Document current authorization implementation

[jalbinson]

User Story

As a member of the ReportStream team, I would like to understand our current authorization strategy.

Description/Use Case

We need clear documentation of our current authorization strategy so we can make informed decisions going forward. We want to make sure we can support all the same use-cases as the existing system if we were to decide changes are warranted.

Dev notes

See all endpoints defined here

Acceptance Criteria

• Document current authorization approach(es)
• Document all endpoints authorization requirements including:
  • required scopes
  • required groups
  • any other checks (e.g.: client_id header, checking scope and group name formatting)
• Document pros and cons of our current system

[MichaelEsuruoso]

Hey team! Please add your planning poker estimate with Zenhub @jack-h-wang @jalbinson @JFisk42 @kant777 @wcutshall

[MichaelEsuruoso]

Please add your planning poker estimate with Zenhub @adegolier