feat: harden SaaS authentication and authorization

Tiku.Application/Auth/IAuthSessionStore.cs

@@ -0,0 +1,49 @@
+using Tiku.Domain.Tenancy;
+
+namespace Tiku.Application.Auth;
+
+public interface IAuthSessionStore
+{
+    string GenerateRefreshToken(AuthRealm realm, Guid? tenantId, Guid sessionId);
+    bool TryParseRefreshToken(string refreshToken, out RefreshTokenLocator locator);
+    string HashRefreshToken(string refreshToken);
+
+    Task<AuthTokenPair> IssueAsync(
+        AuthSessionIssueRequest request,
+        CancellationToken cancellationToken = default);
+
+    Task<AuthTokenPair> RotateAsync(
+        string refreshToken,
+        string? ipAddress,
+        string? userAgent,
+        CancellationToken cancellationToken = default);
+
+    Task<AuthSessionValidationResult?> ValidateAccessSessionAsync(
+        Guid sessionId,
+        Guid userId,
+        AuthRealm realm,
+        Guid? tenantId,
+        CancellationToken cancellationToken = default);
+
+    Task RevokeFamilyAsync(string refreshToken, string reason, CancellationToken cancellationToken = default);
+    Task RevokeRealmAsync(Guid userId, AuthRealm realm, Guid? tenantId, string reason, CancellationToken cancellationToken = default);
+    Task RevokeAllAsync(Guid userId, string reason, CancellationToken cancellationToken = default);
+}
+
+public sealed record AuthSessionIssueRequest(
+    Guid UserId,
+    string? Phone,
+    string? Email,
+    string SecurityStamp,
+    AuthRealm Realm,
+    Guid? TenantId,
+    string Provider,
+    bool MfaSatisfied,
+    string? IpAddress,
+    string? UserAgent,
+    Guid? TokenFamilyId = null,
+    Guid? ParentSessionId = null);
+
+public sealed record AuthSessionValidationResult(Guid UserId, AuthRealm Realm, Guid? TenantId, bool MfaSatisfied);
+
+public readonly record struct RefreshTokenLocator(AuthRealm Realm, Guid? TenantId, Guid SessionId);