feat: harden SaaS authentication and authorization

2026-07-28 12:15:51 +08:00
parent f22f329d33
commit 5d2248efee
123 changed files with 9090 additions and 2822 deletions
--- a/Tiku.Application/Security/BackendPermissions.cs
+++ b/Tiku.Application/Security/BackendPermissions.cs
@@ -0,0 +1,64 @@
+namespace Tiku.Application.Security;
+
+public static class BackendPermissions
+{
+    public const string TenantDashboardView = "tenant:dashboard:view";
+    public const string TenantStaffManage = "tenant:staff:manage";
+    public const string TenantRoleManage = "tenant:role:manage";
+    public const string TenantStudentManage = "tenant:student:manage";
+    public const string TenantContentManage = "tenant:content:manage";
+    public const string TenantSettingsManage = "tenant:settings:manage";
+    public const string TenantProviderManage = "tenant:provider:manage";
+    public const string TenantCommerceOperate = "tenant:commerce:operate";
+    public const string TenantCrmManage = "tenant:crm:manage";
+    public const string TenantCommissionManage = "tenant:commission:manage";
+    public const string TenantJobManage = "tenant:job:manage";
+
+    public const string PlatformDashboardView = "platform:dashboard:view";
+    public const string PlatformTenantManage = "platform:tenant:manage";
+    public const string PlatformStaffManage = "platform:staff:manage";
+    public const string PlatformRoleManage = "platform:role:manage";
+    public const string PlatformQuestionBankManage = "platform:question-bank:manage";
+    public const string PlatformAuditView = "platform:audit:view";
+
+    public static readonly IReadOnlySet<string> Tenant = new HashSet<string>(StringComparer.Ordinal)
+    {
+        TenantDashboardView,
+        TenantStaffManage,
+        TenantRoleManage,
+        TenantStudentManage,
+        TenantContentManage,
+        TenantSettingsManage,
+        TenantProviderManage,
+        TenantCommerceOperate,
+        TenantCrmManage,
+        TenantCommissionManage,
+        TenantJobManage
+    };
+
+    public static readonly IReadOnlySet<string> Platform = new HashSet<string>(StringComparer.Ordinal)
+    {
+        PlatformDashboardView,
+        PlatformTenantManage,
+        PlatformStaffManage,
+        PlatformRoleManage,
+        PlatformQuestionBankManage,
+        PlatformAuditView
+    };
+
+    public static void EnsureTenant(string permissionCode)
+    {
+        if (!Tenant.Contains(permissionCode))
+        {
+            throw new ArgumentOutOfRangeException(nameof(permissionCode), permissionCode, "Unknown tenant permission.");
+        }
+    }
+
+    public static void EnsurePlatform(string permissionCode)
+    {
+        if (!Platform.Contains(permissionCode))
+        {
+            throw new ArgumentOutOfRangeException(nameof(permissionCode), permissionCode, "Unknown platform permission.");
+        }
+    }
+}