Access control / permissions in Wasp

[Martinsos]

Ideas:

• On Page/Route level (for UX purposes really, not security)
• On Operation level
• On Entity level
• On Entity field level

[infomiho]

Related to #263

[sodic]

Bumping this because it's a popular request.

Related: #2396 and #1133

[cprecioso]

Related https://github.com/wasp-lang/wasp/issues/584

[sodic]

More users requesting this: https://discord.com/channels/686873244791210014/1353781474456768714/1353781474456768714

[Martinsos]

More users requesting this: https://discord.com/channels/686873244791210014/1353781474456768714/1353781474456768714

Some quotes:

would it be possible to create staff accounts that aren't admin but can view pages that noraml users can't?

would love to have "team" admins for my users & role based access within teams.

I'm super reluctant to be adding a separate db query for every page just to get organisation data for a user. Are we not simply able to change the context.user to join our "organisation" entity so we have all the information here. Basically I want an organisation to hold the subscription details not the user. And only certain actions or pages can be performed based on your subscription. Also you can only load data that is linked to your organisation.

In terms of restricting data I can do this pretty easily, just using queries, views, filters etc, but the crux is getting access within context.user or context.Org so that you don't have to do a db query everytime a page loads or a query/action is required