feat: 구현: 유저 그룹 중심 권한 통합 및 미들웨어 정책 고도화

backend/internal/middleware/rbac.go

@@ -37,15 +37,23 @@ func RequireKetoPermission(config RBACConfig, namespace, relation string) fiber.
 		}
 
 		// Get object ID from path (e.g., tenant ID)
-		objectID := c.Params("id")
-		if objectID == "" {
+		// Fix: For Tenant namespace, prioritize tenantId param if available
+		objectID := ""
+		if namespace == "Tenant" {
 			objectID = c.Params("tenantId")
 		}
+		
+		if objectID == "" {
+			objectID = c.Params("id")
+		}
 
 		if objectID == "" {
+			slog.Error("RBAC Keto check failed: missing object id", "path", c.Path())
 			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "missing object id for permission check"})
 		}
 
+		slog.Info("Performing Keto permission check", "userID", profile.ID, "namespace", namespace, "objectID", objectID, "relation", relation)
+
 		// Set tenant_id for audit logging if namespace is Tenant
 		if namespace == "Tenant" {
 			c.Locals("tenant_id", objectID)
@@ -53,9 +61,14 @@ func RequireKetoPermission(config RBACConfig, namespace, relation string) fiber.
 
 		// Check with Keto
 		allowed, err := config.KetoService.CheckPermission(c.Context(), profile.ID, namespace, objectID, relation)
-		if err != nil || !allowed {
+		if err != nil {
+			slog.Error("Keto service error", "error", err, "userID", profile.ID, "objectID", objectID)
+			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "permission check error"})
+		}
+		
+		if !allowed {
 			slog.Warn("Keto permission denied", "userID", profile.ID, "namespace", namespace, "objectID", objectID, "relation", relation)
-			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "forbidden: keto permission denied"})
+			return c.Status(fiber.StatusForbidden).JSON(fiber.Map{"error": "forbidden: keto permission denied for " + namespace + ":" + objectID})
 		}
 
 		return c.Next()
@@ -141,7 +154,26 @@ func RequireTenantMatch(config RBACConfig) fiber.Handler {
 				targetTenantID = c.Params("id") // common for /tenants/:id
 			}
 
-			if profile.TenantID == nil || *profile.TenantID != targetTenantID {
+			if targetTenantID == "" {
+				return c.Next() // No target specified, let Keto or next handler decide
+			}
+
+			// Check primary tenant match
+			if profile.TenantID != nil && *profile.TenantID == targetTenantID {
+				return c.Next()
+			}
+
+			// Check inherited manageable tenants
+			isAllowed := false
+			for _, t := range profile.ManageableTenants {
+				if t.ID == targetTenantID {
+					isAllowed = true
+					break
+				}
+			}
+
+			if !isAllowed {
+				slog.Warn("Tenant match failed", "userID", profile.ID, "targetTenantID", targetTenantID)
 				return c.Status(fiber.StatusForbidden).JSON(fiber.Map{
 					"error": "forbidden: you do not have access to this tenant",
 				})