feat(auth): integrate portal JWT for enhanced authentication and authorization

Added support for portal JWT authentication, enabling single sign-on (SSO) capabilities. Updated the application to handle JWT claims for user permissions and roles, enhancing security and access control. Refactored relevant components and API routes to accommodate the new authentication flow, ensuring a seamless user experience. Updated documentation to reflect the new authentication requirements and configurations.

Co-authored-by: Cursor <[email protected]>

internal/store/ownership_test.go

@@ -0,0 +1,67 @@
+package store
+
+import "testing"
+
+func TestSeesAllOwned(t *testing.T) {
+	if !SeesAllOwned("apikey", false) {
+		t.Fatal("api keys must see all rows")
+	}
+	if !SeesAllOwned("jwt", true) {
+		t.Fatal("admin jwt must see all rows")
+	}
+	if SeesAllOwned("jwt", false) {
+		t.Fatal("non-admin jwt must not see all rows")
+	}
+}
+
+func TestCanAccessOwned(t *testing.T) {
+	if !CanAccessOwned("apikey", false, "", "someone") {
+		t.Fatal("api key must access any owner")
+	}
+	if !CanAccessOwned("jwt", true, "admin", "user-1") {
+		t.Fatal("admin jwt must access any owner")
+	}
+	if !CanAccessOwned("jwt", false, "user-1", "user-1") {
+		t.Fatal("owner must access their resource")
+	}
+	if CanAccessOwned("jwt", false, "user-1", "user-2") {
+		t.Fatal("non-owner must not access foreign resource")
+	}
+	if CanAccessOwned("jwt", false, "user-1", "") {
+		t.Fatal("non-admin jwt must not see legacy rows without owner")
+	}
+}
+
+type ownRow struct {
+	id    string
+	owner string
+}
+
+func TestFilterOwned(t *testing.T) {
+	rows := []ownRow{
+		{"a", "user-1"},
+		{"b", "user-2"},
+		{"c", ""},
+	}
+	get := func(r ownRow) string { return r.owner }
+
+	got := FilterOwned(rows, get, "apikey", false, "")
+	if len(got) != 3 {
+		t.Fatalf("apikey filter: got=%d want 3", len(got))
+	}
+
+	got = FilterOwned(rows, get, "jwt", true, "any")
+	if len(got) != 3 {
+		t.Fatalf("admin jwt filter: got=%d want 3", len(got))
+	}
+
+	got = FilterOwned(rows, get, "jwt", false, "user-1")
+	if len(got) != 1 || got[0].id != "a" {
+		t.Fatalf("user-1 filter: got=%+v want [a]", got)
+	}
+
+	got = FilterOwned(rows, get, "jwt", false, "user-3")
+	if len(got) != 0 {
+		t.Fatalf("unknown user filter: got=%+v want []", got)
+	}
+}