Add authentication, user management, and database migration features

- Implement OAuth 2.0 and PAT authentication methods
- Add user management, roles, and profile functionality
- Add database migrations and admin user scripts
- Update services for authentication and user settings
- Add protected routes and permission hooks
- Update documentation for authentication and database access

backend/src/routes/applications.ts

@@ -7,13 +7,17 @@ import { calculateRequiredEffortApplicationManagementWithBreakdown } from '../se
 import { findBIAMatch, loadBIAData, clearBIACache, calculateSimilarity } from '../services/biaMatchingService.js';
 import { calculateApplicationCompleteness } from '../services/dataCompletenessConfig.js';
 import { getQueryString, getParamString } from '../utils/queryHelpers.js';
+import { requireAuth, requirePermission } from '../middleware/authorization.js';
 import type { SearchFilters, ReferenceValue, ClassificationResult, ApplicationDetails, ApplicationStatus } from '../types/index.js';
 import type { Server, Flows, Certificate, Domain, AzureSubscription, CMDBObjectTypeName } from '../generated/jira-types.js';
 
 const router = Router();
 
-// Search applications with filters
-router.post('/search', async (req: Request, res: Response) => {
+// All routes require authentication
+router.use(requireAuth);
+
+// Search applications with filters (requires search permission)
+router.post('/search', requirePermission('search'), async (req: Request, res: Response) => {
   try {
     const { filters, page = 1, pageSize = 25 } = req.body as {
       filters: SearchFilters;
@@ -356,9 +360,22 @@ router.get('/:id', async (req: Request, res: Response) => {
   }
 });
 
-// Update application with conflict detection
-router.put('/:id', async (req: Request, res: Response) => {
+// Update application with conflict detection (requires edit permission)
+router.put('/:id', requirePermission('edit_applications'), async (req: Request, res: Response) => {
   try {
+    // Check if user has Jira PAT configured OR service account token is available (required for write operations)
+    const userSettings = (req as any).userSettings;
+    const { config } = await import('../config/env.js');
+    
+    // Allow writes if user has PAT OR service account token is configured
+    if (!userSettings?.jira_pat && !config.jiraServiceAccountToken) {
+      res.status(403).json({
+        error: 'Jira PAT not configured',
+        message: 'A Personal Access Token (PAT) is required to save changes to Jira Assets. Please configure it in your user settings, or configure JIRA_SERVICE_ACCOUNT_TOKEN in .env as a fallback.'
+      });
+      return;
+    }
+    
     const id = getParamString(req, 'id');
     const { updates, _jiraUpdatedAt } = req.body as {
       updates?: {
@@ -468,9 +485,22 @@ router.put('/:id', async (req: Request, res: Response) => {
   }
 });
 
-// Force update (ignore conflicts)
-router.put('/:id/force', async (req: Request, res: Response) => {
+// Force update (ignore conflicts) (requires edit permission)
+router.put('/:id/force', requirePermission('edit_applications'), async (req: Request, res: Response) => {
   try {
+    // Check if user has Jira PAT configured OR service account token is available (required for write operations)
+    const userSettings = (req as any).userSettings;
+    const { config } = await import('../config/env.js');
+    
+    // Allow writes if user has PAT OR service account token is configured
+    if (!userSettings?.jira_pat && !config.jiraServiceAccountToken) {
+      res.status(403).json({
+        error: 'Jira PAT not configured',
+        message: 'A Personal Access Token (PAT) is required to save changes to Jira Assets. Please configure it in your user settings, or configure JIRA_SERVICE_ACCOUNT_TOKEN in .env as a fallback.'
+      });
+      return;
+    }
+    
     const id = getParamString(req, 'id');
     const updates = req.body;