Protect routes

[sirkrypt0]

We need some way of authenticating users, such that not every user is able to call all routes. Could be done using JWTs that are sent using the Authorization header.

[frcroth]

Possible solution:

1. Send an authorization request (May be handled via ssh or password)
2. On successful authorization, the server will reply an access_token
3. All further actions have an access_token token in the request (May just be in the URL since we should use SSL anyway)
4. The access_token is only valid for a limited time

[frcroth]

Comparison to Matrix:
curl -XGET "https://localhost:8448/_matrix/client/r0/login"

{
    "flows": [
        {
            "type": "m.login.password"
        }
    ]
}

curl -XPOST -d '{"type":"m.login.password", "user":"example", "password":"wordpass"}' "https://localhost:8448/_matrix/client/r0/login"

{
    "access_token": "QGV4YW1wbGU6bG9jYWxob3N0.vRDLTgxefmKWQEtgGd", 
    "home_server": "localhost", 
    "user_id": "@example:localhost"
}

[frcroth]

https://matrix.org/docs/guides/client-server-api

[frcroth]

https://github.com/Keats/jsonwebtoken