feat(auth): enhance tenant resolution in JWT handling

Updated the authentication logic to prioritize tenant resolution from JWT claims, specifically using `tenants.bgp` or `bgp_tenant_id` as the primary source. If these claims are absent, the system will fallback to the configured `EVOBGP_PORTAL_TENANT_ID`. This change improves the flexibility of tenant management in the authentication process. Additionally, updated related documentation to reflect these changes and added tests to ensure proper functionality.

internal/httpapi/auth.go

@@ -160,9 +160,6 @@ func (s *Server) resolveAuth(raw string) (Auth, bool) {
 // resolveJWT parses and validates a portal HS256 token, returning an Auth on success.
 // Returns (auth, status, detail, ok). status/detail are used when ok=false.
 func (s *Server) resolveJWT(raw string) (Auth, int, string, bool) {
-	if strings.TrimSpace(s.portalTenantID) == "" {
-		return Auth{}, http.StatusServiceUnavailable, "portal tenant not configured (EVOBGP_PORTAL_TENANT_ID)", false
-	}
 	tok, err := jwt.Parse(raw, func(t *jwt.Token) (any, error) {
 		if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
 			return nil, jwt.ErrSignatureInvalid
@@ -190,12 +187,19 @@ func (s *Server) resolveJWT(raw string) (Auth, int, string, bool) {
 	if strings.TrimSpace(sub) == "" {
 		return Auth{}, http.StatusUnauthorized, "jwt missing sub", false
 	}
+	tenantID := tenantIDFromClaims(claims)
+	if tenantID == "" {
+		tenantID = strings.TrimSpace(s.portalTenantID)
+	}
+	if tenantID == "" {
+		return Auth{}, http.StatusServiceUnavailable, "portal tenant not configured (set bgp tenant in auth-portal App Switcher or EVOBGP_PORTAL_TENANT_ID)", false
+	}
 	email, _ := claims["email"].(string)
 	perms := coerceStringSlice(claims["permissions"])
 	isAdmin, _ := claims["is_admin"].(bool)
 	return Auth{
 		Kind:        AuthKindJWT,
-		TenantID:    s.portalTenantID,
+		TenantID:    tenantID,
 		UserID:      strings.TrimSpace(sub),
 		Email:       strings.TrimSpace(email),
 		Permissions: perms,
@@ -204,6 +208,21 @@ func (s *Server) resolveJWT(raw string) (Auth, int, string, bool) {
 	}, 0, "", true
 }
 
+// tenantIDFromClaims prefers tenants.bgp, then bgp_tenant_id.
+func tenantIDFromClaims(claims jwt.MapClaims) string {
+	if m, ok := claims["tenants"].(map[string]any); ok {
+		if v, ok := m["bgp"].(string); ok {
+			if tid := strings.TrimSpace(v); tid != "" {
+				return tid
+			}
+		}
+	}
+	if v, ok := claims["bgp_tenant_id"].(string); ok {
+		return strings.TrimSpace(v)
+	}
+	return ""
+}
+
 func coerceStringSlice(v any) []string {
 	switch t := v.(type) {
 	case []string: