feat(auth): map federated roles to tenant permissions

[seonghobae]

Objective

Advance issue #314 with a server-owned tenant/role authorization mapping stacked on #364. External role claims must not become arbitrary Clearfolio permissions: a deployment-controlled mapping fixes the tenant authority and translates only explicitly configured roles into internal permissions.

Test-first state

This Draft starts intentionally RED at test-only head 929f5b06e8dee2a1c1b966c86e22b6ceb91493c7. TenantRoleMappingPolicyTest requires a defensive immutable role-to-permission policy, fixed tenant authority, union of only configured role permissions, and fail-closed handling of absent/malformed subjects, unmapped roles, or ambiguous server configuration. The production TenantRoleMappingPolicy type does not exist at this head, so test compilation is expected to fail at that exact boundary.

Stack and scope

Base is #364 (feat/issuer-trust-policy-after-343-20260811) exact head 06dcc78c747db02136adbec3b286de73badf829a, itself stacked on #343. This child adds only server-owned tenant/role authorization mapping and focused tests. It does not parse or verify JWTs, perform OIDC discovery/JWK retrieval, introspect opaque tokens, modify TenantContext, change controllers, or migrate the current signed-HMAC adapter.

Acceptance

Observe exact-head RED -> add the smallest mapping implementation -> exact-head Maven/coverage/Javadoc acceptance and directly emitted CI evidence. Keep Draft while #364/#343 are open. After ancestors integrate, reconcile this unique delta onto the new exact protected base and regenerate base-sensitive checks/reviews. Independent write-authorized approval remains a separate protected-merge gate.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3a73e841-9b25-44dc-9743-0df172b64d34

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}