At the moment, the only auth guard the application uses is to check whether the user is authenticated. However, certain requests should check whether the user has the right permissions, e.g. that the user can only delete a tournament if they own it.
Most of these guards will be generic and usable for multiple requests, but there may also need to be guards for the logic behind private tournaments.
If an owner can give permissions to users, this guarding must also be handled.
At the moment, the only auth guard the application uses is to check whether the user is authenticated. However, certain requests should check whether the user has the right permissions, e.g. that the user can only delete a tournament if they own it.
Most of these guards will be generic and usable for multiple requests, but there may also need to be guards for the logic behind private tournaments.
If an owner can give permissions to users, this guarding must also be handled.