Enforce auth/MFA/claim gates server-side

[coderabbitai]

Summary

The current API tree is a contract-only mock. Before any non-mock deployment, the service must enforce authentication, authorization claims, MFA assurance, API-key controls, and feed-token validation on the server.

This issue consolidates the deferred auth-family review findings from PR #1.

Required changes

• Validate OIDC bearer tokens before authentication succeeds.
  • Verify signature, issuer, audience, expiry, and applicable token claims.
  • Resolve the validated token to a server-side principal.
• Validate platform API keys before authentication succeeds.
  • Validate key identity, active/revoked state, expiry, and required scopes.
  • Resolve the validated key to a server-side principal.
• Enforce the platform-admin claim for the audit-events route.
• Enforce current MFA assurance for API-key management routes.
• Enforce current MFA assurance for domain-verification creation routes.
• Validate feed tokens for public asset-feed access.
• Return the contract-defined unauthorized or forbidden problem response when a gate fails.
• Replace mock-only authentication behavior in every route that currently depends on Authenticated or equivalent access controls.

Affected areas

• src/nc3_testing_platform/core/security.py
• src/nc3_testing_platform/domains/admin/router.py
• src/nc3_testing_platform/domains/api_keys/router.py
• src/nc3_testing_platform/domains/assets/router.py
• src/nc3_testing_platform/domains/scans/dependencies.py
• Other route modules that use Authenticated or expose token-gated access.

Deployment gate

Do not deploy this tree outside a mock or contract-only environment until this issue is complete and its acceptance criteria pass.

Acceptance criteria

• Invalid, expired, malformed, incorrectly issued, or incorrectly signed OIDC tokens cannot access protected operations.
• Invalid, expired, revoked, or insufficient-scope API keys cannot access protected operations.
• The audit-events route requires a verified platform-admin claim.
• API-key management and verification creation require verified current MFA assurance.
• Public feeds require a valid, active feed token.
• Protected operations use verified principals, not raw header presence.
• Automated tests cover success and failure cases for each gate.
• OpenAPI response documentation remains consistent with the enforced 401 and 403 behavior.

Backlinks

• PR: feat(api): v4.0.1 OpenAPI contract, contract-first source, and specs #1
• Review comment: feat(api): v4.0.1 OpenAPI contract, contract-first source, and specs #1 (comment)

Requested by: @t0kubetsu

[nicky-mezzina-lhc]

Why is Coderabbit creating GH issues??