feat: scope-based authorization — read standard scope claim, remove custom roles extraction

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/main/java/net/siegeln/cameleer/saas/config/MeController.java

@@ -34,9 +34,6 @@ public class MeController {
 
         String orgId = jwt.getClaimAsString("organization_id");
 
-        List<String> globalRoles = jwt.getClaimAsStringList("roles");
-        boolean isPlatformAdmin = globalRoles != null && globalRoles.contains("platform-admin");
-
         if (orgId != null) {
             var tenant = tenantService.getByLogtoOrgId(orgId).orElse(null);
             List<Map<String, Object>> tenants = tenant != null
@@ -49,7 +46,6 @@ public class MeController {
 
             return ResponseEntity.ok(Map.of(
                     "userId", userId,
-                    "isPlatformAdmin", isPlatformAdmin,
                     "tenants", tenants));
         }
 
@@ -67,7 +63,6 @@ public class MeController {
 
         return ResponseEntity.ok(Map.of(
                 "userId", userId,
-                "isPlatformAdmin", isPlatformAdmin,
                 "tenants", tenants));
     }
 }

src/main/java/net/siegeln/cameleer/saas/config/SecurityConfig.java

@@ -62,17 +62,14 @@ public class SecurityConfig {
         var converter = new JwtAuthenticationConverter();
         converter.setJwtGrantedAuthoritiesConverter(jwt -> {
             List<GrantedAuthority> authorities = new ArrayList<>();
-
-            var roles = jwt.getClaimAsStringList("roles");
-            if (roles != null) {
-                roles.forEach(r -> authorities.add(new SimpleGrantedAuthority("ROLE_" + r)));
+            String scope = jwt.getClaimAsString("scope");
+            if (scope != null) {
+                for (String s : scope.split(" ")) {
+                    if (!s.isBlank()) {
+                        authorities.add(new SimpleGrantedAuthority("SCOPE_" + s));
+                    }
+                }
             }
-
-            var orgRoles = jwt.getClaimAsStringList("organization_roles");
-            if (orgRoles != null) {
-                orgRoles.forEach(r -> authorities.add(new SimpleGrantedAuthority("ROLE_org_" + r)));
-            }
-
             return authorities;
         });
         return converter;

src/main/java/net/siegeln/cameleer/saas/tenant/TenantController.java

@@ -28,7 +28,7 @@ public class TenantController {
     }
 
     @GetMapping
-    @PreAuthorize("hasRole('platform-admin')")
+    @PreAuthorize("hasAuthority('SCOPE_platform:admin')")
     public ResponseEntity<List<TenantResponse>> listAll() {
         List<TenantResponse> tenants = tenantService.findAll().stream()
                 .map(this::toResponse).toList();
@@ -36,7 +36,7 @@ public class TenantController {
     }
 
     @PostMapping
-    @PreAuthorize("hasRole('platform-admin')")
+    @PreAuthorize("hasAuthority('SCOPE_platform:admin')")
     public ResponseEntity<TenantResponse> create(@Valid @RequestBody CreateTenantRequest request,
                                                   Authentication authentication) {
         try {