feat(auth): enhance JWT claims and app switcher configuration

- Added support for optional tenant IDs in JWT claims for user permissions.
- Updated auth routes to include tenant information in the JWT payload.
- Enhanced app switcher configuration to handle tenant IDs without exposing them publicly.
- Improved documentation for EvoBGP tenant ID integration and its usage in JWT.

apps/api/src/plugins/auth-guards.ts

@@ -25,6 +25,8 @@ declare module '@fastify/jwt' {
       name: string
       apps: string[]
       permissions: string[]
+      tenants?: Record<string, string>
+      bgp_tenant_id?: string
       is_admin?: boolean
       iss: string
     }
@@ -34,6 +36,8 @@ declare module '@fastify/jwt' {
       name: string
       apps: string[]
       permissions: string[]
+      tenants?: Record<string, string>
+      bgp_tenant_id?: string
       is_admin?: boolean
       iss: string
     }

apps/api/src/routes/auth.ts

@@ -3,9 +3,12 @@ import { hash, verify } from '@node-rs/argon2'
 import { randomBytes } from 'node:crypto'
 import {
   PERMISSION_CATALOG,
+  allPermissionKeys,
   appsMetaFromSwitcher,
   loginRequestSchema,
   normalizePermissionKeys,
+  publicAppSwitcherConfig,
+  tenantsClaimForUser,
   type LoginResponse,
 } from '@authportal/shared'
 import {
@@ -53,9 +56,16 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
       }
 
       const apps = getUserApps(app.db, user.id)
-      const permissions = normalizePermissionKeys(
+      let permissions = normalizePermissionKeys(
         getUserPermissions(app.db, user.id),
       )
+      // Portal admin gets full catalog in JWT so apps can rely on permissions
+      // even when UI also checks is_admin.
+      if (user.isAdmin) {
+        permissions = allPermissionKeys()
+      }
+      const switcher = getAppSwitcherConfig(app.db)
+      const tenants = tenantsClaimForUser(switcher, apps)
       const me = toMe(user, apps, permissions)
 
       const expiresAt = new Date(
@@ -68,6 +78,8 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
           name: user.name,
           apps,
           permissions,
+          tenants,
+          bgp_tenant_id: tenants.bgp,
           is_admin: user.isAdmin,
           iss: app.config.issuer,
         },
@@ -109,7 +121,9 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
   })
 
   /** Public — apps chrome (CFDM/VPS) fetch switcher URLs without portal JWT. */
-  app.get('/api/v1/app-switcher', async () => getAppSwitcherConfig(app.db))
+  app.get('/api/v1/app-switcher', async () =>
+    publicAppSwitcherConfig(getAppSwitcherConfig(app.db)),
+  )
 
   app.get(
     '/api/v1/auth/me',