Enforce role-limited Studio authorization

Extract role-scope intersection so membership authorization can be regression tested.

app/security/studio_identity.py

@@ -4,7 +4,11 @@ import hmac
 import re
 import time
 from collections.abc import Mapping
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
+
+from app.security.context import AuthContext
+from app.security.scopes import DEFAULT_ROLE_SCOPES
+from app.security.tenancy import TenantPrincipal
 
 _HEX_SHA256 = re.compile(r"^[a-f0-9]{64}$")
 
@@ -57,3 +61,30 @@ def verify_studio_identity(
     if not hmac.compare_digest(expected, signature):
         raise ValueError("Studio identity signature is invalid.")
     return StudioIdentity(subject=subject, email=email, name=name, timestamp=timestamp)
+
+
+def constrain_context_to_membership(
+    context: AuthContext, principal: TenantPrincipal
+) -> AuthContext:
+    """Intersect API-key scopes with persisted workspace-role capabilities."""
+    raw_role = principal.membership_role.strip().lower()
+    role_map = {
+        "owner": "developer",
+        "admin": "developer",
+        "developer": "developer",
+        "operator": "operator",
+        "viewer": "viewer",
+        "member": "viewer",
+    }
+    effective_role = role_map.get(raw_role)
+    if effective_role is None:
+        raise ValueError("Unsupported workspace membership role.")
+    return replace(
+        context,
+        role=effective_role,
+        scopes=frozenset(context.scopes.intersection(DEFAULT_ROLE_SCOPES[effective_role])),
+        workspace_id=principal.workspace_id,
+        user_id=principal.user_id,
+        membership_id=principal.membership_id,
+        membership_role=raw_role,
+    )