feat(security): complete capability messaging workflows

Tiku.IntegrationTests/Api/AuthorizationManifestTests.cs

@@ -7,14 +7,17 @@ using Microsoft.AspNetCore.Mvc.Routing;
 using Microsoft.AspNetCore.Mvc.Controllers;
 using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.DependencyInjection;
+using MassTransit;
 using Tiku.Api.Security;
+using Tiku.Application.Security;
+using Tiku.Infrastructure.Messaging;
 
 namespace Tiku.IntegrationTests.Api;
 
 public sealed class AuthorizationManifestTests
 {
-    private const int ExpectedActionCount = 330;
-    private const string ExpectedSha256 = "ad09167662cb9dc25111f40902c5f16a6633465f0ca7e7da0e50cdc10cfb8bb5";
+    private const int ExpectedActionCount = 332;
+    private const string ExpectedSha256 = "a80fe477ba3021625e17c9fc639e5109bab678178f8024a51c3c732bf5a46d3f";
 
     [Fact]
     public void Controller_authorization_surface_matches_reviewed_manifest()
@@ -61,6 +64,30 @@ public sealed class AuthorizationManifestTests
         }
     }
 
+    [Fact]
+    public void Message_consumers_have_reviewed_authorization_and_audit_metadata()
+    {
+        var consumers = typeof(MessagingOptions).Assembly.GetTypes()
+            .Where(type => !type.IsAbstract && type.GetInterfaces().Any(candidate =>
+                candidate.IsGenericType && candidate.GetGenericTypeDefinition() == typeof(IConsumer<>)))
+            .ToArray();
+
+        Assert.Equal(2, consumers.Length);
+        foreach (var consumer in consumers)
+        {
+            var metadata = consumer.GetCustomAttribute<ConsumerAuthorizationMetadataAttribute>();
+            Assert.NotNull(metadata);
+            Assert.Contains(metadata.Realm, new[] { "tenant", "platform", "system" });
+            Assert.False(string.IsNullOrWhiteSpace(metadata.Module));
+            Assert.False(string.IsNullOrWhiteSpace(metadata.AuditAction));
+            if (consumer.Name == "BackgroundJobRequestedConsumer")
+            {
+                Assert.Equal(CapabilityOperation.Write, metadata.Operation);
+                Assert.True(metadata.RequiresSystemScope);
+            }
+        }
+    }
+
     private static string Describe(Type controller, MethodInfo action)
     {
         var controllerRoute = controller.GetCustomAttribute<RouteAttribute>()?.Template ?? string.Empty;