feat(auth): integrate portal JWT for enhanced authentication and authorization

Added support for portal JWT authentication, enabling single sign-on (SSO) capabilities. Updated the application to handle JWT claims for user permissions and roles, enhancing security and access control. Refactored relevant components and API routes to accommodate the new authentication flow, ensuring a seamless user experience. Updated documentation to reflect the new authentication requirements and configurations.

Co-authored-by: Cursor <[email protected]>

internal/httpapi/routes_postgres_maintenance.go

@@ -27,12 +27,10 @@ func (s *Server) registerPostgresMaintenanceRoutes(m *http.ServeMux) {
 	m.HandleFunc("GET /postgres/maintenance/logs", s.handlePostgresMaintenanceLogs)
 }
 
+// requireOperatorStrict is a compatibility shim mapping the legacy "operator"
+// API-key role to the tenant-settings admin permission for JWT/API-key clients.
 func (s *Server) requireOperatorStrict(w http.ResponseWriter, a Auth) bool {
-	if strings.ToLower(a.Role) != "operator" {
-		writeProblem(w, http.StatusForbidden, "Forbidden", "operator role required")
-		return false
-	}
-	return true
+	return s.requirePerm(w, a, "bgp:tenant_settings:admin")
 }
 
 func (s *Server) checkPgMaintRateLimit(tenantID, kind string) bool {
@@ -201,7 +199,7 @@ func (s *Server) handlePostgresCleanup(w http.ResponseWriter, r *http.Request) {
 
 func (s *Server) handlePostgresMaintenanceLogs(w http.ResponseWriter, r *http.Request) {
 	a, ok := authFromContext(r.Context())
-	if !ok || !s.requireAtLeast(w, a, "viewer") || !s.requirePostgres(w) {
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") || !s.requirePostgres(w) {
 		return
 	}
 	cursor := r.URL.Query().Get("cursor")