feat: add cerbos access control

api/routes/account/create.ts

@@ -13,6 +13,7 @@ export default create.access("public").handle(async ({ body: { name, email } })
     .create()
     .addName(name)
     .addEmailStrategy(email)
+    .addRole("user")
     .save()
     .then((account) => account.id);
 });

api/routes/account/get-by-id.ts

@@ -0,0 +1,17 @@
+import { ForbiddenError } from "@spec/relay/mod.ts";
+import { NotFoundError } from "@spec/relay/mod.ts";
+import { getById } from "@spec/schemas/account/routes.ts";
+
+import { db } from "~stores/read-store/database.ts";
+
+export default getById.access("authenticated").handle(async ({ params: { id } }, { access }) => {
+  const account = await db.collection("accounts").findOne({ id });
+  if (account === null) {
+    return new NotFoundError();
+  }
+  const decision = await access.isAllowed({ kind: "account", id: account.id, attributes: {} }, "read");
+  if (decision === false) {
+    return new ForbiddenError();
+  }
+  return account;
+});