[API] Add a RBAC solution

[jbygdell]

Description
A RBAC solution for the admin API.

RBAC is configured through a JSON structure as shown below:

Each endpoint needs an entry or access will be disallowed, a role entry of "*" in the policy section will allow access to any user with a valid token. The action can be a single entry GET/POST/PUT or several separate by | as per example.

Specific roles are mapped to the roles section, where the role is either a role name or a username. the rolebinding allows a role to function as a group where multiple roles/users can be bound to the same role. This simplifies the policy section as only the top level role needs to be specified for an endpoint

{
   "policy": [
      {
         "role": "admin",
         "path": "/c4gh-keys/*",
         "action": "(GET)|(POST)|(PUT)"
      },
      {
         "role": "submission",
         "path": "/file/*",
         "action": "POST"
      },
      {
         "role": "*",
         "path": "/files",
         "action": "GET"
      }
   ],
   "roles": [
      {
         "role": "admin",
         "rolebinding": "submission"
      },
      {
         "role": "[email protected]",
         "rolebinding": "admin"
      },
      {
         "role": "[email protected]",
         "rolebinding": "submission"
      }
   ]
}

[viklund]

Role names should not be hardcoded.

It should be possible to define new roles without changing the go source code, and what endpoints they have access to.

[jbygdell]

Role names should not be hardcoded.

It should be possible to define new roles without changing the go source code, and what endpoints they have access to.

That would make this extremely complex to almost no gain.
You better come up with some reasonable scenarios where this will be beneficial before we spend the time to implement it.

[viklund]

Role names should not be hardcoded.
It should be possible to define new roles without changing the go source code, and what endpoints they have access to.

That would make this extremely complex to almost no gain. You better come up with some reasonable scenarios where this will be beneficial before we spend the time to implement it.

The code in this file should not become more complicated (probably less). It's basically one annotation per endpoint. RBAC is a solved problem.

New and improved

[MalinAhlberg]

Looks good! I added some minor suggestions for the documentaiton. Will do some testing before I approve.

[MalinAhlberg]

Good work!

[nanjiangshu]

Looks good!