feat: harden SaaS authentication and authorization

Tiku.Application/Auth/AuthContracts.cs

@@ -1,3 +1,4 @@
+using System.Text.Json.Serialization;
 using Tiku.Domain.Tenancy;
 
 namespace Tiku.Application.Auth;
@@ -35,6 +36,7 @@ public sealed record TenantMembershipSummary(
 /// <param name="Phone">手机号。</param>
 /// <param name="Email">邮箱。</param>
 /// <param name="Name">用户显示名称。</param>
+/// <param name="Realm">当前令牌的 tenant 或 platform 授权域。</param>
 /// <param name="Tenant">当前登录租户成员摘要。</param>
 /// <param name="Tokens">认证令牌对。</param>
 public sealed record AuthenticatedUser(
@@ -42,25 +44,47 @@ public sealed record AuthenticatedUser(
     string? Phone,
     string? Email,
     string? Name,
-    TenantMembershipSummary Tenant,
+    AuthRealm Realm,
+    TenantMembershipSummary? Tenant,
     AuthTokenPair Tokens);
 
+public enum AuthenticationStatus
+{
+    [JsonStringEnumMemberName("authenticated")]
+    Authenticated,
+    [JsonStringEnumMemberName("mfa_required")]
+    MfaRequired,
+    [JsonStringEnumMemberName("mfa_enrollment_required")]
+    MfaEnrollmentRequired,
+    [JsonStringEnumMemberName("password_change_required")]
+    PasswordChangeRequired
+}
+
+public sealed record AuthenticationResult(
+    AuthenticationStatus Status,
+    AuthenticatedUser? User = null,
+    string? ChallengeToken = null,
+    DateTimeOffset? ChallengeExpiresAt = null);
+
 public sealed record PasswordLoginRequest(
-    Guid TenantId,
+    AuthRealm Realm,
+    Guid? TenantId,
     string Phone,
     string Password,
     string? IpAddress,
     string? UserAgent);
 
 public sealed record SmsLoginRequest(
-    Guid TenantId,
+    AuthRealm Realm,
+    Guid? TenantId,
     string Phone,
     string Code,
     string? IpAddress,
     string? UserAgent);
 
 public sealed record WechatLoginRequest(
-    Guid TenantId,
+    AuthRealm Realm,
+    Guid? TenantId,
     string Code,
     string? IpAddress,
     string? UserAgent);
@@ -73,6 +97,24 @@ public sealed record RefreshSessionRequest(
 public sealed record LogoutSessionRequest(
     string RefreshToken);
 
+public sealed record MfaChallengeRequest(
+    string ChallengeToken,
+    string? Code,
+    string? IpAddress,
+    string? UserAgent);
+
+public sealed record PasswordChangeChallengeRequest(
+    string ChallengeToken,
+    string NewPassword,
+    string? IpAddress,
+    string? UserAgent);
+
+public sealed record MfaSetupResult(string SharedKey, string AuthenticatorUri);
+
+public sealed record MfaConfirmResult(
+    AuthenticationResult Authentication,
+    IReadOnlyList<string> RecoveryCodes);
+
 public sealed record SmsSendResult(
     Guid VerificationId,
     DateTimeOffset ExpiresAt);
@@ -82,4 +124,5 @@ public sealed record SendSmsCodeRequest(
     string Phone,
     SmsPurpose Purpose,
     string? IpAddress,
-    string? UserAgent);
+    string? UserAgent,
+    string? DeviceId = null);