caps and delete

backend/src/auth/mod.rs

@@ -1,4 +1,6 @@
 pub mod api_tokens;
+pub mod capability_guard;
+pub mod capability_sets;
 pub mod jwt;
 pub mod passkeys;
 pub mod password;
@@ -10,16 +12,25 @@ use serde::{Deserialize, Serialize};
 use utoipa::ToSchema;
 
 use crate::{
+    auth::capability_sets::{load_capabilities_for_set, load_capability_set},
     error::AppError,
+    models::ApiCapability,
     state::{AppState, PgPooledConnection},
 };
 use uuid::Uuid;
 
+use crate::auth::jwt::PrincipalKind;
+
 #[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
 pub struct AuthenticatedUser {
     pub user_id: uuid::Uuid,
     pub username: String,
     pub tenant_id: uuid::Uuid,
+    pub principal_kind: PrincipalKind,
+    pub principal_id: Uuid,
+    pub capability_set_id: Uuid,
+    pub cap_version: i32,
+    pub capabilities: Vec<ApiCapability>,
 }
 
 #[async_trait]
@@ -44,10 +55,26 @@ impl FromRequestParts<AppState> for AuthenticatedUser {
             .verify_token(bearer.token())
             .map_err(|_| AppError::unauthorized())?;
 
+        let mut tenant_conn = state.db_for_tenant(claims.tenant_id)?;
+        let capability_set = load_capability_set(&mut tenant_conn, claims.capability_set_id)
+            .map_err(|_| AppError::unauthorized())?;
+
+        if capability_set.cap_version != claims.cap_version {
+            return Err(AppError::unauthorized());
+        }
+
+        let capabilities = load_capabilities_for_set(&mut tenant_conn, capability_set.id)
+            .map_err(|_| AppError::unauthorized())?;
+
         let user = AuthenticatedUser {
             user_id: claims.sub,
             username: claims.username,
             tenant_id: claims.tenant_id,
+            principal_kind: claims.principal_kind,
+            principal_id: claims.principal_id,
+            capability_set_id: claims.capability_set_id,
+            cap_version: claims.cap_version,
+            capabilities,
         };
 
         parts.extensions.insert(user.clone());