Authorize endpoints and methods.

[gleidsonlm]

Users should only be able to reach endpoints and execute methods they are allowed. Nestjs Guards could fulfill this requirement. https://docs.nestjs.com/guards

[gleidsonlm]

Need to implement the JWT and Roles guards in /users/ as well, ensuring users can only Patch, Update, and Exclude themselves.

[gleidsonlm]

Although implementation is functioning as designed so far, there is some problem in our testing setup with Mongoose.MongoDB.Types when using InMemory DB. Reported in #7, but will not block the development.

Moving forward to implement Roles, likely using Guards.

[gleidsonlm]

Resolved previous problems, working on implementing the Roles guard.

[gleidsonlm]

Roles guard implemented, trying to fix the issue related to the requiredRoles ['admin','staff'] against userRoles [{enum: 'staff'}].

[gleidsonlm]

The current implementation of roles as part of User entity is not FAD , and worse, it's not supporting our idea for how the end-user will control access with them. I'll start anew , but trying Roles as a module related to the User. That will also support us in the future to implement a ACL approach for authorization.

[gleidsonlm]

Implemented roles guard successfully, adding another layer to the JWT authorization guard. Tests are not functioning right now. Ideally, we would implement a mock user with the proper authorization. We'll defer this for https://github.com/users/gleidsonlm/projects/1/views/1?pane=issue&itemId=18662145.

[gleidsonlm]

Current features of 0.1.0:

• Create, List, Update, and Exclude Users by self-registration (/me) and user management (/users).
• Authenticate by local email/pass and Bearer token (/auth).
• Assign or remove roles from the users using the API (/roles).
• RBAC - Role-Based Access Control.
• All routes, but the public ones, require Authentications and Authorization (RBAC).
• Self-registration and local Authentication are public routes.