Security Dashboard API Route

Next.js API route handler enforcing role-based access control at the API layer before delegating to SecurityMetricsService. Validates that only Organization Admins and Global Admins can reach security metrics endpoints regardless of UI-level gating, and extracts tenant context from the authenticated session for scoping.

Feature: Security Dashboard

security-dashboard-api-route

• Enforce role-gating at the API layer for all security metrics endpoints
• Extract and validate tenant context from the authenticated session
• Delegate metric retrieval to SecurityMetricsService and serialize response
• Return 403 for unauthorized roles independent of UI visibility state