feat: harden SaaS authentication and authorization

Tiku.Application/Auth/IAuthService.cs

@@ -2,19 +2,19 @@ namespace Tiku.Application.Auth;
 
 public interface IAuthService
 {
-    Task<AuthenticatedUser> LoginWithPasswordAsync(
+    Task<AuthenticationResult> LoginWithPasswordAsync(
         PasswordLoginRequest request,
         CancellationToken cancellationToken = default);
 
-    Task<AuthenticatedUser> LoginWithSmsAsync(
+    Task<AuthenticationResult> LoginWithSmsAsync(
         SmsLoginRequest request,
         CancellationToken cancellationToken = default);
 
-    Task<AuthenticatedUser> LoginWithWechatWebAsync(
+    Task<AuthenticationResult> LoginWithWechatWebAsync(
         WechatLoginRequest request,
         CancellationToken cancellationToken = default);
 
-    Task<AuthenticatedUser> LoginWithWechatMiniAppAsync(
+    Task<AuthenticationResult> LoginWithWechatMiniAppAsync(
         WechatLoginRequest request,
         CancellationToken cancellationToken = default);
 
@@ -25,4 +25,22 @@ public interface IAuthService
     Task LogoutAsync(
         LogoutSessionRequest request,
         CancellationToken cancellationToken = default);
+
+    Task LogoutAllAsync(Guid userId, CancellationToken cancellationToken = default);
+
+    Task<MfaSetupResult> SetupTotpAsync(
+        MfaChallengeRequest request,
+        CancellationToken cancellationToken = default);
+
+    Task<MfaConfirmResult> ConfirmTotpAsync(
+        MfaChallengeRequest request,
+        CancellationToken cancellationToken = default);
+
+    Task<AuthenticationResult> VerifyTotpAsync(
+        MfaChallengeRequest request,
+        CancellationToken cancellationToken = default);
+
+    Task<AuthenticationResult> ChangeRequiredPasswordAsync(
+        PasswordChangeChallengeRequest request,
+        CancellationToken cancellationToken = default);
 }