# TASK 5.1: Validate end-to-end BFF, auth, and tenant enforcement behavior

## Summary

Validate that the new architecture works end-to-end and that the old insecure or DB-dependent behavior is gone.

## Dependencies

- TASK 4.3 complete

## Required Behavior

Validation should cover:

- login and logout through Keycloak-backed auth,
- Laravel boot and normal portal usage without a database connection,
- backend authenticated API access,
- admin-only flows,
- tenant-scoped user flows,
- document list/upload/remove behavior,
- denial of cross-tenant access attempts,
- denial of unauthenticated access attempts.

## Acceptance Criteria

- [ ] Authenticated admin flow works end-to-end
- [ ] Authenticated tenant user flow works end-to-end
- [ ] Laravel works without DB access
- [ ] Backend rejects unauthenticated protected requests
- [ ] Backend rejects cross-tenant access attempts
- [ ] Document management works without Laravel local file metadata

## Notes

- This task should include both positive and negative authorization tests.