From 13f586356171f141f5ab83a2cd84f2447e808a04 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= <f.gruenbichler@proxmox.com>
Date: Wed, 30 Dec 2020 12:21:13 +0100
Subject: [PATCH] api: improve error messages for restricted endpoints
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

the old variant attempted to parse a tokenid as userid and returned the
cryptic parsing error to the client, which is rather confusing.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
---
 src/api2/access.rs | 14 +++++++++-----
 src/api2/node.rs   | 22 ++++++++++++++++++----
 2 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/src/api2/access.rs b/src/api2/access.rs
index 2f7fb6ec..22d6ebd2 100644
--- a/src/api2/access.rs
+++ b/src/api2/access.rs
@@ -206,14 +206,18 @@ fn change_password(
     password: String,
     rpcenv: &mut dyn RpcEnvironment,
 ) -> Result<Value, Error> {
-
-    let current_user: Userid = rpcenv
+    let current_auth: Authid = rpcenv
         .get_auth_id()
-        .ok_or_else(|| format_err!("unknown user"))?
+        .ok_or_else(|| format_err!("no authid available"))?
         .parse()?;
-    let current_auth = Authid::from(current_user.clone());
 
-    let mut allowed = userid == current_user;
+    if current_auth.is_token() {
+        bail!("API tokens cannot access this API endpoint");
+    }
+
+    let current_user = current_auth.user();
+
+    let mut allowed = userid == *current_user;
 
     if current_user == "root@pam" { allowed = true; }
 
diff --git a/src/api2/node.rs b/src/api2/node.rs
index dcde83df..b1a25e0e 100644
--- a/src/api2/node.rs
+++ b/src/api2/node.rs
@@ -92,11 +92,16 @@ async fn termproxy(
     rpcenv: &mut dyn RpcEnvironment,
 ) -> Result<Value, Error> {
     // intentionally user only for now
-    let userid: Userid = rpcenv
+    let auth_id: Authid = rpcenv
         .get_auth_id()
-        .ok_or_else(|| format_err!("unknown user"))?
+        .ok_or_else(|| format_err!("no authid available"))?
         .parse()?;
-    let auth_id = Authid::from(userid.clone());
+
+    if auth_id.is_token() {
+        bail!("API tokens cannot access this API endpoint");
+    }
+
+    let userid = auth_id.user();
 
     if userid.realm() != "pam" {
         bail!("only pam users can use the console");
@@ -267,7 +272,16 @@ fn upgrade_to_websocket(
 ) -> ApiResponseFuture {
     async move {
         // intentionally user only for now
-        let userid: Userid = rpcenv.get_auth_id().unwrap().parse()?;
+        let auth_id: Authid = rpcenv
+            .get_auth_id()
+            .ok_or_else(|| format_err!("no authid available"))?
+            .parse()?;
+
+        if auth_id.is_token() {
+            bail!("API tokens cannot access this API endpoint");
+        }
+
+        let userid = auth_id.user();
         let ticket = tools::required_string_param(&param, "vncticket")?;
         let port: u16 = tools::required_integer_param(&param, "port")? as u16;