feat: harden SaaS authentication and authorization

2026-07-28 12:15:51 +08:00
parent f22f329d33
commit 5d2248efee
123 changed files with 9090 additions and 2822 deletions
--- a/Tiku.Api/Security/AuditingAuthorizationMiddlewareResultHandler.cs
+++ b/Tiku.Api/Security/AuditingAuthorizationMiddlewareResultHandler.cs
@@ -0,0 +1,59 @@
+using System.Text.Json;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization.Policy;
+using Tiku.Application.Security;
+using Tiku.Domain.Operations;
+using Tiku.Infrastructure.Persistence;
+
+namespace Tiku.Api.Security;
+
+internal sealed class AuditingAuthorizationMiddlewareResultHandler(
+    IServiceScopeFactory scopeFactory,
+    ILogger<AuditingAuthorizationMiddlewareResultHandler> logger) : IAuthorizationMiddlewareResultHandler
+{
+    private readonly AuthorizationMiddlewareResultHandler fallback = new();
+
+    public async Task HandleAsync(
+        RequestDelegate next,
+        HttpContext context,
+        AuthorizationPolicy policy,
+        PolicyAuthorizationResult authorizeResult)
+    {
+        if (authorizeResult.Forbidden && context.User.Identity?.IsAuthenticated == true)
+        {
+            try
+            {
+                await using var scope = scopeFactory.CreateAsyncScope();
+                var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
+                dbContext.AuditLogs.Add(new AuditLog
+                {
+                    TenantId = Guid.TryParse(context.User.FindFirst(TikuClaimTypes.TenantId)?.Value, out var tenantId)
+                        ? tenantId
+                        : null,
+                    ActorUserId = Guid.TryParse(context.User.FindFirst(TikuClaimTypes.UserId)?.Value, out var userId)
+                        ? userId
+                        : null,
+                    Action = "authorization.access_denied",
+                    TargetType = "http_endpoint",
+                    TargetId = context.Request.Path,
+                    IpAddress = context.Connection.RemoteIpAddress?.ToString(),
+                    UserAgent = context.Request.Headers.UserAgent.ToString(),
+                    Details = JsonSerializer.SerializeToElement(new
+                    {
+                        Method = context.Request.Method,
+                        Path = context.Request.Path.Value,
+                        Realm = context.User.FindFirst(TikuClaimTypes.Realm)?.Value,
+                        Failure = authorizeResult.AuthorizationFailure?.FailureReasons.Select(reason => reason.Message).ToArray()
+                    })
+                });
+                await dbContext.SaveChangesAsync(context.RequestAborted);
+            }
+            catch (Exception exception)
+            {
+                logger.LogWarning(exception, "Failed to persist authorization denial audit event.");
+            }
+        }
+
+        await fallback.HandleAsync(next, context, policy, authorizeResult);
+    }
+}