Fix #1016: Add roles and permissions, plus CLI to manage them

[robhudson]

See the docs/access_controls.md and docs/cli.md files here for a bit more details.

This doesn't currently add any permissions or permission dependencies to any routes, that will come later.

[robhudson]

@leplatrem or @grahamalama: Curious if either of you would have time for a quick review? I know +2,312 lines isn't quick but perhaps a high level review?

[leplatrem]

I'm sorry Rob for the delay.

This is great! Super clean 👌

I have one question about the permissions. Since permissions are meant to be used in code, do you think it's relevant to expose their manipulation to admins? Intuitively I would either create them on the fly when a view refers to it, and put their creation in migration code so that they get created automatically when a new version is deployed. What do you think?

[robhudson]

I have one question about the permissions. Since permissions are meant to be used in code, do you think it's relevant to expose their manipulation to admins?

I think having a CLI to manage permissions and roles is valuable, as it provides flexibility for admins when needed. That said, I agree that the most common approach would be to add permissions via migrations alongside the code that uses them. This ensures they are always created when deploying a new version, keeping them in sync with the application logic.