Add auth.credentials_login permission to default-user #1653
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a step towards enabling more granular logins. Once this is merged we will want to enforce the user has this permission when logg n in here:
open-balena-api/src/features/auth/index.ts
Line 28 in 423fc58
This can't be done directly using the
middleware.permissionRequired
because this middleware requires a partiallyAuthenticatedUser to work. So we can just enforce it on the login method, as: https://github.com/balena-io/open-balena-api/pull/1654/files#diff-09036ece83a65b9a83897a8dd10e51dec832301f86fe4a21aed2b76d3ef98050R27-R31 in hereWe also want to have a "auth.service_account_login" for SSO providers and enforce it, but on balena-api. On SAML specific, the saml role won't have these permissions.
Change-type: minor