feat: restrict admin access to club operations and rollout test environment

backend/WorkClub.Api/Program.cs

@@ -24,6 +24,7 @@ builder.Services.AddScoped<SeedDataService>();
 builder.Services.AddScoped<TaskService>();
 builder.Services.AddScoped<ShiftService>();
 builder.Services.AddScoped<ClubService>();
+builder.Services.AddScoped<AdminClubService>();
 builder.Services.AddScoped<MemberService>();
 builder.Services.AddScoped<MemberSyncService>();
 
@@ -49,9 +50,13 @@ builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
 builder.Services.AddScoped<IClaimsTransformation, ClubRoleClaimsTransformation>();
 
 builder.Services.AddAuthorizationBuilder()
-    .AddPolicy("RequireAdmin", policy => policy.RequireRole("Admin"))
-    .AddPolicy("RequireManager", policy => policy.RequireRole("Admin", "Manager"))
-    .AddPolicy("RequireMember", policy => policy.RequireRole("Admin", "Manager", "Member"))
+    .AddPolicy("RequireGlobalAdmin", policy => policy.RequireAssertion(context =>
+    {
+        var realmAccess = context.User.FindFirst("realm_access")?.Value;
+        return realmAccess != null && realmAccess.Contains("\"admin\"");
+    }))
+    .AddPolicy("RequireManager", policy => policy.RequireRole("Manager"))
+    .AddPolicy("RequireMember", policy => policy.RequireRole("Manager", "Member"))
     .AddPolicy("RequireViewer", policy => policy.RequireAuthenticatedUser());
 
 builder.Services.AddDbContext<AppDbContext>((sp, options) =>
@@ -122,6 +127,7 @@ app.MapGet("/api/test", () => Results.Ok(new { message = "Test endpoint" }))
 app.MapTaskEndpoints();
 app.MapShiftEndpoints();
 app.MapClubEndpoints();
+app.MapAdminClubEndpoints();
 app.MapMemberEndpoints();
 
 app.Run();