fix(security): rebuild tenant-scoped admin authority on current main

[seonghobae]

Objective

Reconstruct the critical administrative authorization boundary directly on current protected main, preserving the corrected tenant-scoped semantics while removing the unrelated OpenAPI/license regressions that entered predecessor #440 after its later branch update.

Exact reconstruction identity

• protected base at reconstruction: eb0a32e87e7470469c8fa0f8c67d9583654bef57;
• exact current head: da48e22c9a2095092f1f0def55bba46a2d79ed4d;
• source semantic authority: corrected predecessor head ee6a2a9824682def83a787d2187cee6d7cda362a;
• changed paths are limited to the admin permission, controller, service compatibility boundary, focused controller regression, and security learning record;
• current protected-main OpenAPI, Apache-2.0 metadata, buyer examples, artifact byte route, health route, and their contract tests remain untouched.

Security contract

Every administrative list, delete, and retry endpoint requires tenant:configure, preserves the authenticated TenantContext, and calls only tenant-scoped service operations. Missing or malformed authority fails before service interaction. Missing and foreign jobs are concealed as 404. Compatibility defaults filter before legacy mutation; durable adapters must replace them with storage predicates and generation-fenced transitions.

Test-first lineage

The original RED review evidence on #440 proved unscoped global list/delete/retry behavior and authentication fixtures that bypassed the real authority boundary. Corrected head ee6a2a9824682def83a787d2187cee6d7cda362a supplied the reviewed GREEN implementation and focused regressions. This PR reconstructs that bounded semantic directly on current protected main; predecessor checks and reviews do not transfer.

Scope boundary

This does not implement OIDC/JWT federation, database row-level security, durable authorization persistence, cross-organization delegation, or a complete audit ledger. It establishes the fail-closed application boundary those adapters must preserve.

Merge gate

Keep Draft until exact-head CI, Security Scan, SAST Semgrep, fuzz, zero valid unresolved findings, and a qualifying independent non-author approval are present. Do not import or reintroduce predecessor #440's unrelated OpenAPI deletions.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d8283a9c-af00-46b1-9069-c8452b59c5b3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}