Hey there 👋

Playing around with the PRs, I noticed that some routes are protected by scopes while others aren't. If some of those are correct, I just want to make sure we do consider carefully those choices for each router:

• alerts: should it be exposed to everyone on Read? admin & device for create, update, delete? (feat: Added admin scopes on tables to protect #99, feat: Added admin scopes to alert routes #122)
• devices: "admin" by default for all routes, "me" added to self-ID routes (feat: Added admin scopes to device routes #121)
• events: should it be exposed to everyone on Read? admin & device for create, update, delete? ([scopes][events] Add scopes to CUD routes #59, feat: Added admin scopes on tables to protect #99)
• installations: should it be exposed to everyone on Read? admin only for create, update, delete? (feat: Added admin scopes on tables to protect #99, feat: Added admin scopes to installation routes #120)
• media: we need some scope but can't be admin only, since a logged user whose scope includes a given device, should have access to its media (feat: Added admin scopes on tables to protect #99, feat: Added proper scopes to media routes #118)
• sites: should it be exposed to everyone on Read? admin only for create, update, delete? ([scopes][sites]Add admin scopes to CUD routes #58, feat: Added admin scopes on tables to protect #99)
• users: "admin" by default for all routes, "me" added to self-ID routes (feat: Added a password update route #15, refactor: Added admin to authorized scopes of selfID routes #44)

Those where I have no clue whether we should add some:

• accesses: "admin" by default for all routes (Add security admin scope requirement on accesses routes #104)
• login: no scope

cc @florianriche @jeanpasquier75 @fe51 @martin1tab