feat: harden SaaS authentication and authorization

Tiku.Api/Options/AuthRateLimitOptions.cs

@@ -0,0 +1,33 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Tiku.Api.Options;
+
+public sealed class AuthRateLimitOptions
+{
+    public const string SectionName = "RateLimiting:Authentication";
+
+    [Range(1, 100)]
+    public int PasswordPermitLimit { get; set; } = 5;
+
+    [Range(1, 86_400)]
+    public int PasswordWindowSeconds { get; set; } = 900;
+
+    [Range(1, 100)]
+    public int SmsPermitLimit { get; set; } = 5;
+
+    [Range(1, 86_400)]
+    public int SmsWindowSeconds { get; set; } = 300;
+
+    [Range(1, 100)]
+    public int MfaPermitLimit { get; set; } = 5;
+
+    [Range(1, 86_400)]
+    public int MfaWindowSeconds { get; set; } = 300;
+}
+
+public static class AuthRateLimitPolicies
+{
+    public const string Password = "auth-password";
+    public const string Sms = "auth-sms";
+    public const string Mfa = "auth-mfa";
+}

Tiku.Api/Options/OptionsValidation.cs

@@ -5,8 +5,6 @@ namespace Tiku.Api.Options;
 
 public static class OptionsValidation
 {
-    public const string DevelopmentSigningKey = "development-only-tiku-signing-key-change-before-production";
-
     public static string ResolveDatabaseConnectionString(
         IConfiguration configuration,
         bool isDevelopment)
@@ -30,11 +28,7 @@ public static class OptionsValidation
 
     public static bool BeValidJwtOptions(JwtOptions options, bool isProduction)
     {
-        return !isProduction ||
-               !string.Equals(
-                   options.SigningKey,
-                   DevelopmentSigningKey,
-                   StringComparison.Ordinal);
+        return JwtOptions.BeValid(options, isProduction);
     }
 
     public static bool BeValidCorsOptions(CorsOptions options)