feat: add tenant authorization middleware

backend/internal/membership/repository.go

@@ -0,0 +1,39 @@
+package membership
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+
+	"proxui/backend/internal/rbac"
+)
+
+type Repository struct {
+	db *sql.DB
+}
+
+func NewRepository(db *sql.DB) Repository {
+	return Repository{db: db}
+}
+
+func (r Repository) ResolveTenantMembership(ctx context.Context, profileID string, tenantID string) (Membership, bool, error) {
+	var membership Membership
+	var role string
+	err := r.db.QueryRowContext(ctx, `
+		select m.tenant_id::text, m.role::text
+		from public.memberships m
+		join public.tenants t on t.id = m.tenant_id
+		where m.profile_id = $1
+			and m.tenant_id = $2
+			and t.status = 'active'
+	`, profileID, tenantID).Scan(&membership.TenantID, &role)
+	if errors.Is(err, sql.ErrNoRows) {
+		return Membership{}, false, nil
+	}
+	if err != nil {
+		return Membership{}, false, err
+	}
+
+	membership.Role = rbac.Role(role)
+	return membership, true, nil
+}