
-	// setup pools (return value)
-	const pools = {};
-	// for each poolname
-	for (const poolpartial of poolnames.data) {
-		const poolname = poolpartial.poolid;
-		// get the pool
-		const p = await global.access.getPool(poolname, req.cookies);
-		if (p.ok !== true) {
-			continue;
-		}
-		const pool = p.pool;
-		// if user is in the pool, add it to pools (return value)
-		if (global.utils.checkUserInPool(pool, userObj)) {
-			const resources = await global.utils.getPoolResources(req, poolname);
-			pool.resources = resources;
-			pools[poolname] = pool;
-		}
-	}
-
-	res.status(200).send({ pools });
-	res.end();
-});
-
-/**
- * GET - get specific pool
- * request:
- * - poolname: name of pool to get
- * responses:
- * - 200: {auth: true, pool: Object}
- * - 401: {auth: false}
- */
-router.get("/:poolname", async (req, res) => {
-	const params = {
-		poolname: req.params.poolname
-	};
-	// check auth
-	const auth = await global.utils.checkAuth(req.cookies, res);
-	if (!auth) {
-		return;
-	}
-
-	// get pool
-	const p = await global.access.getPool(params.poolname, req.cookies);
-	if (p.ok !== true) {
-		res.status(p.status).send({ auth:true, error: p });
-		return;
-	}
-	const pool = p.pool;
-	// get resources
-	const resources = await global.utils.getPoolResources(req, params.poolname);
-	// append resources to pool
-	pool.resources = resources;
-
-	res.status(200).send({ auth: true, pool });
-});

src/routes/access/users.js

@@ -1,116 +0,0 @@
-import { Router } from "express";
-export const router = Router({ mergeParams: true });
-
-const config = global.config;
-const checkAuth = global.utils.checkAuth;
-
-/**
- * GET - get specific user
- * request:
- * - username: username (id@realm) of user to get
- * responses:
- * - 200: {auth: true, user: Object}
- * - 401: {auth: false}
- */
-router.get("/:username", async (req, res) => {
-	const params = {
-		username: req.params.username
-	};
-	// check auth
-	const auth = await global.utils.checkAuth(req.cookies, res);
-	if (!auth) {
-		return;
-	}
-
-	// attempt to parse user from username
-	const userObj = global.utils.getUserObjFromUsername(params.username);
-	if (userObj === null) {
-		res.status(400).send({ auth:true, error:`username ${params.username} does not match format uid@realm.` });
-	}
-
-	// get user
-	const u = await global.access.getUser(userObj, req.cookies);
-	if (u.ok !== true) {
-		res.status(u.status).send({ auth: true, error: u });
-		return;
-	}
-	const user = u.user;
-
-	res.status(200).send({ user });
-});
-
-/**
- * GET - get user accessible iso files
- * response:
- * - 200: Array.<Object>
- * - 401: {auth: false}
- */
-router.get("/:username/vm-isos", async (req, res) => {
-	const params = {
-		username: req.params.username
-	};
-	// check auth
-	const auth = await checkAuth(req.cookies, res);
-	if (!auth) {
-		return;
-	}
-	// check requested username is current user
-	if (req.cookies.username !== params.username) {
-		res.status(401).send({ auth: false  });
-		return;
-	}
-	// get user iso config
-	const userIsoConfig = config.useriso;
-	// get all isos
-	const content = await global.pve.requestPVE(`/nodes/${userIsoConfig.node}/storage/${userIsoConfig.storage}/content?content=iso`, "GET", { token: true });
-	if (content.status !== 200) {
-		res.status(content.status).send({ error: content.statusText });
-		return;
-	}
-	const isos = content.data;
-	const userIsos = [];
-	isos.forEach((iso) => {
-		iso.name = iso.volid.replace(`${userIsoConfig.storage}:iso/`, "");
-		userIsos.push(iso);
-	});
-	userIsos.sort();
-	res.status(200).send(userIsos);
-});
-
-/**
- * GET - get user accessible container template files
- * response:
- * - 200: Array.<Object>
- * - 401: {auth: false}
- */
-router.get("/:username/ct-templates", async (req, res) => {
-	const params = {
-		username: req.params.username
-	};
-	// check auth
-	const auth = await checkAuth(req.cookies, res);
-	if (!auth) {
-		return;
-	}
-	// check requested username is current user
-	if (req.cookies.username !== params.username) {
-		res.status(401).send({ auth: false  });
-		return;
-	}
-	// get user iso config
-	const userIsoConfig = config.useriso;
-	// get all isos
-	const content = await global.pve.requestPVE(`/nodes/${userIsoConfig.node}/storage/${userIsoConfig.storage}/content?content=vztmpl`, "GET", { token: true });
-	if (content.status !== 200) {
-		res.status(content.status).send({ error: content.statusText });
-		return;
-	}
-	const isos = content.data;
-	const userIsos = [];
-	isos.forEach((iso) => {
-		iso.name = iso.volid.replace(`${userIsoConfig.storage}:vztmpl/`, "");
-		userIsos.push(iso);
-	});
-	userIsos.sort();
-	res.status(200).send(userIsos);
-});

src/routes/auth.js

@@ -3,8 +3,6 @@ export const router = Router({ mergeParams: true }); ;
 
 const checkAuth = global.utils.checkAuth;
 
-global.utils.recursiveImportRoutes(router, "", "access", import.meta.url);
-
 /**
  * GET - check authentication
  * responses:
@@ -25,12 +23,12 @@ router.get("/", async (req, res) => {
 class CookieFetcher {
 	#fetchedBackends = [];
 	#cookies = [];
-	async fetchBackends (backends, user, password) {
+	async fetchBackends (backends, credentials) {
 		for (const backend of backends) {
 			if (this.#fetchedBackends.indexOf(backend) === -1) {
-				const response = await global.backends[backend].openSession(user, password);
+				const response = await backend.openSession(credentials);
 				if (!response.ok) {
-					return response.message;
+					return false;
 				}
 				this.#cookies = this.#cookies.concat(response.cookies);
 				this.#fetchedBackends.push(backend);
@@ -39,7 +37,7 @@ class CookieFetcher {
 				continue;
 			}
 		}
-		return null;
+		return true;
 	}
 
 	exportCookies () {
@@ -61,37 +59,25 @@ router.post("/ticket", async (req, res) => {
 		username: req.body.username,
 		password: req.body.password
 	};
-
-	// get user and user backends from config
-	const userObj = global.utils.getUserObjFromUsername(params.username);
-	const backends = [global.config.handlers.users, global.config.handlers.instance];
-
-	// fetch cookies using cookie fetcher
+	const domain = global.config.application.domain;
+	const userRealm = params.username.split("@").at(-1);
+	const backends = [global.pve, global.db];
+	if (userRealm in global.auth) {
+		backends.push(global.auth[userRealm]);
+	}
 	const cm = new CookieFetcher();
-	const error = await cm.fetchBackends(backends, userObj, params.password);
-	if (error) {
-		res.status(401).send({ auth: false, error });
+	const success = await cm.fetchBackends(backends, params);
+	if (!success) {
+		res.status(401).send({ auth: false });
 		return;
 	}
 	const cookies = cm.exportCookies();
-
-	// get global config domain name
-	const domain = global.config.application.domain;
-
-	// for each cookie, add the cookie to response and also compute the minimum across all cookies 
-	let minimumExpires = Infinity;
 	for (const cookie of cookies) {
 		const expiresDate = new Date(Date.now() + cookie.expiresMSFromNow);
-		res.cookie(cookie.name, cookie.value, { domain, path: "/", httpOnly: true, secure: true, expires: expiresDate, sameSite: "none" });
-		if (cookie.expiresMSFromNow < minimumExpires) {
-			minimumExpires = cookie.expiresMSFromNow;
-		}
+		res.cookie(cookie.name, cookie.value, { domain, path: "/", httpOnly: true, secure: true, expires: expiresDate });
 	}
-
-	// set username and auth cookie with the minimum cookie length
-	const expiresDate = new Date(Date.now() + minimumExpires);
-	res.cookie("username", params.username, { domain, path: "/", secure: true, expires: expiresDate, sameSite: "none" });
-	res.cookie("auth", 1, { domain, path: "/", secure: true, expires: expiresDate, sameSite: "none" });
+	res.cookie("username", params.username, { domain, path: "/", secure: true });
+	res.cookie("auth", 1, { domain, path: "/", secure: true });
 	res.status(200).send({ auth: true });
 });
 
@@ -101,22 +87,17 @@ router.post("/ticket", async (req, res) => {
  * - 200: {auth: false}
  */
 router.delete("/ticket", async (req, res) => {
-	// must have cookies to delete, otherwise just return ok
 	if (Object.keys(req.cookies).length === 0) {
 		res.status(200).send({ auth: false });
 		return;
 	}
-
-	// for each cookie, set the expire date to 0
 	const domain = global.config.application.domain;
 	const expire = new Date(0);
 	for (const cookie in req.cookies) {
-		res.cookie(cookie, "", { domain, path: "/", expires: expire, secure: true, sameSite: "none" });
+		res.cookie(cookie, "", { domain, path: "/", expires: expire });
 	}
-
-	// call close session on each backend, even if was not used
 	await global.pve.closeSession(req.cookies);
-	await global.access.closeSession(req.cookies);
+	await global.db.closeSession(req.cookies);
 	res.status(200).send({ auth: false });
 });
 
@@ -133,16 +114,24 @@ router.post("/password", async (req, res) => {
 		password: req.body.password
 	};
 
-	// check auth
-	const auth = await checkAuth(req.cookies, res);
-	if (!auth) {
-		return;
+	const userRealm = params.username.split("@").at(-1);
+	const authHandlers = global.config.handlers.auth;
+	const userID = params.username.replace(`@${userRealm}`, "");
+	const userObj = { id: userID, realm: userRealm };
+	if (userRealm in authHandlers) {
+		const handler = authHandlers[userRealm];
+		const newAttributes = {
+			userpassword: params.password
+		};
+		const response = await handler.setUser(userObj, newAttributes, req.cookies);
+		if (response.ok) {
+			res.status(response.status).send(response.data);
+		}
+		else {
+			res.status(response.status).send({ error: response.data.error });
+		}
+	}
+	else {
+		res.status(501).send({ error: `Auth type ${userRealm} not implemented yet.` });
 	}
-
-	const userObj = global.utils.getUserObjFromUsername(params.username);
-	const newAttributes = {
-		userpassword: params.password
-	};
-	const response = await global.access.setUser(userObj, newAttributes, req.cookies);
-	res.status(response.status).send(response);
 });

src/routes/cluster.js

@@ -1,6 +1,11 @@
 import { Router } from "express";
 export const router = Router({ mergeParams: true });
 
+const db = global.db;
+const checkAuth = global.utils.checkAuth;
+const approveResources = global.utils.approveResources;
+const getUserResources = global.utils.getUserResources;
+
 const nodeRegexP = "[\\w-]+";
 const typeRegexP = "qemu|lxc";
 const vmidRegexP = "\\d+";
@@ -10,60 +15,44 @@ const basePath = `/:node(${nodeRegexP})/:type(${typeRegexP})/:vmid(${vmidRegexP}
 global.utils.recursiveImportRoutes(router, basePath, "cluster", import.meta.url);
 
 /**
- * GET - get all available cluster nodes
- * uses existing user permissions without elevation
- * returns only node IDs
- * responses:
- * - 200: List of nodes
- * - PVE error
- */
-router.get("/nodes", async (req, res) => {
-	// check auth
-	const auth = await global.utils.checkAuth(req.cookies, res);
-	if (!auth) {
-		return;
-	}
-
-	// get all nodes
-	const allNodes = await global.pve.requestPVE("/nodes", "GET", { cookies: req.cookies });
-	if (allNodes.status === 200) {
-		const allNodesIDs = Array.from(allNodes.data, (x) => x.node);
-		res.status(allNodes.status).send({ nodes: allNodesIDs });
-		res.end();
-	}
-	else {
-		res.status(allNodes.status).send({ error: allNodes.statusText });
-		res.end();
-	}
-});
-
-/**
- * GET - get basic resources for vm using the fabric format
+ * GET - get available pcie devices given node and user
  * request:
  * - node: string - vm host node id
- * - type: string - vm type (lxc, qemu)
- * - vmid: number - vm id number
- * response:
- * - 200: Fabric instance config
+ * responses:
+ * - 200: PVE PCI Device Object
  * - 401: {auth: false}
+ * - 401: {auth: false, path: string}
+ * - 500: {error: string}
  */
-router.get(`${basePath}`, async (req, res) => {
+router.get(`/:node(${nodeRegexP})/pci`, async (req, res) => {
 	const params = {
-		node: req.params.node,
-		type: req.params.type,
-		vmid: req.params.vmid
+		node: req.params.node
 	};
 
-	// check auth for specific instance
-	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
+	const userRealm = req.cookies.username.split("@").at(-1);
+	const userID = req.cookies.username.replace(`@${userRealm}`, "");
+	const userObj = { id: userID, realm: userRealm };
+
+	// check auth
+	const auth = await checkAuth(req.cookies, res);
 	if (!auth) {
 		return;
 	}
-
-	// get current config
-	const instance = await global.pve.getInstance(params.node, params.vmid);
-	res.status(200).send(instance);
+	const userNodes = db.getUser(userObj).cluster.nodes;
+	if (userNodes[params.node] !== true) {
+		res.status(401).send({ auth: false, path: params.node });
+		res.end();
+		return;
+	}
+	// get remaining user resources
+	const userAvailPci = (await getUserResources(req, userObj)).pci.nodes[params.node];
+	// get node avail devices
+	let nodeAvailPci = await global.pve.getNodeAvailDevices(params.node, req.cookies);
+	nodeAvailPci = nodeAvailPci.filter(nodeAvail => userAvailPci.some((userAvail) => {
+		return nodeAvail.device_name && nodeAvail.device_name.includes(userAvail.match) && userAvail.avail > 0;
+	}));
+	res.status(200).send(nodeAvailPci);
+	res.end();
 });
 
 /**
@@ -78,8 +67,8 @@ router.get(`${basePath}`, async (req, res) => {
  * - swap: number, optional - new amount of swap for instance
  * responses:
  * - 200: PVE Task Object
- * - 400: {request; Object, error: string, reason: Object}
  * - 401: {auth: false, path: string}
+ * - 500: {request: Object, error: string}
  * - 500: PVE Task Object
  */
 router.post(`${basePath}/resources`, async (req, res) => {
@@ -94,34 +83,34 @@ router.post(`${basePath}/resources`, async (req, res) => {
 		boot: req.body.boot
 	};
 
+	const userRealm = req.cookies.username.split("@").at(-1);
+	const userID = req.cookies.username.replace(`@${userRealm}`, "");
+	const userObj = { id: userID, realm: userRealm };
+
 	// check auth for specific instance
 	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
+	const auth = await checkAuth(req.cookies, res, vmpath);
 	if (!auth) {
 		return;
 	}
 	// get current config
-	const instance = await global.pve.getInstance(params.node, params.vmid);
+	const currentConfig = await global.pve.requestPVE(`/nodes/${params.node}/${params.type}/${params.vmid}/config`, "GET", { token: true });
 	const request = {
-		cores: Number(params.cores) - Number(instance.cores),
-		memory: Number(params.memory) - Number(instance.memory)
+		cores: Number(params.cores) - Number(currentConfig.data.data.cores),
+		memory: Number(params.memory) - Number(currentConfig.data.data.memory)
 	};
 	if (params.type === "lxc") {
-		request.swap = Number(params.swap) - Number(instance.swap);
+		request.swap = Number(params.swap) - Number(currentConfig.data.data.swap);
 	}
 	else if (params.type === "qemu") {
 		request.cpu = params.proctype;
 	}
-
 	// check resource approval
-	const userObj = global.utils.getUserObjFromUsername(req.cookies.username);
-	const { approved, reason } = await global.utils.approveResources(req, userObj, params.node, instance.pool, request);
-	if (!approved) {
-		res.status(400).send({ request, error: "Not enough resources to satisfy request.", reason });
+	if (!await approveResources(req, userObj, request, params.node)) {
+		res.status(500).send({ request, error: "Could not fulfil request." });
 		res.end();
 		return;
 	}
-
 	// setup action
 	const action = { cores: params.cores, memory: params.memory };
 	if (params.type === "lxc") {
@@ -132,11 +121,9 @@ router.post(`${basePath}/resources`, async (req, res) => {
 		action.boot = `order=${params.boot.toString().replaceAll(",", ";")};`;
 	}
 	const method = params.type === "qemu" ? "POST" : "PUT";
-
 	// commit action
 	const result = await global.pve.requestPVE(`${vmpath}/config`, method, { token: true }, action);
 	await global.pve.handleResponse(params.node, result, res);
-	await global.pve.syncInstance(params.node, params.vmid);
 });
 
 /**
@@ -156,9 +143,9 @@ router.post(`${basePath}/resources`, async (req, res) => {
  * - rootfssize: number, optional, - size of lxc instance rootfs
  * responses:
  * - 200: PVE Task Object
- * - 400: {request: Object, error: string, reason: Object}
  * - 401: {auth: false, path: string}
  * - 500: {error: string}
+ * - 500: {request: Object, error: string}
  * - 500: PVE Task Object
  */
 router.post(`${basePath}/create`, async (req, res) => {
@@ -178,52 +165,50 @@ router.post(`${basePath}/create`, async (req, res) => {
 		rootfssize: req.body.rootfssize
 	};
 
+	const userRealm = req.cookies.username.split("@").at(-1);
+	const userID = req.cookies.username.replace(`@${userRealm}`, "");
+	const userObj = { id: userID, realm: userRealm };
+
 	// check auth
-	const auth = await global.utils.checkAuth(req.cookies, res);
+	const auth = await checkAuth(req.cookies, res);
 	if (!auth) {
 		return;
 	}
-
-	// get pool config
-	const pool = (await global.access.getPool(params.pool, req.cookies)).pool;
+	// get user db config
+	const user = await db.getUser(userObj);
 	const vmid = Number.parseInt(params.vmid);
-	const vmidMin = pool["vmid-allowed"].min;
-	const vmidMax = pool["vmid-allowed"].max;
-
+	const vmidMin = user.cluster.vmid.min;
+	const vmidMax = user.cluster.vmid.max;
 	// check vmid is within allowed range
 	if (vmid < vmidMin || vmid > vmidMax) {
 		res.status(500).send({ error: `Requested vmid ${vmid} is out of allowed range [${vmidMin},${vmidMax}].` });
 		res.end();
 		return;
 	}
-
 	// check node is within allowed list
-	if (pool["nodes-allowed"][params.node] !== true) {
-		res.status(500).send({ error: `Requested node ${params.node} is not in allowed nodes [${pool["nodes-allowed"]}].` });
+	if (user.cluster.nodes[params.node] !== true) {
+		res.status(500).send({ error: `Requested node ${params.node} is not in allowed nodes [${user.cluster.nodes}].` });
 		res.end();
 		return;
 	}
-
-	// check if user is in pool
-	const userObj = global.utils.getUserObjFromUsername(req.cookies.username);
-	if(global.utils.checkUserInPool(pool, userObj) !== true) {
-		res.status(500).send({ error: `Requested pool ${params.pool} does not contain user ${req.cookies.username}]` });
+	// check if pool is in user allowed pools
+	if (user.cluster.pools[params.pool] !== true) {
+		res.status(500).send({ error: `Requested pool ${params.pool} not in allowed pools [${user.pools}]` });
 		res.end();
 		return;
 	}
-
 	// setup request
 	const request = {
 		cores: Number(params.cores),
-		memory: Number(params.memory) * 1024 ** 2
+		memory: Number(params.memory)
 	};
 	if (params.type === "lxc") {
-		request.swap = Number(params.swap) * 1024 ** 2;
-		request[params.rootfslocation] = params.rootfssize * 1024 ** 3;
+		request.swap = params.swap;
+		request[params.rootfslocation] = params.rootfssize;
 	}
-	for (const key of Object.keys(pool.templates.instances[params.type])) {
-		const item = pool.templates.instances[params.type][key];
-		if (item.resource.enabled) {
+	for (const key of Object.keys(user.templates.instances[params.type])) {
+		const item = user.templates.instances[params.type][key];
+		if (item.resource) {
 			if (request[item.resource.name]) {
 				request[item.resource.name] += item.resource.amount;
 			}
@@ -232,15 +217,12 @@ router.post(`${basePath}/create`, async (req, res) => {
 			}
 		}
 	}
-
 	// check resource approval
-	const { approved, reason } = await await global.utils.approveResources(req, userObj, params.node, params.pool, request);
-	if (!approved) {
-		res.status(400).send({ request, error: "Not enough resources to satisfy request.", reason });
+	if (!await approveResources(req, userObj, request, params.node)) { // check resource approval
+		res.status(500).send({ request, error: "Not enough resources to satisfy request." });
 		res.end();
 		return;
 	}
-
 	// setup action by adding non resource values
 	const action = {
 		vmid: params.vmid,
@@ -248,11 +230,10 @@ router.post(`${basePath}/create`, async (req, res) => {
 		memory: Number(params.memory),
 		pool: params.pool
 	};
-	for (const key of Object.keys(pool.templates.instances[params.type])) {
-		action[key] = pool.templates.instances[params.type][key].value;
+	for (const key of Object.keys(user.templates.instances[params.type])) {
+		action[key] = user.templates.instances[params.type][key].value;
 	}
 	if (params.type === "lxc") {
-		action.swap = params.swap;
 		action.hostname = params.name;
 		action.unprivileged = 1;
 		action.features = "nesting=1";
@@ -263,11 +244,9 @@ router.post(`${basePath}/create`, async (req, res) => {
 	else {
 		action.name = params.name;
 	}
-
 	// commit action
 	const result = await global.pve.requestPVE(`/nodes/${params.node}/${params.type}`, "POST", { token: true }, action);
 	await global.pve.handleResponse(params.node, result, res);
-	await global.pve.syncNode(params.node);
 });
 
 /**
@@ -287,16 +266,13 @@ router.delete(`${basePath}/delete`, async (req, res) => {
 		type: req.params.type,
 		vmid: req.params.vmid
 	};
-
 	// check auth for specific instance
 	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
+	const auth = await checkAuth(req.cookies, res, vmpath);
 	if (!auth) {
 		return;
 	}
-
 	// commit action
 	const result = await global.pve.requestPVE(vmpath, "DELETE", { token: true });
 	await global.pve.handleResponse(params.node, result, res);
-	await global.pve.syncNode(params.node);
 });

src/routes/cluster/backup.js

@@ -1,320 +0,0 @@
-import { Router } from "express";
-export const router = Router({ mergeParams: true }); ;
-
-/**
- * GET - get backups for an instance
- * request:
- * - node: string - vm host node id
- * - type: string - vm type (lxc, qemu)
- * - vmid: number - vm id number
- * responses:
- * - 200: List of backups
- * - 401: {auth: false, path: string}
- * - 500: {error: string}
- * - 500: PVE Task Object
- */
-router.get("/", async (req, res) => {
-	const params = {
-		node: req.params.node,
-		type: req.params.type,
-		vmid: req.params.vmid
-	};
-
-	// check auth for specific instance
-	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
-	if (!auth) {
-		return;
-	}
-
-	// get vm backups
-	const storage = global.config.backups.storage;
-	const backups = await global.pve.requestPVE(`/nodes/${params.node}/storage/${storage}/content?content=backup&vmid=${params.vmid}`, "GET", { token: true });
-	
-	if (backups.status === 200) {
-		res.status(backups.status).send(backups.data);
-	}
-	else {
-		res.status(backups.status).send({ auth: true, error: backups.statusText });
-	}
-});
-
-/**
- * POST - create a new backup of instance using snapshot mode
- * !!! Due to the time that backups can take, the API will not wait for the proxmox task to finish !!!
- * request:
- * - node: string - vm host node id
- * - type: string - vm type (lxc, qemu)
- * - vmid: number - vm id number
- * - notes: notes template string or null if the default one should be used
- * responses:
- * - 200: PVE Task Object
- * - 401: {auth: false, path: string}
- * - 500: {error: string}
- * - 500: PVE Task Object
- */
-router.post("/", async (req, res) => {
-	const params = {
-		node: req.params.node,
-		type: req.params.type,
-		vmid: req.params.vmid,
-		notes: req.body.notes ? req.body.notes : "[PAAS] {{node}}.{{vmid}} ({{guestname}}) has been backed up"
-	};
-
-	// check auth for specific instance
-	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
-	if (!auth) {
-		return;
-	}
-
-	// get number of currently backups used
-	const storage = global.config.backups.storage;
-	const backups = await global.pve.requestPVE(`/nodes/${params.node}/storage/${storage}/content?content=backup&vmid=${params.vmid}`, "GET", { token: true });
-	if (backups.status !== 200) {
-		res.status(backups.status).send({ error: backups.statusText });
-		return;
-	}
-	const numBackups = backups.data.length;
-
-	// get instance
-	const instance = await global.pve.getInstance(params.node, params.vmid);
-	if (instance === null) {
-		res.status(400).send({ error: `failed to get instance ${params.node}/${params.vmid}` });
-		return;
-	}
-
-	// get pool and pool allowed nodes
-	const pool = await global.access.getPool(instance.pool, req.cookies);
-	if (!pool.ok) {
-		res.status(pool.status).send({ error: `failed to get pool ${pool}` });
-		return;
-	}
-	const maxAllowed = pool.pool["backups-allowed"].max;
-
-	// check if used backups is more than maximum allowed, if so exit
-	if (numBackups >= maxAllowed) {
-		res.status(backups.status).send({ error: `${params.vmid} already has ${numBackups} >= ${maxAllowed} max backups allowed` });
-		return;
-	}
-
-	// create backup using vzdump path
-	const body = {
-		storage,
-		vmid: params.vmid,
-		mode: "snapshot",
-		remove: 0,
-		compress: "zstd",
-		"notes-template": params.notes
-	};
-	const result = await global.pve.requestPVE(`/nodes/${params.node}/vzdump`, "POST", { token: true }, body);
-	res.status(result.status).send(result.data);
-});
-
-/**
- * POST - edit the notes for an existing backup
- * request:
- * - node: string - vm host node id
- * - type: string - vm type (lxc, qemu)
- * - vmid: number - vm id number
- * - volid: volid of the backup to be deleted
- * - notes: notes template string
- * responses:
- * - 200: PVE Task Object
- * - 401: {auth: false, path: string}
- * - 500: {error: string}
- * - 500: PVE Task Object
- */
-router.post("/notes", async (req, res) => {
-	const params = {
-		node: req.params.node,
-		type: req.params.type,
-		vmid: req.params.vmid,
-		volid: req.body.volid,
-		notes: req.body.notes
-	};
-
-	// check auth for specific instance
-	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
-	if (!auth) {
-		return;
-	}
-
-	// check if the specified volid is a backup for the instance
-	// for whatever reason, calling /nodes/node/storage/content/volid does not return the vmid number whereas /nodes/storage/content?... does
-	const storage = global.config.backups.storage;
-	const backups = await global.pve.requestPVE(`/nodes/${params.node}/storage/${storage}/content?content=backup&vmid=${params.vmid}`, "GET", { token: true });
-	if (backups.status !== 200) {
-		res.status(backups.status).send({ error: backups.statusText });
-		return;
-	}
-	let found = false;
-	for (const volume of backups.data) {
-		if (volume.subtype === params.type && String(volume.vmid) === params.vmid && volume.content === "backup" && volume.volid === params.volid) {
-			found = true;
-		}
-	}
-	if (!found) {
-		res.status(500).send({ error: `Did not find backup volume ${params.volid} for ${params.node}.${params.vmid}` });
-		return;
-	}
-
-	// modify backup notes
-	const body = {
-		notes: params.notes
-	};
-	const result = await global.pve.requestPVE(`/nodes/${params.node}/storage/${storage}/content/${params.volid}`, "PUT", { token: true }, body);
-	if (result.status === 200) {
-		res.status(result.status).send();
-	}
-	else {
-		res.status(result.status).send({ error: result.statusText });
-	}
-});
-
-/**
- * DELETE - delete existing backup of instance
- * request:
- * - node: string - vm host node id
- * - type: string - vm type (lxc, qemu)
- * - vmid: number - vm id number
- * - volid: volid of the backup to be deleted
- * responses:
- * - 200: PVE Task Object
- * - 401: {auth: false, path: string}
- * - 500: {error: string}
- * - 500: PVE Task Object
- */
-router.delete("/", async (req, res) => {
-	const params = {
-		node: req.params.node,
-		type: req.params.type,
-		vmid: req.params.vmid,
-		volid: req.body.volid
-	};
-
-	// check auth for specific instance
-	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
-	if (!auth) {
-		return;
-	}
-
-	// check if the specified volid is a backup for the instance
-	// for whatever reason, calling /nodes/node/storage/content/volid does not return the vmid number whereas /nodes/storage/content?... does
-	const storage = global.config.backups.storage;
-	const backups = await global.pve.requestPVE(`/nodes/${params.node}/storage/${storage}/content?content=backup&vmid=${params.vmid}`, "GET", { token: true });
-	if (backups.status !== 200) {
-		res.status(backups.status).send({ error: backups.statusText });
-		return;
-	}
-	let found = false;
-	for (const volume of backups.data) {
-		if (volume.subtype === params.type && String(volume.vmid) === params.vmid && volume.content === "backup" && volume.volid === params.volid) {
-			found = true;
-		}
-	}
-	if (!found) {
-		res.status(500).send({ error: `Did not find backup volume ${params.volid} for ${params.node}.${params.vmid}` });
-		return;
-	}
-
-	// found a valid backup with matching vmid and volid
-	const result = await global.pve.requestPVE(`/nodes/${params.node}/storage/${storage}/content/${params.volid}?delay=5`, "DELETE", { token: true });
-	res.status(result.status).send(result.data);
-});
-
-/**
- * POST - restore instance using backup file. Ideally, PBS should be used instead so that individual disk level restore can be done.
- * request:
- * - node: string - vm host node id
- * - type: string - vm type (lxc, qemu)
- * - vmid: number - vm id number
- * - volid: volid of the backup to be deleted
- * responses:
- * - 200: PVE Task Object
- * - 401: {auth: false, path: string}
- * - 500: {error: string}
- * - 500: PVE Task Object
- */
-router.post("/restore", async (req, res) => {
-	const params = {
-		node: req.params.node,
-		type: req.params.type,
-		vmid: req.params.vmid,
-		volid: req.body.volid
-	};
-
-	// check auth for specific instance
-	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
-	if (!auth) {
-		return;
-	}
-
-	// check if the specified volid is a backup for the instance
-	// for whatever reason, calling /nodes/node/storage/content/volid does not return the vmid number whereas /nodes/storage/content?... does
-	const storage = global.config.backups.storage;
-	const backups = await global.pve.requestPVE(`/nodes/${params.node}/storage/${storage}/content?content=backup&vmid=${params.vmid}`, "GET", { token: true });
-	if (backups.status !== 200) {
-		res.status(backups.status).send({ error: backups.statusText });
-		return;
-	}
-	let found = false;
-	for (const volume of backups.data) {
-		if (volume.subtype === params.type && String(volume.vmid) === params.vmid && volume.content === "backup" && volume.volid === params.volid) {
-			found = true;
-		}
-	}
-	if (!found) {
-		res.status(500).send({ error: `Did not find backup volume ${params.volid} for ${params.node}.${params.vmid}` });
-		return;
-	}
-
-	// container restore
-	// need to use "advanced" mode to specify the storage used for each disk, so we also need to read the container's config
-	// for whatever reason, this will wipe disks that are not included in the backup !!!
-	if (params.type === "lxc") {
-		const body = {
-			vmid: params.vmid,
-			force: 1,
-			ostemplate: params.volid,
-			restore: 1
-		};
-
-		const instance = await global.pve.getInstance(params.node, params.vmid);
-		for (const v in instance.volumes) {
-			const volume = instance.volumes[v];
-			if (volume.type === "mp") {
-				body[v] = `${volume.storage}:${volume.size / 1024 ** 3},mp=${volume.mp},backup=1`;
-			}
-			else if (volume.type === "rootfs") {
-				body[v] = `${volume.storage}:${volume.size / 1024 ** 3}`;
-			}
-		}
-
-		const result = await global.pve.requestPVE(`/nodes/${params.node}/${params.type}/`, "POST", { token: true }, body);
-		if (result.status === 200) {
-			res.status(result.status).send();
-		}
-		else {
-			res.status(result.status).send({ error: result.statusText });
-		}
-	}
-	// VM restore, unlike the container restore, this should not affect disks which are not in the backup
-	else if (params.type === "qemu") { // vm restore
-		const body = {
-			vmid: params.vmid,
-			force: 1,
-			archive: params.volid
-		};
-		const result = await global.pve.requestPVE(`/nodes/${params.node}/${params.type}/`, "POST", { token: true }, body);
-		if (result.status === 200) {
-			res.status(result.status).send();
-		}
-		else {
-			res.status(result.status).send({ error: result.statusText });
-		}
-	}
-});

src/routes/cluster/disk.js

@@ -1,6 +1,9 @@
 import { Router } from "express";
 export const router = Router({ mergeParams: true });
 
+const checkAuth = global.utils.checkAuth;
+const approveResources = global.utils.approveResources;
+
 /**
  * POST - detach mounted disk from instance
  * request:
@@ -22,37 +25,30 @@ router.post("/:disk/detach", async (req, res) => {
 		vmid: req.params.vmid,
 		disk: req.params.disk
 	};
-
 	// check auth for specific instance
 	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
+	const auth = await checkAuth(req.cookies, res, vmpath);
 	if (!auth) {
 		return;
 	}
-
+	// get current config
+	const config = (await global.pve.requestPVE(`${vmpath}/config`, "GET", { cookies: req.cookies })).data.data;
 	// disk must exist
-	const disk = await global.pve.getDisk(params.node, params.vmid, params.disk);
-	if (!disk) {
+	if (!config[params.disk]) {
 		res.status(500).send({ error: `Disk ${params.disk} does not exist.` });
 		res.end();
 		return;
 	}
-
 	// disk cannot be unused
 	if (params.disk.includes("unused")) {
 		res.status(500).send({ error: `Requested disk ${params.disk} cannot be unused. Use /disk/delete to permanently delete unused disks.` });
 		res.end();
 		return;
 	}
-
-	// setup detach action
 	const action = { delete: params.disk };
 	const method = params.type === "qemu" ? "POST" : "PUT";
-
-	// commit action
 	const result = await global.pve.requestPVE(`${vmpath}/config`, method, { token: true }, action);
 	await global.pve.handleResponse(params.node, result, res);
-	await global.pve.syncInstance(params.node, params.vmid);
 });
 
 /**
@@ -76,42 +72,37 @@ router.post("/:disk/attach", async (req, res) => {
 		type: req.params.type,
 		vmid: req.params.vmid,
 		disk: req.params.disk,
-		source: req.body.source,
-		mp: req.body.mp
+		source: req.body.source
 	};
-
 	// check auth for specific instance
 	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
+	const auth = await checkAuth(req.cookies, res, vmpath);
 	if (!auth) {
 		return;
 	}
-
+	// get current config
+	const config = (await global.pve.requestPVE(`${vmpath}/config`, "GET", { cookies: req.cookies })).data.data;
 	// disk must exist
-	const disk = await global.pve.getDisk(params.node, params.vmid, `unused${params.source}`);
-	if (!disk) {
-		res.status(500).send({ error: `Requested disk unused${params.source} does not exist.` });
+	if (!config[`unused${params.source}`]) {
+		res.status(403).send({ error: `Requested disk unused${params.source} does not exist.` });
 		res.end();
 		return;
 	}
-
 	// target disk must be allowed according to source disk's storage options
+	const diskConfig = await global.pve.getDiskInfo(params.node, config, `unused${params.source}`); // get target disk
 	const resourceConfig = global.config.resources;
-	if (!resourceConfig[disk.storage].disks.some(diskPrefix => params.disk.startsWith(diskPrefix))) {
-		res.status(500).send({ error: `Requested target ${params.disk} is not in allowed list [${resourceConfig[disk.storage].disks}].` });
+	if (!resourceConfig[diskConfig.storage].disks.some(diskPrefix => params.disk.startsWith(diskPrefix))) {
+		res.status(500).send({ error: `Requested target ${params.disk} is not in allowed list [${resourceConfig[diskConfig.storage].disks}].` });
 		res.end();
 		return;
 	}
-
 	// setup action using source disk info from vm config
 	const action = {};
-	action[params.disk] = params.type === "qemu" ? `${disk.file}` : `${disk.file},mp=${params.mp},backup=1`;
+	action[params.disk] = config[`unused${params.source}`];
 	const method = params.type === "qemu" ? "POST" : "PUT";
-
 	// commit action
 	const result = await global.pve.requestPVE(`${vmpath}/config`, method, { token: true }, action);
 	await global.pve.handleResponse(params.node, result, res);
-	await global.pve.syncInstance(params.node, params.vmid);
 });
 
 /**
@@ -139,48 +130,39 @@ router.post("/:disk/resize", async (req, res) => {
 		size: req.body.size
 	};
 
-	// attempt to parse user from username
-	const userObj = global.utils.getUserObjFromUsername(req.cookies.username);
-	if (userObj === null) {
-		res.status(400).send({ auth:true, error:`username ${req.cookies.username} does not match format uid@realm.` });
-	}
+	const userRealm = req.cookies.username.split("@").at(-1);
+	const userID = req.cookies.username.replace(`@${userRealm}`, "");
+	const userObj = { id: userID, realm: userRealm };
 
 	// check auth for specific instance
 	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
+	const auth = await checkAuth(req.cookies, res, vmpath);
 	if (!auth) {
 		return;
 	}
-
-	// get instance config for pool membership
-	const instance = await global.pve.getInstance(params.node, params.vmid);
-
+	// get current config
+	const config = (await global.pve.requestPVE(`${vmpath}/config`, "GET", { cookies: req.cookies })).data.data;
 	// check disk existence
-	const disk = await global.pve.getDisk(params.node, params.vmid, params.disk); // get target disk
-	if (!disk) { // exit if disk does not exist
+	const diskConfig = await global.pve.getDiskInfo(params.node, config, params.disk); // get target disk
+	if (!diskConfig) { // exit if disk does not exist
 		res.status(500).send({ error: `requested disk ${params.disk} does not exist.` });
 		res.end();
 		return;
 	}
-
 	// setup request
-	const storage = disk.storage; // get the storage
+	const storage = diskConfig.storage; // get the storage
 	const request = {};
 	request[storage] = Number(params.size * 1024 ** 3); // setup request object
-
 	// check request approval
-	const { approved } = await global.utils.approveResources(req, userObj, params.node, instance.pool, request);
-	if (!approved) {
+	if (!await approveResources(req, userObj, request, params.node)) {
 		res.status(500).send({ request, error: `Storage ${storage} could not fulfill request of size ${params.size}G.` });
 		res.end();
 		return;
 	}
-
 	// action approved, commit to action
 	const action = { disk: params.disk, size: `+${params.size}G` };
 	const result = await global.pve.requestPVE(`${vmpath}/resize`, "PUT", { token: true }, action);
 	await global.pve.handleResponse(params.node, result, res);
-	await global.pve.syncInstance(params.node, params.vmid);
 });
 
 /**
@@ -210,37 +192,34 @@ router.post("/:disk/move", async (req, res) => {
 		delete: req.body.delete
 	};
 
-	// attempt to parse user from username
-	const userObj = global.utils.getUserObjFromUsername(req.cookies.username);
-	if (userObj === null) {
-		res.status(400).send({ auth:true, error:`username ${req.cookies.username} does not match format uid@realm.` });
-	}
+	const userRealm = req.cookies.username.split("@").at(-1);
+	const userID = req.cookies.username.replace(`@${userRealm}`, "");
+	const userObj = { id: userID, realm: userRealm };
 
 	// check auth for specific instance
 	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
+	const auth = await checkAuth(req.cookies, res, vmpath);
 	if (!auth) {
 		return;
 	}
-	// get instance config for pool membership
-	const instance = await global.pve.getInstance(params.node, params.vmid);
+	// get current config
+	const config = (await global.pve.requestPVE(`${vmpath}/config`, "GET", { cookies: req.cookies })).data.data;
 	// check disk existence
-	const disk = await global.pve.getDisk(params.node, params.vmid, params.disk); // get target disk
-	if (!disk) { // exit if disk does not exist
+	const diskConfig = await global.pve.getDiskInfo(params.node, config, params.disk); // get target disk
+	if (!diskConfig) { // exit if disk does not exist
 		res.status(500).send({ error: `requested disk ${params.disk} does not exist.` });
 		res.end();
 		return;
 	}
 	// setup request
-	const size = parseInt(disk.size); // get source disk size
+	const size = parseInt(diskConfig.size); // get source disk size
 	const dstStorage = params.storage; // get destination storage
 	const request = {};
 	if (!params.delete) { // if not delete, then request storage, otherwise it is net 0
 		request[dstStorage] = Number(size); // always decrease destination storage by size
 	}
 	// check request approval
-	const { approved } = await global.utils.approveResources(req, userObj, params.node, instance.pool, request);
-	if (!approved) {
+	if (!await approveResources(req, userObj, request, params.node)) {
 		res.status(500).send({ request, error: `Storage ${params.storage} could not fulfill request of size ${params.size}G.` });
 		res.end();
 		return;
@@ -257,7 +236,6 @@ router.post("/:disk/move", async (req, res) => {
 	// commit action
 	const result = await global.pve.requestPVE(`${vmpath}/${route}`, "POST", { token: true }, action);
 	await global.pve.handleResponse(params.node, result, res);
-	await global.pve.syncInstance(params.node, params.vmid);
 });
 
 /**
@@ -283,14 +261,15 @@ router.delete("/:disk/delete", async (req, res) => {
 	};
 	// check auth for specific instance
 	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
+	const auth = await checkAuth(req.cookies, res, vmpath);
 	if (!auth) {
 		return;
 	}
+	// get current config
+	const config = (await global.pve.requestPVE(`${vmpath}/config`, "GET", { cookies: req.cookies })).data.data;
 	// disk must exist
-	const disk = await global.pve.getDisk(params.node, params.vmid, params.disk);
-	if (!disk) {
-		res.status(500).send({ error: `Disk ${params.disk} does not exist.` });
+	if (!config[params.disk]) {
+		res.status(403).send({ error: `Requested disk unused${params.source} does not exist.` });
 		res.end();
 		return;
 	}
@@ -306,7 +285,6 @@ router.delete("/:disk/delete", async (req, res) => {
 	// commit action
 	const result = await global.pve.requestPVE(`${vmpath}/config`, method, { token: true }, action);
 	await global.pve.handleResponse(params.node, result, res);
-	await global.pve.syncInstance(params.node, params.vmid);
 });
 
 /**
@@ -336,40 +314,32 @@ router.post("/:disk/create", async (req, res) => {
 		size: req.body.size,
 		iso: req.body.iso
 	};
-	
-	// attempt to parse user from username
-	const userObj = global.utils.getUserObjFromUsername(req.cookies.username);
-	if (userObj === null) {
-		res.status(400).send({ auth:true, error:`username ${req.cookies.username} does not match format uid@realm.` });
-		return;
-	}
+
+	const userRealm = req.cookies.username.split("@").at(-1);
+	const userID = req.cookies.username.replace(`@${userRealm}`, "");
+	const userObj = { id: userID, realm: userRealm };
 
 	// check auth for specific instance
 	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
+	const auth = await checkAuth(req.cookies, res, vmpath);
 	if (!auth) {
 		return;
 	}
-
-	// get instance config for pool membership
-	const instance = await global.pve.getInstance(params.node, params.vmid);
-
+	// get current config
+	const config = (await global.pve.requestPVE(`${vmpath}/config`, "GET", { cookies: req.cookies })).data.data;
 	// disk must not exist
-	const disk = await global.pve.getDisk(params.node, params.vmid, params.disk);
-	if (disk) {
-		res.status(500).send({ error: `Disk ${params.disk} does already exists.` });
+	if (config[params.disk]) {
+		res.status(403).send({ error: `Requested disk ${params.disk} already exists.` });
 		res.end();
 		return;
 	}
-
 	// setup request
 	const request = {};
-	if (!params.disk.includes("ide")) { // ignore resource request if the type is ide (iso file)
+	if (!params.disk.includes("ide")) {
 		// setup request
 		request[params.storage] = Number(params.size * 1024 ** 3);
 		// check request approval
-		const { approved } = await global.utils.approveResources(req, userObj, params.node, instance.pool, request);
-		if (!approved) {
+		if (!await approveResources(req, userObj, request, params.node)) {
 			res.status(500).send({ request, error: `Storage ${params.storage} could not fulfill request of size ${params.size}G.` });
 			res.end();
 			return;
@@ -382,22 +352,19 @@ router.post("/:disk/create", async (req, res) => {
 			return;
 		}
 	}
-
 	// setup action
 	const action = {};
 	if (params.disk.includes("ide") && params.iso) {
 		action[params.disk] = `${params.iso},media=cdrom`;
 	}
 	else if (params.type === "qemu") { // type is qemu, use sata
-		action[params.disk] = `${params.storage}:${params.size},backup=1`;
+		action[params.disk] = `${params.storage}:${params.size}`;
 	}
 	else { // type is lxc, use mp and add mp and backup values
 		action[params.disk] = `${params.storage}:${params.size},mp=/${params.disk}/,backup=1`;
 	}
 	const method = params.type === "qemu" ? "POST" : "PUT";
-	
 	// commit action
 	const result = await global.pve.requestPVE(`${vmpath}/config`, method, { token: true }, action);
 	await global.pve.handleResponse(params.node, result, res);
-	await global.pve.syncInstance(params.node, params.vmid);
 });

src/routes/cluster/net.js

@@ -1,6 +1,10 @@
 import { Router } from "express";
 export const router = Router({ mergeParams: true }); ;
 
+const db = global.db;
+const checkAuth = global.utils.checkAuth;
+const approveResources = global.utils.approveResources;
+
 /**
  * POST - create new virtual network interface
  * request:
@@ -23,25 +27,26 @@ router.post("/:netid/create", async (req, res) => {
 		node: req.params.node,
 		type: req.params.type,
 		vmid: req.params.vmid,
-		netid: req.params.netid,
+		netid: req.params.netid.replace("net", ""),
 		rate: req.body.rate,
 		name: req.body.name
 	};
 
+	const userRealm = req.cookies.username.split("@").at(-1);
+	const userID = req.cookies.username.replace(`@${userRealm}`, "");
+	const userObj = { id: userID, realm: userRealm };
+
 	// check auth for specific instance
 	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
+	const auth = await checkAuth(req.cookies, res, vmpath);
 	if (!auth) {
 		return;
 	}
-
-	// get instance config for pool membership
-	const instance = await global.pve.getInstance(params.node, params.vmid);
-
+	// get current config
+	const currentConfig = await global.pve.requestPVE(`/nodes/${params.node}/${params.type}/${params.vmid}/config`, "GET", { token: true });
 	// net interface must not exist
-	const net = await global.pve.getNet(params.node, params.vmid, params.netid);
-	if (net) {
-		res.status(500).send({ error: `Network interface ${params.netid} already exists.` });
+	if (currentConfig.data.data[`net${params.netid}`]) {
+		res.status(500).send({ error: `Network interface net${params.netid} already exists.` });
 		res.end();
 		return;
 	}
@@ -50,36 +55,28 @@ router.post("/:netid/create", async (req, res) => {
 		res.end();
 		return;
 	}
-
-	// setup request
 	const request = {
 		network: Number(params.rate)
 	};
-
 	// check resource approval
-	const userObj = global.utils.getUserObjFromUsername(req.cookies.username);
-	const { approved } = await global.utils.approveResources(req, userObj, params.node, instance.pool, request);
-	if (!approved) {
+	if (!await approveResources(req, userObj, request, params.node)) {
 		res.status(500).send({ request, error: `Could not fulfil network request of ${params.rate}MB/s.` });
 		res.end();
 		return;
 	}
-
 	// setup action
-	const nc = (await global.access.getUser(userObj, req.cookies)).templates.network[params.type];
+	const nc = db.getUser(userObj).templates.network[params.type];
 	const action = {};
 	if (params.type === "lxc") {
-		action[`${params.netid}`] = `name=${params.name},bridge=${nc.bridge},ip=${nc.ip},ip6=${nc.ip6},tag=${nc.vlan},type=${nc.type},rate=${params.rate}`;
+		action[`net${params.netid}`] = `name=${params.name},bridge=${nc.bridge},ip=${nc.ip},ip6=${nc.ip6},tag=${nc.vlan},type=${nc.type},rate=${params.rate}`;
 	}
 	else {
-		action[`${params.netid}`] = `${nc.type},bridge=${nc.bridge},tag=${nc.vlan},rate=${params.rate}`;
+		action[`net${params.netid}`] = `${nc.type},bridge=${nc.bridge},tag=${nc.vlan},rate=${params.rate}`;
 	}
 	const method = params.type === "qemu" ? "POST" : "PUT";
-
 	// commit action
 	const result = await global.pve.requestPVE(`${vmpath}/config`, method, { token: true }, action);
 	await global.pve.handleResponse(params.node, result, res);
-	await global.pve.syncInstance(params.node, params.vmid);
 });
 
 /**
@@ -103,51 +100,46 @@ router.post("/:netid/modify", async (req, res) => {
 		node: req.params.node,
 		type: req.params.type,
 		vmid: req.params.vmid,
-		netid: req.params.netid,
+		netid: req.params.netid.replace("net", ""),
 		rate: req.body.rate
 	};
 
+	const userRealm = req.cookies.username.split("@").at(-1);
+	const userID = req.cookies.username.replace(`@${userRealm}`, "");
+	const userObj = { id: userID, realm: userRealm };
+
 	// check auth for specific instance
 	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
+	const auth = await checkAuth(req.cookies, res, vmpath);
 	if (!auth) {
 		return;
 	}
-
-	// get instance config for pool membership
-	const instance = await global.pve.getInstance(params.node, params.vmid);
-
+	// get current config
+	const currentConfig = await global.pve.requestPVE(`/nodes/${params.node}/${params.type}/${params.vmid}/config`, "GET", { token: true });
 	// net interface must already exist
-	const net = await global.pve.getNet(params.node, params.vmid, params.netid);
-	if (!net) {
+	if (!currentConfig.data.data[`net${params.netid}`]) {
 		res.status(500).send({ error: `Network interface net${params.netid} does not exist.` });
 		res.end();
 		return;
 	}
-
-	// setup request
+	const currentNetworkConfig = currentConfig.data.data[`net${params.netid}`];
+	const currentNetworkRate = currentNetworkConfig.split("rate=")[1].split(",")[0];
 	const request = {
-		network: Number(params.rate) - Number(net.rate)
+		network: Number(params.rate) - Number(currentNetworkRate)
 	};
-
 	// check resource approval
-	const userObj = global.utils.getUserObjFromUsername(req.cookies.username);
-	const { approved } = await global.utils.approveResources(req, userObj, params.node, instance.pool, request);
-	if (!approved) {
+	if (!await approveResources(req, userObj, request, params.node)) {
 		res.status(500).send({ request, error: `Could not fulfil network request of ${params.rate}MB/s.` });
 		res.end();
 		return;
 	}
-
 	// setup action
 	const action = {};
-	action[`${params.netid}`] = net.value.replace(`rate=${net.rate}`, `rate=${params.rate}`);
+	action[`net${params.netid}`] = currentNetworkConfig.replace(`rate=${currentNetworkRate}`, `rate=${params.rate}`);
 	const method = params.type === "qemu" ? "POST" : "PUT";
-
 	// commit action
 	const result = await global.pve.requestPVE(`${vmpath}/config`, method, { token: true }, action);
 	await global.pve.handleResponse(params.node, result, res);
-	await global.pve.syncInstance(params.node, params.vmid);
 });
 
 /**
@@ -169,30 +161,25 @@ router.delete("/:netid/delete", async (req, res) => {
 		node: req.params.node,
 		type: req.params.type,
 		vmid: req.params.vmid,
-		netid: req.params.netid
+		netid: req.params.netid.replace("net", "")
 	};
-
 	// check auth for specific instance
 	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
+	const auth = await checkAuth(req.cookies, res, vmpath);
 	if (!auth) {
 		return;
 	}
-
+	// get current config
+	const currentConfig = await global.pve.requestPVE(`/nodes/${params.node}/${params.type}/${params.vmid}/config`, "GET", { token: true });
 	// net interface must already exist
-	const net = await global.pve.getNet(params.node, params.vmid, params.netid);
-	if (!net) {
+	if (!currentConfig.data.data[`net${params.netid}`]) {
 		res.status(500).send({ error: `Network interface net${params.netid} does not exist.` });
 		res.end();
 		return;
 	}
-
 	// setup action
-	const action = { delete: `${params.netid}` };
 	const method = params.type === "qemu" ? "POST" : "PUT";
-
 	// commit action
-	const result = await global.pve.requestPVE(`${vmpath}/config`, method, { token: true }, action);
+	const result = await global.pve.requestPVE(`${vmpath}/config`, method, { token: true }, { delete: `net${params.netid}` });
 	await global.pve.handleResponse(params.node, result, res);
-	await global.pve.syncInstance(params.node, params.vmid);
 });

src/routes/cluster/pci.js

@@ -1,74 +1,8 @@
 import { Router } from "express";
 export const router = Router({ mergeParams: true }); ;
 
-/**
- * GET - get available pcie devices for the given node and user
- * request:
- * - node: string - vm host node id
- * responses:
- * - 200: PVE PCI Device Object
- * - 401: {auth: false}
- * - 401: {auth: false, path: string}
- * - 500: {error: string}
- */
-router.get("/", async (req, res) => {
-	const params = {
-		node: req.params.node,
-		type: req.params.type,
-		vmid: req.params.vmid,
-	};
-
-	// check auth
-	const auth = await global.utils.checkAuth(req.cookies, res);
-	if (!auth) {
-		return;
-	}
-
-	// get instance config for pool membership
-	const instance = await global.pve.getInstance(params.node, params.vmid);
-
-	// ensure that requested instance type is vmid
-	if (instance.type !== "VM") {
-		res.status(400).send({ auth: true, error: `actual instance type is ${instance.type} but must be VM` });
-	}
-	else if (params.type !== "qemu") {
-		res.status(400).send({ auth: true, error: `requested instance type is ${params.type} but must be qemu` });
-	}
-
-	// get pool and pool allowed nodes
-	const pool = await global.access.getPool(instance.pool, req.cookies);
-	const poolNodes = pool.pool["nodes-allowed"];
-	if (poolNodes[params.node] !== true) { // user does not have access to the node
-		res.status(401).send({ auth: false, path: params.node });
-		res.end();
-		return;
-	}
-
-	// get remaining user resources
-	const poolAvailPci = (await global.utils.getPoolResources(req, instance.pool)).pci.nodes[params.node]; // we assume that the node list is used. TODO support global lists
-	if (poolAvailPci === undefined) { // user has no available devices on this node, so send an empty list
-		res.status(200).send([]);
-		res.end();
-	}
-	else {
-		// get node avail devices
-		const node = await global.pve.getNode(params.node);
-		let availableDevices = [];
-		// get each device and filter out only thise which are not reserved
-		for (const device of Object.values(node.devices)) {
-			if (device.reserved === false) {
-				availableDevices.push(device);
-			}
-		}
-		//further filter out only devices which the user has access to
-		availableDevices = availableDevices.filter(nodeAvail => poolAvailPci.some((userAvail) => {
-			return nodeAvail.device_name && nodeAvail.device_name.includes(userAvail.match) && userAvail.avail > 0;
-		}));
-
-		res.status(200).send(availableDevices);
-		res.end();
-	}
-});
+const checkAuth = global.utils.checkAuth;
+const approveResources = global.utils.approveResources;
 
 /**
  * GET - get instance pcie device data
@@ -88,24 +22,30 @@ router.get("/:hostpci", async (req, res) => {
 		node: req.params.node,
 		type: req.params.type,
 		vmid: req.params.vmid,
-		hostpci: req.params.hostpci
+		hostpci: req.params.hostpci.replace("hostpci", "")
 	};
-
 	// check auth for specific instance
 	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
+	const auth = await checkAuth(req.cookies, res, vmpath);
 	if (!auth) {
 		return;
 	}
-
-	// get device
-	const device = await global.pve.getDevice(params.node, params.vmid, params.hostpci);
-	if (!device) {
-		res.status(500).send({ error: `Could not find ${params.hostpci}=${device} in ${params.node}.` });
+	// check device is in instance config
+	const config = (await global.pve.requestPVE(`${vmpath}/config`, "GET", { cookies: req.cookies })).data.data;
+	if (!config[`hostpci${params.hostpci}`]) {
+		res.status(500).send({ error: `Could not find hostpci${params.hostpci} in ${params.vmid}.` });
 		res.end();
 		return;
 	}
-	res.status(200).send(device);
+	const device = config[`hostpci${params.hostpci}`].split(",")[0];
+	// get node's pci devices
+	const deviceData = await global.pve.getDeviceInfo(params.node, device);
+	if (!deviceData) {
+		res.status(500).send({ error: `Could not find hostpci${params.hostpci}=${device} in ${params.node}.` });
+		res.end();
+		return;
+	}
+	res.status(200).send(deviceData);
 	res.end();
 });
 
@@ -130,74 +70,72 @@ router.post("/:hostpci/modify", async (req, res) => {
 		node: req.params.node,
 		type: req.params.type,
 		vmid: req.params.vmid,
-		hostpci: req.params.hostpci,
+		hostpci: req.params.hostpci.replace("hostpci", ""),
 		device: req.body.device,
 		pcie: req.body.pcie
 	};
 
+	const userRealm = req.cookies.username.split("@").at(-1);
+	const userID = req.cookies.username.replace(`@${userRealm}`, "");
+	const userObj = { id: userID, realm: userRealm };
+
 	// check if type is qemu
 	if (params.type !== "qemu") {
 		res.status(500).send({ error: "Type must be qemu (vm)." });
 		res.end();
 		return;
 	}
-
 	// check auth for specific instance
 	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
+	const auth = await checkAuth(req.cookies, res, vmpath);
 	if (!auth) {
 		return;
 	}
-
-	// get instance config for pool membership
-	const instance = await global.pve.getInstance(params.node, params.vmid);
-
 	// force all functions
 	params.device = params.device.split(".")[0];
-
-	// device must exist to be modified
-	const existingDevice = await global.pve.getDevice(params.node, params.vmid, params.hostpci);
-	if (!existingDevice) {
-		res.status(500).send({ error: `No device in ${params.hostpci}.` });
+	// get instance config to check if device has not changed
+	const config = (await global.pve.requestPVE(`/nodes/${params.node}/${params.type}/${params.vmid}/config`, "GET", { token: true })).data.data;
+	const currentDeviceData = await global.pve.getDeviceInfo(params.node, config[`hostpci${params.hostpci}`].split(",")[0]);
+	if (!currentDeviceData) {
+		res.status(500).send({ error: `No device in hostpci${params.hostpci}.` });
 		res.end();
 		return;
 	}
-
-	// only check user and node availability if base id is different, we do the split in case of existing partial-function hostpci
-	const userObj = global.utils.getUserObjFromUsername(req.cookies.username);
-	if (existingDevice.device_bus.split(".")[0] !== params.device) {
+	// only check user and node availability if base id is different
+	if (currentDeviceData.id.split(".")[0] !== params.device) {
 		// setup request
-		const node = await global.pve.getNode(params.node);
-		const requestedDevice = node.devices[`${params.device}`];
-		const request = { pci: requestedDevice.device_name };
-		if (!requestedDevice) {
-			res.status(500).send({ request, error: `Could not fulfil request for ${params.device}.` });
-			res.end();
-			return;
-		}
+		const deviceData = await global.pve.getDeviceInfo(params.node, params.device);
+		const request = { pci: deviceData.device_name };
 		// check resource approval
-		const { approved } = await global.utils.approveResources(req, userObj, params.node, instance.pool, request);
-		if (!approved) {
-			res.status(500).send({ request, error: `Could not fulfil request for ${requestedDevice.device_name}.` });
+		if (!await approveResources(req, userObj, request, params.node)) {
+			res.status(500).send({ request, error: `Could not fulfil request for ${deviceData.device_name}.` });
 			res.end();
 			return;
 		}
 		// check node availability
-		if (!Object.values(node.devices).some(element => element.device_bus.split(".")[0] === params.device && element.reserved === false)) {
+		const nodeAvailPci = await global.pve.getNodeAvailDevices(params.node, req.cookies);
+		if (!nodeAvailPci.some(element => element.id.split(".")[0] === params.device)) {
 			res.status(500).send({ error: `Device ${params.device} is already in use on ${params.node}.` });
 			res.end();
 			return;
 		}
 	}
-	
 	// setup action
 	const action = {};
-	action[`${params.hostpci}`] = `${params.device},pcie=${params.pcie}`;
-
+	action[`hostpci${params.hostpci}`] = `${params.device},pcie=${params.pcie}`;
 	// commit action
-	const result = await global.pve.requestPVE(`${vmpath}/config`, "POST", { root: true }, action);
+	const rootauth = await global.pve.requestPVE("/access/ticket", "POST", null, global.config.backends.pve.config.root);
+	if (!(rootauth.status === 200)) {
+		res.status(rootauth.status).send({ auth: false, error: "API could not authenticate as root user." });
+		res.end();
+		return;
+	}
+	const rootcookies = {
+		PVEAuthCookie: rootauth.data.data.ticket,
+		CSRFPreventionToken: rootauth.data.data.CSRFPreventionToken
+	};
+	const result = await global.pve.requestPVE(`${vmpath}/config`, "POST", { cookies: rootcookies }, action);
 	await global.pve.handleResponse(params.node, result, res);
-	await global.pve.syncNode(params.node);
 });
 
 /**
@@ -214,74 +152,74 @@ router.post("/:hostpci/modify", async (req, res) => {
  * - 500: {request: Object, error: string}
  * - 500: PVE Task Object
  */
-router.post("/:hostpci/create", async (req, res) => {
+router.post("/create", async (req, res) => {
 	req.params = Object.assign({}, req.routeparams, req.params);
 	const params = {
 		node: req.params.node,
 		type: req.params.type,
 		vmid: req.params.vmid,
-		hostpci: req.params.hostpci,
 		device: req.body.device,
 		pcie: req.body.pcie
 	};
 
+	const userRealm = req.cookies.username.split("@").at(-1);
+	const userID = req.cookies.username.replace(`@${userRealm}`, "");
+	const userObj = { id: userID, realm: userRealm };
+
 	// check if type is qemu
 	if (params.type !== "qemu") {
 		res.status(500).send({ error: "Type must be qemu (vm)." });
 		res.end();
 		return;
 	}
-
 	// check auth for specific instance
 	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
+	const auth = await checkAuth(req.cookies, res, vmpath);
 	if (!auth) {
 		return;
 	}
-
-	// get instance config for pool membership
-	const instance = await global.pve.getInstance(params.node, params.vmid);
-
 	// force all functions
 	params.device = params.device.split(".")[0];
-
-	// device must not exist to be added
-	const existingDevice = await global.pve.getDevice(params.node, params.vmid, params.hostpci);
-	if (existingDevice) {
-		res.status(500).send({ error: `Existing device in ${params.hostpci}.` });
-		res.end();
-		return;
+	// get instance config to find next available hostpci slot
+	const config = global.pve.requestPVE(`/nodes/${params.node}/${params.type}/${params.vmid}/config`, "GET", { cookies: params.cookies });
+	let hostpci = 0;
+	while (config[`hostpci${hostpci}`]) {
+		hostpci++;
 	}
-
 	// setup request
-	const node = await global.pve.getNode(params.node);
-	const requestedDevice = node.devices[`${params.device}`];
-	const request = { pci: requestedDevice.device_name };
-
+	const deviceData = await global.pve.getDeviceInfo(params.node, params.device);
+	const request = {
+		pci: deviceData.device_name
+	};
 	// check resource approval
-	const userObj = global.utils.getUserObjFromUsername(req.cookies.username);
-	const { approved } = await global.utils.approveResources(req, userObj, params.node, instance.pool, request);
-	if (!approved) {
-		res.status(500).send({ request, error: `Could not fulfil request for ${requestedDevice.device_name}.` });
+	if (!await approveResources(req, userObj, request, params.node)) {
+		res.status(500).send({ request, error: `Could not fulfil request for ${deviceData.device_name}.` });
 		res.end();
 		return;
 	}
-
 	// check node availability
-	if (!Object.values(node.devices).some(element => element.device_bus.split(".")[0] === params.device && element.reserved === false)) {
+	const nodeAvailPci = await global.pve.getNodeAvailDevices(params.node, req.cookies);
+	if (!nodeAvailPci.some(element => element.id.split(".")[0] === params.device)) {
 		res.status(500).send({ error: `Device ${params.device} is already in use on ${params.node}.` });
 		res.end();
 		return;
 	}
-
 	// setup action
 	const action = {};
-	action[`${params.hostpci}`] = `${params.device},pcie=${params.pcie}`;
-
+	action[`hostpci${hostpci}`] = `${params.device},pcie=${params.pcie}`;
 	// commit action
-	const result = await global.pve.requestPVE(`${vmpath}/config`, "POST", { root: true }, action);
+	const rootauth = await global.pve.requestPVE("/access/ticket", "POST", null, global.config.backends.pve.config.root);
+	if (!(rootauth.status === 200)) {
+		res.status(rootauth.status).send({ auth: false, error: "API could not authenticate as root user." });
+		res.end();
+		return;
+	}
+	const rootcookies = {
+		PVEAuthCookie: rootauth.data.data.ticket,
+		CSRFPreventionToken: rootauth.data.data.CSRFPreventionToken
+	};
+	const result = await global.pve.requestPVE(`${vmpath}/config`, "POST", { cookies: rootcookies }, action);
 	await global.pve.handleResponse(params.node, result, res);
-	await global.pve.syncNode(params.node);
 });
 
 /**
@@ -303,36 +241,40 @@ router.delete("/:hostpci/delete", async (req, res) => {
 		node: req.params.node,
 		type: req.params.type,
 		vmid: req.params.vmid,
-		hostpci: req.params.hostpci
+		hostpci: req.params.hostpci.replace("hostpci", "")
 	};
-
 	// check if type is qemu
 	if (params.type !== "qemu") {
 		res.status(500).send({ error: "Type must be qemu (vm)." });
 		res.end();
 		return;
 	}
-
 	// check auth for specific instance
 	const vmpath = `/nodes/${params.node}/${params.type}/${params.vmid}`;
-	const auth = await global.utils.checkAuth(req.cookies, res, vmpath);
+	const auth = await checkAuth(req.cookies, res, vmpath);
 	if (!auth) {
 		return;
 	}
-
 	// check device is in instance config
-	const device = global.pve.getDevice(params.node, params.vmid, params.hostpci);
-	if (!device) {
-		res.status(500).send({ error: `Could not find ${params.hostpci} in ${params.vmid}.` });
+	const config = (await global.pve.requestPVE(`${vmpath}/config`, "GET", { cookies: req.cookies })).data.data;
+	if (!config[`hostpci${params.hostpci}`]) {
+		res.status(500).send({ error: `Could not find hostpci${params.hostpci} in ${params.vmid}.` });
 		res.end();
 		return;
 	}
-
 	// setup action
-	const action = { delete: `${params.hostpci}` };
-
+	const action = { delete: `hostpci${params.hostpci}` };
 	// commit action, need to use root user here because proxmox api only allows root to modify hostpci for whatever reason
-	const result = await global.pve.requestPVE(`${vmpath}/config`, "POST", { root: true }, action);
+	const rootauth = await global.pve.requestPVE("/access/ticket", "POST", null, global.config.backends.pve.config.root);
+	if (!(rootauth.status === 200)) {
+		res.status(rootauth.status).send({ auth: false, error: "API could not authenticate as root user." });
+		res.end();
+		return;
+	}
+	const rootcookies = {
+		PVEAuthCookie: rootauth.data.data.ticket,
+		CSRFPreventionToken: rootauth.data.data.CSRFPreventionToken
+	};
+	const result = await global.pve.requestPVE(`${vmpath}/config`, "POST", { cookies: rootcookies }, action);
 	await global.pve.handleResponse(params.node, result, res);
-	await global.pve.syncNode(params.node);
 });

src/routes/global.js

@@ -12,21 +12,15 @@ router.get("/config/:key", async (req, res) => {
 	const params = {
 		key: req.params.key
 	};
-
 	// check auth
 	const auth = await checkAuth(req.cookies, res);
 	if (!auth) {
 		return;
 	}
-
-	// check if users are allowed to get the config value
-	// return the value if so, otherwise send unauthorized
 	const allowKeys = ["resources"];
 	if (allowKeys.includes(params.key)) {
 		const config = global.config;
-		const result = {};
-		result[params.key] = config[params.key];
-		res.status(200).send(result);
+		res.status(200).send(config[params.key]);
 	}
 	else {
 		res.status(401).send({ auth: false, error: `User is not authorized to access /global/config/${params.key}.` });

src/routes/sync.js

@@ -2,7 +2,11 @@ import { WebSocketServer } from "ws";
 import * as cookie from "cookie";
 
 import { Router } from "express";
-export const router = Router({ mergeParams: true });
+export const router = Router({ mergeParams: true }); ;
+
+const checkAuth = global.utils.checkAuth;
+const getObjectHash = global.utils.getObjectHash;
+const getTimeLeft = global.utils.getTimeLeft;
 
 // maps usernames to socket object(s)
 const userSocketMap = {};
@@ -43,15 +47,15 @@ if (schemes.hash.enabled) {
 	 */
 	router.get("/hash", async (req, res) => {
 		// check auth
-		const auth = await global.utils.checkAuth(req.cookies, res);
+		const auth = await checkAuth(req.cookies, res);
 		if (!auth) {
 			return;
 		}
-		// get current cluster resources - do not use fabric here because fabric is not always updated to changes like up/down state changes
-		const status = (await global.pve.requestPVE("/cluster/resources", "GET", { cookies: req.cookies })).data;
+		// get current cluster resources
+		const status = (await global.pve.requestPVE("/cluster/resources", "GET", { cookies: req.cookies })).data.data;
 		// filter out just state information of resources that are needed
 		const state = extractClusterState(status, resourceTypes);
-		res.status(200).send(global.utils.getObjectHash(state));
+		res.status(200).send(getObjectHash(state));
 	});
 	console.log("clientsync: enabled hash sync");
 }
@@ -118,14 +122,9 @@ if (schemes.interrupt.enabled) {
 			const parsed = message.toString().split(" ");
 			const cmd = parsed[0];
 			// command is rate and the value is valid
-			if (cmd === "rate" && parsed.length === 2 && parsed[1] >= schemes.interrupt["min-rate"] && parsed[1] <= schemes.interrupt["max-rate"]) {
+			if (cmd === "rate" && parsed[1] >= schemes.interrupt["min-rate"] && parsed[1] <= schemes.interrupt["max-rate"]) {
 				// get requested rate in ms
 				const rate = Number(parsed[1]) * 1000;
-				if (isNaN(rate)) {
-					socket.send("error: rate <rate> must be a number");
-					socket.terminate();
-					return;
-				}
 				// if timer has not started, start it with requested rate
 				if (!timer) {
 					timer = setTimeout(handleInterruptSync, rate);
@@ -136,7 +135,7 @@ if (schemes.interrupt.enabled) {
 				// AND if the next event trigger is more than the new rate in the future,
 				// restart the timer with the new rate
 				// avoids a large requested rate preventing a faster rate from being fulfilled
-				else if (rate < Math.min.apply(null, Object.values(requestedRates)) && global.utils.getTimeLeft(timer) > rate) {
+				else if (rate < Math.min.apply(null, Object.values(requestedRates)) && getTimeLeft(timer) > rate) {
 					clearTimeout(timer);
 					timer = setTimeout(handleInterruptSync, rate);
 					const time = global.process.uptime();
@@ -147,12 +146,12 @@ if (schemes.interrupt.enabled) {
 			}
 			// command is rate but the requested value is out of bounds, terminate socket
 			else if (cmd === "rate") {
-				socket.send(`error: rate <rate> must be in range [${schemes.interrupt["min-rate"]}, ${schemes.interrupt["max-rate"]}].`);
+				socket.send(`error: rate must be in range [${schemes.interrupt["min-rate"]}, ${schemes.interrupt["max-rate"]}].`);
 				socket.terminate();
 			}
 			// otherwise, command is invalid, terminate socket
 			else {
-				socket.send(`error: ${cmd} command not supported.`);
+				socket.send(`error: ${cmd} command not found.`);
 				socket.terminate();
 			}
 		});
@@ -166,11 +165,14 @@ if (schemes.interrupt.enabled) {
 			socket.destroy();
 		}
 		else {
-			wsServer.handleUpgrade(req, socket, head, async (socket) => {
-				// use user cookies to determine which pools they can see, lazily assume that if a user can audit a pool they are also can audit pool member state
-				const pools = await global.pve.requestPVE("/pools", "GET", { cookies });
+			wsServer.handleUpgrade(req, socket, head, (socket) => {
+				// get the user pools
+				const userRealm = cookies.username.split("@").at(-1);
+				const userID = cookies.username.replace(`@${userRealm}`, "");
+				const userObj = { id: userID, realm: userRealm };
+				const pools = Object.keys(global.db.getUser(userObj).cluster.pools);
 				// emit the connection to initialize socket
-				wsServer.emit("connection", socket, cookies.username, Object.keys(pools.data));
+				wsServer.emit("connection", socket, cookies.username, pools);
 			});
 		}
 	});
@@ -190,7 +192,7 @@ if (schemes.interrupt.enabled) {
 			return;
 		}
 		// get current cluster resources
-		const status = (await global.pve.requestPVE("/cluster/resources", "GET", { token: true })).data;
+		const status = (await global.pve.requestPVE("/cluster/resources", "GET", { token: true })).data.data;
 		// filter out just state information of resources that are needed, and hash each one
 		const currState = extractClusterState(status, resourceTypes, true);
 		// get a map of users to send sync notifications
@@ -260,7 +262,7 @@ function extractClusterState (status, resourceTypes, hashIndividual = false) {
 				pool: resource.pool || null
 			};
 			if (hashIndividual) {
-				const hash = global.utils.getObjectHash(state[resource.id]);
+				const hash = getObjectHash(state[resource.id]);
 				state[resource.id].hash = hash;
 			}
 		}

src/routes/user.js

@@ -0,0 +1,110 @@
+import { Router } from "express";
+export const router = Router({ mergeParams: true }); ;
+
+const config = global.config;
+const checkAuth = global.utils.checkAuth;
+const getUserResources = global.utils.getUserResources;
+
+/**
+ * GET - get db user resource information including allocated, free, and maximum resource values along with resource metadata
+ * responses:
+ * - 200: {avail: Object, max: Object, used: Object, resources: Object}
+ * - 401: {auth: false}
+ */
+router.get("/dynamic/resources", async (req, res) => {
+	// check auth
+	const auth = await checkAuth(req.cookies, res);
+	if (!auth) {
+		return;
+	}
+
+	const userRealm = req.cookies.username.split("@").at(-1);
+	const userID = req.cookies.username.replace(`@${userRealm}`, "");
+	const userObj = { id: userID, realm: userRealm };
+
+	const resources = await getUserResources(req, userObj);
+	res.status(200).send(resources);
+});
+
+/**
+ * GET - get db user configuration by key
+ * request:
+ * - key: string - user config key
+ * responses:
+ * - 200: Object
+ * - 401: {auth: false}
+ * - 401: {auth: false, error: string}
+ */
+router.get("/config/:key", async (req, res) => {
+	const params = {
+		key: req.params.key
+	};
+
+	const userRealm = req.cookies.username.split("@").at(-1);
+	const userID = req.cookies.username.replace(`@${userRealm}`, "");
+	const userObj = { id: userID, realm: userRealm };
+
+	// check auth
+	const auth = await checkAuth(req.cookies, res);
+	if (!auth) {
+		return;
+	}
+	const allowKeys = ["resources", "cluster"];
+	if (allowKeys.includes(params.key)) {
+		const config = global.db.getUser(userObj);
+		res.status(200).send(config[params.key]);
+	}
+	else {
+		res.status(401).send({ auth: false, error: `User is not authorized to access /user/config/${params.key}.` });
+	}
+});
+
+/**
+ * GET - get user accessible iso files
+ * response:
+ * - 200: Array.<Object>
+ * - 401: {auth: false}
+ */
+router.get("/vm-isos", async (req, res) => {
+	// check auth
+	const auth = await checkAuth(req.cookies, res);
+	if (!auth) {
+		return;
+	}
+	// get user iso config
+	const userIsoConfig = config.useriso;
+	// get all isos
+	const isos = (await global.pve.requestPVE(`/nodes/${userIsoConfig.node}/storage/${userIsoConfig.storage}/content?content=iso`, "GET", { token: true })).data.data;
+	const userIsos = [];
+	isos.forEach((iso) => {
+		iso.name = iso.volid.replace(`${userIsoConfig.storage}:iso/`, "");
+		userIsos.push(iso);
+	});
+	userIsos.sort();
+	res.status(200).send(userIsos);
+});
+
+/**
+ * GET - get user accessible container template files
+ * response:
+ * - 200: Array.<Object>
+ * - 401: {auth: false}
+ */
+router.get("/ct-templates", async (req, res) => {
+	// check auth
+	const auth = await checkAuth(req.cookies, res);
+	if (!auth) {
+		return;
+	}
+	// get user iso config
+	const userIsoConfig = config.useriso;
+	// get all isos
+	const isos = (await global.pve.requestPVE(`/nodes/${userIsoConfig.node}/storage/${userIsoConfig.storage}/content?content=vztmpl`, "GET", { token: true })).data.data;
+	const userIsos = [];
+	isos.forEach((iso) => {
+		iso.name = iso.volid.replace(`${userIsoConfig.storage}:vztmpl/`, "");
+		userIsos.push(iso);
+	});
+	userIsos.sort();
+	res.status(200).send(userIsos);
+});

src/utils.js

@@ -4,7 +4,6 @@ import url from "url";
 import * as fs from "fs";
 import { readFileSync } from "fs";
 import { exit } from "process";
-import { log } from "console";
 
 /**
  * Check if a user is authorized to access a specified vm, or the cluster in general.
@@ -16,34 +15,18 @@ import { log } from "console";
 export async function checkAuth (cookies, res, vmpath = null) {
 	let auth = false;
 
-	const userObj = getUserObjFromUsername(cookies.username); // check if username exists and is valid
-	if (!userObj) {
-		res.status(401).send({ auth, path: vmpath ? `${vmpath}/config` : "/version", error: "Username was missing or invalid." });
+	const userRealm = cookies.username.split("@").at(-1);
+	const userID = cookies.username.replace(`@${userRealm}`, "");
+	const userObj = { id: userID, realm: userRealm };
+
+	if (global.db.getUser(userObj) === null) {
+		auth = false;
+		res.status(401).send({ auth, path: vmpath ? `${vmpath}/config` : "/version", error: `User ${cookies.username} not found in localdb.` });
 		res.end();
 		return false;
 	}
 
-	if (!cookies.PVEAuthCookie) { // check if PVE token exists
-		res.status(401).send({ auth, path: vmpath ? `${vmpath}/config` : "/version", error: "Token was missing or invalid." });
-		res.end();
-		return false;
-	}
-
-	const pveTicket = cookies.PVEAuthCookie;
-	const result = await global.pve.requestPVE("/access/ticket", "POST", null, { username: cookies.username, password: pveTicket });
-	if (result.status !== 200) { // check if PVE token is valid by using /access/ticket to validate ticket with Proxmox
-		res.status(401).send({ auth, path: vmpath ? `${vmpath}/config` : "/version", error: "Username did not match token." });
-		res.end();
-		return false;
-	}
-
-	if ((await global.access.getUser(userObj, cookies)) === null) { // check if user exists in database
-		res.status(401).send({ auth, path: vmpath ? `${vmpath}/config` : "/version", error: `User ${cookies.username} not found in database.` });
-		res.end();
-		return false;
-	}
-
-	if (vmpath) { // if a path is specified, check the permissions on the path
+	if (vmpath) {
 		const result = await global.pve.requestPVE(`/${vmpath}/config`, "GET", { cookies });
 		auth = result.status === 200;
 	}
@@ -56,243 +39,271 @@ export async function checkAuth (cookies, res, vmpath = null) {
 		res.status(401).send({ auth, path: vmpath ? `${vmpath}/config` : "/version", error: "User token did not pass authentication check." });
 		res.end();
 	}
-
 	return auth;
 }
 
 /**
- * Get pool resource data including used, available, and maximum resources.
+ * Get the full config of an instance, including searching disk information.
+ * @param {Object} req ProxmoxAAS API request object.
+ * @param {Object} instance to get config as object containing node, type, and id.
+ * @param {Array} diskprefixes Array containing prefixes for disks.
+ * @returns
+ */
+async function getFullInstanceConfig (req, instance, diskprefixes) {
+	const config = (await global.pve.requestPVE(`/nodes/${instance.node}/${instance.type}/${instance.vmid}/config`, "GET", { cookies: req.cookies })).data.data;
+	// fetch all instance disk and device data concurrently
+	const promises = [];
+	const mappings = [];
+	for (const key in config) {
+		if (diskprefixes.some(prefix => key.startsWith(prefix))) {
+			promises.push(global.pve.getDiskInfo(instance.node, config, key));
+			mappings.push(key);
+		}
+		else if (key.startsWith("hostpci")) {
+			promises.push(global.pve.getDeviceInfo(instance.node, config[key].split(",")[0]));
+			mappings.push(key);
+		}
+	}
+	const results = await Promise.all(promises);
+	results.forEach((e, i) => {
+		const key = mappings[i];
+		config[key] = e;
+	});
+	config.node = instance.node;
+	return config;
+}
+
+/**
+ * Get all configs for every instance owned by the user. Uses the expanded config data from getFullInstanceConfig.
+ * @param {Object} req ProxmoxAAS API request object.
+ * @param {Object} dbResources data about application resources, to indicate which resources are tracked.
+ * @returns {Object} k-v pairs of resource name and used amounts
+ */
+async function getAllInstanceConfigs (req, diskprefixes) {
+	// get the basic resources list
+	const resources = (await global.pve.requestPVE("/cluster/resources", "GET", { cookies: req.cookies })).data.data;
+
+	// filter resources by their type, we only want lxc and qemu
+	const instances = [];
+	for (const resource of resources) {
+		if (resource.type === "lxc" || resource.type === "qemu") {
+			instances.push(resource);
+		}
+	}
+
+	// get all instance configs, also include detailed disk and device info
+	const promises = [];
+	const mappings = [];
+	for (let i = 0; i < instances.length; i++) {
+		const instance = instances[i];
+		const config = getFullInstanceConfig(req, instance, diskprefixes);
+		promises.push(config);
+		mappings.push(i);
+	}
+	const configs = await Promise.all(promises);
+
+	return configs;
+}
+
+/**
+ * Get user resource data including used, available, and maximum resources.
  * @param {Object} req ProxmoxAAS API request object.
  * @param {{id: string, realm: string}} user object of user to get resource data.
- * @returns {{used: Object, avail: Object, max: Object, resources: Object}} used, available, maximum, and resource metadata for the specified pool or null if an error occured
+ * @returns {{used: Object, avail: Object, max: Object, resources: Object}} used, available, maximum, and resource metadata for the specified user.
  */
-export async function getPoolResources (req, pool) {
-	const configResources = global.config.resources;
-	const poolConfig = await global.access.getPool(pool, req.cookies);
-	if (poolConfig.ok !== true) {
-		return null;
-	}
-	const poolConfigResources = poolConfig.pool.resources;
+export async function getUserResources (req, user) {
+	const dbResources = global.config.resources;
+	const userResources = global.db.getUser(user).resources;
 
-	// setup the pool resource object with used and avail for each resource and each resource pool
+	// setup disk prefixes object
+	const diskprefixes = [];
+	for (const resourceName of Object.keys(dbResources)) {
+		if (dbResources[resourceName].type === "storage") {
+			for (const diskPrefix of dbResources[resourceName].disks) {
+				diskprefixes.push(diskPrefix);
+			}
+		}
+	}
+
+	// setup the user resource object with used and avail for each resource and each resource pool
 	// also add a total counter for each resource (only used for display, not used to check requests)
-	for (const resourceName of Object.keys(poolConfigResources)) {
-		if (resourceName in configResources && configResources[resourceName].type === "list") {
-			poolConfigResources[resourceName].total = [];
-			poolConfigResources[resourceName].global.forEach((e) => {
+	for (const resourceName of Object.keys(userResources)) {
+		if (dbResources[resourceName].type === "list") {
+			userResources[resourceName].total = [];
+			userResources[resourceName].global.forEach((e) => {
 				e.used = 0;
 				e.avail = e.max;
-				const index = poolConfigResources[resourceName].total.findIndex((availEelement) => e.match === availEelement.match);
+				const index = userResources[resourceName].total.findIndex((availEelement) => e.match === availEelement.match);
 				if (index === -1) {
-					poolConfigResources[resourceName].total.push(structuredClone(e));
+					userResources[resourceName].total.push(structuredClone(e));
 				}
 				else {
-					poolConfigResources[resourceName].total[index].max += e.max;
-					poolConfigResources[resourceName].total[index].avail += e.avail;
+					userResources[resourceName].total[index].max += e.max;
+					userResources[resourceName].total[index].avail += e.avail;
 				}
 			});
-			for (const nodeName of Object.keys(poolConfigResources[resourceName].nodes)) {
-				poolConfigResources[resourceName].nodes[nodeName].forEach((e) => {
+			for (const nodeName of Object.keys(userResources[resourceName].nodes)) {
+				userResources[resourceName].nodes[nodeName].forEach((e) => {
 					e.used = 0;
 					e.avail = e.max;
-					const index = poolConfigResources[resourceName].total.findIndex((availEelement) => e.match === availEelement.match);
+					const index = userResources[resourceName].total.findIndex((availEelement) => e.match === availEelement.match);
 					if (index === -1) {
-						poolConfigResources[resourceName].total.push(structuredClone(e));
+						userResources[resourceName].total.push(structuredClone(e));
 					}
 					else {
-						poolConfigResources[resourceName].total[index].max += e.max;
-						poolConfigResources[resourceName].total[index].avail += e.avail;
+						userResources[resourceName].total[index].max += e.max;
+						userResources[resourceName].total[index].avail += e.avail;
 					}
 				});
 			}
 		}
-		else if (resourceName in configResources){ // numeric or storage
+		else {
 			const total = {
 				max: 0,
 				used: 0,
 				avail: 0
 			};
-			poolConfigResources[resourceName].global.used = 0;
-			poolConfigResources[resourceName].global.avail = poolConfigResources[resourceName].global.max;
-			total.max += poolConfigResources[resourceName].global.max;
-			total.avail += poolConfigResources[resourceName].global.avail;
-			for (const nodeName of Object.keys(poolConfigResources[resourceName].nodes)) {
-				poolConfigResources[resourceName].nodes[nodeName].used = 0;
-				poolConfigResources[resourceName].nodes[nodeName].avail = poolConfigResources[resourceName].nodes[nodeName].max;
-				total.max += poolConfigResources[resourceName].nodes[nodeName].max;
-				total.avail += poolConfigResources[resourceName].nodes[nodeName].avail;
+			userResources[resourceName].global.used = 0;
+			userResources[resourceName].global.avail = userResources[resourceName].global.max;
+			total.max += userResources[resourceName].global.max;
+			total.avail += userResources[resourceName].global.avail;
+			for (const nodeName of Object.keys(userResources[resourceName].nodes)) {
+				userResources[resourceName].nodes[nodeName].used = 0;
+				userResources[resourceName].nodes[nodeName].avail = userResources[resourceName].nodes[nodeName].max;
+				total.max += userResources[resourceName].nodes[nodeName].max;
+				total.avail += userResources[resourceName].nodes[nodeName].avail;
 			}
-			poolConfigResources[resourceName].total = total;
-		}
-		else {
-			// pool's resource config included a resource which was not in the metadata config
-			// delete it from the config
-			// remeber that a resource requested with no config limit is default deny
-			delete poolConfigResources[resourceName];
-			console.log(`utils: pool had resource key ${resourceName} which is not in the config.json`);
+			userResources[resourceName].total = total;
 		}
 	}
 
-	const resources = await global.pve.getPoolResources(req.cookies, pool);
-	if (resources === null) {
-		return null;
-	}
+	const configs = await getAllInstanceConfigs(req, diskprefixes);
 
-	for (const vmid in resources) {
-		const config = resources[vmid];
+	for (const config of configs) {
 		const nodeName = config.node;
-		// count basic numeric resources
 		for (const resourceName of Object.keys(config)) {
 			// numeric resource type
-			if (resourceName in configResources && configResources[resourceName].type === "numeric") {
+			if (resourceName in dbResources && dbResources[resourceName].type === "numeric") {
 				const val = Number(config[resourceName]);
 				// if the instance's node is restricted by this resource, add it to the instance's used value
-				if (nodeName in poolConfigResources[resourceName].nodes) {
-					poolConfigResources[resourceName].nodes[nodeName].used += val;
-					poolConfigResources[resourceName].nodes[nodeName].avail -= val;
+				if (nodeName in userResources[resourceName].nodes) {
+					userResources[resourceName].nodes[nodeName].used += val;
+					userResources[resourceName].nodes[nodeName].avail -= val;
 				}
 				// otherwise add the resource to the global pool
 				else {
-					poolConfigResources[resourceName].global.used += val;
-					poolConfigResources[resourceName].global.avail -= val;
+					userResources[resourceName].global.used += val;
+					userResources[resourceName].global.avail -= val;
 				}
-				poolConfigResources[resourceName].total.used += val;
-				poolConfigResources[resourceName].total.avail -= val;
+				userResources[resourceName].total.used += val;
+				userResources[resourceName].total.avail -= val;
 			}
-		}
-		// count disk resources in volumes
-		for (const diskid in config.volumes) {
-			const disk = config.volumes[diskid];
-			const storage = disk.storage;
-			const size = disk.size;
-			// only process disk if its storage is in the user resources to be counted
-			if (storage in poolConfigResources) {
+			else if (diskprefixes.some(prefix => resourceName.startsWith(prefix))) {
+				const diskInfo = config[resourceName];
+				if (diskInfo) { // only count if disk exists
+					const val = Number(diskInfo.size);
+					const storage = diskInfo.storage;
+					// if the instance's node is restricted by this resource, add it to the instance's used value
+					if (nodeName in userResources[storage].nodes) {
+						userResources[storage].nodes[nodeName].used += val;
+						userResources[storage].nodes[nodeName].avail -= val;
+					}
+					// otherwise add the resource to the global pool
+					else {
+						userResources[storage].global.used += val;
+						userResources[storage].global.avail -= val;
+					}
+					userResources[storage].total.used += val;
+					userResources[storage].total.avail -= val;
+				}
+			}
+			else if (resourceName.startsWith("net") && config[resourceName].includes("rate=")) { // only count net instances with a rate limit
+				const val = Number(config[resourceName].split("rate=")[1].split(",")[0]);
 				// if the instance's node is restricted by this resource, add it to the instance's used value
-				if (nodeName in poolConfigResources[storage].nodes) {
-					poolConfigResources[storage].nodes[nodeName].used += size;
-					poolConfigResources[storage].nodes[nodeName].avail -= size;
+				if (nodeName in userResources.network.nodes) {
+					userResources.network.nodes[nodeName].used += val;
+					userResources.network.nodes[nodeName].avail -= val;
 				}
 				// otherwise add the resource to the global pool
 				else {
-					poolConfigResources[storage].global.used += size;
-					poolConfigResources[storage].global.avail -= size;
+					userResources.network.global.used += val;
+					userResources.network.global.avail -= val;
 				}
-				poolConfigResources[storage].total.used += size;
-				poolConfigResources[storage].total.avail -= size;
+				userResources.network.total.used += val;
+				userResources.network.total.avail -= val;
 			}
-		}
-		// count net resources in nets
-		for (const netid in config.nets) {
-			const net = config.nets[netid];
-			const rate = net.rate;
-			if (poolConfigResources.network) {
-				// if the instance's node is restricted by this resource, add it to the instance's used value
-				if (nodeName in poolConfigResources.network.nodes) {
-					poolConfigResources.network.nodes[nodeName].used += rate;
-					poolConfigResources.network.nodes[nodeName].avail -= rate;
+			else if (resourceName.startsWith("hostpci")) {
+				const deviceInfo = config[resourceName];
+				if (deviceInfo) { // only count if device exists
+					const deviceName = deviceInfo.device_name;
+					// if the instance's node is restricted by this resource, add it to the instance's used value
+					if (nodeName in userResources.pci.nodes) {
+						const index = userResources.pci.nodes[nodeName].findIndex((availEelement) => deviceName.includes(availEelement.match));
+						userResources.pci.nodes[nodeName][index].used++;
+						userResources.pci.nodes[nodeName][index].avail--;
+					}
+					// otherwise add the resource to the global pool
+					else {
+						const index = userResources.pci.global.findIndex((availEelement) => deviceName.includes(availEelement.match));
+						userResources.pci.global[index].used++;
+						userResources.pci.global[index].avail--;
+					}
+					const index = userResources.pci.total.findIndex((availEelement) => deviceName.includes(availEelement.match));
+					userResources.pci.total[index].used++;
+					userResources.pci.total[index].avail--;
 				}
-				// otherwise add the resource to the global pool
-				else {
-					poolConfigResources.network.global.used += rate;
-					poolConfigResources.network.global.avail -= rate;
-				}
-				poolConfigResources.network.total.used += rate;
-				poolConfigResources.network.total.avail -= rate;
-			}
-		}
-		// count pci device resources in devices
-		for (const deviceid in config.devices) {
-			const device = config.devices[deviceid];
-			const name = device.device_name;
-			// if the node has a node specific rule, add it there
-			if (nodeName in poolConfigResources.pci.nodes) {
-				const index = poolConfigResources.pci.nodes[nodeName].findIndex((availEelement) => name.includes(availEelement.match));
-				if (index >= 0) {
-					poolConfigResources.pci.nodes[nodeName][index].used++;
-					poolConfigResources.pci.nodes[nodeName][index].avail--;
-				}
-			}
-			// otherwise try to add the resource to the global pool
-			else {
-				const index = poolConfigResources.pci.global.findIndex((availEelement) => name.includes(availEelement.match));
-				if (index >= 0) { // device resource is in the user's global list then increment it by 1
-					poolConfigResources.pci.global[index].used++;
-					poolConfigResources.pci.global[index].avail--;
-				}
-			}
-			// finally, add the device to the total map
-			const index = poolConfigResources.pci.total.findIndex((availEelement) => name.includes(availEelement.match));
-			if (index >= 0) {
-				poolConfigResources.pci.total[index].used++;
-				poolConfigResources.pci.total[index].avail--;
 			}
 		}
 	}
 
-	return poolConfigResources;
+	return userResources;
 }
 
 /**
  * Check approval for user requesting additional resources. Generally, subtracts the request from available resources and ensures request can be fulfilled by the available resources.
  * @param {Object} req ProxmoxAAS API request object.
  * @param {{id: string, realm: string}} user object of user requesting additional resources.
- * @param {string} node name of node hosting requested resource(s)
- * @param {string} pool name of pool hosting requested resource(s)
  * @param {Object} request k-v pairs of resources and requested amounts
  * @returns {boolean} true if the available resources can fullfill the requested resources, false otherwise.
- * @returns {Object} map of key values and reason for success or failure
  */
-export async function approveResources (req, user, node, pool, request) {
-	const configResources = global.config.resources;
-	const poolResources = await getPoolResources(req, pool);
-	const reason = {};
-
-	if (poolResources === null) {
-		reason["server"] = "error in retrieving pool resource state";
-		return {approved: false, reason};
-	}
-
-	for (const key in request) {
+export async function approveResources (req, user, request, node) {
+	const dbResources = global.config.resources;
+	const userResources = await getUserResources(req, user);
+	let approved = true;
+	Object.keys(request).every((key) => {
 		// if requested resource is not specified in user resources, assume it's not allowed
-		if (!(key in poolResources)) {
-			reason[key] = { approved: false, reason: `${key} not allowed` };
-			continue;
+		if (!(key in userResources)) {
+			approved = false;
+			return false;
 		}
 
-		// use node specific quota if there is one available, otherwise use the global resource quota
-		const inNode = node in poolResources[key].nodes;
-		const resourceData = inNode ? poolResources[key].nodes[node] : poolResources[key].global;
+		const inNode = node in userResources[key].nodes;
+		const resourceData = inNode ? userResources[key].nodes[node] : userResources[key].global;
 
 		// if the resource type is list, check if the requested resource exists in the list
-		if (configResources[key].type === "list") {
+		if (dbResources[key].type === "list") {
 			const index = resourceData.findIndex((availElement) => request[key].includes(availElement.match));
-			// if no matching resource when index === -1, then remaining is -1 otherwise use the remaining value
+			// if no matching resource when index == -1, then remaining is -1 otherwise use the remaining value
 			const avail = index === -1 ? false : resourceData[index].avail > 0;
-			if (avail !== configResources[key].whitelist) {
-				reason[key] = { approved: false, reason: `${key} ${configResources[key].whitelist ? "not in whitelist" : "in blacklist"}` };
-				continue;
+			if (avail !== dbResources[key].whitelist) {
+				approved = false;
+				return false;
 			}
 		}
-
-		// if either the requested or avail resource is not strictly a number, block
-		else if (typeof (resourceData.avail) !== "number" || typeof (request[key]) !== "number") {
-			reason[key] = { approved: false, reason: `expected ${key} to be a number but got ${request[key]}` };
-			continue;
+		// if either the requested or avail resource is NaN, block
+		else if (isNaN(resourceData.avail) || isNaN(request[key])) {
+			approved = false;
+			return false;
 		}
-
 		// if the avail resources is less than the requested resources, block
 		else if (resourceData.avail - request[key] < 0) {
-			reason[key] = { approved: false, reason: `${key} requested ${request[key]} which is more than ${resourceData.avail} available` };
-			continue;
+			approved = false;
+			return false;
 		}
 
-		reason[key] = { approved: true, reason: "ok" };
-	}
-
-	const approved = Object.values(reason).every((element) => {
-		return element.approved === true;
+		return true;
 	});
-	return { approved, reason }; // if all requested resources pass, allow
+	return approved; // if all requested resources pass, allow
 }
 
 /**
@@ -320,7 +331,7 @@ export function getTimeLeft (timeout) {
 /**
  * Recursively import routes from target folder.
  * @param {Object} router or app object.
- * @param {string} baseroute base route of imported modules starting from the current path.
+ * @param {string} baseroute API route for each imported module.
  * @param {string} target folder to import modules.
  * @param {string} from source folder of calling module, optional for imports from the same base directory.
  */
@@ -347,67 +358,7 @@ export function readJSONFile (path) {
 		return JSON.parse(readFileSync(path));
 	}
 	catch (e) {
-		console.log(`json: error opening ${path}: ${e}`);
+		console.log(`error: ${path} was not found.`);
 		exit(1);
 	}
 };
-
-/**
- * Parse username into user object using the uid@realm format.
- * @param {*} username
- * @returns {Object | null} user object containing userid and realm or null if username format was invalid
- */
-export function getUserObjFromUsername (username) {
-	if (username) {
-		const userRealm = username.split("@").at(-1);
-		const userID = username.replace(`@${userRealm}`, "");
-		const userObj = { id: userID, realm: userRealm };
-		return userObj;
-	}
-	else {
-		return null;
-	}
-}
-
-/**
- * Parse groupname into group object using the gid-realm format.
- * @param {*} groupname
- * @returns {Object | null} user object containing groupid and realm or null if groupname format was invalid
- */
-export function getGroupObjFromGroupname (groupname) {
-	if (groupname) {
-		if (groupname.includes("-")) {
-			const groupRealm = groupname.split("-").at(-1);
-			const groupID = groupname.replace(`-${groupRealm}`, "");
-			const groupObj = { id: groupID, realm: groupRealm };
-			return groupObj;
-		}
-		else {
-			const groupRealm = "pve";
-			const groupID = groupname;
-			const groupObj = { id: groupID, realm: groupRealm };
-			return groupObj;
-		}
-	}
-	else {
-		return null;
-	}
-}
-
-/**
- * Inspect pool object and return true if pool contains any groups which contain the user object.
- * @param {Object} poolObj pool data object
- * @param {Object} userObj user object containing id and realm
- * @returns {boolean} true if userObj in poolObj
- */
-export function checkUserInPool(poolObj, userObj) {
-	for (const group of poolObj.groups) {
-		// assumption: pool listed groups are all relevant memberships (ie are paas client role)
-		for (const user of group.users) {
-			if (user.username.uid === userObj.id && user.username.realm === userObj.realm) {
-				return true;
-			}
-		}
-	}
-	return false;
-}

template.localdb.json

@@ -0,0 +1,131 @@
+{
+    "users": {
+        "exampleuser@auth": {
+			"resources": {
+				"cpu": {
+					"global": [
+						{
+							"match": "kvm64",
+							"name": "kvm64",
+							"max": 1
+						},
+						{
+							"match": "host",
+							"name": "host",
+							"max": 1
+						}
+					],
+					"nodes": {}
+				},
+				"cores": {
+					"global": {
+						"max": 128
+					},
+					"nodes": {}
+				},
+				"memory": {
+					"global": {
+						"max": 131072
+					},
+					"nodes": {}
+				},
+				"swap": {
+					"global": {
+						"max": 131072
+					},
+					"nodes": {}
+				},
+				"local": {
+					"global": {
+						"max": 1099511627776
+					},
+					"nodes": {}
+				},
+				"cephpl": {
+					"global": {
+						"max": 1099511627776
+					},
+					"nodes": {}
+				},
+				"network": {
+					"global": {
+						"max": 100000
+					},
+					"nodes": {}
+				},
+				"pci": {
+					"global": [],
+					"nodes": {
+						"example-node-0": [
+							{
+								"match": "[device 1]",
+								"name": "Device 1",
+								"max": 1
+							},
+							{
+								"match": "[device 2]",
+								"name": "Device 2",
+								"max": 1
+							}
+						]
+					}
+				}
+			},
+			"cluster": {
+				"nodes": {
+					"example-node-0": true,
+					"example-node-1": true,
+					"example-node-2": true
+				},
+				"vmid": {
+					"min": 100,
+					"max": 199
+				},
+				"pools": {
+					"example-pool-1": true,
+					"example-pool-2": true
+				}
+			},
+			"templates": {
+				"instances": {
+					"lxc": {
+						"net0": {
+							"value": "name=eth0,bridge=vmbr0,ip=dhcp,ip6=dhcp,tag=10,type=veth,rate=1000",
+							"resource": {
+								"name": "network",
+								"amount": 1000
+							}
+						}
+					},
+					"qemu": {
+						"cpu": {
+							"value": "host",
+							"resource": null
+						},
+						"net0": {
+							"value": "virtio,bridge=vmbr0,tag=10,rate=1000",
+							"resource": {
+								"name": "network",
+								"amount": 1000
+							}
+						}
+					}
+				},
+				"network": {
+					"lxc": {
+						"type": "veth",
+						"bridge": "vmbr0",
+						"vlan": 10,
+						"ip": "dhcp",
+						"ip6": "dhcp"
+					},
+					"qemu": {
+						"type": "virtio",
+						"bridge": "vmbr0",
+						"vlan": 10
+					}
+				}
+			}
+		}
+    }
+}