feat: add tenant authorization middleware

backend/cmd/api/main.go

@@ -17,7 +17,10 @@ import (
 	_ "github.com/jackc/pgx/v5/stdlib"
 
 	"proxui/backend/internal/auth"
+	"proxui/backend/internal/authorization"
+	"proxui/backend/internal/membership"
 	"proxui/backend/internal/profile"
+	"proxui/backend/internal/rbac"
 )
 
 func main() {
@@ -47,6 +50,8 @@ func main() {
 	defer db.Close()
 
 	profileMiddleware := profile.NewMiddleware(profile.NewRepository(db), logger)
+	membershipMiddleware := membership.NewMiddleware(membership.NewRepository(db), logger)
+	authorizationMiddleware := authorization.NewMiddleware()
 
 	mux := http.NewServeMux()
 	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) {
@@ -59,6 +64,22 @@ func main() {
 		_ = json.NewEncoder(w).Encode(principal)
 	})
 	mux.Handle("GET /me", authMiddleware.RequireAuth(profileMiddleware.EnsureProfile(meHandler)))
+	tenantMembershipHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		tenantMembership, _ := membership.FromRequest(r)
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(tenantMembership)
+	})
+	mux.Handle(
+		"GET /tenants/{tenantID}/membership",
+		authMiddleware.RequireAuth(
+			profileMiddleware.EnsureProfile(
+				membershipMiddleware.RequireTenantMembership(
+					pathTenantID,
+					authorizationMiddleware.Require(rbac.ActionProjectRead, tenantMembershipHandler),
+				),
+			),
+		),
+	)
 
 	server := &http.Server{
 		Addr:              cfg.BackendAddr,
@@ -87,6 +108,11 @@ func main() {
 	}
 }
 
+func pathTenantID(r *http.Request) (string, bool) {
+	tenantID := r.PathValue("tenantID")
+	return tenantID, tenantID != ""
+}
+
 func openDatabase(databaseURL string) (*sql.DB, error) {
 	if databaseURL == "" {
 		return nil, fmt.Errorf("DATABASE_URL is required")