request-validation: 403 auth-deny for uniformly-secured APIs (Hub)

[esraagamal6]

What

Phase B of the Camunda Hub negative-suite auth coverage (camunda-hub#25264) — 403 unauthorized. Phase A (401) landed in #391; this closes #392.

Adds an all-secured mode to the 403 auth-deny generator for APIs that authorize every op via a single scheme and short-circuit the authority check before any resource lookup — Camunda Hub's @PreAuthorize("hasAuthority(...) && hasAccessToOrganization(...)"). A reduced-permission Bearer probe is therefore denied 403 on every secured op with dummy keys (no fixtures).

This is the zero-permission probe approach (option 1): full surface coverage, generic "this op is permission-gated" assertion — the same model OCA's auth-deny uses, but extended from a 7-op read slice to the whole secured surface (Hub's short-circuit removes OCA's need for real fixtures).

Changes

• Config — new per-config authDenyMode: 'slice' | 'all-secured' (default 'slice', preserving OCA's read-side allowlist). Mirrors request-validation: 401 negatives for uniformly-secured APIs (Hub) — missing + invalid token #391's authAbsentMode.
• Generator — generateAuthDeny all-secured branch: one 403 scenario per secured op (reusing the secured field the 401 generators target, so the 403 surface matches the 401 surface), dummy path keys, no body. No SLICE, no fixtures.
• Bearer probe — denyProbeHeaders() returns a Bearer token when RBAC_DENY_PROBE_BEARER_TOKEN is set (Hub), else the Basic zero-grant probe user (OCA). The rbac global-setup skips fixture/probe-user provisioning in Bearer-probe mode.
• Keycloak/docker — a reduced-permission c8-client-deny M2M client (no public-api authorities); start-hub.sh adds it a web-modeler-api audience mapper so its token authenticates (passes 401) and reaches the 403 gate.
• Hub config opts in; README documents minting the probe token + RV_PROFILE=rbac. OCA auth-deny unchanged.
• Tests — all-secured generator (targeting, dummy keys, filter, slice-isolation) + denyProbeHeaders Bearer/Basic switch.

Generation

CONFIG=camunda-hub npm run generate:request-validation emits 29 rbac deny-tests (one per secured op, matching the 401 surface).

Open / remaining (why this is a draft)

• Live validation against a secured local Hub (acceptance criterion). Confirms every op returns 403, not 401/404.
• Body-ordering check for write ops. Hub authorizes via method-level @PreAuthorize, which runs after @RequestBody deserialization/validation. A bodyless POST create could return 400 before the 403. If the live run shows that, this PR will exclude required-body ops (bodyRequired === true) from the all-secured surface with a documented note, deferring create/update deny-tests (which need a valid body) to a follow-up.
• Per-permission deny/allow precision (which exact CRUD authority is enforced) remains a follow-up, as it does for OCA.

🤖 Generated with Claude Code