stage 2 of oauth removal, switch to sanctum pat tokens completed, docs updated

app/Support/TenantAuth.php

@@ -5,7 +5,6 @@ namespace App\Support;
 use App\Models\User;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Http\Request;
-use Illuminate\Support\Arr;
 
 class TenantAuth
 {
@@ -16,24 +15,17 @@ class TenantAuth
      */
     public static function resolveAdminUser(Request $request): User
     {
-        $decoded = (array) $request->attributes->get('decoded_token', []);
         $tenantId = $request->attributes->get('tenant_id')
             ?? $request->input('tenant_id')
-            ?? Arr::get($decoded, 'tenant_id');
+            ?? $request->user()?->tenant_id;
 
         if (! $tenantId) {
             throw (new ModelNotFoundException)->setModel(User::class);
         }
 
-        $userId = Arr::get($decoded, 'user_id');
-
-        if ($userId) {
-            $user = User::query()
-                ->whereKey($userId)
-                ->where('tenant_id', $tenantId)
-                ->first();
-
-            if ($user) {
+        $user = $request->user();
+        if ($user && in_array($user->role, ['tenant_admin', 'admin', 'super_admin'], true)) {
+            if ($user->role !== 'super_admin' || (int) $user->tenant_id === (int) $tenantId) {
                 return $user;
             }
         }