Design authorization & permissions model

[MateuszNaKodach]

Draft

• JWT scope (guard) per command. Certain users may do certain commands.
• Roles may be a set of scopes
• Make something similar for events (listen for events on WebSockets / SSE)
• For GET (queries) - maybe we need to introduce query object.

Or maybe another way around - certain command may decide which roles are able to execute the command? Or simple, as now - role on rest endpoint.

Scopes like:

• command:GenerateLearningMaterialsUrl
• query:GetCourseProgress
• event:UserWasRegistered

[github-actions[bot]]

Branch issue-355-Design_authorization_permissions_model created!