General idea

We're envisioning a system where OpenCore acts like an authorization service. In other words, GeoServer provides the user identifier*, the project and the desired operation (read,write) and OpenCore responds with either Allowed or Denied.

Types of information we may need

    Given: user identifier, projectname, operation (read,write)
        allowed, denied

    Given: user identifier
        all projects user can read
        all projects user can write to

Note that this interface exposes project memberships, and therefore needs to be kept confidential. It would probably be a good idea to require all external applications, such as GeoServer, to provide a secret.

Flow of a single request

    1) A signed cookie provides the username to GeoServer*
    2) The user performs an operation
    3) GeoServer determines whether this is a read or a write
    4) GeoServer sends user identifier, project name, operation to OpenCore backend
    5) OpenCore looks up the rights of the user for the given project, and considers the operation
    6) OpenCore responds with allowed ordenied
    7) GeoServer performs the operation or ignores it
    8) User gets receipt or rejection

*: For the time being we assume this is the username. Lets improve upon this later, it would be sufficient with a session id if the response from OpenCore then is expanded to include the username or a similar identifier, so that GeoServer can store this with the changes.