feat: add tenant authorization middleware

backend/internal/authorization/middleware.go

@@ -0,0 +1,33 @@
+package authorization
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"proxui/backend/internal/membership"
+	"proxui/backend/internal/rbac"
+)
+
+type Middleware struct{}
+
+func NewMiddleware() Middleware {
+	return Middleware{}
+}
+
+func (m Middleware) Require(action rbac.Action, next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		membership, ok := membership.FromRequest(r)
+		if !ok || !rbac.Can(membership.Role, action) {
+			writeError(w, http.StatusForbidden, "forbidden")
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
+
+func writeError(w http.ResponseWriter, status int, message string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(map[string]string{"error": message})
+}

backend/internal/authorization/middleware_test.go

@@ -0,0 +1,66 @@
+package authorization
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"proxui/backend/internal/membership"
+	"proxui/backend/internal/rbac"
+)
+
+func TestRequireAllowsRoleWithPermission(t *testing.T) {
+	middleware := NewMiddleware()
+	handler := middleware.Require(rbac.ActionProjectManage, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	req := requestWithMembership(rbac.RoleAdmin)
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusNoContent)
+	}
+}
+
+func TestRequireRejectsRoleWithoutPermission(t *testing.T) {
+	middleware := NewMiddleware()
+	handler := middleware.Require(rbac.ActionProjectManage, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	req := requestWithMembership(rbac.RoleViewer)
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)
+	}
+}
+
+func TestRequireRejectsMissingMembership(t *testing.T) {
+	middleware := NewMiddleware()
+	handler := middleware.Require(rbac.ActionProjectRead, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/tenants/tenant-1/projects", nil)
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)
+	}
+}
+
+func requestWithMembership(role rbac.Role) *http.Request {
+	req := httptest.NewRequest(http.MethodGet, "/tenants/tenant-1/projects", nil)
+	return req.WithContext(membership.ContextWithMembership(req.Context(), membership.Membership{
+		TenantID: "tenant-1",
+		Role:     role,
+	}))
+}