Implement access management for API routes

[NicolasKieffer]

To restrict access to certain routes and authorise them only for certain users

[NicolasKieffer]

Access management for API routes

Added

• New route-specific permissions system to control user access
  • src/middleware/permissions.js - Permissions middleware
  • src/utils/permissionsManager.js - Permissions management utility
  • scripts/manage_permissions.js - CLI tool for managing permissions
  • conf/permissions.json - Configuration file for storing permissions

Changed

• Updated authentication flow to include permissions checks
• Enhanced error responses with clear permission-related messages
• Modified request validation to check user permissions after authentication
• Display available API routes based on user permissions

Features

• Route-specific access control
  • Allow/block lists per HTTP method
  • Empty allowed list = all authenticated users can access
  • Populated allowed list = only listed users can access
  • Blocked list overrides allowed list
• Permission management commands:

  npm run manage-permissions add <path> <method> [allowed] [blocked]
  npm run manage-permissions remove <path> <method>
  npm run manage-permissions allow <path> <method> <userId>
  npm run manage-permissions block <path> <method> <userId>
  npm run manage-permissions list

Documentation

• Added permissions management section to README.md
• Updated security considerations
• Added permission management examples
• Updated project structure to include new files

Security

• Added route-level access control
• Enhanced error messages for unauthorized access
• Permission checks after token validation