Authentication

[ckoopmann]

Eventually we want to be able to control access to some or all of the api endpoints for different users.

Therefore we will need to add some authentication / user management system.

I'd assume that we would use our own implementation based on JWT.
(found this video on working with JWTs in axum).

Open Questions:

• Do we need this at all ? When ? Priority ? (or do we keep our api open for now)
• Are there any "out of the box" solutions available that can make our life easer ?
• Do we want to provide public endpoints for potential users to register / log-in / generate tokens ? (Or do we just generate those tokens ourselves and hand them out manually ? )
• Token configuration (Do tokens expire ? )
• Do we need multiple tiers of tokens / users ?
• Do we want to have analytics / montioring of user activity ? (With the potential of rate limits etc ? )
• Where do we store the data ? (same db as other services or do we spin up our own db specifically for user management ? )

[alextes]

Would probably start open actually, mostly because it is less work.

Great questions, going to leave them for now but these are the right ones.