feat(security): complete capability messaging workflows

Tiku.Infrastructure/Messaging/BackgroundJobDispatcher.cs

@@ -0,0 +1,40 @@
+using MassTransit;
+using Tiku.Application.Jobs;
+using Tiku.Contracts;
+
+namespace Tiku.Infrastructure.Messaging;
+
+internal sealed class NullBackgroundJobDispatcher : IBackgroundJobDispatcher
+{
+    public bool IsEnabled => false;
+
+    public Task DispatchAsync(
+        Guid jobId,
+        Guid tenantId,
+        string jobType,
+        string correlationId,
+        CancellationToken cancellationToken = default) => Task.CompletedTask;
+}
+
+internal sealed class MassTransitBackgroundJobDispatcher(IPublishEndpoint publishEndpoint) :
+    IBackgroundJobDispatcher
+{
+    public bool IsEnabled => true;
+
+    public Task DispatchAsync(
+        Guid jobId,
+        Guid tenantId,
+        string jobType,
+        string correlationId,
+        CancellationToken cancellationToken = default) =>
+        publishEndpoint.Publish(
+            new BackgroundJobRequestedV1(
+                Guid.NewGuid(),
+                jobId,
+                tenantId,
+                jobType,
+                DateTimeOffset.UtcNow,
+                correlationId),
+            context => context.MessageId = jobId,
+            cancellationToken);
+}

Tiku.Infrastructure/Messaging/BackgroundJobRequestedConsumer.cs

@@ -0,0 +1,28 @@
+using MassTransit;
+using Tiku.Application.Jobs;
+using Tiku.Application.Security;
+using Tiku.Contracts;
+
+namespace Tiku.Infrastructure.Messaging;
+
+[ConsumerAuthorizationMetadata(
+    "tenant", "dynamic-job-module", CapabilityOperation.Write, "background_job.execute",
+    RequiresSystemScope = true)]
+internal sealed class BackgroundJobRequestedConsumer(
+    IBackgroundJobService backgroundJobService,
+    ITenantContextInitializer tenantContextInitializer) : IConsumer<BackgroundJobRequestedV1>
+{
+    public async Task Consume(ConsumeContext<BackgroundJobRequestedV1> context)
+    {
+        var message = context.Message;
+        tenantContextInitializer.InitializeSystem(
+            message.TenantId,
+            $"RabbitMQ background job {message.JobType}");
+        await backgroundJobService.ProcessRequestedAsync(
+            message.JobId,
+            message.TenantId,
+            message.JobType,
+            $"rabbitmq:{Environment.MachineName}",
+            context.CancellationToken);
+    }
+}

Tiku.Infrastructure/Messaging/MessagingOptions.cs

@@ -7,6 +7,8 @@ public sealed class MessagingOptions
     public string Username { get; set; } = string.Empty;
     public string Password { get; set; } = string.Empty;
     public bool ConfigureConsumers { get; set; }
+    public int OutboxBacklogAlertCount { get; set; } = 1000;
+    public int OutboxOldestMessageAlertSeconds { get; set; } = 300;
 
     public bool IsConfigured => Uri.TryCreate(Host, UriKind.Absolute, out var uri) &&
                                 uri.Scheme is "rabbitmq" or "amqp" or "amqps";

Tiku.Infrastructure/Messaging/SecurityStateChangedConsumer.cs

@@ -4,6 +4,8 @@ using Tiku.Contracts;
 
 namespace Tiku.Infrastructure.Messaging;
 
+[ConsumerAuthorizationMetadata(
+    "system", "security-state", CapabilityOperation.Read, "security.invalidation.apply")]
 internal sealed class SecurityStateChangedConsumer(IRedisSecurityStore redisSecurityStore) :
     IConsumer<AuthorizationStateChangedV1>,
     IConsumer<TenantCapabilityChangedV1>,