feat: harden SaaS authentication and authorization

Tiku.Application/TenantAdmin/TenantAdminDirectModels.cs

@@ -6,7 +6,18 @@ using Tiku.Domain.Tenancy;
 
 namespace Tiku.Application.TenantAdmin;
 
-public sealed record TenantAdminActor(Guid TenantId, Guid UserId, TenantRole Role = TenantRole.TenantAdmin);
+public sealed record TenantAdminActor(Guid TenantId, Guid UserId)
+{
+    public static TenantAdminActor FromResolvedIdentity(Guid? tenantId, Guid? userId)
+    {
+        if (tenantId is null || userId is null)
+        {
+            throw new InvalidOperationException("Tenant admin actor was not resolved.");
+        }
+
+        return new(tenantId.Value, userId.Value);
+    }
+}
 
 public sealed record TenantAdminClassFilter(
     Guid? RegionId = null,
@@ -44,10 +55,6 @@ public sealed record TenantAdminAuditLogFilter(
     Guid? ActorUserId = null,
     int? Limit = null);
 
-public sealed record TenantAdminRoleTemplateFilter(
-    string? Status = null,
-    int? Limit = null);
-
 public sealed record TenantAdminBadgeFilter(
     string? Category = null,
     bool IncludeInactive = false,
@@ -140,24 +147,8 @@ public sealed record UpsertTenantAdminMemberCommand(
     UserLookupCommand User,
     string? Role,
     string? Status,
-    Guid? RoleTemplateId,
-    JsonElement Permissions,
     string? PrimaryRole);
 
-public sealed record UpsertTenantAdminRoleTemplateCommand(
-    Guid? Id,
-    string? Code,
-    string Name,
-    string? Description,
-    string? BaseRole,
-    string? Status,
-    JsonElement Permissions,
-    JsonElement MenuPermissions,
-    JsonElement ModulePermissions,
-    JsonElement FieldPermissions,
-    JsonElement DataScope,
-    int? Order);
-
 public sealed record UpsertTenantBrandingCommand(
     string BrandName,
     string? ShortName,
@@ -357,10 +348,6 @@ public sealed record TenantAdminMemberItem(
     Guid UserId,
     TenantRole Role,
     MembershipStatus Status,
-    JsonElement Permissions,
-    Guid? RoleTemplateId,
-    string? RoleTemplateCode,
-    string? RoleTemplateName,
     string? LegacyRole,
     TenantAdminUserSummary User,
     DateTimeOffset CreatedAt,
@@ -379,37 +366,6 @@ public sealed record TenantAdminAuditLogItem(
     string? ActorPhone,
     DateTimeOffset CreatedAt);
 
-public sealed record TenantAdminPermissionMatrix(
-    TenantAdminCurrentPermission Current,
-    IReadOnlyCollection<TenantAdminPermissionCatalogItem> Permissions,
-    IReadOnlyDictionary<string, IReadOnlyCollection<string>> RoleDefaults);
-
-public sealed record TenantAdminCurrentPermission(
-    Guid UserId,
-    Guid TenantId,
-    TenantRole Role);
-
-public sealed record TenantAdminPermissionCatalogItem(string Key, string Label);
-
-public sealed record TenantAdminRoleTemplateItem(
-    Guid Id,
-    string Code,
-    string Name,
-    string? Description,
-    TenantRole BaseRole,
-    TenantRoleTemplateStatus Status,
-    JsonElement Permissions,
-    JsonElement MenuPermissions,
-    JsonElement ModulePermissions,
-    JsonElement FieldPermissions,
-    JsonElement DataScope,
-    bool IsSystem,
-    int Order,
-    Guid? CreatedBy,
-    Guid? UpdatedBy,
-    DateTimeOffset CreatedAt,
-    DateTimeOffset UpdatedAt);
-
 public sealed record TenantBrandingItem(
     Guid TenantId,
     string BrandName,