feat: add tenant authorization middleware

backend/internal/authorization/middleware_test.go

@@ -0,0 +1,66 @@
+package authorization
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"proxui/backend/internal/membership"
+	"proxui/backend/internal/rbac"
+)
+
+func TestRequireAllowsRoleWithPermission(t *testing.T) {
+	middleware := NewMiddleware()
+	handler := middleware.Require(rbac.ActionProjectManage, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	req := requestWithMembership(rbac.RoleAdmin)
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusNoContent)
+	}
+}
+
+func TestRequireRejectsRoleWithoutPermission(t *testing.T) {
+	middleware := NewMiddleware()
+	handler := middleware.Require(rbac.ActionProjectManage, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	req := requestWithMembership(rbac.RoleViewer)
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)
+	}
+}
+
+func TestRequireRejectsMissingMembership(t *testing.T) {
+	middleware := NewMiddleware()
+	handler := middleware.Require(rbac.ActionProjectRead, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/tenants/tenant-1/projects", nil)
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)
+	}
+}
+
+func requestWithMembership(role rbac.Role) *http.Request {
+	req := httptest.NewRequest(http.MethodGet, "/tenants/tenant-1/projects", nil)
+	return req.WithContext(membership.ContextWithMembership(req.Context(), membership.Membership{
+		TenantID: "tenant-1",
+		Role:     role,
+	}))
+}