feat: introduce non-personalized service accounts#2456
Draft
pmig wants to merge 1 commit into
Draft
Conversation
Adds a ServiceAccount principal type that lives alongside UserAccount. Service accounts are non-interactive identities admins create within a vendor org (and optionally scoped to a customer org). Each can hold any number of access tokens that authenticate against the existing "AccessToken: distr-..." header path, so SDK and client code do not change. Backend - New ServiceAccount and ServiceAccountAccessToken tables (migration 100) with vendor/customer-org scoping. - internal/types/service_account.go, internal/db/service_account*.go, internal/mapping/service_account.go, api/service_account.go. - AuthInfo gains CurrentServiceAccountID. SimpleAuthInfo carries a serviceAccountID, DbAuthInfo a *ServiceAccount. - FromServiceAccountAuthKey + UnifiedAuthKeyAuthenticator try user-PAT lookup first, fall back to SA-token lookup. Wired into both Authentication and ArtifactsAuthentication so OCI registry works. - BlockServiceAccount middleware for routes that must reject SA tokens. - /api/v1/service-accounts CRUD + per-SA /tokens, admin-only via RequireAdmin + BlockSuperAdmin + BlockServiceAccount. Customer-org scoping enforced in handlers and middleware. Frontend - SDK ServiceAccount types. - ServiceAccountsService + ServiceAccountsComponent (table below users on both vendor and customer-users pages, admin-only). - ServiceAccountDetailComponent at /users/service-accounts/:id for inline name/role edit and token management. - Extracted AccessTokensTableComponent shared between the personal PAT page and the SA detail page (removes duplication). Docs - website/.../integrations/service-account.md describing creation, admin gating, customer scoping, and curl/OCI usage.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a ServiceAccount principal type that lives alongside UserAccount. Service accounts are non-interactive identities admins create within a vendor org (and optionally scoped to a customer org). Each can hold any number of access tokens that authenticate against the existing "AccessToken: distr-..." header path, so SDK and client code do not change.
Backend
Frontend
Docs