`provisioning` API endpoint safety check

[kennethlimcp]

It seems like the ability to deny adding core public keys to the spark cloud before a core is being claimed is not found in the local cloud.

This will be a great security feature to be included in the basic local cloud code.

[dmiddlecamp]

This change would make the local cloud significantly harder to manage, and can be controlled by managing user accounts on the box, no?

[kennethlimcp]

hmmm..or the user of spark-server will then have to build this mechanism themselves?

I wouldn't want any users to send their own public keys and spin up their own cores/product in the local environment that i'm going to run the Local :cloud:. ;)

[dmiddlecamp]

I just mean, if you disable the creation of new user accounts on your local cloud, then no-one can provision new keys onto your server / connect to your local server, right?

[dmiddlecamp]

For example, you could add a basic setting in settings.js:

 allowNewUsers: false

and then edit main.js with:

var UserCreator = require('./lib/UserCreator.js');
if (settings.allowNewUsers) {
  app.post('/v1/users', UserCreator.getMiddleware());
}

Of course this requires you reboot the server when you make the change, but that would let you lock down your local server from new accounts being generated / new cores being added. :)

[kennethlimcp]

That's for sure! But i thought it would be great if there's this feature as well but that's just my 2 cents. ;)