RBAC: ACLs and user groups

[tomchop]

Yeti currently supports having multiple users, as well users with super prvileges (can reset other user's passwords, etc.). This is not currently used anywhere, except to have people authenticate to the service.

#916 surfaces the need for auditability, which would also include tracking user's actions on the platform.

We should also consider whether we want to add ACLs, and if so, how we want this implemented. Individual-level ACLs, group-level ACLs?

[udgover]

Group-level ACLs would be really useful! I've in mind at least the following ones:

• Admin role, self explanatory :)
• Standard role, give permissions to add data
• Read only role, can browse / query all the data but can't modify / add

[udgover]

After talking about the implementation details, we could probably pick some inspiration from OpenRelik

[tomchop]

Beyond these roles

• admin
• read/write
• read-only

Do we also want to implement visibility on objects? (e.g. an object is only visible to certain groups). How we approach this requires more discussion I think, so maybe as a second step?