feat: harden SaaS authentication and authorization

Tiku.IntegrationTests/Api/AssetManagementEndpointTests.cs

@@ -255,8 +255,6 @@ public sealed class AssetManagementEndpointTests
         var tenantId = Guid.NewGuid();
         var userId = Guid.NewGuid();
         var phone = "13900000000";
-        var passwordHash = new PasswordHasher().Hash("passw0rd!");
-
         await factory.SeedAsync(
             new Tenant
             {
@@ -271,21 +269,13 @@ public sealed class AssetManagementEndpointTests
                 Id = userId,
                 Phone = phone,
                 Name = "Tenant Admin"
-            },
+            }.WithTestPassword(),
             new TenantMembership
             {
                 TenantId = tenantId,
                 UserId = userId,
                 Role = TenantRole.TenantAdmin,
                 Status = MembershipStatus.Active
-            },
-            new UserIdentity
-            {
-                UserId = userId,
-                Provider = "password",
-                ProviderSubject = phone,
-                Phone = phone,
-                SecretPayload = CreateSecretPayload(passwordHash)
             });
 
         return (tenantId, userId, phone);
@@ -295,20 +285,7 @@ public sealed class AssetManagementEndpointTests
         HttpClient client,
         (Guid TenantId, Guid UserId, string Phone) seed)
     {
-        var loginResponse = await client.PostAsJsonAsync(
-            "/api/auth/login/password",
-            new PasswordLoginDto
-            {
-                TenantCode = seed.TenantId.ToString("N"),
-                Phone = seed.Phone,
-                Password = "passw0rd!"
-            });
-        var loginJson = await ReadJsonAsync(loginResponse);
-        var accessToken = loginJson.RootElement
-            .GetProperty("tokens")
-            .GetProperty("accessToken")
-            .GetString();
-        client.DefaultRequestHeaders.Authorization = new("Bearer", accessToken);
+        client.UseAccessToken(await client.LoginAsTenantAsync(seed.TenantId, seed.Phone));
     }
 
     private static async Task<JsonDocument> ReadJsonAsync(HttpResponseMessage response)
@@ -317,13 +294,6 @@ public sealed class AssetManagementEndpointTests
         return await JsonDocument.ParseAsync(stream);
     }
 
-    private static JsonElement CreateSecretPayload(string passwordHash)
-    {
-        using var document = JsonDocument.Parse(
-            $$"""{"passwordHash":{{JsonSerializer.Serialize(passwordHash)}}}""");
-        return document.RootElement.Clone();
-    }
-
     private sealed class FakeObjectStorageService : IObjectStorageService
     {
         public long? MetadataSizeBytes { get; init; }