fix: move to default user when no username is provided

Author: wakonig

bec_lib/bec_lib/acl_login.py

@@ -329,7 +329,8 @@ def _default_user_login_successful(self, full_access: bool) -> bool:
         Login using the default user account.
 
         Args:
-            full_access (bool): If True, the user has to have full access to the Redis
+            full_access (bool): If True, the user has sufficient access to perform all user
+                operations. If False, the user has limited access or no access to perform user operations.
 
         Returns:
             bool: True if the login was successful, False otherwise.
@@ -339,8 +340,8 @@ def _default_user_login_successful(self, full_access: bool) -> bool:
                 return True
 
             try:
-                self.connector.get(MessageEndpoints.acl_accounts())
-                # ACLs are enabled but we have full access. No need to login.
+                # We check an endpoint on level INFO to verify that the user has sufficient access to perform all user operations.
+                self.connector.get(MessageEndpoints.device_config())
                 return True
             # pylint: disable=broad-except
             except Exception:
@@ -366,7 +367,7 @@ def _user_service_login(self, username: str | None = None) -> None:
             raise BECAuthenticationError("Login information not available. Unable to login.")
         self._atlas_login = self._info.atlas_login
         if not username and not self._info.atlas_login:
-            return self.login_with_token(username="user", token=None)
+            return self.login_with_token(username="default", token=None)
         return self.login(username)
 
     def _check_redis_auth(self, user: str | None, password: str | None) -> bool:

bec_lib/bec_lib/utils/user_acls_test.py

@@ -159,18 +159,23 @@ def set_default_limited(self, limited: bool):
 
     def set_default_non_admin(self):
         """Grant the default user access to all non-admin endpoint namespaces."""
-        allowed_namespaces = [
+        read_write_namespaces = [
             EndpointType.PUBLIC.value,
             EndpointType.PERSONAL.value,
             EndpointType.USER.value,
         ]
+        read_only_namespaces = [EndpointType.INFO.value]
         self.connector._managed_connection._redis_conn.acl_setuser(
             "default",
             enabled=True,
             nopass=True,
             categories=["+@all", "-@dangerous"],
-            keys=[f"%RW~{namespace}/*" for namespace in allowed_namespaces],
-            channels=[f"{namespace}/*" for namespace in allowed_namespaces],
+            keys=[f"%RW~{namespace}/*" for namespace in read_write_namespaces]
+            + [f"%R~{namespace}/*" for namespace in read_only_namespaces],
+            channels=[
+                f"{namespace}/*" for namespace in read_write_namespaces + read_only_namespaces
+            ]
+            + [MessageEndpoints.public_file("*", "*").endpoint],
             commands=["+keys"],
             reset_channels=True,
             reset_keys=True,

bec_lib/tests/test_acl_login.py

@@ -166,6 +166,8 @@ def test_access_demo_set_default_non_admin_allows_non_admin_namespaces(access_co
             f"&{EndpointType.PUBLIC.value}/*",
             f"&{EndpointType.PERSONAL.value}/*",
             f"&{EndpointType.USER.value}/*",
+            f"&{EndpointType.INFO.value}/*",
+            f"&{MessageEndpoints.public_file('*', '*').endpoint}",
         ]
     )
     assert f"&{EndpointType.ADMIN.value}/*" not in acl_info["channels"]