Following up on #45, I think it is sound to have a discussion about the multiple access levels in the API. With the current design of scopes, we cannot efficiently separate accesses of large user groups.

Requirements

• We need to restrict "superadmin" from common users
• Users need to be segmented into groups, where each group only has access to a restricted scope (i.e. a local firefighter, while having a "user" scope, should not have access to the same data as someone from another region, while that person is also a "user")
• Groups need to be easily editable
• security on routes will have to combine those to provide proper and secure access to each route

Design suggestion

Simply put, I believe two fields are required:

• access_type: admin, user, device, me
• access_group: ID that would reference a group (we could add a groups table with group_id, and group_name)