fix issue with user realm sync and insufficient permissions using priviledge escalation

app/operations.go

@@ -3,7 +3,6 @@ package app
 import (
 	common "access-manager-api/app/common"
 	"access-manager-api/app/ldap"
-	proxmox "access-manager-api/app/pve"
 	"fmt"
 	"net/http"
 )
@@ -105,7 +104,7 @@ func NewGroup(backends *UserSession, groupname common.Groupname, group common.Gr
 		if err != nil {
 			return code, err
 		}
-		return backends.PVE.(proxmox.ProxmoxClient).SyncRealms()
+		return PVERootSession.SyncRealms()
 	} else {
 		return http.StatusUnauthorized, fmt.Errorf("user is not in the same realm as requested group")
 	}
@@ -120,7 +119,7 @@ func ModGroup(backends *UserSession, groupname common.Groupname, group common.Gr
 		if err != nil {
 			return code, err
 		}
-		return backends.PVE.(proxmox.ProxmoxClient).SyncRealms()
+		return PVERootSession.SyncRealms()
 	} else {
 		return http.StatusUnauthorized, fmt.Errorf("user is not in the same realm as requested group")
 	}
@@ -189,7 +188,7 @@ func DelGroup(backends *UserSession, groupname common.Groupname) (int, error) {
 		if err != nil {
 			return code, err
 		}
-		return backends.PVE.(proxmox.ProxmoxClient).SyncRealms()
+		return PVERootSession.SyncRealms()
 	} else {
 		return http.StatusUnauthorized, fmt.Errorf("user is not in the same realm as requested group")
 	}
@@ -214,7 +213,7 @@ func NewUser(backends *UserSession, username common.Username, user common.User)
 		if err != nil {
 			return code, err
 		}
-		return backends.PVE.(proxmox.ProxmoxClient).SyncRealms()
+		return PVERootSession.SyncRealms()
 	} else {
 		return http.StatusUnauthorized, fmt.Errorf("user is not in the same realm as requested user")
 	}
@@ -229,9 +228,7 @@ func ModUser(backends *UserSession, username common.Username, user common.User)
 		if err != nil {
 			return code, err
 		}
-		// todo, most users will not have access to sync realms, but should be able to modify their own user
-		// will probably use priviledge escalation to give priviledge for modify user operations
-		return backends.PVE.(proxmox.ProxmoxClient).SyncRealms()
+		return PVERootSession.SyncRealms()
 	} else {
 		return http.StatusUnauthorized, fmt.Errorf("user is not in the same realm as requested user")
 	}
@@ -265,7 +262,7 @@ func DelUser(backends *UserSession, username common.Username) (int, error) {
 		if err != nil {
 			return code, err
 		}
-		return backends.PVE.(proxmox.ProxmoxClient).SyncRealms()
+		return PVERootSession.SyncRealms()
 	} else {
 		return http.StatusUnauthorized, fmt.Errorf("user is not in the same realm as requested user")
 	}
@@ -286,7 +283,7 @@ func AddUserToGroup(backends *UserSession, username common.Username, groupname c
 		if err != nil {
 			return code, err
 		}
-		return backends.PVE.(proxmox.ProxmoxClient).SyncRealms()
+		return PVERootSession.SyncRealms()
 	} else { // req user in proxmox and req group in realm (not possible to do)
 		return http.StatusUnauthorized, fmt.Errorf("cannot add %s to %s", username.ToString(), groupname.ToString())
 	}
@@ -307,7 +304,7 @@ func DelUserFromGroup(backends *UserSession, username common.Username, groupname
 		if err != nil {
 			return code, err
 		}
-		return backends.PVE.(proxmox.ProxmoxClient).SyncRealms()
+		return PVERootSession.SyncRealms()
 	} else { // req user in proxmox and req group in realm (not possible to do)
 		return http.StatusUnauthorized, fmt.Errorf("cannot delete %s from %s", username.ToString(), groupname.ToString())
 	}