Feat/auth complete access control for auth