feat(auth): integrate portal JWT for enhanced authentication and authorization

Added support for portal JWT authentication, enabling single sign-on (SSO) capabilities. Updated the application to handle JWT claims for user permissions and roles, enhancing security and access control. Refactored relevant components and API routes to accommodate the new authentication flow, ensuring a seamless user experience. Updated documentation to reflect the new authentication requirements and configurations.

Co-authored-by: Cursor <[email protected]>

internal/httpapi/auth.go

@@ -6,18 +6,32 @@ import (
 	"strings"
 
 	"evobgp/internal/authkey"
+
+	"github.com/golang-jwt/jwt/v5"
 )
 
 type ctxKey int
 
 const authCtxKey ctxKey = 1
 
+// Auth kinds distinguish API key sessions from portal JWT sessions.
+const (
+	AuthKindAPIKey = "apikey"
+	AuthKindJWT    = "jwt"
+)
+
 // Auth holds resolved API identity for a request.
 type Auth struct {
 	TenantID string
-	Role     string // viewer, editor, operator, node
+	Role     string // viewer, editor, operator, node, firewall (apikeys only)
 	Token    string
 	APIKeyID string // non-empty for DB-managed keys
+	// Portal / dual-auth fields (empty for API keys unless noted).
+	Kind        string   // "apikey" | "jwt"
+	UserID      string   // JWT sub
+	Email       string   // JWT email claim
+	Permissions []string // JWT permissions claim (bgp:*)
+	IsAdmin     bool     // JWT is_admin claim
 }
 
 func authFromContext(ctx context.Context) (Auth, bool) {
@@ -56,6 +70,23 @@ func parseAPIKeysSpec(spec string) []apiKeyRecord {
 	return out
 }
 
+// looksLikeJWT reports whether raw is a compact JWS (three dot-separated segments, non-empty).
+func looksLikeJWT(raw string) bool {
+	if raw == "" {
+		return false
+	}
+	parts := strings.Split(raw, ".")
+	if len(parts) != 3 {
+		return false
+	}
+	for _, p := range parts {
+		if strings.TrimSpace(p) == "" {
+			return false
+		}
+	}
+	return true
+}
+
 func (s *Server) authMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		h := r.Header.Get("Authorization")
@@ -65,6 +96,16 @@ func (s *Server) authMiddleware(next http.Handler) http.Handler {
 			return
 		}
 		raw := strings.TrimSpace(strings.TrimPrefix(h, p))
+		if looksLikeJWT(raw) && strings.TrimSpace(s.jwtSecret) != "" {
+			a, status, msg, ok := s.resolveJWT(raw)
+			if !ok {
+				writeProblem(w, status, http.StatusText(status), msg)
+				return
+			}
+			r = r.WithContext(context.WithValue(r.Context(), authCtxKey, a))
+			next.ServeHTTP(w, r)
+			return
+		}
 		a, ok := s.resolveAuth(raw)
 		if !ok {
 			writeProblem(w, http.StatusUnauthorized, "Unauthorized", "unknown api key")
@@ -79,10 +120,16 @@ func (s *Server) authMiddleware(next http.Handler) http.Handler {
 }
 
 func authFromKeyRecord(raw string, rec apiKeyRecord) Auth {
-	return Auth{TenantID: rec.tenantID, Role: rec.role, Token: raw, APIKeyID: rec.keyID}
+	return Auth{
+		Kind:     AuthKindAPIKey,
+		TenantID: rec.tenantID,
+		Role:     rec.role,
+		Token:    raw,
+		APIKeyID: rec.keyID,
+	}
 }
 
-// resolveAuth maps a bearer token to tenant identity.
+// resolveAuth maps a bearer token to tenant identity (API key path).
 // For the literal token "dev", the demo shortcut (devAuth) takes precedence when demo-seed
 // is available; env/DB mapping is used only when demo tenant is absent.
 func (s *Server) resolveAuth(raw string) (Auth, bool) {
@@ -99,23 +146,96 @@ func (s *Server) resolveAuth(raw string) (Auth, bool) {
 	if !ok {
 		if s.firewallResolver != nil {
 			if fw, ok := s.firewallResolver.Lookup(raw); ok {
-				return Auth{TenantID: fw.tenantID, Role: "firewall", Token: raw, APIKeyID: fw.clientID}, true
+				return Auth{Kind: AuthKindAPIKey, TenantID: fw.tenantID, Role: "firewall", Token: raw, APIKeyID: fw.clientID}, true
 			}
 		}
 		if client, err := s.store.LookupFirewallClientByTokenHash(authkey.HashToken(raw)); err == nil {
-			return Auth{TenantID: client.TenantID, Role: "firewall", Token: raw, APIKeyID: client.ID}, true
+			return Auth{Kind: AuthKindAPIKey, TenantID: client.TenantID, Role: "firewall", Token: raw, APIKeyID: client.ID}, true
 		}
 		return Auth{}, false
 	}
 	return authFromKeyRecord(raw, rec), true
 }
 
+// resolveJWT parses and validates a portal HS256 token, returning an Auth on success.
+// Returns (auth, status, detail, ok). status/detail are used when ok=false.
+func (s *Server) resolveJWT(raw string) (Auth, int, string, bool) {
+	if strings.TrimSpace(s.portalTenantID) == "" {
+		return Auth{}, http.StatusServiceUnavailable, "portal tenant not configured (EVOBGP_PORTAL_TENANT_ID)", false
+	}
+	tok, err := jwt.Parse(raw, func(t *jwt.Token) (any, error) {
+		if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, jwt.ErrSignatureInvalid
+		}
+		return []byte(s.jwtSecret), nil
+	}, jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}))
+	if err != nil || tok == nil || !tok.Valid {
+		return Auth{}, http.StatusUnauthorized, "invalid jwt", false
+	}
+	claims, ok := tok.Claims.(jwt.MapClaims)
+	if !ok {
+		return Auth{}, http.StatusUnauthorized, "invalid jwt claims", false
+	}
+	if iss := strings.TrimSpace(s.authIssuer); iss != "" {
+		got, _ := claims["iss"].(string)
+		if strings.TrimSpace(got) != iss {
+			return Auth{}, http.StatusUnauthorized, "jwt issuer mismatch", false
+		}
+	}
+	apps := coerceStringSlice(claims["apps"])
+	if !containsFold(apps, "bgp") {
+		return Auth{}, http.StatusForbidden, "jwt does not grant access to bgp app", false
+	}
+	sub, _ := claims["sub"].(string)
+	if strings.TrimSpace(sub) == "" {
+		return Auth{}, http.StatusUnauthorized, "jwt missing sub", false
+	}
+	email, _ := claims["email"].(string)
+	perms := coerceStringSlice(claims["permissions"])
+	isAdmin, _ := claims["is_admin"].(bool)
+	return Auth{
+		Kind:        AuthKindJWT,
+		TenantID:    s.portalTenantID,
+		UserID:      strings.TrimSpace(sub),
+		Email:       strings.TrimSpace(email),
+		Permissions: perms,
+		IsAdmin:     isAdmin,
+		Token:       raw,
+	}, 0, "", true
+}
+
+func coerceStringSlice(v any) []string {
+	switch t := v.(type) {
+	case []string:
+		return t
+	case []any:
+		out := make([]string, 0, len(t))
+		for _, x := range t {
+			if s, ok := x.(string); ok {
+				out = append(out, s)
+			}
+		}
+		return out
+	default:
+		return nil
+	}
+}
+
+func containsFold(items []string, needle string) bool {
+	for _, x := range items {
+		if strings.EqualFold(strings.TrimSpace(x), needle) {
+			return true
+		}
+	}
+	return false
+}
+
 func (s *Server) devAuth() (Auth, bool) {
 	tid, _, _, _, _ := s.store.DemoIDs()
 	if tid == "" {
 		return Auth{}, false
 	}
-	return Auth{TenantID: tid, Role: "operator", Token: "dev"}, true
+	return Auth{Kind: AuthKindAPIKey, TenantID: tid, Role: "operator", Token: "dev"}, true
 }
 
 func roleLevel(role string) int {
@@ -131,7 +251,8 @@ func roleLevel(role string) int {
 	}
 }
 
-// requireAtLeast rejects node role and enforces viewer/editor/operator ladder.
+// requireAtLeast rejects node/firewall roles and enforces viewer/editor/operator ladder for API keys.
+// New code should call requirePerm which supports JWT permissions in addition to API-key roles.
 func (s *Server) requireAtLeast(w http.ResponseWriter, a Auth, need string) bool {
 	if strings.ToLower(a.Role) == "node" {
 		writeProblem(w, http.StatusForbidden, "Forbidden", "node role cannot access this resource")

internal/httpapi/auth_jwt_test.go

@@ -0,0 +1,225 @@
+package httpapi
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+const (
+	testJWTSecret = "test-secret-32-bytes-long-abcdef"
+	testIssuer    = "https://auth.test.local"
+)
+
+func signTestJWT(t *testing.T, claims jwt.MapClaims) string {
+	t.Helper()
+	tok := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	s, err := tok.SignedString([]byte(testJWTSecret))
+	if err != nil {
+		t.Fatalf("sign jwt: %v", err)
+	}
+	return s
+}
+
+func newJWTTestServer(t *testing.T) (*Server, string) {
+	t.Helper()
+	srv, err := New(Options{
+		SeedDemo:       true,
+		BundleSeedHex:  testBundleSeed,
+		JWTSecret:      testJWTSecret,
+		AuthIssuer:     testIssuer,
+		AuthPortalURL:  "https://portal.test.local",
+		AuthRequired:   true,
+		PortalTenantID: "", // filled after DemoIDs
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	tenant, _, _, _, _ := srv.Store().DemoIDs()
+	// Override tenant to match seed.
+	srv.portalTenantID = tenant
+	return srv, tenant
+}
+
+func TestAuthJWTAcceptedWithBGPApp(t *testing.T) {
+	srv, _ := newJWTTestServer(t)
+	defer srv.Close()
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	token := signTestJWT(t, jwt.MapClaims{
+		"iss":         testIssuer,
+		"sub":         "user-1",
+		"email":       "[email protected]",
+		"apps":        []string{"bgp"},
+		"permissions": []string{"bgp:modules:read"},
+		"exp":         time.Now().Add(time.Hour).Unix(),
+	})
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/modules", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+		t.Fatalf("status=%d body=%s", resp.StatusCode, b)
+	}
+}
+
+func TestAuthJWTRejectedOnWrongIssuer(t *testing.T) {
+	srv, _ := newJWTTestServer(t)
+	defer srv.Close()
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	token := signTestJWT(t, jwt.MapClaims{
+		"iss":  "https://other.example.com",
+		"sub":  "user-1",
+		"apps": []string{"bgp"},
+		"exp":  time.Now().Add(time.Hour).Unix(),
+	})
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/modules", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("status=%d want 401", resp.StatusCode)
+	}
+}
+
+func TestAuthJWTRejectedWhenBGPAppMissing(t *testing.T) {
+	srv, _ := newJWTTestServer(t)
+	defer srv.Close()
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	token := signTestJWT(t, jwt.MapClaims{
+		"iss":  testIssuer,
+		"sub":  "user-1",
+		"apps": []string{"cfdm", "portal"},
+		"exp":  time.Now().Add(time.Hour).Unix(),
+	})
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/modules", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("status=%d want 403", resp.StatusCode)
+	}
+}
+
+func TestAuthJWTIsAdminBypassesPermissions(t *testing.T) {
+	srv, _ := newJWTTestServer(t)
+	defer srv.Close()
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	token := signTestJWT(t, jwt.MapClaims{
+		"iss":      testIssuer,
+		"sub":      "admin-1",
+		"apps":     []string{"bgp"},
+		"is_admin": true,
+		"exp":      time.Now().Add(time.Hour).Unix(),
+	})
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/api-keys", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+		t.Fatalf("status=%d body=%s", resp.StatusCode, b)
+	}
+}
+
+func TestAuthJWTMissingPermissionRejected(t *testing.T) {
+	srv, _ := newJWTTestServer(t)
+	defer srv.Close()
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	token := signTestJWT(t, jwt.MapClaims{
+		"iss":         testIssuer,
+		"sub":         "user-1",
+		"apps":        []string{"bgp"},
+		"permissions": []string{"bgp:modules:read"},
+		"exp":         time.Now().Add(time.Hour).Unix(),
+	})
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/api-keys", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("status=%d want 403", resp.StatusCode)
+	}
+}
+
+func TestAuthConfigPublic(t *testing.T) {
+	srv, _ := newJWTTestServer(t)
+	defer srv.Close()
+
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/v1/auth/config", nil)
+	resp, err := ts.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+		t.Fatalf("status=%d body=%s", resp.StatusCode, b)
+	}
+}
+
+func TestHasPermissionSupersets(t *testing.T) {
+	cases := []struct {
+		name    string
+		granted []string
+		want    string
+		ok      bool
+	}{
+		{"exact-read", []string{"bgp:modules:read"}, "bgp:modules:read", true},
+		{"write-covers-read", []string{"bgp:modules:write"}, "bgp:modules:read", true},
+		{"admin-covers-write", []string{"bgp:modules:admin"}, "bgp:modules:write", true},
+		{"read-does-not-cover-write", []string{"bgp:modules:read"}, "bgp:modules:write", false},
+		{"different-section", []string{"bgp:network:admin"}, "bgp:modules:read", false},
+		{"empty-granted", nil, "bgp:modules:read", false},
+		{"malformed-required", []string{"bgp:modules:admin"}, "bgp:modules", false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := HasPermission(tc.granted, tc.want); got != tc.ok {
+				t.Fatalf("HasPermission(%v, %q) = %v, want %v", tc.granted, tc.want, got, tc.ok)
+			}
+		})
+	}
+}

internal/httpapi/permissions.go

@@ -0,0 +1,107 @@
+package httpapi
+
+import (
+	"net/http"
+	"strings"
+)
+
+// Portal permission strings. Format: <app>:<section>:<level> (bgp:modules:read).
+// Superset order: admin ⊃ write ⊃ read for the same <app>:<section>.
+const (
+	permLevelRead  = "read"
+	permLevelWrite = "write"
+	permLevelAdmin = "admin"
+)
+
+// permLevelRank returns 0 for unknown, 1 for read, 2 for write, 3 for admin.
+func permLevelRank(level string) int {
+	switch strings.ToLower(strings.TrimSpace(level)) {
+	case permLevelRead:
+		return 1
+	case permLevelWrite:
+		return 2
+	case permLevelAdmin:
+		return 3
+	default:
+		return 0
+	}
+}
+
+// splitPerm splits a permission string into (app, section, level).
+func splitPerm(perm string) (app, section, level string, ok bool) {
+	parts := strings.Split(strings.TrimSpace(perm), ":")
+	if len(parts) != 3 {
+		return "", "", "", false
+	}
+	return strings.TrimSpace(parts[0]), strings.TrimSpace(parts[1]), strings.TrimSpace(parts[2]), true
+}
+
+// HasPermission reports whether the granted list satisfies required, applying the
+// admin ⊃ write ⊃ read superset within the same app+section.
+func HasPermission(granted []string, required string) bool {
+	rApp, rSection, rLevel, ok := splitPerm(required)
+	if !ok {
+		return false
+	}
+	needRank := permLevelRank(rLevel)
+	if needRank == 0 {
+		return false
+	}
+	for _, g := range granted {
+		gApp, gSection, gLevel, ok := splitPerm(g)
+		if !ok {
+			continue
+		}
+		if !strings.EqualFold(gApp, rApp) || !strings.EqualFold(gSection, rSection) {
+			continue
+		}
+		if permLevelRank(gLevel) >= needRank {
+			return true
+		}
+	}
+	return false
+}
+
+// permAPIKeyRoleFor maps a permission level to the API-key role required.
+func permAPIKeyRoleFor(perm string) string {
+	_, _, level, ok := splitPerm(perm)
+	if !ok {
+		return "operator"
+	}
+	switch strings.ToLower(level) {
+	case permLevelRead:
+		return "viewer"
+	case permLevelWrite:
+		return "editor"
+	case permLevelAdmin:
+		return "operator"
+	default:
+		return "operator"
+	}
+}
+
+// requirePerm enforces a permission for a portal JWT or falls back to the API-key role ladder.
+// node/firewall roles are always rejected (they use requireNode / requireFirewall).
+func (s *Server) requirePerm(w http.ResponseWriter, a Auth, perm string) bool {
+	switch strings.ToLower(a.Role) {
+	case "node":
+		writeProblem(w, http.StatusForbidden, "Forbidden", "node role cannot access this resource")
+		return false
+	case "firewall":
+		writeProblem(w, http.StatusForbidden, "Forbidden", "firewall role cannot access this resource")
+		return false
+	}
+	if a.Kind == AuthKindJWT || len(a.Permissions) > 0 {
+		if a.IsAdmin || HasPermission(a.Permissions, perm) {
+			return true
+		}
+		writeProblem(w, http.StatusForbidden, "Forbidden", "missing permission: "+perm)
+		return false
+	}
+	need := permAPIKeyRoleFor(perm)
+	if roleLevel(a.Role) < roleLevel(need) {
+		writeProblem(w, http.StatusForbidden, "Forbidden", "insufficient role")
+		return false
+	}
+	return true
+}

internal/httpapi/routes.go

@@ -35,6 +35,7 @@ func (s *Server) Handler() http.Handler {
 	s.mux.HandleFunc("GET /v1/health", s.handleHealth)
 	s.mux.HandleFunc("GET /v1/ready", s.handleReady)
 	s.mux.HandleFunc("GET /v1/version", s.handleVersion)
+	s.mux.HandleFunc("GET /v1/auth/config", s.handleAuthConfigPublic)
 	s.mux.HandleFunc("POST /v1/firewall/enroll", s.handleFirewallEnrollPublic)
 	s.mux.HandleFunc("GET /v1/firewall/install.sh", s.handleFirewallInstallScript)
 	s.mux.HandleFunc("GET /v1/firewall/sync-script", s.handleFirewallSyncScript)
@@ -93,6 +94,15 @@ func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
 }
 
+// handleAuthConfigPublic exposes portal-auth wiring so the UI can decide whether to redirect to the login portal.
+// Registered on the public mux (no auth middleware): safe to call without a bearer token.
+func (s *Server) handleAuthConfigPublic(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, http.StatusOK, map[string]any{
+		"required":   s.authRequired,
+		"portal_url": s.authPortalURL,
+	})
+}
+
 func (s *Server) handleReady(w http.ResponseWriter, r *http.Request) {
 	checks := map[string]string{"store": "ok", "jobs": "memory"}
 	ctx, cancel := context.WithTimeout(r.Context(), 2*time.Second)
@@ -188,7 +198,7 @@ func (s *Server) handleListModules(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:modules:read") {
 		return
 	}
 	typeFilter := strings.TrimSpace(r.URL.Query().Get("type"))
@@ -204,23 +214,9 @@ func (s *Server) handleListModules(w http.ResponseWriter, r *http.Request) {
 	}
 
 	filtered := make([]*store.Module, 0)
-	limit := parseListLimit(r)
-	cursor := r.URL.Query().Get("cursor")
-	if typeFilter == "" && enabledFilter == nil {
-		page, next, more := s.store.ListModulesPage(a.TenantID, cursor, limit)
-		for _, mod := range page {
-			filtered = append(filtered, mod)
-		}
-		items := make([]map[string]any, 0, len(filtered))
-		for _, mod := range filtered {
-			items = append(items, moduleJSON(mod))
-		}
-		writeJSON(w, http.StatusOK, map[string]any{
-			"items": items, "next_cursor": strPtrOrNull(next), "has_more": more,
-		})
-		return
-	}
-	for _, mod := range s.store.ListModules(a.TenantID) {
+	all := s.store.ListModules(a.TenantID)
+	all = store.FilterOwned(all, func(m *store.Module) string { return m.CreatedByUserID }, a.Kind, a.IsAdmin, a.UserID)
+	for _, mod := range all {
 		if typeFilter != "" && mod.Type != typeFilter {
 			continue
 		}
@@ -245,7 +241,7 @@ func (s *Server) handleRouterListsCatalog(w http.ResponseWriter, r *http.Request
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:directories:read") {
 		return
 	}
 	cat, err := reports.BuildRouterListsCatalog(s.store, a.TenantID)
@@ -268,10 +264,14 @@ func (s *Server) handleGetModule(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:modules:read") {
 		return
 	}
 	mod, err := s.store.GetModule(a.TenantID, r.PathValue("module_id"))
+	if err == nil && !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, mod.CreatedByUserID) {
+		writeProblem(w, http.StatusNotFound, "Not Found", "module not found")
+		return
+	}
 	if err != nil {
 		if err == store.ErrNotFound || err == store.ErrTenantScope {
 			writeProblem(w, http.StatusNotFound, "Not Found", "module not found")
@@ -289,10 +289,11 @@ func (s *Server) handleListPeers(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:network:read") {
 		return
 	}
 	allPeers := s.store.ListPeers(a.TenantID)
+	allPeers = store.FilterOwned(allPeers, func(p *store.BGPPeer) string { return p.CreatedByUserID }, a.Kind, a.IsAdmin, a.UserID)
 	page, next, more := store.PaginateOffset(allPeers, r.URL.Query().Get("cursor"), parseListLimit(r))
 	fresh := r != nil && strings.EqualFold(strings.TrimSpace(r.URL.Query().Get("live")), "1")
 	ctx, cancel := context.WithTimeout(r.Context(), 12*time.Second)
@@ -392,7 +393,7 @@ func (s *Server) handleListSpeakers(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:network:read") {
 		return
 	}
 	speakers := s.store.ListSpeakersForTenant(a.TenantID)
@@ -424,7 +425,7 @@ func (s *Server) handleModuleRefresh(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "editor") {
+	if !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	moduleID := r.PathValue("module_id")
@@ -460,7 +461,7 @@ func (s *Server) handleTenantRefresh(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "editor") {
+	if !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body struct {
@@ -514,7 +515,7 @@ func (s *Server) handleListRevisions(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
@@ -587,7 +588,7 @@ func (s *Server) handleGetRevision(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	rev, err := s.store.GetRevisionSummary(a.TenantID, r.PathValue("revision_id"))
@@ -604,7 +605,7 @@ func (s *Server) handleRevisionPreview(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	rev, err := s.store.GetRevision(a.TenantID, r.PathValue("revision_id"))
@@ -643,7 +644,7 @@ func (s *Server) handleRevisionDiagnosticLog(w http.ResponseWriter, r *http.Requ
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	revID := r.PathValue("revision_id")
@@ -669,7 +670,7 @@ func (s *Server) handleRevisionDiff(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	d, err := s.store.RevisionDiff(a.TenantID, r.PathValue("revision_a"), r.PathValue("revision_b"))
@@ -686,7 +687,7 @@ func (s *Server) handleRevisionRollback(w http.ResponseWriter, r *http.Request)
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "operator") {
+	if !s.requirePerm(w, a, "bgp:operations:admin") {
 		return
 	}
 	revID := r.PathValue("revision_id")
@@ -717,8 +718,7 @@ func (s *Server) handleApply(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if strings.ToLower(a.Role) != "operator" {
-		writeProblem(w, http.StatusForbidden, "Forbidden", "operator role required")
+	if !s.requirePerm(w, a, "bgp:operations:admin") {
 		return
 	}
 	var body struct {
@@ -764,8 +764,7 @@ func (s *Server) handleSpeakerApply(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if strings.ToLower(a.Role) != "operator" {
-		writeProblem(w, http.StatusForbidden, "Forbidden", "operator role required")
+	if !s.requirePerm(w, a, "bgp:operations:admin") {
 		return
 	}
 	spkID := r.PathValue("id")
@@ -815,8 +814,7 @@ func (s *Server) handleBirdReload(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if strings.ToLower(a.Role) != "operator" {
-		writeProblem(w, http.StatusForbidden, "Forbidden", "operator role required")
+	if !s.requirePerm(w, a, "bgp:operations:admin") {
 		return
 	}
 	idem := strings.TrimSpace(r.Header.Get("Idempotency-Key"))
@@ -839,7 +837,7 @@ func (s *Server) handleBirdStatus(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:monitoring:read") {
 		return
 	}
 	ctx, cancel := context.WithTimeout(r.Context(), 12*time.Second)
@@ -854,7 +852,7 @@ func (s *Server) handleListJobs(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
@@ -877,7 +875,7 @@ func (s *Server) handleGetJob(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	j, err := s.jobs.Get(a.TenantID, r.PathValue("job_id"))
@@ -894,7 +892,7 @@ func (s *Server) handleGetJobReport(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	j, err := s.jobs.Get(a.TenantID, r.PathValue("job_id"))
@@ -932,7 +930,7 @@ func (s *Server) handleCancelJob(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "editor") {
+	if !s.requirePerm(w, a, "bgp:operations:admin") {
 		return
 	}
 	j, err := s.jobs.RequestCancel(a.TenantID, r.PathValue("job_id"))

internal/httpapi/routes_api_keys.go

@@ -21,13 +21,22 @@ func (s *Server) registerAPIKeyRoutes(m *http.ServeMux) {
 
 func (s *Server) handleAuthSession(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok {
+		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	writeJSON(w, http.StatusOK, map[string]any{
+	resp := map[string]any{
 		"tenant_id": a.TenantID,
 		"role":      a.Role,
-	})
+		"kind":      a.Kind,
+	}
+	if a.Kind == AuthKindJWT {
+		resp["user_id"] = a.UserID
+		resp["email"] = a.Email
+		resp["permissions"] = a.Permissions
+		resp["is_admin"] = a.IsAdmin
+	}
+	writeJSON(w, http.StatusOK, resp)
 }
 
 func apiKeyJSON(k *store.APIKey) map[string]any {
@@ -59,7 +68,7 @@ func apiKeyJSON(k *store.APIKey) map[string]any {
 
 func (s *Server) handleListAPIKeys(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:access:admin") {
 		return
 	}
 	list, err := s.store.ListAPIKeys(a.TenantID)
@@ -74,7 +83,7 @@ func (s *Server) handleListAPIKeys(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleGetAPIKey(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:access:admin") {
 		return
 	}
 	k, err := s.store.GetAPIKey(a.TenantID, r.PathValue("id"))
@@ -87,7 +96,7 @@ func (s *Server) handleGetAPIKey(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePostAPIKey(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:access:admin") {
 		return
 	}
 	var body struct {
@@ -127,7 +136,7 @@ func (s *Server) handlePostAPIKey(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePatchAPIKey(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:access:admin") {
 		return
 	}
 	var raw map[string]json.RawMessage
@@ -183,7 +192,7 @@ func (s *Server) handlePatchAPIKey(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleDeleteAPIKey(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:access:admin") {
 		return
 	}
 	if err := s.store.RevokeAPIKey(a.TenantID, r.PathValue("id")); err != nil {
@@ -199,7 +208,7 @@ func (s *Server) handleDeleteAPIKey(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleRotateAPIKey(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:access:admin") {
 		return
 	}
 	rotated, err := s.store.RotateAPIKey(a.TenantID, r.PathValue("id"))

internal/httpapi/routes_crud.go

@@ -80,7 +80,7 @@ func (s *Server) registerCRUDRoutes(m *http.ServeMux) {
 
 func (s *Server) handlePostModule(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body struct {
@@ -99,12 +99,16 @@ func (s *Server) handlePostModule(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid json")
 		return
 	}
-	mod, err := s.store.CreateModule(a.TenantID, &store.Module{
+	newModule := &store.Module{
 		Type: body.Type, Name: body.Name, Enabled: body.Enabled, Priority: body.Priority,
 		RefreshIntervalSec: body.RefreshIntervalSec, CronExpr: body.CronExpr,
 		DefaultCommunityID: body.DefaultCommunityID, DohProfileID: body.DohProfileID,
 		DohProfileIDs: body.DohProfileIDs, DohResolverPolicy: body.DohResolverPolicy,
-	})
+	}
+	if a.Kind == AuthKindJWT && strings.TrimSpace(a.UserID) != "" {
+		newModule.CreatedByUserID = a.UserID
+	}
+	mod, err := s.store.CreateModule(a.TenantID, newModule)
 	if err != nil {
 		writeStoreErr(w, err)
 		return
@@ -114,7 +118,7 @@ func (s *Server) handlePostModule(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePatchModule(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	rawBody, err := io.ReadAll(r.Body)
@@ -158,7 +162,14 @@ func (s *Server) handlePatchModule(w http.ResponseWriter, r *http.Request) {
 			body.RefreshIntervalSec = &zero
 		}
 	}
-	mod, err := s.store.UpdateModule(a.TenantID, r.PathValue("module_id"), &body)
+	moduleID := r.PathValue("module_id")
+	if existing, gerr := s.store.GetModule(a.TenantID, moduleID); gerr == nil {
+		if !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, existing.CreatedByUserID) {
+			writeProblem(w, http.StatusNotFound, "Not Found", "module not found")
+			return
+		}
+	}
+	mod, err := s.store.UpdateModule(a.TenantID, moduleID, &body)
 	if err != nil {
 		writeStoreErr(w, err)
 		return
@@ -168,10 +179,17 @@ func (s *Server) handlePatchModule(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleDeleteModule(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
-	if err := s.store.SoftDeleteModule(a.TenantID, r.PathValue("module_id")); err != nil {
+	moduleID := r.PathValue("module_id")
+	if existing, gerr := s.store.GetModule(a.TenantID, moduleID); gerr == nil {
+		if !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, existing.CreatedByUserID) {
+			writeProblem(w, http.StatusNotFound, "Not Found", "module not found")
+			return
+		}
+	}
+	if err := s.store.SoftDeleteModule(a.TenantID, moduleID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
@@ -215,7 +233,7 @@ func writePostgresStoreErr(w http.ResponseWriter, err error) bool {
 
 func (s *Server) handleListCDNSources(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:read") {
 		return
 	}
 	list, err := s.store.ListCDNSources(a.TenantID, r.PathValue("module_id"))
@@ -248,7 +266,7 @@ func cdnSourceJSON(x *store.CDNSource) map[string]any {
 
 func (s *Server) handlePreviewCDNSource(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body struct {
@@ -327,7 +345,7 @@ func (s *Server) handlePreviewCDNSource(w http.ResponseWriter, r *http.Request)
 
 func (s *Server) handlePostCDNSource(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body store.CDNSource
@@ -357,7 +375,7 @@ func (s *Server) handlePostCDNSource(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePatchCDNSource(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body store.CDNSourcePatch
@@ -387,7 +405,7 @@ func (s *Server) handlePatchCDNSource(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleDeleteCDNSource(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	mid := r.PathValue("module_id")
@@ -401,7 +419,7 @@ func (s *Server) handleDeleteCDNSource(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleListAS(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:read") {
 		return
 	}
 	list, err := s.store.ListASEntries(a.TenantID, r.PathValue("module_id"))
@@ -439,7 +457,7 @@ func asEntryJSON(x *store.ASEntry) map[string]any {
 
 func (s *Server) handlePostAS(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body store.ASEntry
@@ -459,7 +477,7 @@ func (s *Server) handlePostAS(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePatchAS(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body store.ASEntryPatch
@@ -479,7 +497,7 @@ func (s *Server) handlePatchAS(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleDeleteAS(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	mid := r.PathValue("module_id")
@@ -493,7 +511,7 @@ func (s *Server) handleDeleteAS(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleListDomain(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:read") {
 		return
 	}
 	list, err := s.store.ListDomainEntries(a.TenantID, r.PathValue("module_id"))
@@ -516,7 +534,7 @@ func domainEntryJSON(x *store.DomainEntry) map[string]any {
 
 func (s *Server) handlePostDomain(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body store.DomainEntry
@@ -536,7 +554,7 @@ func (s *Server) handlePostDomain(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePatchDomain(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body store.DomainEntryPatch
@@ -556,7 +574,7 @@ func (s *Server) handlePatchDomain(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleDeleteDomain(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	mid := r.PathValue("module_id")
@@ -570,7 +588,7 @@ func (s *Server) handleDeleteDomain(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleListIPRange(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:read") {
 		return
 	}
 	list, err := s.store.ListIPRangeEntries(a.TenantID, r.PathValue("module_id"))
@@ -593,7 +611,7 @@ func ipRangeJSON(x *store.IPRangeEntry) map[string]any {
 
 func (s *Server) handlePostIPRange(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body store.IPRangeEntry
@@ -613,7 +631,7 @@ func (s *Server) handlePostIPRange(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePatchIPRange(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	var body store.IPRangePatch
@@ -633,7 +651,7 @@ func (s *Server) handlePatchIPRange(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleDeleteIPRange(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	mid := r.PathValue("module_id")
@@ -647,7 +665,7 @@ func (s *Server) handleDeleteIPRange(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleExportModuleEntriesCSV(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:read") {
 		return
 	}
 	moduleID := r.PathValue("module_id")
@@ -730,7 +748,7 @@ func (s *Server) handleExportModuleEntriesCSV(w http.ResponseWriter, r *http.Req
 
 func (s *Server) handleImportModuleEntriesCSV(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:modules:write") {
 		return
 	}
 	moduleID := r.PathValue("module_id")
@@ -774,7 +792,7 @@ func (s *Server) handleImportModuleEntriesCSV(w http.ResponseWriter, r *http.Req
 
 func (s *Server) handleListDoh(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:read") {
 		return
 	}
 	list, err := s.store.ListDohProfiles(a.TenantID)
@@ -806,7 +824,7 @@ func dohJSON(x *store.DohProfile) map[string]any {
 
 func (s *Server) handleGetDoh(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:read") {
 		return
 	}
 	x, err := s.store.GetDohProfile(a.TenantID, r.PathValue("id"))
@@ -819,7 +837,7 @@ func (s *Server) handleGetDoh(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePostDoh(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:write") {
 		return
 	}
 	var body store.DohProfile
@@ -837,7 +855,7 @@ func (s *Server) handlePostDoh(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePatchDoh(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:write") {
 		return
 	}
 	var body store.DohProfilePatch
@@ -855,7 +873,7 @@ func (s *Server) handlePatchDoh(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleDeleteDoh(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:write") {
 		return
 	}
 	if err := s.store.DeleteDohProfile(a.TenantID, r.PathValue("id")); err != nil {
@@ -867,7 +885,7 @@ func (s *Server) handleDeleteDoh(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleListComm(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:read") {
 		return
 	}
 	list, err := s.store.ListCommunities(a.TenantID)
@@ -892,7 +910,7 @@ func commJSON(x *store.Community) map[string]any {
 
 func (s *Server) handleGetComm(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:read") {
 		return
 	}
 	x, err := s.store.GetCommunity(a.TenantID, r.PathValue("id"))
@@ -905,7 +923,7 @@ func (s *Server) handleGetComm(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePostComm(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:write") {
 		return
 	}
 	var body store.Community
@@ -923,7 +941,7 @@ func (s *Server) handlePostComm(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePatchComm(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:write") {
 		return
 	}
 	var body store.CommunityPatch
@@ -941,7 +959,7 @@ func (s *Server) handlePatchComm(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleDeleteComm(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:directories:write") {
 		return
 	}
 	if err := s.store.DeleteCommunity(a.TenantID, r.PathValue("id")); err != nil {
@@ -953,7 +971,7 @@ func (s *Server) handleDeleteComm(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePostPeer(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:write") {
 		return
 	}
 	var body store.BGPPeer
@@ -962,6 +980,9 @@ func (s *Server) handlePostPeer(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	body.TenantID = a.TenantID
+	if a.Kind == AuthKindJWT && strings.TrimSpace(a.UserID) != "" {
+		body.CreatedByUserID = a.UserID
+	}
 	x, err := s.store.CreatePeer(a.TenantID, &body)
 	if err != nil {
 		writeStoreErr(w, err)
@@ -973,7 +994,7 @@ func (s *Server) handlePostPeer(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleGetPeer(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:read") {
 		return
 	}
 	x, err := s.store.GetPeer(a.TenantID, r.PathValue("id"))
@@ -981,12 +1002,16 @@ func (s *Server) handleGetPeer(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	if !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, x.CreatedByUserID) {
+		writeProblem(w, http.StatusNotFound, "Not Found", "peer not found")
+		return
+	}
 	writeJSON(w, http.StatusOK, peerJSON(x))
 }
 
 func (s *Server) handlePatchPeer(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:write") {
 		return
 	}
 	var body store.PeerPatch
@@ -994,7 +1019,14 @@ func (s *Server) handlePatchPeer(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid json")
 		return
 	}
-	x, err := s.store.UpdatePeer(a.TenantID, r.PathValue("id"), &body)
+	peerID := r.PathValue("id")
+	if existing, gerr := s.store.GetPeer(a.TenantID, peerID); gerr == nil {
+		if !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, existing.CreatedByUserID) {
+			writeProblem(w, http.StatusNotFound, "Not Found", "peer not found")
+			return
+		}
+	}
+	x, err := s.store.UpdatePeer(a.TenantID, peerID, &body)
 	if err != nil {
 		writeStoreErr(w, err)
 		return
@@ -1005,10 +1037,17 @@ func (s *Server) handlePatchPeer(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleDeletePeer(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:write") {
 		return
 	}
-	if err := s.store.DeletePeer(a.TenantID, r.PathValue("id")); err != nil {
+	peerID := r.PathValue("id")
+	if existing, gerr := s.store.GetPeer(a.TenantID, peerID); gerr == nil {
+		if !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, existing.CreatedByUserID) {
+			writeProblem(w, http.StatusNotFound, "Not Found", "peer not found")
+			return
+		}
+	}
+	if err := s.store.DeletePeer(a.TenantID, peerID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
@@ -1018,7 +1057,7 @@ func (s *Server) handleDeletePeer(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePostSpeaker(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:write") {
 		return
 	}
 	var body store.Speaker
@@ -1044,7 +1083,7 @@ func (s *Server) handlePostSpeaker(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleGetSpeakerByID(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:read") {
 		return
 	}
 	x, err := s.store.GetSpeaker(a.TenantID, r.PathValue("speaker_id"))
@@ -1057,7 +1096,7 @@ func (s *Server) handleGetSpeakerByID(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePatchSpeaker(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:write") {
 		return
 	}
 	var body store.SpeakerPatch
@@ -1075,7 +1114,7 @@ func (s *Server) handlePatchSpeaker(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleDeleteSpeaker(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "editor") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:write") {
 		return
 	}
 	if err := s.store.DeleteSpeaker(a.TenantID, r.PathValue("speaker_id")); err != nil {
@@ -1087,7 +1126,7 @@ func (s *Server) handleDeleteSpeaker(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handleRevisionPrefixes(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
@@ -1111,7 +1150,7 @@ func (s *Server) handleRevisionPrefixes(w http.ResponseWriter, r *http.Request)
 
 func (s *Server) handleGetSettings(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:tenant_settings:admin") {
 		return
 	}
 	m, err := s.store.ListGlobalSettings(a.TenantID)
@@ -1124,7 +1163,7 @@ func (s *Server) handleGetSettings(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePatchSettings(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:tenant_settings:admin") {
 		return
 	}
 	var body map[string]any

internal/httpapi/routes_firewall.go

@@ -43,7 +43,7 @@ func (s *Server) registerFirewallRoutes(m *http.ServeMux) {
 
 func (s *Server) handleFirewallInstallContext(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:firewall:write") {
 		return
 	}
 	seed := strings.TrimSpace(s.bundleSeedHex)
@@ -187,7 +187,7 @@ func readFirewallScript(name string) ([]byte, error) {
 
 func (s *Server) handleListFirewallClients(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:firewall:read") {
 		return
 	}
 	items, err := s.store.ListFirewallClients(a.TenantID)
@@ -195,12 +195,13 @@ func (s *Server) handleListFirewallClients(w http.ResponseWriter, r *http.Reques
 		writeInternalError(w, "internal", err)
 		return
 	}
+	items = store.FilterOwned(items, func(c *store.FirewallClient) string { return c.CreatedByUserID }, a.Kind, a.IsAdmin, a.UserID)
 	writeJSON(w, http.StatusOK, map[string]any{"items": items})
 }
 
 func (s *Server) handleGetFirewallClient(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:firewall:read") {
 		return
 	}
 	id := strings.TrimSpace(r.PathValue("id"))
@@ -209,15 +210,25 @@ func (s *Server) handleGetFirewallClient(w http.ResponseWriter, r *http.Request)
 		writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
 		return
 	}
+	if !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, client.CreatedByUserID) {
+		writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
+		return
+	}
 	writeJSON(w, http.StatusOK, client)
 }
 
 func (s *Server) handlePatchFirewallClient(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:firewall:write") {
 		return
 	}
 	id := strings.TrimSpace(r.PathValue("id"))
+	if existing, gerr := s.store.GetFirewallClient(a.TenantID, id); gerr == nil {
+		if !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, existing.CreatedByUserID) {
+			writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
+			return
+		}
+	}
 	var patch store.FirewallClientPatch
 	if err := json.NewDecoder(r.Body).Decode(&patch); err != nil {
 		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid JSON body")
@@ -233,10 +244,16 @@ func (s *Server) handlePatchFirewallClient(w http.ResponseWriter, r *http.Reques
 
 func (s *Server) handleApproveFirewallClient(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:firewall:write") {
 		return
 	}
 	id := strings.TrimSpace(r.PathValue("id"))
+	if existing, gerr := s.store.GetFirewallClient(a.TenantID, id); gerr == nil {
+		if !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, existing.CreatedByUserID) {
+			writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
+			return
+		}
+	}
 	client, err := s.store.ApproveFirewallClient(a.TenantID, id, a.APIKeyID)
 	if err != nil {
 		writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
@@ -249,10 +266,16 @@ func (s *Server) handleApproveFirewallClient(w http.ResponseWriter, r *http.Requ
 
 func (s *Server) handleRevokeFirewallClient(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:firewall:write") {
 		return
 	}
 	id := strings.TrimSpace(r.PathValue("id"))
+	if existing, gerr := s.store.GetFirewallClient(a.TenantID, id); gerr == nil {
+		if !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, existing.CreatedByUserID) {
+			writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
+			return
+		}
+	}
 	if err := s.store.RevokeFirewallClient(a.TenantID, id); err != nil {
 		writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
 		return
@@ -264,10 +287,16 @@ func (s *Server) handleRevokeFirewallClient(w http.ResponseWriter, r *http.Reque
 
 func (s *Server) handleDeleteFirewallClient(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:firewall:write") {
 		return
 	}
 	id := strings.TrimSpace(r.PathValue("id"))
+	if existing, gerr := s.store.GetFirewallClient(a.TenantID, id); gerr == nil {
+		if !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, existing.CreatedByUserID) {
+			writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
+			return
+		}
+	}
 	if err := s.store.DeleteFirewallClient(a.TenantID, id); err != nil {
 		writeProblem(w, http.StatusNotFound, "Not Found", "client not found")
 		return
@@ -279,7 +308,7 @@ func (s *Server) handleDeleteFirewallClient(w http.ResponseWriter, r *http.Reque
 
 func (s *Server) handleListFirewallRules(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:firewall:read") {
 		return
 	}
 	scope := strings.TrimSpace(r.URL.Query().Get("scope"))
@@ -297,12 +326,13 @@ func (s *Server) handleListFirewallRules(w http.ResponseWriter, r *http.Request)
 		writeInternalError(w, "internal", err)
 		return
 	}
+	items = store.FilterOwned(items, func(rule *store.FirewallRule) string { return rule.CreatedByUserID }, a.Kind, a.IsAdmin, a.UserID)
 	writeJSON(w, http.StatusOK, map[string]any{"items": items})
 }
 
 func (s *Server) handleCreateFirewallRule(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:firewall:write") {
 		return
 	}
 	var body struct {
@@ -326,12 +356,16 @@ func (s *Server) handleCreateFirewallRule(w http.ResponseWriter, r *http.Request
 		cid := strings.TrimSpace(*body.ClientID)
 		clientID = &cid
 	}
-	rule, err := s.store.CreateFirewallRule(a.TenantID, clientID, &store.FirewallRuleCreate{
+	fwRule := &store.FirewallRuleCreate{
 		Priority:    body.Priority,
 		Action:      body.Action,
 		CommunityID: body.CommunityID,
 		Comment:     body.Comment,
-	})
+	}
+	if a.Kind == AuthKindJWT && strings.TrimSpace(a.UserID) != "" {
+		fwRule.CreatedByUserID = a.UserID
+	}
+	rule, err := s.store.CreateFirewallRule(a.TenantID, clientID, fwRule)
 	if err != nil {
 		writeProblem(w, http.StatusUnprocessableEntity, "Unprocessable Entity", "invalid rule")
 		return
@@ -342,10 +376,16 @@ func (s *Server) handleCreateFirewallRule(w http.ResponseWriter, r *http.Request
 
 func (s *Server) handlePatchFirewallRule(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:firewall:write") {
 		return
 	}
 	id := strings.TrimSpace(r.PathValue("id"))
+	if existing, gerr := s.store.GetFirewallRule(a.TenantID, id); gerr == nil {
+		if !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, existing.CreatedByUserID) {
+			writeProblem(w, http.StatusNotFound, "Not Found", "rule not found")
+			return
+		}
+	}
 	var patch store.FirewallRulePatch
 	if err := json.NewDecoder(r.Body).Decode(&patch); err != nil {
 		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid JSON body")
@@ -362,10 +402,16 @@ func (s *Server) handlePatchFirewallRule(w http.ResponseWriter, r *http.Request)
 
 func (s *Server) handleDeleteFirewallRule(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:firewall:write") {
 		return
 	}
 	id := strings.TrimSpace(r.PathValue("id"))
+	if existing, gerr := s.store.GetFirewallRule(a.TenantID, id); gerr == nil {
+		if !store.CanAccessOwned(a.Kind, a.IsAdmin, a.UserID, existing.CreatedByUserID) {
+			writeProblem(w, http.StatusNotFound, "Not Found", "rule not found")
+			return
+		}
+	}
 	if err := s.store.DeleteFirewallRule(a.TenantID, id); err != nil {
 		writeProblem(w, http.StatusNotFound, "Not Found", "rule not found")
 		return
@@ -376,7 +422,7 @@ func (s *Server) handleDeleteFirewallRule(w http.ResponseWriter, r *http.Request
 
 func (s *Server) handleReorderFirewallRules(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:firewall:write") {
 		return
 	}
 	var body struct {
@@ -494,7 +540,7 @@ func (s *Server) handleFirewallHeartbeat(w http.ResponseWriter, r *http.Request)
 
 func (s *Server) handleFirewallClientPreview(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:firewall:read") {
 		return
 	}
 	id := strings.TrimSpace(r.PathValue("id"))

internal/httpapi/routes_lookup.go

@@ -16,7 +16,7 @@ func (s *Server) handleLookup(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusUnauthorized, "Unauthorized", "missing auth")
 		return
 	}
-	if !s.requireAtLeast(w, a, "viewer") {
+	if !s.requirePerm(w, a, "bgp:lookup:read") {
 		return
 	}
 	q := strings.TrimSpace(r.URL.Query().Get("q"))

internal/httpapi/routes_maintenance.go

@@ -62,7 +62,7 @@ func maintenancePolicyJSON(p *store.MaintenancePolicy) map[string]any {
 
 func (s *Server) handleListMaintenancePolicies(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	cursor := r.URL.Query().Get("cursor")
@@ -81,7 +81,7 @@ func (s *Server) handleListMaintenancePolicies(w http.ResponseWriter, r *http.Re
 
 func (s *Server) handleGetMaintenancePolicy(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	p, err := s.store.GetMaintenancePolicy(r.PathValue("id"))
@@ -163,7 +163,7 @@ func (s *Server) handleDeleteMaintenancePolicy(w http.ResponseWriter, r *http.Re
 
 func (s *Server) handleMaintenancePolicyHints(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	if s.maintStats == nil {
@@ -185,7 +185,7 @@ func (s *Server) handleMaintenancePolicyHints(w http.ResponseWriter, r *http.Req
 
 func (s *Server) handleListMaintenanceConfigAudit(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	cursor := r.URL.Query().Get("cursor")

internal/httpapi/routes_postgres_maintenance.go

@@ -27,12 +27,10 @@ func (s *Server) registerPostgresMaintenanceRoutes(m *http.ServeMux) {
 	m.HandleFunc("GET /postgres/maintenance/logs", s.handlePostgresMaintenanceLogs)
 }
 
+// requireOperatorStrict is a compatibility shim mapping the legacy "operator"
+// API-key role to the tenant-settings admin permission for JWT/API-key clients.
 func (s *Server) requireOperatorStrict(w http.ResponseWriter, a Auth) bool {
-	if strings.ToLower(a.Role) != "operator" {
-		writeProblem(w, http.StatusForbidden, "Forbidden", "operator role required")
-		return false
-	}
-	return true
+	return s.requirePerm(w, a, "bgp:tenant_settings:admin")
 }
 
 func (s *Server) checkPgMaintRateLimit(tenantID, kind string) bool {
@@ -201,7 +199,7 @@ func (s *Server) handlePostgresCleanup(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePostgresMaintenanceLogs(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	cursor := r.URL.Query().Get("cursor")

internal/httpapi/routes_postgres_monitoring.go

@@ -35,7 +35,7 @@ func parseLimitQuery(r *http.Request, def, max int) int {
 
 func (s *Server) handlePostgresOverview(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	ctx, cancel := context.WithTimeout(r.Context(), 3*time.Second)
@@ -50,7 +50,7 @@ func (s *Server) handlePostgresOverview(w http.ResponseWriter, r *http.Request)
 
 func (s *Server) handlePostgresQueries(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	ctx, cancel := context.WithTimeout(r.Context(), 3*time.Second)
@@ -65,7 +65,7 @@ func (s *Server) handlePostgresQueries(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePostgresLocks(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	ctx, cancel := context.WithTimeout(r.Context(), 3*time.Second)
@@ -80,7 +80,7 @@ func (s *Server) handlePostgresLocks(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePostgresTables(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	ctx, cancel := context.WithTimeout(r.Context(), 3*time.Second)
@@ -95,7 +95,7 @@ func (s *Server) handlePostgresTables(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePostgresRecommendations(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
@@ -110,7 +110,7 @@ func (s *Server) handlePostgresRecommendations(w http.ResponseWriter, r *http.Re
 
 func (s *Server) handleMonitoringCorrelation(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	window := 60

internal/httpapi/routes_revisions_prune.go

@@ -52,7 +52,7 @@ func (s *Server) resolveRevisionRetentionMinutesBody(r *http.Request, tenantID s
 
 func (s *Server) handleRevisionPruneEstimate(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:operations:read") {
 		return
 	}
 	minutes, valid := s.resolveRevisionRetentionMinutesQuery(r, a.TenantID)
@@ -78,7 +78,7 @@ func (s *Server) handleRevisionPruneEstimate(w http.ResponseWriter, r *http.Requ
 
 func (s *Server) handleRevisionPrune(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") {
+	if !ok || !s.requirePerm(w, a, "bgp:operations:admin") {
 		return
 	}
 	minutes, valid := s.resolveRevisionRetentionMinutesBody(r, a.TenantID)

internal/httpapi/routes_runtime_logs.go

@@ -70,7 +70,7 @@ func runtimeLogCleanupAuditJSON(row *store.RuntimeLogCleanupAudit) map[string]an
 
 func (s *Server) handleListRuntimeLogFiles(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requireRuntimeLogs(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requireRuntimeLogs(w) {
 		return
 	}
 	items, err := s.runtimeLogs.ListFiles()
@@ -87,7 +87,7 @@ func (s *Server) handleListRuntimeLogFiles(w http.ResponseWriter, r *http.Reques
 
 func (s *Server) handleGetRuntimeLogTail(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requireRuntimeLogs(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requireRuntimeLogs(w) {
 		return
 	}
 	filename := r.PathValue("filename")
@@ -111,7 +111,7 @@ func (s *Server) handleGetRuntimeLogTail(w http.ResponseWriter, r *http.Request)
 
 func (s *Server) handleDeleteRuntimeLogFile(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") || !s.requireRuntimeLogs(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:tenant_settings:admin") || !s.requireRuntimeLogs(w) {
 		return
 	}
 	filename := r.PathValue("filename")
@@ -157,7 +157,7 @@ func (s *Server) runtimeLogAutoPolicy(w http.ResponseWriter, r *http.Request, te
 
 func (s *Server) handleRuntimeLogAutoEstimate(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") || !s.requireRuntimeLogs(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:tenant_settings:admin") || !s.requireRuntimeLogs(w) {
 		return
 	}
 	policy, ok := s.runtimeLogAutoPolicy(w, r, a.TenantID)
@@ -199,7 +199,7 @@ func (s *Server) handleRuntimeLogAutoEstimate(w http.ResponseWriter, r *http.Req
 
 func (s *Server) handleRuntimeLogAutoRun(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "operator") || !s.requireRuntimeLogs(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:tenant_settings:admin") || !s.requireRuntimeLogs(w) {
 		return
 	}
 	policy, ok := s.runtimeLogAutoPolicy(w, r, a.TenantID)
@@ -221,7 +221,7 @@ func (s *Server) handleRuntimeLogAutoRun(w http.ResponseWriter, r *http.Request)
 
 func (s *Server) handleListRuntimeLogCleanupAudit(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") {
 		return
 	}
 	cursor := r.URL.Query().Get("cursor")

internal/httpapi/server.go

@@ -36,6 +36,13 @@ type Server struct {
 	runtimeLogs             *runtimelogs.Service
 	runtimeLogsPolicyTenant string
 	mux                     *http.ServeMux
+
+	// Portal / dual-auth (JWT) configuration.
+	jwtSecret      string
+	authIssuer     string
+	authPortalURL  string
+	portalTenantID string
+	authRequired   bool
 }
 
 // Options configures the API server.
@@ -49,6 +56,13 @@ type Options struct {
 	CORSAllowedOrigins string
 	// RuntimeLogsPolicyTenant overrides tenant for auto-cleanup scheduler settings (optional).
 	RuntimeLogsPolicyTenant string
+
+	// Portal / dual-auth (JWT) — leave empty to disable JWT path.
+	JWTSecret      string // AUTH_JWT_SECRET / EVOBGP_AUTH_JWT_SECRET (HS256 shared secret)
+	AuthIssuer     string // AUTH_ISSUER (expected iss claim; default https://auth.shnt.top)
+	AuthPortalURL  string // AUTH_PORTAL_URL (returned by /v1/auth/config for the UI)
+	PortalTenantID string // EVOBGP_PORTAL_TENANT_ID (single tenant scope for JWT users)
+	AuthRequired   bool   // AUTH_REQUIRED / EVOBGP_AUTH_REQUIRED (surfaced via /v1/auth/config)
 }
 
 // New constructs Server and wiring for async jobs.
@@ -104,6 +118,14 @@ func New(opts Options) (*Server, error) {
 		cdnHTTP:                 NewCDNHTTPClient(),
 		runtimeLogs:             runtimelogs.NewService(runtimelogs.ConfigFromEnv()),
 		runtimeLogsPolicyTenant: strings.TrimSpace(opts.RuntimeLogsPolicyTenant),
+		jwtSecret:               strings.TrimSpace(opts.JWTSecret),
+		authIssuer:              strings.TrimSpace(opts.AuthIssuer),
+		authPortalURL:           strings.TrimSpace(opts.AuthPortalURL),
+		portalTenantID:          strings.TrimSpace(opts.PortalTenantID),
+		authRequired:            opts.AuthRequired,
+	}
+	if s.authIssuer == "" {
+		s.authIssuer = "https://auth.shnt.top"
 	}
 	s.mux = http.NewServeMux()
 	s.registerRoutes()

internal/httpapi/speakers.go

@@ -71,7 +71,7 @@ func speakerJSONFromStore(st store.Backend, sp *store.Speaker) map[string]any {
 
 func (s *Server) handleBundleSigningPublicKey(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") {
+	if !ok || !s.requirePerm(w, a, "bgp:network:read") {
 		return
 	}
 	writeJSON(w, http.StatusOK, map[string]any{