Edge Function authentication and authorization

Implement guard as auth-guard.ts exporting a single async function verifyRequest(req: Request): Promise. If verification fails, return a Response object; if it passes, return an AuthContext containing { userId, orgId, isServiceRole }. Callers check the return type before proceeding. Use Deno's built-in crypto for JWT verification rather than third-party libraries to minimize supply chain risk.

The integration_admin claim lives in app_metadata.claims.integration_admin (set by Supabase admin API) — document this clearly so ops can grant/revoke without code changes. For service role detection, compare the Authorization header value to Deno.env.get('SUPABASE_SERVICE_ROLE_KEY') using a constant-time comparison to prevent timing attacks. All credential vault queries must include AND org_id = $orgId as a WHERE clause parameter — never as a JavaScript filter applied after fetching all rows.

Unit tests: (1) missing Authorization header → 401; (2) malformed JWT → 401; (3) valid JWT without integration_admin claim → 403; (4) valid JWT with integration_admin claim for org A trying to invoke for org B → 403 org_scope_violation; (5) service role key → accepted; (6) valid JWT with correct org → guard passes, downstream function called. Use Supabase test JWT signing with known secret for unit tests. Integration test: deploy locally, invoke with real Supabase Auth tokens with and without integration_admin claim, verify response codes. Security test: attempt to pass org_id in payload that differs from JWT claim — verify rejection.