simplify access controls

[ricardogsilva]

As a succession to #90, and keeping up with the aim of improving UX, let's simplify the system access controls. Now that we have a bit more insight on how the system will be used, the original proposal seems more complex than needed. For reference, here is a simplified depiction of the original proposal:

The item ownership concept is fairly complex and also demands that custom UI controls be provided for transferring ownership of items. Also, the management of settings items is a privilege of the system admin. Given that the client is a small team of experts working collaboratively towards a common goal, this level of granularity is not that useful and can potentially become a hindrance.

As an alternative, let's implement a simpler design, as depicted below:

In this version, the item ownership concept does not exist and catalog editors effectively have the same access level as system admins. Advantages of this reworked proposal:

• A better fit for the client, which is composed of a small team where all users are likely to co-own all datasets
• Simpler to understand as the access controls are equal for all resource types
• Easier to implement
• Does not require UI for managing item ownership transfer

[ricardogsilva]

As a corollary to this, let's also modify the authentik blueprint in order to not allow users to self-register - a system admin shall manually create new users and assign them either the catalog-editor or catalog-viewer roles.

[lcalisto]

I think it makes sense and its simpler. 👍 Given the size of the team and the discussions we had I think this is a good strategy. Later if we need to add complexity its easier but I don't expect it any time soon.