proxmox-tape: api: restore_key-code moved to tape-encryption-keys

The restore_key api-endpoint is tape/drive/{drive}/restore-key.
Since I cannot set the url parameter for the drivename to null or
undefined, when restoring by exported-key, I moved the
added restore_key-api-code to
"create_key aka POST api2/json/config/tape-encryption-keys" and
added an ApiHandler call in the cli's "restore_key" to call
"create_key" in the api.

Signed-off-by: Markus Frank <m.frank@proxmox.com>

src/api2/config/tape_encryption_keys.rs

@@ -182,6 +182,14 @@ pub fn change_passphrase(
             },
             hint: {
                 schema: PASSWORD_HINT_SCHEMA,
+                optional: true,
+            },
+            key: {
+                description: "A previously exported paperkey in JSON format.",
+                type: String,
+                min_length: 300,
+                max_length: 600,
+                optional: true,
             },
         },
     },
@@ -196,8 +204,9 @@ pub fn change_passphrase(
 pub fn create_key(
     kdf: Option<Kdf>,
     password: String,
-    hint: String,
-    _rpcenv: &mut dyn RpcEnvironment,
+    hint: Option<String>,
+    key: Option<String>,
+    _rpcenv: &mut dyn RpcEnvironment
 ) -> Result<Fingerprint, Error> {
     let kdf = kdf.unwrap_or_default();
 
@@ -207,13 +216,33 @@ pub fn create_key(
             format_err!("Please specify a key derivation function (none is not allowed here).")
         );
     }
+    if hint.is_none() && key.is_none() {
+        param_bail!(
+            "hint",
+            format_err!("Please specify either a hint or a key")
+        );
+    }
 
-    let (key, mut key_config) = KeyConfig::new(password.as_bytes(), kdf)?;
-    key_config.hint = Some(hint);
-
+    let (key_decrypt, mut key_config, fingerprint) = match key {
+        Some(key) => {
+            let key_config: KeyConfig =
+                serde_json::from_str(&key).map_err(|err| format_err!("<errmsg>: {}", err))?;
+            let password_fn = || Ok(password.as_bytes().to_vec());
+            let (key_decrypt, _created, fingerprint) = key_config.decrypt(&password_fn)?;
+            (key_decrypt, key_config, fingerprint)
+        }
+        None => {
+            let (key_decrypt, key_config) = KeyConfig::new(password.as_bytes(), kdf)?;
             let fingerprint = key_config.fingerprint.clone().unwrap();
+            (key_decrypt, key_config, fingerprint)
+        }
+    };
 
-    insert_key(key, key_config, false)?;
+    if hint.is_some() {
+        key_config.hint = hint;
+    }
+
+    insert_key(key_decrypt, key_config, false)?;
 
     Ok(fingerprint)
 }

src/api2/tape/drive.rs

@@ -23,7 +23,6 @@ use pbs_api_types::{
 
 use pbs_api_types::{PRIV_TAPE_AUDIT, PRIV_TAPE_READ, PRIV_TAPE_WRITE};
 
-use pbs_config::key_config::KeyConfig;
 use pbs_config::tape_encryption_keys::insert_key;
 use pbs_config::CachedUserInfo;
 use pbs_tape::{
@@ -610,18 +609,10 @@ fn write_media_label(
             drive: {
                 schema: DRIVE_NAME_SCHEMA,
                 //description: "Restore the key from this drive the (encrypted) key was saved on.",
-                optional: true,
             },
             password: {
                 description: "The password the key was encrypted with.",
             },
-            key: {
-                description: "Restore the key from this JSON string. Clashes with drive.",
-                type: String,
-                min_length: 300,
-                max_length: 600,
-                optional: true,
-            },
         },
     },
     access: {
@@ -630,17 +621,10 @@ fn write_media_label(
 )]
 /// Try to restore a tape encryption key
 pub async fn restore_key(
-    drive: Option<String>,
+    drive: String,
     password: String,
-    key: Option<String>,
 ) -> Result<(), Error> {
-    if drive.is_some() && key.is_some() {
-        bail!("cannot have both 'drive' and 'key' parameter set!");
-    } else if !drive.is_some() && !key.is_some() {
-        bail!("one of either 'drive' or 'key' parameter must be set!");
-    }
 
-    if let Some(drive) = drive {
     run_drive_blocking_task(drive.clone(), "restore key".to_string(), move |config| {
         let mut drive = open_drive(&config, &drive)?;
 
@@ -657,13 +641,6 @@ pub async fn restore_key(
         Ok(())
     })
     .await?;
-    } else if let Some(key) = key {
-        let key_config: KeyConfig =
-            serde_json::from_str(&key).map_err(|err| format_err!("<errmsg>: {}", err))?;
-        let password_fn = || Ok(password.as_bytes().to_vec());
-        let (key, ..) = key_config.decrypt(&password_fn)?;
-        insert_key(key, key_config, false)?;
-    }
 
     Ok(())
 }

src/bin/proxmox_tape/encryption_key.rs

@@ -247,12 +247,19 @@ async fn restore_key(
 
     let password = tty::read_password("Tape Encryption Key Password: ")?;
     param["password"] = String::from_utf8(password)?.into();
-
+    if drive_passed {
         let info = &api2::tape::drive::API_METHOD_RESTORE_KEY;
         match info.handler {
             ApiHandler::Async(handler) => (handler)(param, info, rpcenv).await?,
             _ => unreachable!(),
         };
+    } else {
+        let info = &api2::config::tape_encryption_keys::API_METHOD_CREATE_KEY;
+        match info.handler {
+            ApiHandler::Sync(handler) => (handler)(param, info, rpcenv)?,
+            _ => unreachable!(),
+        };
+    }
 
     Ok(())
 }