feat(security): complete capability messaging workflows

Tiku.Application/Jobs/BackgroundJobModels.cs

@@ -33,6 +33,14 @@ public interface IBackgroundJobService
     Task<int> ProcessPendingAsync(
         string workerId,
         int batchSize,
+        bool includeImmediateJobs = true,
+        CancellationToken cancellationToken = default);
+
+    Task<bool> ProcessRequestedAsync(
+        Guid jobId,
+        Guid tenantId,
+        string jobType,
+        string workerId,
         CancellationToken cancellationToken = default);
 
     Task<IReadOnlyCollection<BackgroundJobItem>> ListAsync(
@@ -41,3 +49,15 @@ public interface IBackgroundJobService
         int limit = 50,
         CancellationToken cancellationToken = default);
 }
+
+public interface IBackgroundJobDispatcher
+{
+    bool IsEnabled { get; }
+
+    Task DispatchAsync(
+        Guid jobId,
+        Guid tenantId,
+        string jobType,
+        string correlationId,
+        CancellationToken cancellationToken = default);
+}

Tiku.Application/PlatformAdmin/PlatformAdminModels.cs

@@ -110,6 +110,28 @@ public sealed record UpsertPlatformTenantBillingProfileCommand(
 
 public sealed record PlatformPlanList(IReadOnlyCollection<PlatformSaasPlan> Items);
 
+public sealed record PlatformPlanModuleEntitlements(
+    string PlanCode,
+    IReadOnlyCollection<string> ModuleCodes);
+
+public sealed record ReplacePlatformPlanModulesCommand(
+    string PlanCode,
+    IReadOnlyCollection<string> ModuleCodes);
+
+public sealed record PlatformTenantModuleOverrideItem(
+    Guid TenantId,
+    string ModuleCode,
+    TenantModuleOverrideMode Mode,
+    DateTimeOffset? ExpiresAt,
+    string? Reason);
+
+public sealed record UpsertPlatformTenantModuleOverrideCommand(
+    Guid TenantId,
+    string ModuleCode,
+    TenantModuleOverrideMode Mode,
+    DateTimeOffset? ExpiresAt,
+    string Reason);
+
 public sealed record UpsertPlatformSubscriptionCommand(
     Guid TenantId,
     string PlanCode,
@@ -239,7 +261,9 @@ public interface IPlatformAdminService
     Task<PlatformTenantItem> UpdateTenantStatusAsync(PlatformAdminActor actor, UpdatePlatformTenantStatusCommand command, CancellationToken cancellationToken = default);
     Task<TenantBillingProfileItem> UpsertTenantBillingProfileAsync(PlatformAdminActor actor, UpsertPlatformTenantBillingProfileCommand command, CancellationToken cancellationToken = default);
     Task<PlatformPlanList> GetPlansAsync(PlatformAdminActor actor, PlatformAdminQuery query, CancellationToken cancellationToken = default);
+    Task<PlatformPlanModuleEntitlements> ReplacePlanModulesAsync(PlatformAdminActor actor, ReplacePlatformPlanModulesCommand command, CancellationToken cancellationToken = default);
     Task<PlatformTenantSubscriptionItem> UpsertSubscriptionAsync(PlatformAdminActor actor, UpsertPlatformSubscriptionCommand command, CancellationToken cancellationToken = default);
+    Task<PlatformTenantModuleOverrideItem> UpsertTenantModuleOverrideAsync(PlatformAdminActor actor, UpsertPlatformTenantModuleOverrideCommand command, CancellationToken cancellationToken = default);
     Task<PlatformDomainList> GetDomainsAsync(PlatformAdminActor actor, PlatformAdminQuery query, CancellationToken cancellationToken = default);
     Task<PlatformDomainRecheckResult> RecheckDomainAsync(PlatformAdminActor actor, Guid domainId, CancellationToken cancellationToken = default);
     Task<PlatformStaffList> GetStaffAsync(PlatformAdminActor actor, PlatformAdminQuery query, CancellationToken cancellationToken = default);

Tiku.Application/Security/ConsumerAuthorizationMetadata.cs

@@ -0,0 +1,15 @@
+namespace Tiku.Application.Security;
+
+[AttributeUsage(AttributeTargets.Class, AllowMultiple = false, Inherited = false)]
+public sealed class ConsumerAuthorizationMetadataAttribute(
+    string realm,
+    string module,
+    CapabilityOperation operation,
+    string auditAction) : Attribute
+{
+    public string Realm { get; } = realm;
+    public string Module { get; } = module;
+    public CapabilityOperation Operation { get; } = operation;
+    public string AuditAction { get; } = auditAction;
+    public bool RequiresSystemScope { get; init; }
+}

Tiku.Application/Security/ITenantExecutionScope.cs

@@ -14,7 +14,8 @@ public sealed record SystemScopeRequest(
     SystemScopeCallerType CallerType,
     string Caller,
     string Reason,
-    string CorrelationId);
+    string CorrelationId,
+    bool IsGlobal = false);
 
 public interface ITenantExecutionScope
 {

Tiku.Application/Security/ProductModuleCatalog.cs

@@ -0,0 +1,23 @@
+namespace Tiku.Application.Security;
+
+public static class ProductModuleCatalog
+{
+    public static readonly IReadOnlyDictionary<string, string> All =
+        new Dictionary<string, string>(StringComparer.Ordinal)
+        {
+            ["dashboard"] = "Dashboard",
+            ["staff"] = "Staff",
+            ["role"] = "Roles",
+            ["student"] = "Students",
+            ["content"] = "Content",
+            ["settings"] = "Settings",
+            ["provider"] = "Providers",
+            ["commerce"] = "Commerce",
+            ["crm"] = "CRM",
+            ["commission"] = "Commission",
+            ["job"] = "Background Jobs"
+        };
+
+    public static bool Contains(string moduleCode) =>
+        All.ContainsKey(moduleCode.Trim().ToLowerInvariant());
+}