feat(auth): integrate portal JWT for enhanced authentication and authorization

Added support for portal JWT authentication, enabling single sign-on (SSO) capabilities. Updated the application to handle JWT claims for user permissions and roles, enhancing security and access control. Refactored relevant components and API routes to accommodate the new authentication flow, ensuring a seamless user experience. Updated documentation to reflect the new authentication requirements and configurations.

Co-authored-by: Cursor <[email protected]>

internal/httpapi/server.go

@@ -36,6 +36,13 @@ type Server struct {
 	runtimeLogs             *runtimelogs.Service
 	runtimeLogsPolicyTenant string
 	mux                     *http.ServeMux
+
+	// Portal / dual-auth (JWT) configuration.
+	jwtSecret      string
+	authIssuer     string
+	authPortalURL  string
+	portalTenantID string
+	authRequired   bool
 }
 
 // Options configures the API server.
@@ -49,6 +56,13 @@ type Options struct {
 	CORSAllowedOrigins string
 	// RuntimeLogsPolicyTenant overrides tenant for auto-cleanup scheduler settings (optional).
 	RuntimeLogsPolicyTenant string
+
+	// Portal / dual-auth (JWT) — leave empty to disable JWT path.
+	JWTSecret      string // AUTH_JWT_SECRET / EVOBGP_AUTH_JWT_SECRET (HS256 shared secret)
+	AuthIssuer     string // AUTH_ISSUER (expected iss claim; default https://auth.shnt.top)
+	AuthPortalURL  string // AUTH_PORTAL_URL (returned by /v1/auth/config for the UI)
+	PortalTenantID string // EVOBGP_PORTAL_TENANT_ID (single tenant scope for JWT users)
+	AuthRequired   bool   // AUTH_REQUIRED / EVOBGP_AUTH_REQUIRED (surfaced via /v1/auth/config)
 }
 
 // New constructs Server and wiring for async jobs.
@@ -104,6 +118,14 @@ func New(opts Options) (*Server, error) {
 		cdnHTTP:                 NewCDNHTTPClient(),
 		runtimeLogs:             runtimelogs.NewService(runtimelogs.ConfigFromEnv()),
 		runtimeLogsPolicyTenant: strings.TrimSpace(opts.RuntimeLogsPolicyTenant),
+		jwtSecret:               strings.TrimSpace(opts.JWTSecret),
+		authIssuer:              strings.TrimSpace(opts.AuthIssuer),
+		authPortalURL:           strings.TrimSpace(opts.AuthPortalURL),
+		portalTenantID:          strings.TrimSpace(opts.PortalTenantID),
+		authRequired:            opts.AuthRequired,
+	}
+	if s.authIssuer == "" {
+		s.authIssuer = "https://auth.shnt.top"
 	}
 	s.mux = http.NewServeMux()
 	s.registerRoutes()