Service (bot) accounts

[patrys]

Saleor now has a robust API that powers our new dashboard. That API would also make a great integration point (even if currently missing some useful mutations) for third-party services like external stock management or price synchronization. We are however missing a robust method to invoke those APIs in a S2S configuration.

Service accounts

I propose that we add a new flag to the User model indicating whether the account is meant to be used by a human or a machine (is_service? is_bot?).

• A new permission would allow admins to create, edit and remove (deactivate?) service accounts.
• Service accounts would use permissions in the same fashion as regular accounts do.
• Service accounts would not be allowed to use a password to authenticate.
• Service accounts would be able to authenticate using OAuth2 service (server to server) flow
• The dashboard should include an icon indicating that any given account is a service account when displaying its name ("created by 🤖SalesForce Robot", "last edited by 🤖Slack Integration" etc.). The icon itself is TBD.

The proposed workflow for integrations would be to (instead of building them into Saleor) deploy them as AWS Lambda functions or small Node containers that each use a dedicated service account with a tailored set of permissions to talk to the GraphQL API.

[NyanKiyoshi]

We will soon only be missing #2084 in the whole awesomeness 😉

[Satloff]

Any progress on this or #2084?

[maarcingebala]

We now have support for service accounts in the API (#4689), UI for Dashboard 2.0 is under construction (saleor/saleor-dashboard#188)