#837 api: fine-grained permission control for service account creation Pull request opened by alvarofraguas Summary • Adds optional

user_access

,

query_access

,

carve_access

, and

admin_access

fields to the user creation API endpoint • When provided, these override the legacy behavior where all permission levels were derived from the binary

admin

flag • Enables creating service accounts with specific permission combinations (e.g. read + query for monitoring, read + carve for forensics) Backward compatibility Fields use pointer types (

*bool

) so

nil

(not provided) is distinguishable from

false

(explicitly denied). When none of the new fields are provided, the handler falls back to the existing behavior:

user_access=true

, everything else =

admin

value. Existing API clients and the CLI continue working unchanged. API usage POST /api/v1/users/my-monitoring-bot/add { "username": "my-monitoring-bot", "password": "secure_password", "email": "monitoring@example.com", "service": true, "admin": false, "environments": ["env-uuid"], "user_access": true, "query_access": true, "carve_access": false, "admin_access": false } Security The endpoint is already gated behind global admin permission (

AdminLevel

check). Only admins can create users or assign permissions. This change adds granularity to what admins can already do — it does not expand the attack surface. Closes #774 Test plan •

go build ./...

clean •

go test ./cmd/api/... ./pkg/users/...

passes • Legacy behavior preserved: omitting new fields produces same permissions as before • Fine-grained:

admin=false

+

query_access=true

creates user with read + query only jmpsec/osctrl