bec-lib 3.151.3__tar.gz → 3.153.0__tar.gz

{bec_lib-3.151.3 → bec_lib-3.153.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bec_lib
-Version: 3.151.3
+Version: 3.153.0
 Summary: BEC library
 Project-URL: Bug Tracker, https://github.com/bec-project/bec/issues
 Project-URL: Homepage, https://github.com/bec-project/bec
@@ -13,7 +13,7 @@ Requires-Dist: beautifulsoup4~=4.14
 Requires-Dist: fastjsonschema~=2.19
 Requires-Dist: fpdf2>=2.7.7,~=2.7
 Requires-Dist: h5py~=3.10
-Requires-Dist: hdf5plugin<7.0,>=4.3
+Requires-Dist: hdf5plugin<8.0,>=4.3
 Requires-Dist: hiredis~=3.0
 Requires-Dist: lmfit~=1.3
 Requires-Dist: loguru~=0.7
@@ -45,7 +45,7 @@ Requires-Dist: coverage~=7.0; extra == 'dev'
 Requires-Dist: fakeredis>=2.23.2,~=2.23; extra == 'dev'
 Requires-Dist: isort>=5.13.2,~=5.13; extra == 'dev'
 Requires-Dist: jinja2~=3.1; extra == 'dev'
-Requires-Dist: pandas~=2.0; extra == 'dev'
+Requires-Dist: pandas<4,>=2; extra == 'dev'
 Requires-Dist: pylint<5,>=3; extra == 'dev'
 Requires-Dist: pytest-random-order~=1.1; extra == 'dev'
 Requires-Dist: pytest-redis<5,>=3; extra == 'dev'

{bec_lib-3.151.3 → bec_lib-3.153.0}/bec_lib/acl_login.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
 import os
+from collections.abc import Iterator
+from contextlib import contextmanager
 from functools import wraps
 from getpass import getpass
 from typing import TYPE_CHECKING, cast
@@ -13,6 +15,7 @@ from rich.table import Table
 from bec_lib.endpoints import MessageEndpoints
 from bec_lib.logger import bec_logger
 from bec_lib.redis_connector import RedisConnector
+from bec_lib.service_config import ACLConfig
 from bec_lib.utils.import_utils import lazy_import_from
 
 if TYPE_CHECKING:  # pragma: no cover
@@ -87,8 +90,35 @@ class BECAccess:
         """
         self.connector.authenticate(username=username, password=token)
 
+    @contextmanager
+    def temporary_user(self, *, username: str, token: str | None) -> Iterator[None]:
+        """
+        Temporarily authenticate as another ACL user and restore the current user on exit.
+        """
+        credentials = self.current_credentials()
+        self.login_with_token(username=username, token=token)
+        try:
+            yield
+        finally:
+            self.login_with_token(
+                username=credentials["username"] or "default", token=credentials.get("token")
+            )
+
+    def current_credentials(self) -> dict[str, str | None]:
+        """
+        Return the current Redis ACL credentials for forwarding to linked clients.
+        """
+        # pylint: disable=protected-access
+        conn_kwargs = (
+            self.connector._managed_connection._redis_conn.connection_pool.connection_kwargs
+        )
+        token = conn_kwargs.get("password")
+        if token == "null":
+            token = None
+        return {"username": self.connector.username, "token": token}
+
     def _bec_service_login(
-        self, prompt_for_acl: bool = False, acl_config: dict | str | None = None
+        self, prompt_for_acl: bool = False, acl_config: ACLConfig | dict | str | None = None
     ) -> None:
         """
         Login to Redis using the ACL system. This is the main entry point for the login process, started
@@ -97,9 +127,8 @@ class BECAccess:
         Args:
             prompt_for_acl (bool): If True, prompt the user to login using ACL. This is typically only used
                 for user-facing services. Default is False.
-            acl_config (dict or str): The ACL configuration. If a string is provided, it will be treated as a
-                path to the configuration file. If a dictionary is provided, it should contain the username and
-                password for the account.
+            acl_config (ACLConfig, dict, str, optional): The ACL configuration. If a string is provided,
+                it will be treated as a path to the configuration file.
         """
 
         if not self.connector.redis_server_is_running():
@@ -241,40 +270,58 @@ class BECAccess:
         password = getpass(f"Enter the token for {selected_account} (hidden): ")
         return password
 
-    def _config_login_successful(self, prompt_for_acl: bool, acl_config: dict | str) -> bool:
+    def _config_login_successful(
+        self, prompt_for_acl: bool, acl_config: ACLConfig | dict | str | None
+    ) -> bool:
         """
         Login to Redis using the configuration file.
 
         Args:
             prompt_for_acl (bool): If True, prompt the user to login using ACL. Default is False.
-            acl_config (dict or str): The ACL configuration. If a string is provided, it will be treated as a path to the configuration file.
+            acl_config (ACLConfig, dict, str, optional): The ACL configuration. If a string is provided,
+                it will be treated as a path to the configuration file.
 
         Returns:
             bool: True if the login was successful, False otherwise.
         """
 
+        if acl_config is None:
+            return False
+
         if isinstance(acl_config, str):
-            if os.path.exists(acl_config) and not prompt_for_acl:
-                # Load the account information from the .env file
-                # This is relevant for the BEC services that are not launched by the user
-                # but are auto-deployed.
-                account = dotenv_values(acl_config)
-                user = account.get("REDIS_USER")
-                password = account.get("REDIS_PASSWORD")
-                if self._check_redis_auth(user, password):
-                    return True
+            env_file = acl_config
+            username = None
+            password = None
         elif isinstance(acl_config, dict):
-            username = acl_config.get("username")
+            env_file = acl_config.get("env_file")
+            username = acl_config.get("username") or acl_config.get("user")
             password = acl_config.get("password")
-            if self._check_redis_auth(username, password):
-                return True
-            if not password and prompt_for_acl:
-                self._user_service_login(username=username)
-                return True
+        elif isinstance(acl_config, ACLConfig):
+            env_file = acl_config.env_file
+            username = acl_config.user
+            password = acl_config.password
         else:
             raise ValueError(
-                "Invalid value for 'acl' in the service config. Must be a dict or a path to a .env file."
+                "Invalid value for 'acl' in the service config. Must be an ACLConfig, dict, "
+                "or a path to a .env file."
             )
+
+        if env_file and not prompt_for_acl and os.path.exists(env_file):
+            # Load the account information from the .env file. This is relevant for BEC services
+            # that are not launched by the user but are auto-deployed.
+            account = dotenv_values(env_file)
+            user = account.get("REDIS_USER")
+            env_password = account.get("REDIS_PASSWORD")
+            if self._check_redis_auth(user, env_password):
+                return True
+
+        if (username or password) and self._check_redis_auth(username, password):
+            return True
+
+        if prompt_for_acl and username:
+            self._user_service_login(username=username)
+            return True
+
         return False
 
     def _default_user_login_successful(self, full_access: bool) -> bool:
@@ -282,7 +329,8 @@ class BECAccess:
         Login using the default user account.
 
         Args:
-            full_access (bool): If True, the user has to have full access to the Redis
+            full_access (bool): If True, the user has sufficient access to perform all user
+                operations. If False, the user has limited access or no access to perform user operations.
 
         Returns:
             bool: True if the login was successful, False otherwise.
@@ -292,8 +340,8 @@ class BECAccess:
                 return True
 
             try:
-                self.connector.get(MessageEndpoints.acl_accounts())
-                # ACLs are enabled but we have full access. No need to login.
+                # We check an endpoint on level INFO to verify that the user has sufficient access to perform all user operations.
+                self.connector.get(MessageEndpoints.device_config())
                 return True
             # pylint: disable=broad-except
             except Exception:
@@ -319,7 +367,7 @@ class BECAccess:
             raise BECAuthenticationError("Login information not available. Unable to login.")
         self._atlas_login = self._info.atlas_login
         if not username and not self._info.atlas_login:
-            return self.login_with_token(username="user", token=None)
+            return self.login_with_token(username="default", token=None)
         return self.login(username)
 
     def _check_redis_auth(self, user: str | None, password: str | None) -> bool:

{bec_lib-3.151.3 → bec_lib-3.153.0}/bec_lib/bec_service.py

@@ -6,19 +6,15 @@ from __future__ import annotations
 
 import argparse
 import getpass
-import os
 import socket
 import sys
 import threading
 import time
 import uuid
 from dataclasses import asdict, dataclass
-from importlib.metadata import PackageNotFoundError
-from importlib.metadata import version as importlib_version
 from typing import TYPE_CHECKING, Any, Literal
 
 import psutil
-import tomli
 from rich.console import Console
 from rich.table import Table
 
@@ -111,7 +107,7 @@ def parse_cmdline_args(parser=None, config_name: Literal["client", "server"] | s
     config_file = args.config
     cli_args = vars(args)
     user = cli_args.pop("user")
-    acl_config = {"username": user} if user else {}
+    acl_config = {"user": user} if user else None
     redis_url = args.bec_server
 
     if redis_url and config_file:
@@ -134,18 +130,21 @@ def parse_cmdline_args(parser=None, config_name: Literal["client", "server"] | s
             except ValueError:
                 raise ValueError(f"Invalid port number in Redis URL: {comps[1]}")
 
-        service_config = ServiceConfig(
-            redis=redis_data, cmdline_args=cli_args, acl=acl_config, config_name=config_name
-        )
+        kwargs = {"redis": redis_data, "cmdline_args": cli_args, "config_name": config_name}
+        if acl_config:
+            kwargs["acl"] = acl_config
+        service_config = ServiceConfig(**kwargs)
     elif config_file:
-        service_config = ServiceConfig(
-            config_file, cmdline_args=cli_args, acl=acl_config, config_name=config_name
-        )
+        kwargs = {"cmdline_args": cli_args, "config_name": config_name}
+        if acl_config:
+            kwargs["acl"] = acl_config
+        service_config = ServiceConfig(config_file, **kwargs)
     else:
         # If no config file or Redis URL is provided, use the default ServiceConfig
-        service_config = ServiceConfig(
-            cmdline_args=cli_args, acl=acl_config, config_name=config_name
-        )
+        kwargs = {"cmdline_args": cli_args, "config_name": config_name}
+        if acl_config:
+            kwargs["acl"] = acl_config
+        service_config = ServiceConfig(**kwargs)
 
     return args, extra_args, service_config
 
@@ -173,7 +172,7 @@ class BECService:
             else connector
         )
         self.acl = BECAccess(self.connector)
-        self.acl._bec_service_login(prompt_for_acl, self._service_config.config.get("acl"))
+        self.acl._bec_service_login(prompt_for_acl, self._service_config.model.acl)
 
         self._unique_service = unique_service
         self.wait_for_server = wait_for_server

{bec_lib-3.151.3 → bec_lib-3.153.0}/bec_lib/devicemanager.py

@@ -315,7 +315,9 @@ class DeviceContainer(dict):
         return list(tags)
 
     def get_software_triggered_devices(self) -> list:
-        """get a list of all devices that should receive a software trigger detectors"""
+        """
+        Get a list of all enabled devices that should receive a software trigger during a scan.
+        """
         # pylint: disable=protected-access
         devices = [
             dev for _, dev in self.items() if dev._config.get("softwareTrigger", False) is True

{bec_lib-3.151.3 → bec_lib-3.153.0}/bec_lib/endpoints.py

@@ -234,7 +234,7 @@ class MessageEndpoints:
         Returns:
             EndpointInfo: Endpoint for device config request.
         """
-        endpoint = f"{EndpointType.ADMIN.value}/devices/config_request"
+        endpoint = f"{EndpointType.USER.value}/devices/config_request"
         return EndpointInfo(
             endpoint=endpoint, message_type=messages.DeviceConfigMessage, message_op=MessageOp.SEND
         )
@@ -703,7 +703,7 @@ class MessageEndpoints:
         Returns:
             EndpointInfo: Endpoint for stopping devices.
         """
-        endpoint = f"{EndpointType.INFO.value}/queue/stop_devices"
+        endpoint = f"{EndpointType.USER.value}/queue/stop_devices"
         return EndpointInfo(
             endpoint=endpoint, message_type=messages.VariableMessage, message_op=MessageOp.SEND
         )
@@ -849,17 +849,6 @@ class MessageEndpoints:
             message_op=MessageOp.SET_PUBLISH,
         )
 
-    @staticmethod
-    def bluesky_events() -> str:
-        """
-        Endpoint for bluesky events. This endpoint is used by the scan bundler to
-        publish the bluesky events using a direct msgpack dump of the bluesky event.
-
-        Returns:
-            str: Endpoint for bluesky events.
-        """
-        return f"{EndpointType.INFO.value}/scans/bluesky-events"
-
     @staticmethod
     def scan_segment():
         """
@@ -1084,7 +1073,7 @@ class MessageEndpoints:
         Returns:
             EndpointInfo: Endpoint for log.
         """
-        endpoint = f"{EndpointType.INFO.value}/log"
+        endpoint = f"{EndpointType.USER.value}/log"
         return EndpointInfo(
             endpoint=endpoint, message_type=messages.LogMessage, message_op=MessageOp.STREAM
         )
@@ -1626,7 +1615,7 @@ class MessageEndpoints:
         Returns:
             EndpointInfo: Endpoint for procedure queue updates for given queue.
         """
-        endpoint = f"{EndpointType.INFO.value}/procedures/logs/{queue}"
+        endpoint = f"{EndpointType.USER.value}/procedures/logs/{queue}"
         return EndpointInfo(
             endpoint=endpoint, message_type=messages.RawMessage, message_op=MessageOp.STREAM
         )
@@ -1682,7 +1671,7 @@ class MessageEndpoints:
 
     @staticmethod
     def modify_interlock_table():
-        endpoint = f"{EndpointType.INTERNAL.value}/actor/builtin/scan_interlock/table_mod"
+        endpoint = f"{EndpointType.USER.value}/actor/builtin/scan_interlock/table_mod"
         return EndpointInfo(
             endpoint=endpoint,
             message_type=messages.ScanInterlockModifyStateTableMessage,
@@ -1700,7 +1689,7 @@ class MessageEndpoints:
 
     @staticmethod
     def scan_interlock_enabled():
-        endpoint = f"{EndpointType.INFO.value}/actor/builtin/scan_interlock/config/enabled"
+        endpoint = f"{EndpointType.USER.value}/actor/builtin/scan_interlock/config/enabled"
         return EndpointInfo(
             endpoint=endpoint,
             message_type=messages.BoolConfigDefaultFalse,
@@ -1710,7 +1699,7 @@ class MessageEndpoints:
     @staticmethod
     def scan_interlock_trigger_setting():
         """Whether to restart the scan when the interlock is triggered."""
-        endpoint = f"{EndpointType.INFO.value}/actor/builtin/scan_interlock/config/trigger_setting"
+        endpoint = f"{EndpointType.USER.value}/actor/builtin/scan_interlock/config/trigger_setting"
         return EndpointInfo(
             endpoint=endpoint,
             message_type=messages.ScanInterlockTriggerSettingMessage,
@@ -1738,18 +1727,18 @@ class MessageEndpoints:
         )
 
     @staticmethod
-    def gui_acl(gui_id: str):
+    def acl_session(session_id: str):
         """
-        Endpoint for exchanging GUI ACL information. This endpoint is used by the CLI or GUI to exchange
+        Endpoint for exchanging ACL session information. This endpoint is used by the CLI or GUI to exchange
         updates on the required ACL user. It uses a messages.CredentialsMessage message.
 
         Args:
-            gui_id (str): GUI ID.
+            session_id (str): Session ID.
         Returns:
-            EndpointInfo: Endpoint for GUI ACL.
+            EndpointInfo: Endpoint for ACL session.
         """
 
-        endpoint = f"{EndpointType.USER.value}/gui/acl/{gui_id}"
+        endpoint = f"{EndpointType.USER.value}/acl/{session_id}"
         return EndpointInfo(
             endpoint=endpoint, message_type=messages.CredentialsMessage, message_op=MessageOp.SEND
         )
@@ -1812,7 +1801,7 @@ class MessageEndpoints:
         Returns:
             EndpointInfo: Endpoint for script execution info.
         """
-        endpoint = f"{EndpointType.INFO.value}/scripts/execution_info/{script_id}"
+        endpoint = f"{EndpointType.USER.value}/scripts/execution_info/{script_id}"
         return EndpointInfo(
             endpoint=endpoint,
             message_type=messages.ScriptExecutionInfoMessage,
@@ -1828,7 +1817,7 @@ class MessageEndpoints:
         Returns:
             EndpointInfo: Endpoint for script content.
         """
-        endpoint = f"{EndpointType.INFO.value}/scripts/content/{script_id}"
+        endpoint = f"{EndpointType.USER.value}/scripts/content/{script_id}"
         return EndpointInfo(
             endpoint=endpoint, message_type=messages.VariableMessage, message_op=MessageOp.KEY_VALUE
         )
@@ -1859,7 +1848,7 @@ class MessageEndpoints:
         Returns:
             EndpointInfo: Endpoint for beamline state.
         """
-        endpoint = f"{EndpointType.INFO.value}/beamline_state/{state_name}"
+        endpoint = f"{EndpointType.USER.value}/beamline_state/{state_name}"
         return EndpointInfo(
             endpoint=endpoint,
             message_type=messages.BeamlineStateMessage,
@@ -1875,7 +1864,7 @@ class MessageEndpoints:
         Returns:
             EndpointInfo: Endpoint for beamline state updates.
         """
-        endpoint = f"{EndpointType.INFO.value}/available_beamline_states"
+        endpoint = f"{EndpointType.USER.value}/available_beamline_states"
         return EndpointInfo(
             endpoint=endpoint,
             message_type=messages.AvailableBeamlineStatesMessage,
@@ -2073,7 +2062,7 @@ class MessageEndpoints:
         Returns:
             EndpointInfo: Endpoint for dynamic metric publishing.
         """
-        endpoint = f"{EndpointType.INFO.value}/dynamic_metrics/{group_name}"
+        endpoint = f"{EndpointType.USER.value}/dynamic_metrics/{group_name}"
         return EndpointInfo(
             endpoint=endpoint,
             message_type=messages.DynamicMetricMessage,

{bec_lib-3.151.3 → bec_lib-3.153.0}/bec_lib/messages.py

@@ -415,6 +415,8 @@ class RequestBlock(BaseModel):
         scan_number (int | None): Scan number if applicable
         scan_id (str | None): Scan ID if applicable
         report_instructions (list[dict] | None): List of report instructions for the scan, if any
+        owned_device_locks (list[str]): List of device locks owned by the request
+        pending_device_locks (list[str]): List of device locks pending for the request
 
     """
 
@@ -427,6 +429,8 @@ class RequestBlock(BaseModel):
     scan_number: int | None
     scan_id: str | None
     report_instructions: list[dict] | None = None
+    owned_device_locks: list[str] = Field(default_factory=list)
+    pending_device_locks: list[str] = Field(default_factory=list)
 
 
 class QueueInfoEntry(BaseModel):

{bec_lib-3.151.3 → bec_lib-3.153.0}/bec_lib/queue_items.py

@@ -54,6 +54,7 @@ class QueueItem:
         self.active_request_block = active_request_block
         self.scan_ids = scan_id
         self.reason = reason
+        self._lock = threading.RLock()
         if client_messages is None:
             client_messages = []
         self.client_messages = client_messages
@@ -85,6 +86,44 @@ class QueueItem:
     def status(self):
         return self._status
 
+    @threadlocked
+    def _get_device_lock_state(self) -> tuple[list[str], list[str]]:
+        """
+        Return a snapshot of owned and pending device locks.
+
+        Returns:
+            tuple[list[str], list[str]]: A tuple containing two lists:
+                - The first list contains the names of devices whose locks are currently owned.
+                - The second list contains the names of devices whose locks are pending.
+        """
+        owned_device_locks = sorted(
+            {
+                device
+                for request_block in self.request_blocks
+                for device in request_block.owned_device_locks
+            }
+        )
+        pending_device_locks = sorted(
+            {
+                device
+                for request_block in self.request_blocks
+                for device in request_block.pending_device_locks
+            }
+        )
+        return owned_device_locks, pending_device_locks
+
+    def get_device_lock_state(self) -> tuple[list[str], list[str]]:
+        """
+        Refresh and return a consistent snapshot of device-lock state.
+
+        Returns:
+            tuple[list[str], list[str]]: A tuple containing two lists:
+                - The first list contains the names of devices whose locks are currently owned.
+                - The second list contains the names of devices whose locks are pending.
+        """
+        self._update_with_buffer()
+        return self._get_device_lock_state()
+
     def _update_with_buffer(self):
         current_queue = self.scan_manager.queue_storage.current_scan_queue
         if not current_queue:
@@ -103,6 +142,7 @@ class QueueItem:
                 self.update_queue_item(queue_item.info)
                 return
 
+    @threadlocked
     def update_queue_item(self, queue_item: messages.QueueInfoEntry):
         """update the queue item"""
         self.request_blocks = queue_item.request_blocks

{bec_lib-3.151.3 → bec_lib-3.153.0}/bec_lib/scan_input_validator.py

@@ -13,7 +13,7 @@ from bec_lib.scan_args import ScanArgument
 from bec_lib.signature_serializer import deserialize_dtype, dict_to_signature
 
 # Internal scan kwargs that are automatically added to the scan request
-INTERNAL_SCAN_KWARGS = {"user_metadata", "system_config", "scan_queue"}
+INTERNAL_SCAN_KWARGS = {"user_metadata", "system_config", "scan_queue", "monitored", "on_request"}
 
 
 class ScanInputValidator:

{bec_lib-3.151.3 → bec_lib-3.153.0}/bec_lib/scans.py

@@ -58,6 +58,7 @@ class ScanObject:
         hide_report: bool = False,
         metadata: dict | None = None,
         monitored: list[str | DeviceBase] | None = None,
+        on_request: list[str | DeviceBase] | None = None,
         file_suffix: str | None = None,
         file_directory: str | None = None,
         scan_queue: str | None = None,
@@ -72,7 +73,8 @@ class ScanObject:
             async_callback: Asynchronous callback function
             hide_report: Hide the report
             metadata: Metadata dictionary
-            monitored: List of monitored devices
+            monitored: List of devices to be put on the readout priority `monitored`
+            on_request: List of devices to be put on the readout priority `on_request`
             file_suffix: File suffix for the scan data
             file_directory: File directory for the scan data
             scan_queue: Scan queue name. If None, the default queue will be used.
@@ -110,13 +112,25 @@ class ScanObject:
                 monitored = [monitored]
             for mon_device in monitored:
                 if isinstance(mon_device, str):
-                    mon_device = self.client.device_manager.devices.get(mon_device)
-                    if not mon_device:
+                    mon_device_obj = self.client.device_manager.devices.get(mon_device)
+                    if not mon_device_obj:
                         raise RuntimeError(
                             f"Specified monitored device {mon_device} does not exist in the current device configuration."
                         )
             kwargs["monitored"] = monitored
 
+        if on_request is not None:
+            if not isinstance(on_request, list):
+                on_request = [on_request]
+            for or_device in on_request:
+                if isinstance(or_device, str):
+                    or_device_obj = self.client.device_manager.devices.get(or_device)
+                    if not or_device_obj:
+                        raise RuntimeError(
+                            f"Specified on_request device {or_device} does not exist in the current device configuration."
+                        )
+            kwargs["on_request"] = on_request
+
         sys_config = sys_config.model_dump()
         # pylint: disable=protected-access
         if scans._scan_group:

{bec_lib-3.151.3 → bec_lib-3.153.0}/bec_lib/service_config.py

@@ -83,6 +83,7 @@ class ACLConfig(BaseModel):
 
     env_file: str = Field(default_factory=lambda: os.path.join(DEFAULT_BASE_PATH, ".bec_acl.env"))
     user: str | None = None
+    password: str | None = None
 
 
 class ProcedureConfig(BaseModel):

{bec_lib-3.151.3 → bec_lib-3.153.0}/bec_lib/utils/user_acls_test.py

@@ -1,7 +1,7 @@
 import sys
 from typing import Literal
 
-from bec_lib.endpoints import MessageEndpoints
+from bec_lib.endpoints import EndpointType, MessageEndpoints
 from bec_lib.redis_connector import RedisConnector
 
 
@@ -12,12 +12,20 @@ class BECAccessDemo:  # pragma: no cover
             self.connector = connector
         else:
             self.connector = RedisConnector("localhost:6379")
-        self.connector.authenticate(**self._find_admin_account())
+        admin_account = self._find_admin_account()
+        if admin_account:
+            self.connector.authenticate(**admin_account)
         self.username = "user"
         self.admin_username = "admin"
         self.deployment_id = "test_deployment"
 
-    def _find_admin_account(self) -> dict[str, str]:
+    def _find_admin_account(self) -> dict[str, str] | None:
+        try:
+            self.connector.acl_list()
+            return None
+        except Exception:
+            pass
+
         for user, token in [("default", "null"), ("admin", "admin")]:
             try:
                 self.connector.authenticate(username=user, password=token)
@@ -149,6 +157,30 @@ class BECAccessDemo:  # pragma: no cover
                 reset_keys=True,
             )
 
+    def set_default_non_admin(self):
+        """Grant the default user access to all non-admin endpoint namespaces."""
+        read_write_namespaces = [
+            EndpointType.PUBLIC.value,
+            EndpointType.PERSONAL.value,
+            EndpointType.USER.value,
+        ]
+        read_only_namespaces = [EndpointType.INFO.value]
+        self.connector._managed_connection._redis_conn.acl_setuser(
+            "default",
+            enabled=True,
+            nopass=True,
+            categories=["+@all", "-@dangerous"],
+            keys=[f"%RW~{namespace}/*" for namespace in read_write_namespaces]
+            + [f"%R~{namespace}/*" for namespace in read_only_namespaces],
+            channels=[
+                f"{namespace}/*" for namespace in read_write_namespaces + read_only_namespaces
+            ]
+            + [MessageEndpoints.public_file("*", "*").endpoint],
+            commands=["+keys"],
+            reset_channels=True,
+            reset_keys=True,
+        )
+
 
 def _main(
     mode: str, connector: RedisConnector | None = None, shutdown: bool = True
@@ -167,6 +199,14 @@ def _main(
             print(
                 "Enabled mode admin. Please make sure to place the .bec_acl.env file in the root directory and restart the bec server."
             )
+        case "non_admin":
+            demo.reset()
+            demo.add_user()
+            demo.add_admin()
+            demo.set_default_non_admin()
+            print(
+                "Enabled mode non_admin. The default user can access all non-admin namespaces. Please restart the bec server."
+            )
         case _:
             raise ValueError(f"Invalid mode: {mode}")
 
@@ -185,6 +225,6 @@ if __name__ == "__main__":  # pragma: no cover
     args = parser.parse_args()
 
     if args.mode is None:
-        args.mode = "default"
+        args.mode = "non_admin"
 
     _main("default" if args.reset else args.mode)