Skip to content

Harden v1 proxmox VM endpoints (httpx pooling, LXC action allow-list, pagination) #88

@pparage

Description

@pparage

Follow-ups from the v1 VM endpoint audit (app/routes/v1/proxmox/vms.py):

  • Pooled httpx client: a new AsyncClient is created per request. Move to a shared client on app.state (lifespan) for keep-alive/connection pooling.
  • Per-guest-type action allow-list: suspend/resume aren't valid for LXC the same way as qemu; a suspend on vmtype=lxc reaches Proxmox and returns a generic 502. Validate allowed actions per type.
  • Pagination: list_host_vms returns limit=len(items) and accepts no offset/limit; align with the shared Page contract (or document single-page intent).
  • Error granularity: Proxmox 401/403 (bad token) and a 4xx status error both collapse to 502 — consider distinguishing for the UI.

Low/Med priority — none block current functionality.

Metadata

Metadata

Assignees

Labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions