feat(rest-api): ACL middleware for several endpoints

[b-Nollet]

Description

Review by commit

ACL middleware for :

• pif (XO-2069)
• proxy (XO-2071)
• pool (XO-2070)

Checklist

• Commit
  • Title follows commit conventions
  • Reference the relevant issue (Fixes #007, See xoa-support#42, See https://...)
  • If bug fix, add Introduced by
• Changelog
  • If visible by XOA users, add changelog entry
  • Update "Packages to release" in CHANGELOG.unreleased.md
• PR
  • If UI changes, add screenshots
  • If not finished or not tested, open as Draft

Review process

If you are an external contributor, you can skip this part. Simply create the pull request, and we'll get back to you as soon as possible.

This 2-passes review process aims to:

• develop skills of junior reviewers
• limit the workload for senior reviewers
• limit the number of unnecessary changes by the author

1. The author creates a PR.
2. Review process:
   1. The author assigns the junior reviewer.
   2. The junior reviewer conducts their review:
      • Resolves their comments if they are addressed.
      • Adds comments if necessary or approves the PR.
   3. The junior reviewer assigns the senior reviewer.
   4. The senior reviewer conducts their review:
      • If there are no unresolved comments on the PR → merge.
      • Otherwise, we continue with 3.
3. The author responds to comments and/or makes corrections, and we go back to 2.

Notes:

1. The author can request a review at any time, even if the PR is still a Draft.
2. In theory, there should not be more than one reviewer at a time.
3. The author should not make any changes:
   • When a reviewer is assigned.
   • Between the junior and senior reviews.

[plane-sync-vates]

Linked to Plane Work Item(s)

• [XO-2069] [REST API] Restrict pifs endpoint with ACL
• [XO-2071] [REST API] Restrict proxies endpoint with ACL
• [XO-2070] [REST API] Restrict pools endpoint with ACL

This comment was auto-generated by Plane

[MathieuRA]

I suggest:

Suggested change

	getObject: <T extends XenApiRecord>(
	// id is either uuid or ref
	idOrUuidOrRef: T[Extract<'uuid', keyof T>] | T['$ref'],
	defaultValue?: T
	) => T
	getObject: <XoRecord extends XapiXoRecord, WrappedRecord extends WrappedXenApiRecord = Extract<WrappedXenApiRecord, { $type: XoRecord['type'] }>>(
	idOrUuidOrRef: XoRecord['id'] | WrappedRecord['$ref'] | WrappedRecord['uuid'],
	defaultValue?: WrappedRecord
	) => WrappedRecord

So, idOrUuidOrRef reflect the 3 possible types: XO ID, or XAPI UUID or a XAPI $ref, and it return the XAPI object wrapped (with $xapi property, ..)

BTW, in pool.controller, you will need to change const template = pool.$xapi.getObject<XenApiVm>(req.body.template) to const template = pool.$xapi.getObject<XoVm>(req.body.template)

[b-Nollet]

added and tested