[Proxmox API] GET /access/permissions returns incorrect permissions for resources contained in pools.

[ltcptgeneral]

I have an example user testuser, which is a member of group dmz:

Iin ALCs, I have given group dmz a custom PAAS-Client role to /pools/dmz with propogate:

Where the custom role has Pool.Audit, Datastore.Audit, VM.Audit, VM.Console, and VM.PowerMgmt


But, when I make a GET request to /access/permissions I get:

{
    "data": {
        "/vms/109": {
            "VM.Audit": 0,
            "Pool.Audit": 0,
            "Datastore.Audit": 0,
            "VM.Console": 0,
            "VM.PowerMgmt": 0
        },
        "/pool/dmz": {
            "VM.PowerMgmt": 1,
            "Pool.Audit": 1,
            "Datastore.Audit": 1,
            "VM.Audit": 1,
            "VM.Console": 1
        },
        "/vms/107": {
            "VM.Console": 0,
            "Pool.Audit": 0,
            "Datastore.Audit": 0,
            "VM.Audit": 0,
            "VM.PowerMgmt": 0
        },
        "/storage/cephfs": {
            "VM.PowerMgmt": 0,
            "Pool.Audit": 0,
            "Datastore.Audit": 0,
            "VM.Audit": 0,
            "VM.Console": 0
        },
        "/vms/102": {
            "VM.PowerMgmt": 0,
            "VM.Audit": 0,
            "Pool.Audit": 0,
            "Datastore.Audit": 0,
            "VM.Console": 0
        },
        "/vms/106": {
            "VM.PowerMgmt": 0,
            "VM.Console": 0,
            "VM.Audit": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0
        },
        "/storage/cephpl_nvme": {
            "VM.Console": 0,
            "VM.Audit": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0,
            "VM.PowerMgmt": 0
        },
        "/vms/103": {
            "VM.Console": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0,
            "VM.Audit": 0,
            "VM.PowerMgmt": 0
        },
        "/vms/105": {
            "VM.PowerMgmt": 0,
            "VM.Console": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0,
            "VM.Audit": 0
        },
        "/vms/108": {            
            "VM.PowerMgmt": 0,
            "VM.Console": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0,
            "VM.Audit": 0
        },
        "/vms/100": {
            "VM.Console": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0,
            "VM.Audit": 0,
            "VM.PowerMgmt": 0
        },
        "/vms/101": {
            "VM.PowerMgmt": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0,
            "VM.Audit": 0,
            "VM.Console": 0
        },
        "/storage/local": {
            "VM.PowerMgmt": 0,
            "VM.Audit": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0,
            "VM.Console": 0
        },
        "/vms/999999": {
            "VM.PowerMgmt": 0,
            "Datastore.Audit": 0,
            "Pool.Audit": 0,
            "VM.Audit": 0,
            "VM.Console": 0
        }
    }
}

Which shows 0 for the permissions granted through PAAS-Client on /pool/dmz's contained resources, when I would expect 1 for those permissions. The actual permission checking when the user does something (ie audit the VM settings) works as expected.

Is this the intended behavior for the API endpoint?

Proxmox Version: 9.2.24

 

[fabian]

the boolean after the privilege indicates whether the privileges propagates further down the ACL tree at that path or not. privileges which are the result of pool ACL expansions never propagate further, so both the output and the practical consequences are correct

edit: the return schema in the API also states this:

Map of "path" => (Map of "privilege" => "propagate boolean").