feat: harden SaaS authentication and authorization

2026-07-28 12:15:51 +08:00
parent f22f329d33
commit 5d2248efee
123 changed files with 9090 additions and 2822 deletions
--- a/Tiku.Infrastructure/Security/CurrentAccessContext.cs
+++ b/Tiku.Infrastructure/Security/CurrentAccessContext.cs
@@ -0,0 +1,141 @@
+using Microsoft.EntityFrameworkCore;
+using Tiku.Application.Security;
+using Tiku.Domain.Identity;
+using Tiku.Domain.Operations;
+using Tiku.Domain.Tenancy;
+using Tiku.Infrastructure.Persistence;
+
+namespace Tiku.Infrastructure.Security;
+
+internal sealed class CurrentAccessContext(
+    ICurrentUser currentUser,
+    ITenantContext tenantContext,
+    TikuDbContext dbContext) : ICurrentAccessContext
+{
+    private Task<CurrentAccessSnapshot>? snapshotTask;
+
+    public Task<CurrentAccessSnapshot> GetAsync(CancellationToken cancellationToken = default)
+    {
+        // The context is scoped to one request. Do not allow an aborted authorization
+        // check to poison the cached access snapshot used later in that request.
+        return snapshotTask ??= LoadAsync(CancellationToken.None);
+    }
+
+    private async Task<CurrentAccessSnapshot> LoadAsync(CancellationToken cancellationToken)
+    {
+        if (!currentUser.IsAuthenticated || currentUser.UserId is not { } userId)
+        {
+            return Empty();
+        }
+
+        var isUserActive = await dbContext.Users.AsNoTracking()
+            .AnyAsync(user => user.Id == userId && user.Status == UserStatus.Active, cancellationToken);
+        if (!isUserActive)
+        {
+            return new CurrentAccessSnapshot(
+                userId,
+                tenantContext.TenantId,
+                false,
+                false,
+                new HashSet<string>(StringComparer.Ordinal),
+                new HashSet<string>(StringComparer.Ordinal),
+                CurrentDataScope.Self);
+        }
+
+        var platformPermissions = await LoadPlatformPermissionsAsync(userId, cancellationToken);
+        if (tenantContext.TenantId is not { } tenantId)
+        {
+            return new CurrentAccessSnapshot(
+                userId,
+                null,
+                true,
+                false,
+                new HashSet<string>(StringComparer.Ordinal),
+                platformPermissions,
+                CurrentDataScope.Self);
+        }
+
+        var isTenantActive = await dbContext.Tenants.AsNoTracking()
+            .AnyAsync(tenant => tenant.Id == tenantId && tenant.Status == TenantStatus.Active, cancellationToken);
+        var isActiveMember = isTenantActive && await dbContext.TenantMemberships.AsNoTracking()
+            .AnyAsync(
+                membership => membership.TenantId == tenantId &&
+                              membership.UserId == userId &&
+                              membership.Status == MembershipStatus.Active,
+                cancellationToken);
+
+        if (!isActiveMember)
+        {
+            return new CurrentAccessSnapshot(
+                userId,
+                tenantId,
+                true,
+                false,
+                new HashSet<string>(StringComparer.Ordinal),
+                platformPermissions,
+                CurrentDataScope.Self);
+        }
+
+        var tenantRoles = await (
+                from userRole in dbContext.TenantBackendUserRoles.AsNoTracking()
+                join role in dbContext.TenantBackendRoles.AsNoTracking() on userRole.RoleId equals role.Id
+                where userRole.TenantId == tenantId &&
+                      userRole.UserId == userId &&
+                      role.Status == BackendRoleStatus.Active
+                select new { role.Id, role.DataScope })
+            .ToArrayAsync(cancellationToken);
+
+        var roleIds = tenantRoles.Select(role => role.Id).ToArray();
+        var tenantPermissions = roleIds.Length == 0
+            ? new HashSet<string>(StringComparer.Ordinal)
+            : (await (
+                    from binding in dbContext.TenantBackendRolePermissions.AsNoTracking()
+                    join permission in dbContext.BackendPermissions.AsNoTracking()
+                        on binding.PermissionCode equals permission.Code
+                    where binding.TenantId == tenantId &&
+                          roleIds.Contains(binding.RoleId) &&
+                          (permission.Area == BackendPermissionArea.Tenant || permission.Area == BackendPermissionArea.Both)
+                    select binding.PermissionCode)
+                .Distinct()
+                .ToArrayAsync(cancellationToken))
+                .ToHashSet(StringComparer.Ordinal);
+
+        return new CurrentAccessSnapshot(
+            userId,
+            tenantId,
+            true,
+            true,
+            tenantPermissions,
+            platformPermissions,
+            CurrentDataScope.Merge(tenantRoles.Select(role => role.DataScope)));
+    }
+
+    private async Task<HashSet<string>> LoadPlatformPermissionsAsync(Guid userId, CancellationToken cancellationToken)
+    {
+        return (await (
+                from userRole in dbContext.PlatformBackendUserRoles.AsNoTracking()
+                join role in dbContext.PlatformBackendRoles.AsNoTracking() on userRole.RoleId equals role.Id
+                join binding in dbContext.PlatformBackendRolePermissions.AsNoTracking() on role.Id equals binding.RoleId
+                join permission in dbContext.BackendPermissions.AsNoTracking()
+                    on binding.PermissionCode equals permission.Code
+                where userRole.UserId == userId &&
+                      role.Status == BackendRoleStatus.Active &&
+                      (permission.Area == BackendPermissionArea.Platform || permission.Area == BackendPermissionArea.Both)
+                select binding.PermissionCode)
+            .Distinct()
+            .ToArrayAsync(cancellationToken))
+            .ToHashSet(StringComparer.Ordinal);
+    }
+
+    private CurrentAccessSnapshot Empty()
+    {
+        return new CurrentAccessSnapshot(
+            null,
+            tenantContext.TenantId,
+            false,
+            false,
+            new HashSet<string>(StringComparer.Ordinal),
+            new HashSet<string>(StringComparer.Ordinal),
+            CurrentDataScope.Self);
+    }
+}