feat: harden SaaS authentication and authorization

Tiku.Api/Controllers/TenantContentDirectController.cs

@@ -11,7 +11,7 @@ using Tiku.Domain.Content;
 namespace Tiku.Api.Controllers;
 
 [ApiController]
-[Authorize(Policy = TikuPolicies.TenantAdmin)]
+[Authorize(Policy = BackendPermissions.TenantContentManage)]
 [Produces("application/json")]
 [Route("api/tenant-content")]
 public sealed class TenantContentDirectController(
@@ -20,6 +20,7 @@ public sealed class TenantContentDirectController(
     ITenantContext currentTenant) : ControllerBase
 {
     [HttpPost("questions")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("创建题目及首个版本")]
     [ProducesResponseType<ContentManagementResult<QuestionManagementItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<QuestionManagementItem>>> CreateQuestion(
@@ -30,6 +31,7 @@ public sealed class TenantContentDirectController(
     }
 
     [HttpPatch("questions")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("更新题目并可选择创建新版本")]
     [ProducesResponseType<ContentManagementResult<QuestionManagementItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<QuestionManagementItem>>> UpdateQuestion(
@@ -60,6 +62,7 @@ public sealed class TenantContentDirectController(
     }
 
     [HttpGet("vocabulary-words")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("查询管理侧词汇")]
     [ProducesResponseType<CatalogList<VocabularyWord>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<VocabularyWord>>> GetVocabularyWords(
@@ -70,6 +73,7 @@ public sealed class TenantContentDirectController(
     }
 
     [HttpPut("vocabulary-words")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("新增或更新词汇")]
     [ProducesResponseType<ContentManagementResult<VocabularyWord>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<VocabularyWord>>> UpsertVocabularyWord(
@@ -100,6 +104,7 @@ public sealed class TenantContentDirectController(
     }
 
     [HttpGet("handbook-chapters")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("查询管理侧知识手册章节")]
     [ProducesResponseType<CatalogList<HandbookChapter>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<HandbookChapter>>> GetHandbookChapters(
@@ -110,6 +115,7 @@ public sealed class TenantContentDirectController(
     }
 
     [HttpPut("handbook-chapters")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("新增或更新知识手册章节")]
     [ProducesResponseType<ContentManagementResult<HandbookChapter>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<HandbookChapter>>> UpsertHandbookChapter(
@@ -120,6 +126,7 @@ public sealed class TenantContentDirectController(
     }
 
     [HttpGet("handbook-entries")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("查询管理侧知识手册条目")]
     [ProducesResponseType<CatalogList<HandbookEntry>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<HandbookEntry>>> GetHandbookEntries(
@@ -130,6 +137,7 @@ public sealed class TenantContentDirectController(
     }
 
     [HttpPut("handbook-entries")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("新增或更新知识手册条目")]
     [ProducesResponseType<ContentManagementResult<HandbookEntry>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<HandbookEntry>>> UpsertHandbookEntry(
@@ -240,6 +248,7 @@ public sealed class TenantContentDirectController(
     }
 
     [HttpGet("videos")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("查询租户视频解析")]
     [ProducesResponseType<CatalogList<VideoManagementItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<VideoManagementItem>>> GetVideos(
@@ -250,6 +259,7 @@ public sealed class TenantContentDirectController(
     }
 
     [HttpPut("videos")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("新增或更新视频解析")]
     [ProducesResponseType<ContentManagementResult<VideoManagementItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<VideoManagementItem>>> UpsertVideo(
@@ -260,6 +270,7 @@ public sealed class TenantContentDirectController(
     }
 
     [HttpPost("question-videos")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("绑定题目与解析视频")]
     [ProducesResponseType<ContentManagementResult<QuestionVideoManagementItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<QuestionVideoManagementItem>>> BindQuestionVideo(
@@ -270,6 +281,7 @@ public sealed class TenantContentDirectController(
     }
 
     [HttpGet("operations/{kind}")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("查询运营内容")]
     [ProducesResponseType<CatalogList<OperationContentItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<OperationContentItem>>> GetOperationContent(
@@ -281,6 +293,7 @@ public sealed class TenantContentDirectController(
     }
 
     [HttpPut("operations/{kind}")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("新增或更新运营内容")]
     [ProducesResponseType<ContentManagementResult<OperationContentItem>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ContentManagementResult<OperationContentItem>>> UpsertOperationContent(
@@ -292,6 +305,7 @@ public sealed class TenantContentDirectController(
     }
 
     [HttpPost("imports/preview/{importType}")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("预览内容导入数据")]
     [ProducesResponseType<SimpleImportResult>(StatusCodes.Status200OK)]
     public async Task<ActionResult<SimpleImportResult>> PreviewImport(
@@ -303,6 +317,7 @@ public sealed class TenantContentDirectController(
     }
 
     [HttpPost("imports/{importType}")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("执行同步内容导入")]
     [ProducesResponseType<SimpleImportResult>(StatusCodes.Status200OK)]
     public async Task<ActionResult<SimpleImportResult>> ExecuteImport(
@@ -314,6 +329,7 @@ public sealed class TenantContentDirectController(
     }
 
     [HttpGet("imports/issues")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("查询内容导入问题明细")]
     [ProducesResponseType<CatalogList<ContentImportIssueModel>>(StatusCodes.Status200OK)]
     public async Task<ActionResult<CatalogList<ContentImportIssueModel>>> GetImportIssues(
@@ -324,6 +340,7 @@ public sealed class TenantContentDirectController(
     }
 
     [HttpPost("imports/post-check")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("执行内容导入后完整性检查")]
     [ProducesResponseType<ImportPostCheckResult>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ImportPostCheckResult>> RunImportPostCheck(
@@ -334,6 +351,7 @@ public sealed class TenantContentDirectController(
     }
 
     [HttpGet("imports/post-check")]
+    [Authorize(Policy = TikuPolicies.TenantContentManageAllScope)]
     [EndpointSummary("查询内容导入后检查状态")]
     [ProducesResponseType<ImportPostCheckResult>(StatusCodes.Status200OK)]
     public async Task<ActionResult<ImportPostCheckResult>> GetImportPostCheck(