docs

cmd/cognito_test/cognitotest/readme.md

@@ -103,6 +103,21 @@ curl -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIs..." http://localhost:8080/us
 | /query | exporters |
 | /api/inventory/update | exporters, uploaders |
 
+Note. If you want to change the RBAC requirements for the server they are completely table driven.  
+The code where they are defined (in main()) looks like this.    Feel free to change them and rerun. 
+```go
+	routePermissions := map[string][]string{
+		"/users":                {"exporters"},
+		"/users/:id":            {"exporters", "querybuilders"},
+		"/orders":               {"exporters", "exporters"},
+		"/reports/sales":        {"exporters", "uploaders", "querybuilders"},
+		"/settings":             {"exporters"},
+		"/query":                {"exporters", "querybuilders"}, // Only exporters can access /query
+		"/api/inventory/update": {"exporters", "uploaders"},
+	}
+
+```
+
 4. If your user doesn't have the required group for an endpoint, you'll receive a 403 Forbidden response:
 
 ```json
@@ -124,6 +139,7 @@ curl -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIs..." http://localhost:8080/us
 3. **Token Exchange**: The server exchanges this code for OAuth tokens by calling Cognito's token endpoint
 4. **Token Verification**: The server verifies the JWT token signature using Cognito's JWKS
 5. **Group Verification**: The server checks if the user belongs to the required groups for the `/query` endpoint
+   6. Note that /query is just a placeholder and will be changes to something like /login or /login/callback in the api server.  This setting is set in cognito on the user pool.  
 6. **Response**: If authorized, the server returns the tokens and user information; if not, it returns a 403 error
 
 ### Subsequent API Requests