fix: internal service accounts are the router's own, of which the metrics service's is the one at present, and the documentation says what a service account is.

debian-package/src/usr/lib/vpn-router/web

@@ -15,7 +15,7 @@ Pages:
            profile, and TOTP enrolment (see users()); service accounts are not among them
   /service-accounts
            the service accounts: list, add, change the e-mail address, set the password,
-           disable, enable, unlock and remove; the internal one is only listed (see
+           disable, enable, unlock and remove; the internal ones are only listed (see
            service_accounts())
   /groups  the groups of the router's directory: list, add, rename or describe, remove, and
            add and take out members (see groups())
@@ -516,8 +516,8 @@ def service_accounts(method, path, body):
       POST   /service-accounts/<name>/unlock     end a lockout after failed logins
       DELETE /service-accounts/<name>            remove it
 
-    A name that is not a service account is 404. The internal one (vpnrouter_users.metrics_account), which
-    vpn-router-setup adds and keeps, is only listed: every other request on it is refused with 403.
+    A name that is not a service account is 404. The internal service accounts (vpnrouter_users.internal_accounts),
+    which the router manages, are only listed: every other request on one is refused with 403.
     """
     if body == 'invalid' or (body is not None and not isinstance(body, dict)):
         return 400, {'error': 'the body must be a JSON object'}
@@ -540,8 +540,8 @@ def service_accounts(method, path, body):
     }
     if route not in actions:
         return 404, {'error': f'no route {method} {path}'}
-    if name is not None and name == vpnrouter_users.metrics_account():
-        return 403, {'error': f'{name} is the internal service account of the metrics service; only vpn-router-setup changes it'}
+    if name is not None and name in vpnrouter_users.internal_accounts():
+        return 403, {'error': f'{name} is an internal service account, which the router manages'}
     try:
         with vpnrouter_users.session() as connection:
             if name is not None and not vpnrouter_users.service(vpnrouter_users.entry(connection, name)):
@@ -564,7 +564,7 @@ def groups(state, method, path, body):
       POST   /groups/<name>/members           add a member: {"user": ...}
       DELETE /groups/<name>/members/<user>    take a member out; the last member cannot leave
 
-    The internal service account (vpnrouter_users.metrics_account) is not put in or taken out of a group: such a
+    An internal service account (vpnrouter_users.internal_accounts) is not put in or taken out of a group: such a
     request is refused with 403.
     """
     if body == 'invalid' or (body is not None and not isinstance(body, dict)):
@@ -573,11 +573,12 @@ def groups(state, method, path, body):
     parts = path.strip('/').split('/')
     name = parts[1] if len(parts) > 1 else None
     route = (method, len(parts), parts[2] if len(parts) > 2 else None)
-    internal = vpnrouter_users.metrics_account()
     members = body.get('members') if route == ('POST', 1, None) else [body.get('user')] if route == ('POST', 3, 'members') \
         else [parts[3]] if route == ('DELETE', 4, 'members') else []
-    if internal is not None and isinstance(members, list) and internal in members:
-        return 403, {'error': f'{internal} is the internal service account of the metrics service; only vpn-router-setup changes it'}
+    internal = sorted(vpnrouter_users.internal_accounts().intersection(
+        member for member in (members if isinstance(members, list) else []) if isinstance(member, str)))
+    if internal:
+        return 403, {'error': f'{", ".join(internal)}: internal service accounts, which the router manages, are not group members'}
     actions = {
         ('GET', 1, None): lambda connection: vpnrouter_users.list_groups(connection),
         ('POST', 1, None): lambda connection: vpnrouter_users.group_add(