change default service user role to internal-user (#91)

* change default service user role to internal-user

* update links

* update CHANGELOG.md

* wording

Author: rlindner81

CHANGELOG.md

@@ -9,6 +9,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## v1.2.4 - tbd
 
+### Changed
+
+- cds-plugin: change default service access role to `internal-user` (fixes #90).
+
 ## v1.2.3 - 2025-02-05
 
 ### Added

docs/plugin/index.md

@@ -37,8 +37,8 @@ all of them the same unique name. See
 
 _serviceAccessRoles_, _readAccessRoles_, _writeAccessRoles_, _adminAccessRoles_<br>
 By default the `FeatureService` read and write endpoints are accessible only to users with the CAP pseudo-role
-[system-user](https://cap.cloud.sap/docs/guides/authorization#pseudo-roles). Different projects have their own access role preferences, so this setting allows them to set a
-list of strings, which represent the roles required to access the service. For details see [@requires](https://cap.cloud.sap/docs/guides/authorization#requires).
+[internal-user](https://cap.cloud.sap/docs/guides/security/authorization#pseudo-roles). Different projects have their own access role preferences, so this setting allows them to set a
+list of strings, which represent the roles required to access the service. For details see [@requires](https://cap.cloud.sap/docs/guides/security/authorization#requires).
 
 It will usually be sufficient to set the `serviceAccessRoles` configuration, which covers both the read and write
 endpoints, but not the admin endpoints. If more discriminating access control is required, the `readAccessRoles` and

example-cap-server/.cdsrc.json

@@ -6,8 +6,7 @@
         "system": {
           "tenant": "system",
           "password": "system",
-          "id": "system-user",
-          "roles": ["system-user"]
+          "roles": ["internal-user"]
         },
         "alice": {
           "tenant": "people",

example-cap-server/package.json

@@ -31,7 +31,7 @@
     "featureToggles": {
       "configFile": "./srv/feature/toggles.yaml",
       "serviceAccessRoles": [
-        "system-user",
+        "internal-user",
         "custom-role"
       ]
     }

src/service/feature-service.cds

@@ -2,13 +2,13 @@
 
 @impl: '@cap-js-community/feature-toggle-library/src/service/feature-service.js'
 service FeatureService {
-    @(requires: ['system-user'])
+    @(requires: ['internal-user'])
     function state() returns {};
-    @(requires: ['system-user'])
+    @(requires: ['internal-user'])
     action redisRead() returns {};
 
     // NOTE: expects an object as input
-    @(requires: ['system-user'])
+    @(requires: ['internal-user'])
     @open
     action redisUpdate(newValues: {});
 

test/cds-test-project/.cdsrc.json

@@ -6,8 +6,7 @@
         "system": {
           "tenant": "system",
           "password": "system",
-          "id": "system-user",
-          "roles": ["system-user"]
+          "roles": ["internal-user"]
         }
       }
     }