Use Casbin for the authorization layer

[mario-nt]

Casbin is a powerful library for implementing authorization.

Using Casbin as an authorization layer would make the code cleaner and easier to work with, also, it will allow us to implement several authorization patterns like role based authorization and attribute based authorization with ease.

The idea is to refactor the authorization service and implement Casbin for the authorization logic.

Subtasks

• Admin role authorization #615 Use Casbin for the authorization layer #624
• Torrent owner authorization
• Authorization for public handlers #615: Authorization for public handlers #662
• Tests 615 - Tests for authorization logic #718
• Force authorization for services/handlers

[josecelano]

Hi @mario-nt, I think after implementing this issue, we should make sure all handlers call the authorization service directly or inside the application services. It would be better if we create an application service for all handlers.

Examples

Handlers without authorization:

#[allow(clippy::unused_async)]
pub async fn about_page_handler(State(_app_data): State<Arc<AppData>>) -> Response {
    (
        StatusCode::OK,
        [(header::CONTENT_TYPE, "text/html; charset=utf-8")],
        about::page(),
    )
        .into_response()
}

pub async fn license_page_handler(State(_app_data): State<Arc<AppData>>) -> Response {
    (
        StatusCode::OK,
        [(header::CONTENT_TYPE, "text/html; charset=utf-8")],
        about::license_page(),
    )
        .into_response()
}

pub async fn get_all_handler(State(app_data): State<Arc<AppData>>) -> Response {
    match app_data.category_repository.get_all().await {
        Ok(categories) => {
            let categories: Vec<Category> = categories.into_iter().map(Category::from).collect();
            Json(responses::OkResponseData { data: categories }).into_response()
        }
        Err(error) => error.into_response(),
    }
}

In fact, there are a lot of them, including all the public endpoints and those that only require a user to be logged in. Even if they don't not require a specific role or conditions we should include them in the authorization service to make the permission explicit in the list.