Micro-app access grants: per-app claim + access policy, enforced at the serving gateway

[jrosseel]

Context

Consumer slice of the micro-app plane design (2026-08-18 discussion): agents deploy micro-apps into a per-silo micro-app namespace, served same-origin under the silo host (/a/<app>) behind one universal identity-aware gateway — no per-app OIDC clients. User access uses the same identity end to end:

• Each micro-app gets a Zitadel project role (claim), e.g. group:apps:<name>, minted through the silo idp-management port (Silo IdP management port: mode-scoped Zitadel credential (standalone = full org, fleet = claims-only PAT) #659).
• Grants/revokes write Zitadel (source of truth for the access graph) AND mirror local access-policy rows in one $transaction (external call last).
• Per-request enforcement is against local rows at the gateway — instant revocation, no re-login dependency. Claims + mirror-groups.ts remain the login-time sync channel.
• The access-policy model copies the shipped MCP entitlement pattern (McpServerAccessPolicy in libs/backend/server/gateways/mcp/main/src/core/mcp-operator.logic.ts + apps/opencrane/prisma/schema/mcp.prisma): everyone-in-org / per-user / per-group, org-admin-gated.

Todo

• Prisma: MicroApp + MicroAppAccessPolicy (everyone / user / group entitlement) modeled on mcp.prisma.
• On app create: mint the group:apps:<name> project role via the idp-management port, same-transaction rule.
• Org-admin-gated grant/revoke routes: Zitadel authorization write through the port + local row mirror in one transaction; API-first (no CLI).
• Gateway enforcement hop: resolve /a/<name> → app record → per-request entitlement check against local rows → proxy to the app Service; forward verified identity (channel-proxy pattern: user and workload authorized independently).
• Negative tests: revoked user denied on the next request, unentitled group denied, app claim absent from token does not grant (local rows are the authority), gateway refuses unknown app names.

Depends on

• Silo IdP management port: mode-scoped Zitadel credential (standalone = full org, fleet = claims-only PAT) #659 (silo idp-management port) and its fleet-side pair (elewa-git/WeOwnAI#64).
• The micro-app workload/serving plane itself (namespace class, Deployment/Service builder + controller extension, per-app CNPG database provisioner, gateway deployable) — separate issues still to be filed for those workstreams.