[pumpi]

Adds GET /api/_action/frosh-tools/security/accounts behind frosh_tools_security:read, listing admin users, integrations and ACL roles so Shopmon can diff snapshots and alert on new accounts or privilege escalation.

Exposes ids and security relevant attributes only - no usernames, names, e-mail addresses or access keys. Aggregated across many shops those would form a credential stuffing list, so accounts are resolved to a person via the returned adminPath instead. Read via DBAL so no personal column is loaded in the first place.

App integrations report the ACL role attached through app.acl_role_id, which Shopware resolves with precedence over integration_role.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge based on the reviewed changes.

Summary

Adds an account inventory endpoint for external monitoring.

• Security monitoring can fetch a snapshot of users, integrations, and roles.

No actionable new issues were established. Both earlier, unnumbered findings are addressed in the current code.

_{Reviews (3) · Last reviewed commit: "feat: add masked e-mail to admin account..." · Reviewed by Greptile}

[shyim]

@schneider-felix what do you think here. For me it feels little bit like useless if we canot say which excactly admin user got created and so on 🙈

[schneider-felix]

I don't think the credential stuffing problem would be too bad but the concern is definitly valid.

Here's my wild idea, how we could solve it:
Create a hash of the e-mail or username (you could even "pepper" it with a value like the APP_URL). That's the value which would then be stored in shopmon. When something happens, shopmon could retrieve the real username on demand so we would never have to store it.

On the other hand: I think if shopmon get compromised, credential stuffing is the least of our concerns 😅

[schneider-felix]

Or, why don't we just send a webhook to shopmon?