Implements authorization layer

[IsaacIsrael]

• chore: rename folder test to tests
• chore: fix typos
• feat: add features column to users table
• feat: add default feature read:activation_token when creating user
• feat: handle empty email list in orchestrator.getLastEmail()
• feat: send activation email after user registration
• feat: add activation.findOneValidById() and orchestractor.extractUUID()
• feat: add PATCH /api/v1/activations/[token_id]
• feat: add injectAnonymousOrUser and canRequest middlewares to /sessions
• feat: require read:session to access /user endpoint
• feat: require read:activation_token to access /api/v1/activations/[token_id]
• feat: require create:user to access api/v1/users
• feat: require update:user to access api/v1/users/[username]
• feat: consider resource in authorization model
• feat: allow update:user:others to update other users
• refactor: update createSession to accept user object instead of user_id
• feat: apply authorization.filterOutput() to all endpoints
• feat: validate user, feature and resource in authorization model

---

Ignore the size of the PR and analyze commit by commit, once they are a step-by-step of the last classes

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clone-tabnews	Ready	Preview, Comment	Apr 9, 2026 4:56pm