feat: harden SaaS authentication and authorization

Tiku.Api/Controllers/TenantCommerceController.cs

@@ -8,7 +8,7 @@ using Tiku.Domain.Commerce;
 namespace Tiku.Api.Controllers;
 
 [ApiController]
-[Authorize(Policy = TikuPolicies.TenantAdmin)]
+[Authorize(Policy = BackendPermissions.TenantCommerceOperate)]
 [Produces("application/json")]
 [Route("api/tenant-commerce")]
 public sealed class TenantCommerceController(
@@ -17,6 +17,7 @@ public sealed class TenantCommerceController(
     ITenantContext currentTenant) : ControllerBase
 {
     [HttpGet("payment-accounts")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("查询租户支付账号")]
     [ProducesResponseType<IReadOnlyCollection<TenantPaymentProviderItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<IReadOnlyCollection<TenantPaymentProviderItem>>> PaymentAccounts(
@@ -30,6 +31,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpPut("payment-accounts")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("新增或更新租户支付账号")]
     [ProducesResponseType<TenantPaymentProviderItem>(StatusCodes.Status200OK)]
     public async Task<ActionResult<TenantPaymentProviderItem>> UpsertPaymentAccount(
@@ -43,6 +45,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpPut("secrets")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("写入或轮换租户密钥")]
     [ProducesResponseType<TenantSecretItem>(StatusCodes.Status200OK)]
     public async Task<ActionResult<TenantSecretItem>> UpsertSecret(
@@ -82,6 +85,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpPost("code-batches")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("创建兑换码批次")]
     [ProducesResponseType<CodeBatchItem>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CodeBatchItem>> CreateCodeBatch(
@@ -95,6 +99,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpGet("activation-codes")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("查询兑换码")]
     [ProducesResponseType<ActivationCodeList>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ActivationCodeList>> ActivationCodes(
@@ -108,6 +113,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpPost("activation-codes/redeem")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("后台核销兑换码")]
     [ProducesResponseType<ActivationCodeItem>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ActivationCodeItem>> RedeemActivationCode(
@@ -121,6 +127,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpGet("point-activity-tasks")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("查询积分活动任务")]
     [ProducesResponseType<TenantPointTaskList>(StatusCodes.Status200OK)]
     public async Task<ActionResult<TenantPointTaskList>> PointTasks(
@@ -134,6 +141,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpPut("point-activity-tasks")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("新增或更新积分活动任务")]
     [ProducesResponseType<object>(StatusCodes.Status200OK)]
     public async Task<ActionResult<object>> UpsertPointTask(
@@ -147,6 +155,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpGet("point-activity-claims")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("查询积分任务领取记录")]
     [ProducesResponseType<TenantPointClaimList>(StatusCodes.Status200OK)]
     public async Task<ActionResult<TenantPointClaimList>> PointClaims(
@@ -160,6 +169,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpGet("point-exchange-items")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("查询积分兑换项")]
     [ProducesResponseType<TenantPointExchangeItemList>(StatusCodes.Status200OK)]
     public async Task<ActionResult<TenantPointExchangeItemList>> PointExchangeItems(
@@ -173,6 +183,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpPut("point-exchange-items")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("新增或更新积分兑换项")]
     [ProducesResponseType<object>(StatusCodes.Status200OK)]
     public async Task<ActionResult<object>> UpsertPointExchangeItem(
@@ -186,6 +197,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpGet("point-exchange-orders")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("查询积分兑换订单")]
     [ProducesResponseType<TenantPointExchangeOrderList>(StatusCodes.Status200OK)]
     public async Task<ActionResult<TenantPointExchangeOrderList>> PointExchangeOrders(
@@ -199,6 +211,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpPost("point-exchange-orders/status")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("更新积分兑换订单状态")]
     [ProducesResponseType<object>(StatusCodes.Status200OK)]
     public async Task<ActionResult<object>> UpdatePointExchangeOrderStatus(
@@ -212,6 +225,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpGet("coupons")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("查询租户优惠券")]
     [ProducesResponseType<TenantCouponList>(StatusCodes.Status200OK)]
     public async Task<ActionResult<TenantCouponList>> Coupons(
@@ -225,6 +239,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpPut("coupons")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("新增或更新租户优惠券")]
     [ProducesResponseType<object>(StatusCodes.Status200OK)]
     public async Task<ActionResult<object>> UpsertCoupon(
@@ -238,6 +253,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpGet("coupons/redemptions")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("查询优惠券领取和核销记录")]
     [ProducesResponseType<TenantCouponRedemptionList>(StatusCodes.Status200OK)]
     public async Task<ActionResult<TenantCouponRedemptionList>> CouponRedemptions(
@@ -251,6 +267,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpGet("coupons/report")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("查询优惠券基础报表")]
     [ProducesResponseType<TenantCouponReport>(StatusCodes.Status200OK)]
     public async Task<ActionResult<TenantCouponReport>> CouponReport(
@@ -316,6 +333,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpGet("reconciliation/batches")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("查询对账批次")]
     [ProducesResponseType<TenantReconciliationBatchList>(StatusCodes.Status200OK)]
     public async Task<ActionResult<TenantReconciliationBatchList>> ReconciliationBatches(
@@ -329,6 +347,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpPost("reconciliation/batches")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("创建对账批次")]
     [ProducesResponseType<CommerceReconciliationBatch>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CommerceReconciliationBatch>> CreateReconciliationBatch(
@@ -342,6 +361,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpGet("reconciliation/issues")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("查询对账异常")]
     [ProducesResponseType<TenantReconciliationIssueList>(StatusCodes.Status200OK)]
     public async Task<ActionResult<TenantReconciliationIssueList>> ReconciliationIssues(
@@ -355,6 +375,7 @@ public sealed class TenantCommerceController(
     }
 
     [HttpPost("reconciliation/issues/status")]
+    [Authorize(Policy = TikuPolicies.TenantCommerceOperateAllScope)]
     [EndpointSummary("更新对账异常状态")]
     [ProducesResponseType<CommerceReconciliationIssue>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CommerceReconciliationIssue>> UpdateReconciliationIssue(