feat: add customer authentication and scoped RBAC

vehicle-data-platform/apps/api/internal/app/server.go

@@ -29,6 +29,7 @@ func NewServer(cfg config.Config) http.Handler {
 		dataMode = "mock"
 	}
 	var store platform.Store = platform.NewMockStore()
+	var authDB *sql.DB
 	var storeErr error
 	if dataMode != "mock" && dataMode != "production" {
 		storeErr = fmt.Errorf("DATA_MODE must be mock or production")
@@ -46,6 +47,7 @@ func NewServer(cfg config.Config) http.Handler {
 				storeErr = fmt.Errorf("connect production mysql: %w", err)
 			}
 		} else {
+			authDB = db
 			var tdengine *sql.DB
 			if cfg.TDengineDSN != "" {
 				tdengine, err = platform.OpenSQL(ctx, cfg.TDengineDriver, cfg.TDengineDSN)
@@ -92,7 +94,7 @@ func NewServer(cfg config.Config) http.Handler {
 	// Reverse geocoding consumes the server-side AMap credential, so it must
 	// stay behind the same authentication boundary as the platform API.
 	api = withAMapReverseGeocodeAPI(api, cfg, "https://restapi.amap.com", http.DefaultClient)
-	handler := static.Handler(cfg.StaticDir, withAPIAuth(api, cfg))
+	handler := static.Handler(cfg.StaticDir, withAPIAuth(api, cfg, authDB))
 	handler = withAppConfig(handler, cfg)
 	handler = withAMapSecurityProxy(handler, cfg, defaultAMapProxyUpstreams(), http.DefaultClient)
 	return withRequestTimeout(handler, cfg.RequestTimeout)