Limit API access based on user role

[gtsiolis]

Problem to solve

Following up from #15350 (comment), we should make sure that API access is matching the permissions to access resources like dashboard features available based on the user role. 🔍

Currently, we have two distinct roles for teams (OWNER, MEMBER), however, users may also have ADMIN flag that can be set through admin user settings.

It could be worth clearly defining across an instance so that it's easier to limit access in the product as well as API. 💡

Cc @easyCZ @svenefftinge

[svenefftinge]

I think we can close this as we already generally do this and also in the specific case mentioned. We do work on a new authorization model, though. but this would be tracked in another ticket/epic

[gtsiolis]

Sounds good, thanks for coming back to this, @svenefftinge! 🏓