feat: enforce team membership validation for cloudtty access

[CasLubbers]

No description provided.

[Copilot]

Pull request overview

This PR tightens CloudTTY access control by ensuring users can only open/delete a cloud shell for teams they belong to, and aligns the CloudTTY OpenAPI ACL to avoid cross-team access for team admins.

Changes:

• Enforce team membership checks in OtomiStack.connectCloudtty() and OtomiStack.deleteCloudtty() for non-platform-admin users.
• Update Cloudtty OpenAPI ACL so teamAdmin actions are team-scoped (create/read/update/delete vs *-any).
• Add authz tests to ensure team admins cannot connect/delete CloudTTY for another team.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/otomi-stack.ts	Adds explicit membership enforcement before connecting/deleting CloudTTY for non-platform admins.
src/openapi/cloudtty.yaml	Makes teamAdmin permissions team-scoped to prevent cross-team access via *-any.
src/api-v2.authz.test.ts	Expands authz coverage for team-admin CloudTTY access restrictions.

Suppressed comments (1)

src/api-v2.authz.test.ts:1864

• Team-admin DELETE /v2/cloudtty is only tested for the cross-team 403 case. Add a positive test for deleting cloudtty for the admin’s own team to ensure the new membership validation doesn’t block legitimate deletes.

        await agent
          .delete('/v2/cloudtty')
          .query({ teamId: 'team2' })
          .set('Authorization', `Bearer ${teamAdminToken}`)
          .expect(403)

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.