feat: harden SaaS authentication and authorization

Tiku.Api/Controllers/TenantAdminDirectController.cs

@@ -10,7 +10,6 @@ using Tiku.Domain.Tenancy;
 namespace Tiku.Api.Controllers;
 
 [ApiController]
-[Authorize(Policy = TikuPolicies.TenantAdmin)]
 [Produces("application/json")]
 [Route("api/tenant-admin")]
 public sealed class TenantAdminDirectController(
@@ -19,6 +18,7 @@ public sealed class TenantAdminDirectController(
     ITenantContext currentTenant) : ControllerBase
 {
     [HttpGet("classes")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("查询租户班级")]
     [ProducesResponseType<TenantAdminClassList>(StatusCodes.Status200OK)]
     public async Task<ActionResult<TenantAdminClassList>> GetClasses(
@@ -29,6 +29,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPut("classes")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("新增或更新租户班级")]
     [ProducesResponseType<ContentManagementResult<TenantAdminClassItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantAdminClassItem>>> UpsertClass(
@@ -39,6 +40,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPost("classes/disable")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("停用租户班级")]
     [ProducesResponseType<ContentManagementResult<TenantAdminClassItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantAdminClassItem>>> DisableClass(
@@ -49,6 +51,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpGet("classes/members")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("查询班级成员")]
     [ProducesResponseType<CatalogList<TenantAdminClassMemberItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<TenantAdminClassMemberItem>>> GetClassMembers(
@@ -59,6 +62,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPut("classes/members")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("新增或更新班级成员")]
     [ProducesResponseType<ContentManagementResult<TenantAdminClassMemberItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantAdminClassMemberItem>>> UpsertClassMember(
@@ -69,6 +73,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPost("classes/members/remove")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("移除班级成员")]
     [ProducesResponseType<ContentManagementResult<TenantAdminClassMemberItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantAdminClassMemberItem>>> RemoveClassMember(
@@ -79,6 +84,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpGet("students")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("查询租户学生")]
     [ProducesResponseType<TenantAdminStudentList>(StatusCodes.Status200OK)]
     public async Task<ActionResult<TenantAdminStudentList>> GetStudents(
@@ -89,6 +95,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPut("students")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("新增或更新租户学生档案")]
     [ProducesResponseType<ContentManagementResult<TenantAdminStudentItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantAdminStudentItem>>> UpsertStudent(
@@ -99,6 +106,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPost("students/status")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("更新租户学生状态")]
     [ProducesResponseType<ContentManagementResult<TenantAdminStudentStatusItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantAdminStudentStatusItem>>> UpdateStudentStatus(
@@ -109,6 +117,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpGet("student-notes")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("查询学生备注")]
     [ProducesResponseType<CatalogList<TenantAdminStudentNoteItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<TenantAdminStudentNoteItem>>> GetStudentNotes(
@@ -119,6 +128,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPut("student-notes")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("新增或更新学生备注")]
     [ProducesResponseType<ContentManagementResult<TenantAdminStudentNoteItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantAdminStudentNoteItem>>> UpsertStudentNote(
@@ -129,6 +139,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpGet("student-followups")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("查询学生跟进")]
     [ProducesResponseType<CatalogList<TenantAdminStudentFollowupItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<TenantAdminStudentFollowupItem>>> GetStudentFollowups(
@@ -139,6 +150,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPut("student-followups")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("新增或更新学生跟进")]
     [ProducesResponseType<ContentManagementResult<TenantAdminStudentFollowupItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantAdminStudentFollowupItem>>> UpsertStudentFollowup(
@@ -149,6 +161,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpGet("members")]
+    [Authorize(Policy = BackendPermissions.TenantStaffManage)]
     [EndpointSummary("查询租户成员")]
     [ProducesResponseType<CatalogList<TenantAdminMemberItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<TenantAdminMemberItem>>> GetMembers(
@@ -159,6 +172,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPut("members")]
+    [Authorize(Policy = BackendPermissions.TenantStaffManage)]
     [EndpointSummary("新增或更新租户成员")]
     [ProducesResponseType<ContentManagementResult<TenantAdminMemberItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantAdminMemberItem>>> UpsertMember(
@@ -169,6 +183,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPost("members/disable")]
+    [Authorize(Policy = BackendPermissions.TenantStaffManage)]
     [EndpointSummary("停用租户成员并撤销会话")]
     [ProducesResponseType<ContentManagementResult<TenantAdminMemberItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantAdminMemberItem>>> DisableMember(
@@ -179,6 +194,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpGet("audit-logs")]
+    [Authorize(Policy = BackendPermissions.TenantStaffManage)]
     [EndpointSummary("查询租户审计日志")]
     [ProducesResponseType<CatalogList<TenantAdminAuditLogItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<TenantAdminAuditLogItem>>> GetAuditLogs(
@@ -188,45 +204,8 @@ public sealed class TenantAdminDirectController(
         return Ok(await tenantAdminService.GetAuditLogsAsync(ResolveActor(), query.ToFilter(), cancellationToken));
     }
 
-    [HttpGet("permissions")]
-    [EndpointSummary("查询租户后台权限矩阵")]
-    [ProducesResponseType<TenantAdminPermissionMatrix>(StatusCodes.Status200OK)]
-    public async Task<ActionResult<TenantAdminPermissionMatrix>> GetPermissions(CancellationToken cancellationToken)
-    {
-        return Ok(await tenantAdminService.GetPermissionMatrixAsync(ResolveActor(), cancellationToken));
-    }
-
-    [HttpGet("role-templates")]
-    [EndpointSummary("查询租户角色模板")]
-    [ProducesResponseType<CatalogList<TenantAdminRoleTemplateItem>>(StatusCodes.Status200OK)]
-    public async Task<ActionResult<CatalogList<TenantAdminRoleTemplateItem>>> GetRoleTemplates(
-        [FromQuery] TenantAdminRoleTemplateQueryDto query,
-        CancellationToken cancellationToken)
-    {
-        return Ok(await tenantAdminService.GetRoleTemplatesAsync(ResolveActor(), query.ToFilter(), cancellationToken));
-    }
-
-    [HttpPut("role-templates")]
-    [EndpointSummary("新增或更新租户角色模板")]
-    [ProducesResponseType<ContentManagementResult<TenantAdminRoleTemplateItem>>(StatusCodes.Status200OK)]
-    public async Task<ActionResult<ContentManagementResult<TenantAdminRoleTemplateItem>>> UpsertRoleTemplate(
-        UpsertTenantAdminRoleTemplateDto request,
-        CancellationToken cancellationToken)
-    {
-        return Ok(await tenantAdminService.UpsertRoleTemplateAsync(ResolveActor(), request.ToCommand(), cancellationToken));
-    }
-
-    [HttpPost("role-templates/disable")]
-    [EndpointSummary("停用租户角色模板")]
-    [ProducesResponseType<ContentManagementResult<TenantAdminRoleTemplateItem>>(StatusCodes.Status200OK)]
-    public async Task<ActionResult<ContentManagementResult<TenantAdminRoleTemplateItem>>> DisableRoleTemplate(
-        DisableTenantAdminRoleTemplateDto request,
-        CancellationToken cancellationToken)
-    {
-        return Ok(await tenantAdminService.DisableRoleTemplateAsync(ResolveActor(), request.RoleTemplateId, cancellationToken));
-    }
-
     [HttpPut("branding")]
+    [Authorize(Policy = BackendPermissions.TenantSettingsManage)]
     [EndpointSummary("更新租户品牌信息")]
     [ProducesResponseType<ContentManagementResult<TenantBrandingItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantBrandingItem>>> UpsertBranding(
@@ -237,6 +216,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPut("settings")]
+    [Authorize(Policy = BackendPermissions.TenantSettingsManage)]
     [EndpointSummary("更新租户公开设置与功能开关")]
     [ProducesResponseType<ContentManagementResult<TenantSettingsItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantSettingsItem>>> UpsertSettings(
@@ -247,6 +227,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpGet("theme-templates")]
+    [Authorize(Policy = BackendPermissions.TenantSettingsManage)]
     [EndpointSummary("查询可用租户主题模板")]
     [ProducesResponseType<CatalogList<TenantThemeTemplateItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<TenantThemeTemplateItem>>> GetThemeTemplates(CancellationToken cancellationToken)
@@ -255,6 +236,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpGet("theme")]
+    [Authorize(Policy = BackendPermissions.TenantSettingsManage)]
     [EndpointSummary("查询租户当前主题与草稿")]
     [ProducesResponseType<ContentManagementResult<TenantThemeItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantThemeItem>>> GetTheme(CancellationToken cancellationToken)
@@ -263,6 +245,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPost("theme/preview")]
+    [Authorize(Policy = BackendPermissions.TenantSettingsManage)]
     [EndpointSummary("生成租户主题草稿")]
     [ProducesResponseType<ContentManagementResult<TenantThemeItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantThemeItem>>> PreviewTheme(
@@ -273,6 +256,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPost("theme/publish")]
+    [Authorize(Policy = BackendPermissions.TenantSettingsManage)]
     [EndpointSummary("发布租户主题")]
     [ProducesResponseType<ContentManagementResult<TenantThemeItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantThemeItem>>> PublishTheme(
@@ -283,6 +267,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpGet("domains")]
+    [Authorize(Policy = BackendPermissions.TenantSettingsManage)]
     [EndpointSummary("查询租户域名")]
     [ProducesResponseType<CatalogList<TenantDomainItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<TenantDomainItem>>> GetDomains(CancellationToken cancellationToken)
@@ -291,6 +276,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPost("domains")]
+    [Authorize(Policy = BackendPermissions.TenantSettingsManage)]
     [EndpointSummary("添加租户域名")]
     [ProducesResponseType<ContentManagementResult<TenantDomainItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantDomainItem>>> CreateDomain(
@@ -301,6 +287,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpGet("auth-providers")]
+    [Authorize(Policy = BackendPermissions.TenantProviderManage)]
     [EndpointSummary("查询租户登录 Provider 公开配置")]
     [ProducesResponseType<CatalogList<TenantIdentityProviderItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<TenantIdentityProviderItem>>> GetAuthProviders(CancellationToken cancellationToken)
@@ -309,6 +296,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPut("auth-providers")]
+    [Authorize(Policy = BackendPermissions.TenantProviderManage)]
     [EndpointSummary("新增或更新租户登录 Provider")]
     [ProducesResponseType<ContentManagementResult<TenantIdentityProviderItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantIdentityProviderItem>>> UpsertAuthProvider(
@@ -319,6 +307,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpGet("badges")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("查询租户勋章")]
     [ProducesResponseType<CatalogList<TenantAdminBadgeItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<TenantAdminBadgeItem>>> GetBadges(
@@ -329,6 +318,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPut("badges")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("新增或更新租户勋章")]
     [ProducesResponseType<ContentManagementResult<TenantAdminBadgeItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantAdminBadgeItem>>> UpsertBadge(
@@ -339,6 +329,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpGet("badge-grants")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("查询勋章发放记录")]
     [ProducesResponseType<CatalogList<TenantAdminBadgeGrantItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<TenantAdminBadgeGrantItem>>> GetBadgeGrants(
@@ -349,6 +340,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPost("badge-grants")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("向租户成员发放勋章")]
     [ProducesResponseType<ContentManagementResult<TenantAdminBadgeGrantItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantAdminBadgeGrantItem>>> GrantBadge(
@@ -359,6 +351,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpGet("notifications")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("查询用户站内通知")]
     [ProducesResponseType<CatalogList<TenantAdminNotificationItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<TenantAdminNotificationItem>>> GetNotifications(
@@ -369,6 +362,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPut("notifications")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("新增或更新用户站内通知")]
     [ProducesResponseType<ContentManagementResult<TenantAdminNotificationItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantAdminNotificationItem>>> UpsertNotification(
@@ -379,6 +373,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpGet("feedbacks")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("查询用户反馈")]
     [ProducesResponseType<CatalogList<TenantAdminFeedbackItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<TenantAdminFeedbackItem>>> GetFeedbacks(
@@ -389,6 +384,7 @@ public sealed class TenantAdminDirectController(
     }
 
     [HttpPost("feedbacks/status")]
+    [Authorize(Policy = BackendPermissions.TenantStudentManage)]
     [EndpointSummary("处理用户反馈")]
     [ProducesResponseType<ContentManagementResult<TenantAdminFeedbackItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<TenantAdminFeedbackItem>>> UpdateFeedback(
@@ -400,17 +396,13 @@ public sealed class TenantAdminDirectController(
 
     private TenantAdminActor ResolveActor()
     {
-        if (currentTenant.TenantId is null || currentUser.UserId is null)
+        try
         {
-            throw new TenantAdminDirectException("Tenant admin actor was not resolved.", "tenant_admin_access_denied");
+            return TenantAdminActor.FromResolvedIdentity(currentTenant.TenantId, currentUser.UserId);
+        }
+        catch (InvalidOperationException exception)
+        {
+            throw new TenantAdminDirectException(exception.Message, "tenant_admin_access_denied");
         }
-
-        var role = Enum.TryParse<TenantRole>(
-            currentUser.TenantRole?.Replace("_", string.Empty, StringComparison.Ordinal),
-            ignoreCase: true,
-            out var parsedRole)
-            ? parsedRole
-            : TenantRole.TenantAdmin;
-        return new TenantAdminActor(currentTenant.TenantId.Value, currentUser.UserId.Value, role);
     }
 }