feat: add current user and tenant endpoints

Tiku.Api/Controllers/AuthController.cs

@@ -0,0 +1,92 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Tiku.Application.Auth;
+
+namespace Tiku.Api.Controllers;
+
+[ApiController]
+[Route("api/auth")]
+public sealed class AuthController(IAuthService authService) : ControllerBase
+{
+    [AllowAnonymous]
+    [HttpPost("login/password")]
+    public async Task<ActionResult<AuthenticatedUser>> LoginWithPassword(
+        PasswordLoginHttpRequest request,
+        CancellationToken cancellationToken)
+    {
+        var result = await authService.LoginWithPasswordAsync(
+            new PasswordLoginRequest(
+                request.TenantId,
+                request.Phone,
+                request.Password,
+                GetIpAddress(),
+                Request.Headers.UserAgent.ToString()),
+            cancellationToken);
+
+        return Ok(result);
+    }
+
+    [AllowAnonymous]
+    [HttpPost("login/sms")]
+    public async Task<ActionResult<AuthenticatedUser>> LoginWithSms(
+        SmsLoginHttpRequest request,
+        CancellationToken cancellationToken)
+    {
+        var result = await authService.LoginWithSmsAsync(
+            new SmsLoginRequest(
+                request.TenantId,
+                request.Phone,
+                request.Code,
+                GetIpAddress(),
+                Request.Headers.UserAgent.ToString()),
+            cancellationToken);
+
+        return Ok(result);
+    }
+
+    [AllowAnonymous]
+    [HttpPost("refresh")]
+    public async Task<ActionResult<AuthTokenPair>> Refresh(
+        RefreshHttpRequest request,
+        CancellationToken cancellationToken)
+    {
+        var result = await authService.RefreshAsync(
+            new RefreshSessionRequest(
+                request.RefreshToken,
+                GetIpAddress(),
+                Request.Headers.UserAgent.ToString()),
+            cancellationToken);
+
+        return Ok(result);
+    }
+
+    [AllowAnonymous]
+    [HttpPost("logout")]
+    public async Task<IActionResult> Logout(
+        RefreshHttpRequest request,
+        CancellationToken cancellationToken)
+    {
+        await authService.LogoutAsync(
+            new LogoutSessionRequest(request.RefreshToken),
+            cancellationToken);
+
+        return NoContent();
+    }
+
+    private string? GetIpAddress()
+    {
+        return HttpContext.Connection.RemoteIpAddress?.ToString();
+    }
+}
+
+public sealed record PasswordLoginHttpRequest(
+    Guid TenantId,
+    string Phone,
+    string Password);
+
+public sealed record SmsLoginHttpRequest(
+    Guid TenantId,
+    string Phone,
+    string Code);
+
+public sealed record RefreshHttpRequest(string RefreshToken);

Tiku.Api/Controllers/MeController.cs

@@ -0,0 +1,68 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Tiku.Application.Security;
+using Tiku.Domain.Tenancy;
+using Tiku.Infrastructure.Persistence;
+
+namespace Tiku.Api.Controllers;
+
+[ApiController]
+[Authorize(Policy = TikuPolicies.AuthenticatedUser)]
+[Route("api/me")]
+public sealed class MeController(
+    ICurrentUser currentUser,
+    TikuDbContext dbContext) : ControllerBase
+{
+    [HttpGet]
+    public async Task<ActionResult<MeResponse>> Get(CancellationToken cancellationToken)
+    {
+        if (currentUser.UserId is null)
+        {
+            return Unauthorized();
+        }
+
+        var user = await dbContext.Users.FindAsync([currentUser.UserId.Value], cancellationToken);
+        if (user is null)
+        {
+            return Unauthorized();
+        }
+
+        var memberships = await dbContext.TenantMemberships
+            .Where(membership =>
+                membership.UserId == user.Id &&
+                membership.Status == MembershipStatus.Active)
+            .Join(
+                dbContext.Tenants,
+                membership => membership.TenantId,
+                tenant => tenant.Id,
+                (membership, tenant) => new TenantMembershipResponse(
+                    tenant.Id,
+                    tenant.Name,
+                    tenant.Slug,
+                    membership.Role,
+                    membership.Status))
+            .ToArrayAsync(cancellationToken);
+
+        return Ok(new MeResponse(
+            user.Id,
+            user.Phone,
+            user.Email,
+            user.Name,
+            memberships));
+    }
+}
+
+public sealed record MeResponse(
+    Guid UserId,
+    string? Phone,
+    string? Email,
+    string? Name,
+    IReadOnlyCollection<TenantMembershipResponse> Tenants);
+
+public sealed record TenantMembershipResponse(
+    Guid TenantId,
+    string TenantName,
+    string TenantSlug,
+    TenantRole Role,
+    MembershipStatus Status);

Tiku.Api/Controllers/TenantsController.cs

@@ -0,0 +1,61 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using System.Text.Json;
+using Tiku.Application.Auth;
+using Tiku.Application.Security;
+using Tiku.Domain.Tenancy;
+using Tiku.Infrastructure.Persistence;
+
+namespace Tiku.Api.Controllers;
+
+[ApiController]
+[Authorize(Policy = TikuPolicies.CurrentTenantMember)]
+[Route("api/tenants")]
+public sealed class TenantsController(
+    ICurrentUser currentUser,
+    ICurrentTenant currentTenant,
+    TikuDbContext dbContext) : ControllerBase
+{
+    [HttpGet("current")]
+    public async Task<ActionResult<CurrentTenantResponse>> GetCurrent(CancellationToken cancellationToken)
+    {
+        if (currentUser.UserId is null || currentTenant.TenantId is null)
+        {
+            throw new TenantAccessDeniedException();
+        }
+
+        var result = await dbContext.TenantMemberships
+            .Where(membership =>
+                membership.UserId == currentUser.UserId.Value &&
+                membership.TenantId == currentTenant.TenantId.Value &&
+                membership.Status == MembershipStatus.Active)
+            .Join(
+                dbContext.Tenants,
+                membership => membership.TenantId,
+                tenant => tenant.Id,
+                (membership, tenant) => new CurrentTenantResponse(
+                    tenant.Id,
+                    tenant.Name,
+                    tenant.Slug,
+                    tenant.Status,
+                    membership.Role,
+                    membership.Permissions))
+            .SingleOrDefaultAsync(cancellationToken);
+
+        if (result is null)
+        {
+            throw new TenantAccessDeniedException();
+        }
+
+        return Ok(result);
+    }
+}
+
+public sealed record CurrentTenantResponse(
+    Guid TenantId,
+    string TenantName,
+    string TenantSlug,
+    TenantStatus Status,
+    TenantRole Role,
+    JsonElement Permissions);

Tiku.Api/Middleware/ExceptionHandlingMiddleware.cs

@@ -1,4 +1,5 @@
 using Microsoft.AspNetCore.Mvc;
+using Tiku.Application.Auth;
 
 namespace Tiku.Api.Middleware;
 
@@ -15,6 +16,12 @@ public sealed class ExceptionHandlingMiddleware(
         }
         catch (Exception exception)
         {
+            if (exception is AuthException authException)
+            {
+                await WriteAuthProblemAsync(context, authException);
+                return;
+            }
+
             logger.LogError(exception, "Unhandled API exception");
 
             var problem = new ProblemDetails
@@ -30,4 +37,26 @@ public sealed class ExceptionHandlingMiddleware(
             await context.Response.WriteAsJsonAsync(problem);
         }
     }
+
+    private static async Task WriteAuthProblemAsync(HttpContext context, AuthException exception)
+    {
+        var status = exception.Code switch
+        {
+            "tenant_access_denied" => StatusCodes.Status403Forbidden,
+            "sms_rate_limited" => StatusCodes.Status429TooManyRequests,
+            "session_revoked" => StatusCodes.Status401Unauthorized,
+            _ => StatusCodes.Status401Unauthorized
+        };
+        var problem = new ProblemDetails
+        {
+            Title = exception.Message,
+            Status = status,
+            Instance = context.Request.Path
+        };
+
+        problem.Extensions["code"] = exception.Code;
+        problem.Extensions["traceId"] = context.TraceIdentifier;
+        context.Response.StatusCode = status;
+        await context.Response.WriteAsJsonAsync(problem);
+    }
 }

Tiku.Api/Program.cs

@@ -1,16 +1,23 @@
 using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.EntityFrameworkCore;
 using Microsoft.IdentityModel.Tokens;
 using Scalar.AspNetCore;
 using System.Text;
+using System.Text.Json.Serialization;
 using Tiku.Api.Middleware;
 using Tiku.Api.Security;
 using Tiku.Application;
 using Tiku.Application.Security;
 using Tiku.Infrastructure;
+using Tiku.Infrastructure.Persistence;
 
 var builder = WebApplication.CreateBuilder(args);
 
-builder.Services.AddControllers();
+builder.Services.AddControllers()
+    .AddJsonOptions(options =>
+    {
+        options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter());
+    });
 builder.Services.AddOpenApi();
 builder.Services.AddProblemDetails();
 builder.Services.AddApplication();
@@ -42,6 +49,36 @@ builder.Services
             ValidateLifetime = true,
             ClockSkew = TimeSpan.FromMinutes(1)
         };
+        options.Events = new JwtBearerEvents
+        {
+            OnTokenValidated = async context =>
+            {
+                if (!jwtOptions.ValidateSessions)
+                {
+                    return;
+                }
+
+                var sessionIdValue = context.Principal?.FindFirst(TikuClaimTypes.SessionId)?.Value;
+                if (!Guid.TryParse(sessionIdValue, out var sessionId))
+                {
+                    context.Fail("Missing session claim.");
+                    return;
+                }
+
+                var dbContext = context.HttpContext.RequestServices.GetRequiredService<TikuDbContext>();
+                var now = DateTimeOffset.UtcNow;
+                var isSessionActive = await dbContext.AuthSessions.AnyAsync(
+                    session =>
+                        session.Id == sessionId &&
+                        session.RevokedAt == null &&
+                        session.ExpiresAt > now);
+
+                if (!isSessionActive)
+                {
+                    context.Fail("Session has been revoked or expired.");
+                }
+            }
+        };
     });
 
 builder.Services.AddAuthorization(options =>

Tiku.Api/appsettings.json

@@ -11,7 +11,8 @@
       "Audience": "tiku-api",
       "SigningKey": "development-only-tiku-signing-key-change-before-production",
       "AccessTokenMinutes": 30,
-      "RefreshTokenDays": 30
+      "RefreshTokenDays": 30,
+      "ValidateSessions": true
     }
   },
   "AllowedHosts": "*"