feat: harden SaaS authentication and authorization

2026-07-28 12:15:51 +08:00
parent f22f329d33
commit 5d2248efee
123 changed files with 9090 additions and 2822 deletions
--- a/Tiku.Api/Controllers/AuthController.cs
+++ b/Tiku.Api/Controllers/AuthController.cs
@@ -1,10 +1,14 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.RateLimiting;
+using Microsoft.Extensions.Options;
 using Tiku.Application.Auth;
 using Tiku.Api.Contracts;
+using Tiku.Api.Options;
 using Tiku.Application.Security;
 using Tiku.Application.Tenancy;
 using Tiku.Infrastructure.Content;
+using Tiku.Domain.Tenancy;

 namespace Tiku.Api.Controllers;

@@ -13,97 +17,144 @@ namespace Tiku.Api.Controllers;
 [Produces("application/json")]
 public sealed class AuthController(
    IAuthService authService,
-    ISessionService sessionService,
+    ISmsVerificationService smsVerificationService,
+    IAuthSessionStore sessionStore,
    ITenantContext tenantContext,
    ITenantContextInitializer tenantContextInitializer,
-    ITenantDirectory tenantDirectory) : ControllerBase
+    ITenantDirectory tenantDirectory,
+    ICurrentUser currentUser,
+    IOptions<TenantResolutionOptions> tenantResolutionOptions) : ControllerBase
 {
    [AllowAnonymous]
+    [EnableRateLimiting(AuthRateLimitPolicies.Sms)]
+    [HttpPost("sms/send")]
+    [ProducesResponseType<SmsSendResult>(StatusCodes.Status202Accepted)]
+    [ProducesResponseType<ProblemDetails>(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType<ProblemDetails>(StatusCodes.Status429TooManyRequests)]
+    public async Task<ActionResult<SmsSendResult>> SendSmsCode(
+        [FromBody] SendSmsCodeDto request,
+        CancellationToken cancellationToken)
+    {
+        var realm = request.Realm!.Value;
+        if (realm != AuthRealm.Tenant)
+        {
+            throw new RequiredFieldException("SMS authentication is only available in the tenant realm.");
+        }
+
+        var tenantId = await ResolveRealmTenantIdAsync(realm, request.TenantCode, cancellationToken)
+            ?? throw new RequiredFieldException("tenantCode is required for SMS authentication.");
+        var result = await smsVerificationService.CreateCodeAsync(
+            new SendSmsCodeRequest(
+                tenantId,
+                request.Phone,
+                SmsPurpose.Login,
+                GetIpAddress(),
+                Request.Headers.UserAgent.ToString(),
+                request.DeviceId),
+            cancellationToken);
+        return Accepted(result);
+    }
+
+    [AllowAnonymous]
+    [EnableRateLimiting(AuthRateLimitPolicies.Password)]
    [HttpPost("login/password")]
    [EndpointSummary("手机号密码登录")]
    [EndpointDescription("使用本地手机号和密码登录，签发 JWT access token 与数据库 refresh/session。")]
-    [ProducesResponseType<AuthenticatedUserDto>(StatusCodes.Status200OK)]
+    [ProducesResponseType<AuthenticationResultDto>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status401Unauthorized)]
-    public async Task<ActionResult<AuthenticatedUserDto>> LoginWithPassword(
+    public async Task<ActionResult<AuthenticationResultDto>> LoginWithPassword(
        [FromBody] PasswordLoginDto request,
        CancellationToken cancellationToken)
    {
+        var realm = request.Realm!.Value;
+        var identifier = request.Identifier ?? request.Phone;
+        if (string.IsNullOrWhiteSpace(identifier))
+        {
+            throw new RequiredFieldException("identifier is required.");
+        }
        var result = await authService.LoginWithPasswordAsync(
            new PasswordLoginRequest(
-                await ResolveTenantIdAsync(request.TenantCode, cancellationToken),
-                request.Phone,
+                realm,
+                await ResolveRealmTenantIdAsync(realm, request.TenantCode, cancellationToken),
+                identifier,
                request.Password,
                GetIpAddress(),
                Request.Headers.UserAgent.ToString()),
            cancellationToken);

-        return Ok(AuthenticatedUserDto.FromApplication(result));
+        return Ok(AuthenticationResultDto.FromApplication(result));
    }

    [AllowAnonymous]
    [HttpPost("login/sms")]
    [EndpointSummary("短信验证码登录")]
    [EndpointDescription("校验已发送的登录用途短信验证码，成功后签发 JWT access token 与数据库 refresh/session。")]
-    [ProducesResponseType<AuthenticatedUserDto>(StatusCodes.Status200OK)]
+    [ProducesResponseType<AuthenticationResultDto>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status401Unauthorized)]
-    public async Task<ActionResult<AuthenticatedUserDto>> LoginWithSms(
+    public async Task<ActionResult<AuthenticationResultDto>> LoginWithSms(
        [FromBody] SmsLoginDto request,
        CancellationToken cancellationToken)
    {
+        var realm = request.Realm!.Value;
        var result = await authService.LoginWithSmsAsync(
            new SmsLoginRequest(
-                await ResolveTenantIdAsync(request.TenantCode, cancellationToken),
+                realm,
+                await ResolveRealmTenantIdAsync(realm, request.TenantCode, cancellationToken),
                request.Phone,
                request.Code,
                GetIpAddress(),
                Request.Headers.UserAgent.ToString()),
            cancellationToken);

-        return Ok(AuthenticatedUserDto.FromApplication(result));
+        return Ok(AuthenticationResultDto.FromApplication(result));
    }

    [AllowAnonymous]
    [HttpPost("oauth/wechat")]
    [EndpointSummary("微信网页 OAuth 登录")]
    [EndpointDescription("使用微信网页授权 code 换取 openid/unionid，upsert 用户身份并创建应用会话。")]
-    [ProducesResponseType<AuthenticatedUserDto>(StatusCodes.Status200OK)]
+    [ProducesResponseType<AuthenticationResultDto>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status401Unauthorized)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status503ServiceUnavailable)]
-    public async Task<ActionResult<AuthenticatedUserDto>> LoginWithWechatWeb(
+    public async Task<ActionResult<AuthenticationResultDto>> LoginWithWechatWeb(
        [FromBody] OAuthCodeDto request,
        CancellationToken cancellationToken)
    {
+        var realm = request.Realm!.Value;
        var result = await authService.LoginWithWechatWebAsync(
            new WechatLoginRequest(
-                await ResolveTenantIdAsync(request.TenantCode, cancellationToken),
+                realm,
+                await ResolveRealmTenantIdAsync(realm, request.TenantCode, cancellationToken),
                request.Code,
                GetIpAddress(),
                Request.Headers.UserAgent.ToString()),
            cancellationToken);

-        return Ok(AuthenticatedUserDto.FromApplication(result));
+        return Ok(AuthenticationResultDto.FromApplication(result));
    }

    [AllowAnonymous]
    [HttpPost("oauth/wechat-miniapp")]
    [EndpointSummary("微信小程序登录")]
    [EndpointDescription("使用小程序 wx.login 返回的 code 换取 openid/session_key，upsert 用户身份并创建应用会话。")]
-    [ProducesResponseType<AuthenticatedUserDto>(StatusCodes.Status200OK)]
+    [ProducesResponseType<AuthenticationResultDto>(StatusCodes.Status200OK)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status401Unauthorized)]
    [ProducesResponseType<ProblemDetails>(StatusCodes.Status503ServiceUnavailable)]
-    public async Task<ActionResult<AuthenticatedUserDto>> LoginWithWechatMiniApp(
+    public async Task<ActionResult<AuthenticationResultDto>> LoginWithWechatMiniApp(
        [FromBody] OAuthCodeDto request,
        CancellationToken cancellationToken)
    {
+        var realm = request.Realm!.Value;
        var result = await authService.LoginWithWechatMiniAppAsync(
            new WechatLoginRequest(
-                await ResolveTenantIdAsync(request.TenantCode, cancellationToken),
+                realm,
+                await ResolveRealmTenantIdAsync(realm, request.TenantCode, cancellationToken),
                request.Code,
                GetIpAddress(),
                Request.Headers.UserAgent.ToString()),
            cancellationToken);

-        return Ok(AuthenticatedUserDto.FromApplication(result));
+        return Ok(AuthenticationResultDto.FromApplication(result));
    }

    [AllowAnonymous]
@@ -142,14 +193,135 @@ public sealed class AuthController(
        return NoContent();
    }

+    [HttpPost("logout-all")]
+    [Authorize]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    public async Task<IActionResult> LogoutAll(CancellationToken cancellationToken)
+    {
+        if (currentUser.UserId is not { } userId)
+        {
+            return Unauthorized();
+        }
+
+        await authService.LogoutAllAsync(userId, cancellationToken);
+        return NoContent();
+    }
+
+    [AllowAnonymous]
+    [EnableRateLimiting(AuthRateLimitPolicies.Mfa)]
+    [HttpPost("mfa/totp/setup")]
+    public async Task<ActionResult<MfaSetupResult>> SetupTotp(
+        [FromBody] MfaChallengeDto request,
+        CancellationToken cancellationToken)
+    {
+        ResolveAuthChallengeTenant(request.ChallengeToken);
+        var result = await authService.SetupTotpAsync(
+            new MfaChallengeRequest(
+                request.ChallengeToken, null, GetIpAddress(), Request.Headers.UserAgent.ToString()),
+            cancellationToken);
+        return Ok(result);
+    }
+
+    [AllowAnonymous]
+    [EnableRateLimiting(AuthRateLimitPolicies.Mfa)]
+    [HttpPost("mfa/totp/confirm")]
+    public async Task<ActionResult<MfaConfirmDto>> ConfirmTotp(
+        [FromBody] MfaChallengeDto request,
+        CancellationToken cancellationToken)
+    {
+        ResolveAuthChallengeTenant(request.ChallengeToken);
+        var result = await authService.ConfirmTotpAsync(
+            new MfaChallengeRequest(
+                request.ChallengeToken, request.Code, GetIpAddress(), Request.Headers.UserAgent.ToString()),
+            cancellationToken);
+        return Ok(new MfaConfirmDto
+        {
+            Authentication = AuthenticationResultDto.FromApplication(result.Authentication),
+            RecoveryCodes = result.RecoveryCodes
+        });
+    }
+
+    [AllowAnonymous]
+    [EnableRateLimiting(AuthRateLimitPolicies.Mfa)]
+    [HttpPost("mfa/totp/verify")]
+    public async Task<ActionResult<AuthenticationResultDto>> VerifyTotp(
+        [FromBody] MfaChallengeDto request,
+        CancellationToken cancellationToken)
+    {
+        ResolveAuthChallengeTenant(request.ChallengeToken);
+        var result = await authService.VerifyTotpAsync(
+            new MfaChallengeRequest(
+                request.ChallengeToken, request.Code, GetIpAddress(), Request.Headers.UserAgent.ToString()),
+            cancellationToken);
+        return Ok(AuthenticationResultDto.FromApplication(result));
+    }
+
+    [AllowAnonymous]
+    [HttpPost("password/change-required")]
+    [EnableRateLimiting(AuthRateLimitPolicies.Mfa)]
+    public async Task<ActionResult<AuthenticationResultDto>> ChangeRequiredPassword(
+        [FromBody] RequiredPasswordChangeDto request,
+        CancellationToken cancellationToken)
+    {
+        ResolveAuthChallengeTenant(request.ChallengeToken);
+        var result = await authService.ChangeRequiredPasswordAsync(
+            new PasswordChangeChallengeRequest(
+                request.ChallengeToken, request.NewPassword, GetIpAddress(), Request.Headers.UserAgent.ToString()),
+            cancellationToken);
+        return Ok(AuthenticationResultDto.FromApplication(result));
+    }
+
    private void ResolveRefreshTokenTenant(string refreshToken)
    {
-        if (!sessionService.TryParseRefreshToken(refreshToken, out var locator))
+        if (!sessionStore.TryParseRefreshToken(refreshToken, out var locator))
        {
            return;
        }

-        tenantContextInitializer.Initialize(locator.TenantId, null, TenantResolutionSource.RefreshToken);
+        if (locator.Realm == AuthRealm.Platform)
+        {
+            EnsurePlatformHost();
+            if (tenantContext.IsResolved)
+            {
+                throw new TenantContextConflictException(tenantContext.TenantId!.Value, Guid.Empty);
+            }
+            return;
+        }
+
+        if (!tenantContext.IsResolved)
+        {
+            throw new RequiredFieldException(
+                "tenant refresh/logout requires a tenant host or x-tenant-code matching the refresh token.");
+        }
+
+        tenantContextInitializer.Initialize(locator.TenantId!.Value, null, TenantResolutionSource.RefreshToken);
+    }
+
+    private void ResolveAuthChallengeTenant(string challengeToken)
+    {
+        var parts = challengeToken.Split('.', 4, StringSplitOptions.None);
+        if (parts.Length != 4 || parts[0] != "c1")
+        {
+            return;
+        }
+
+        if (parts[1] == "p" && parts[2] == "-")
+        {
+            EnsurePlatformHost();
+            if (tenantContext.IsResolved)
+            {
+                throw new TenantContextConflictException(tenantContext.TenantId!.Value, Guid.Empty);
+            }
+            return;
+        }
+
+        if (parts[1] != "t" || !Guid.TryParseExact(parts[2], "N", out var tenantId) || !tenantContext.IsResolved)
+        {
+            throw new RequiredFieldException(
+                "tenant authentication challenge requires a tenant host or x-tenant-code.");
+        }
+
+        tenantContextInitializer.Initialize(tenantId, null, TenantResolutionSource.RefreshToken);
    }

    private string? GetIpAddress()
@@ -157,8 +329,22 @@ public sealed class AuthController(
        return HttpContext.Connection.RemoteIpAddress?.ToString();
    }

-    private async Task<Guid> ResolveTenantIdAsync(string? tenantCode, CancellationToken cancellationToken)
+    private async Task<Guid?> ResolveRealmTenantIdAsync(
+        AuthRealm realm,
+        string? tenantCode,
+        CancellationToken cancellationToken)
    {
+        if (realm == AuthRealm.Platform)
+        {
+            EnsurePlatformHost();
+            if (tenantContext.IsResolved || !string.IsNullOrWhiteSpace(tenantCode))
+            {
+                throw new RequiredFieldException("platform realm does not accept tenantCode and must use a platform host.");
+            }
+
+            return null;
+        }
+
        if (tenantContext.TenantId.HasValue)
        {
            if (!string.IsNullOrWhiteSpace(tenantCode) &&
@@ -189,4 +375,17 @@ public sealed class AuthController(
            TenantResolutionSource.TenantCode);
        return tenant.TenantId;
    }
+
+    private void EnsurePlatformHost()
+    {
+        var requestHost = Request.Host.Host.Trim().TrimEnd('.');
+        if (!tenantResolutionOptions.Value.PlatformHosts.Any(host =>
+                string.Equals(
+                    host.Trim().TrimEnd('.'),
+                    requestHost,
+                    StringComparison.OrdinalIgnoreCase)))
+        {
+            throw new RequiredFieldException("platform realm is only available on a configured platform host.");
+        }
+    }
 }