fix(xo-server/vm/revert): set admin ACL on created snapshot (#4391)

Fixes #4331

CHANGELOG.unreleased.md

@@ -11,6 +11,8 @@
 
 > Users must be able to say: “I had this issue, happy to know it's fixed”
 
+- [VM revert] Snapshot before: add admin ACLs on created snapshot [#4331](https://github.com/vatesfr/xen-orchestra/issues/4331) (PR [#4391](https://github.com/vatesfr/xen-orchestra/pull/4391))
+
 ### Released packages
 
 > Packages will be released in the order they are here, therefore, they should

packages/xo-server/src/api/vm.js

@@ -1137,10 +1137,15 @@ resume.resolve = {
 // -------------------------------------------------------------------
 
 export async function revert({ snapshot, snapshotBefore }) {
-  await this.checkPermissions(this.user.id, [
-    [snapshot.$snapshot_of, 'operate'],
-  ])
-  return this.getXapi(snapshot).revertVm(snapshot._xapiId, snapshotBefore)
+  const { id: userId, permission } = this.user
+  await this.checkPermissions(userId, [[snapshot.$snapshot_of, 'operate']])
+  const newSnapshot = await this.getXapi(snapshot).revertVm(
+    snapshot._xapiId,
+    snapshotBefore
+  )
+  if (snapshotBefore && permission !== 'admin') {
+    await this.addAcl(userId, newSnapshot.$id, 'admin')
+  }
 }
 
 revert.params = {

packages/xo-server/src/xapi/mixins/vm.js

@@ -463,8 +463,9 @@ export default {
 
   async revertVm(snapshotId, snapshotBefore = true) {
     const snapshot = this.getObject(snapshotId)
+    let newSnapshot
     if (snapshotBefore) {
-      await this._snapshotVm(snapshot.$snapshot_of)
+      newSnapshot = await this._snapshotVm(snapshot.$snapshot_of)
     }
     await this.callAsync('VM.revert', snapshot.$ref)
     if (snapshot.snapshot_info['power-state-at-snapshot'] === 'Running') {
@@ -475,6 +476,7 @@ export default {
         this.resumeVm(vm.$id)::ignoreErrors()
       }
     }
+    return newSnapshot
   },
 
   async resumeVm(vmId) {