feat(auth): return permissions/roles/modules from /auth/me (all branches)

src/modules/auth/auth.controller.ts

@@ -494,7 +494,10 @@ export class AuthController {
           id: api_key.customer_id,
           name: api_key.customer_name,
           tier: api_key.customer_tier,
-        }
+        },
+        permissions: [],
+        roles: [],
+        modules: [],
       };
 
       return res.status(200).json(userDto);

src/modules/auth/auth.service.ts

@@ -35,6 +35,7 @@ import { BulkEditResponse, UserDTO } from './dtos/login';
 import jwt, { JwtPayload } from 'jsonwebtoken';
 import { PackTheMetadata } from 'src/utils/PackTheMetadata';
 import { Request, Response } from 'express';
+import { deriveOrchestIdentity } from './orchest-identity';
 
 type AuthSession = {
   accessToken?: string;
@@ -447,6 +448,7 @@ export class AuthClientService implements OnModuleInit {
         name: payload.customer_name,
         tier: payload.customer_tier,
       },
+      ...deriveOrchestIdentity(payload.permissions),
     };
 
     return userDto;

src/modules/auth/dtos/login.ts

@@ -152,5 +152,8 @@ export type UserDTO = {
     id: string,
     name: string,
     tier: string,
-  }
+  },
+  permissions: string[],
+  roles: string[],
+  modules: string[],
 }

src/modules/auth/orchest-identity.integration.spec.ts

@@ -0,0 +1,27 @@
+import { deriveOrchestIdentity } from './orchest-identity';
+
+// The three getMe branches must all yield the three fields. This test
+// pins the SHAPE contract without loading the DUC gRPC client.
+describe('/auth/me field contract', () => {
+  it('cookie/refresh path derives from payload permissions', () => {
+    const enriched = {
+      id: 'u', name: 'n', email: 'e',
+      customer: { id: 'c', name: 'cust', tier: 't' },
+      ...deriveOrchestIdentity(['users:admin', 'intelligence:open']),
+    };
+    expect(enriched.roles).toContain('super-admin');
+    expect(enriched.modules).toContain('intelligence');
+    expect(enriched.permissions).toHaveLength(2);
+  });
+
+  it('api-key branch is empty for all three fields', () => {
+    const apiKeyDto = {
+      id: 'u', name: 'n', email: 'n',
+      customer: { id: 'c', name: 'cust', tier: 't' },
+      permissions: [] as string[], roles: [] as string[], modules: [] as string[],
+    };
+    expect(apiKeyDto.permissions).toEqual([]);
+    expect(apiKeyDto.roles).toEqual([]);
+    expect(apiKeyDto.modules).toEqual([]);
+  });
+});