feat: harden SaaS authentication and authorization

Tiku.Infrastructure/Auth/SelfHostedIdentityProvider.cs

@@ -1,4 +1,5 @@
 using Tiku.Application.Auth;
+using Tiku.Domain.Tenancy;
 
 namespace Tiku.Infrastructure.Auth;
 
@@ -13,6 +14,7 @@ internal sealed class SelfHostedIdentityProvider(IAuthService authService) : IId
         {
             "password" => await authService.LoginWithPasswordAsync(
                 new PasswordLoginRequest(
+                    AuthRealm.Tenant,
                     request.TenantId,
                     request.Identifier,
                     request.Secret,
@@ -21,6 +23,7 @@ internal sealed class SelfHostedIdentityProvider(IAuthService authService) : IId
                 cancellationToken),
             "sms" => await authService.LoginWithSmsAsync(
                 new SmsLoginRequest(
+                    AuthRealm.Tenant,
                     request.TenantId,
                     request.Identifier,
                     request.Secret,
@@ -29,6 +32,7 @@ internal sealed class SelfHostedIdentityProvider(IAuthService authService) : IId
                 cancellationToken),
             "wechat_web" => await authService.LoginWithWechatWebAsync(
                 new WechatLoginRequest(
+                    AuthRealm.Tenant,
                     request.TenantId,
                     request.Secret,
                     request.IpAddress,
@@ -36,6 +40,7 @@ internal sealed class SelfHostedIdentityProvider(IAuthService authService) : IId
                 cancellationToken),
             "wechat_miniapp" => await authService.LoginWithWechatMiniAppAsync(
                 new WechatLoginRequest(
+                    AuthRealm.Tenant,
                     request.TenantId,
                     request.Secret,
                     request.IpAddress,
@@ -44,11 +49,13 @@ internal sealed class SelfHostedIdentityProvider(IAuthService authService) : IId
             _ => throw new AuthProviderNotConfiguredException(provider)
         };
 
+        var user = authenticated.User ?? throw new InvalidAuthChallengeException("interactive_authentication_required");
+
         return new IdentityProviderResult(
             provider,
-            authenticated.UserId.ToString("N"),
-            authenticated.Phone,
-            authenticated.Email,
-            authenticated.Name);
+            user.UserId.ToString("N"),
+            user.Phone,
+            user.Email,
+            user.Name);
     }
 }