feat(auth): implement and verify authorization for all endpoints #54

New issue

Closed

opened 2025-08-11 13:35:59 +00:00 by chartgerink · 0 comments

chartgerink commented

2025-08-11 13:35:59 +00:00

Owner

The implementation is mostly focused on authentication at this time - authentication only verifies being logged in.

Authorization will ensure the logged in user has the relevant permissions. There are multiple forms of authorization we need to implement:

Role based authorization
User based authorization

Role based means for example that an admin has more rights on the service (for example, to delete institutions) than a regular client. Depends on #26.

User based authorization is to ensure that Person A cannot modify Person B's data. It can also mean that we verify that Person A has access to the requested content (eg a publication draft).

The implementation is mostly focused on authentication at this time - **authentication** only verifies being logged in. **Authorization** will ensure the logged in user has the relevant permissions. There are multiple forms of authorization we need to implement: 1. Role based authorization 2. User based authorization Role based means for example that an admin has more rights on the service (for example, to delete institutions) than a regular client. Depends on #26. User based authorization is to ensure that Person A cannot modify Person B's data. It can also mean that we verify that Person A has access to the requested content (eg a publication draft).