Access control - Githubissues

OAuth2 authorization code with PKCE
Specific permissions for endpoints that change state or affect non-public data
The concept of users and user groups
Permissions publicly exposed under /permission (the one endpoint without references, because this is a finite set that's perfect for caching in bulk)
Permissions are assigned to groups. Users as well as user groups inherit permissions from the groups they belong to.
Endpoints to get and delete existing tokens for users and user groups.

To-dos