[FEATURE] Enable API Authentication with Both Application Token and User Identity

[Aravinda-HWK]

Description

Support API authentication that requires both user credentials and an application access token to be sent as part of the API request.

Use Case

Some APIs require verification of who the user is and which application is making the request. Currently, authentication mechanisms typically support either user-based authentication only.

This limitation makes it difficult to:

• Secure sensitive APIs that must validate end-user identity.
• Ensure the request originates from a trusted and authorized application.
• Prevent misuse of user credentials by unauthorized or rogue applications.

Proposed Solution

Introduce a dual-authentication mechanism for APIs where:

• The application access token is sent via the Authorization: Bearer <access_token> header.
• User credentials (or a user assertion) are sent in the API request body or headers.

The system validates:

• The application access token (issuer, signature, expiry, scopes).
• The user credentials against the identity provider.
• Authorization decisions are made using a combination of:
• Application-level permissions.
• User-level roles or privileges.

Alternatives Considered

Additional Context