feat: create system user accounts

Signed-off-by: Sebastian Krupinski <krupinski01@gmail.com>

lib/Controllers/DefaultController.php

@@ -23,6 +23,7 @@ use KTXF\Resource\Identifier\EntityIdentifier;
 use KTXF\Resource\Identifier\ResourceIdentifier;
 use KTXF\Resource\Identifier\ResourceIdentifiers;
 use KTXF\Resource\Identifier\ServiceIdentifier;
+use KTXF\Mail\Provider\ProviderBaseInterface;
 use KTXF\Resource\Provider\ResourceServiceLocationInterface;
 use KTXF\Routing\Attributes\AuthenticatedRoute;
 use KTXM\MailManager\Manager;
@@ -82,6 +83,24 @@ class DefaultController extends ControllerAbstract {
         $tenantId = $this->tenantIdentity->identifier();
         $userId = $this->userIdentity->identifier();
 
+        // acting-user override: only the reserved system context is permitted,
+        // gated on the system mail management permission
+        if ($user !== null && $user !== $userId) {
+            if ($user !== ProviderBaseInterface::USER_SYSTEM || !$this->userIdentity->hasPermission('mail_manager.system')) {
+                return new JsonResponse([
+                    'version' => $version,
+                    'transaction' => $transaction,
+                    'operation' => $operation,
+                    'status' => 'error',
+                    'data' => [
+                        'code' => JsonResponse::HTTP_FORBIDDEN,
+                        'message' => 'Not permitted to act as user: ' . $user
+                    ]
+                ], JsonResponse::HTTP_FORBIDDEN);
+            }
+            $userId = $user;
+        }
+
         try {
             
             if ($operation !== null) {