[Initiative] Fine-Grained Authorization with OpenFGA/SpiceDB

[juliuskrah]

Summary

Add an optional fine-grained authorization module for GitStore using OpenFGA Ory Keto or SpiceDB to enforce relationship-based permissions for enterprise tenants.

Scope

In scope:

• Pluggable authorization provider contract for OpenFGA/SpiceDB
• Authorization checks in GitStore API for key resources (catalog, basket, orders, admin)
• Mapping from identity claims and tenant context to authorization tuples/checks
• Policy model templates for common RBAC/ReBAC patterns
• Caching and fail-safe behavior for authorization lookups

Out of scope:

• Replacing OIDC authentication
• Building a new identity provider
• Full policy administration UI in this initiative

Acceptance Criteria

• Authorization module can be enabled/disabled by configuration
• GitStore can evaluate permissions via OpenFGA/SpiceDB for protected endpoints
• Tenant isolation rules are enforced by policy model and tested
• Core mode still works without external authorization engine
• Docs include architecture flow and sample model/tuples

Dependencies

• Optional OIDC integration module ([Initiative] OIDC Integration Module #44)
• Optional headless user management integration module ([Initiative] Headless User Management Module #45)
• Enterprise SSO support ([Initiative] Enterprise SSO Support #47)

Tracking

• Milestone: TBD