feat: add customer authentication and scoped RBAC

vehicle-data-platform/apps/api/internal/platform/principal.go

@@ -3,8 +3,49 @@ package platform
 import "context"
 
 type Principal struct {
-	Name string `json:"name"`
-	Role string `json:"role"`
+	SubjectID    string   `json:"subjectId,omitempty"`
+	SessionID    string   `json:"-"`
+	Name         string   `json:"name"`
+	Username     string   `json:"username,omitempty"`
+	Role         string   `json:"role"`
+	UserType     string   `json:"userType"`
+	CustomerRef  string   `json:"customerRef,omitempty"`
+	TenantRef    string   `json:"tenantRef,omitempty"`
+	AuthProvider string   `json:"authProvider"`
+	MenuKeys     []string `json:"menuKeys"`
+	VehicleVINs  []string `json:"-"`
+	VehicleCount int      `json:"vehicleCount"`
+}
+
+func (p Principal) Clone() Principal {
+	p.MenuKeys = append([]string(nil), p.MenuKeys...)
+	p.VehicleVINs = append([]string(nil), p.VehicleVINs...)
+	p.VehicleCount = len(p.VehicleVINs)
+	return p
+}
+
+func (p Principal) CanMenu(key string) bool {
+	if p.UserType == "admin" || p.Role == "admin" {
+		return true
+	}
+	for _, value := range p.MenuKeys {
+		if value == key {
+			return true
+		}
+	}
+	return false
+}
+
+func (p Principal) CanVIN(vin string) bool {
+	if p.UserType != "customer" {
+		return true
+	}
+	for _, allowed := range p.VehicleVINs {
+		if allowed == vin {
+			return true
+		}
+	}
+	return false
 }
 
 type principalContextKey struct{}