feat: harden SaaS authentication and authorization

2026-07-28 12:15:51 +08:00
parent f22f329d33
commit 5d2248efee
123 changed files with 9090 additions and 2822 deletions
--- a/Tiku.IntegrationTests/Api/AuthSessionLifecycleTests.cs
+++ b/Tiku.IntegrationTests/Api/AuthSessionLifecycleTests.cs
@@ -0,0 +1,287 @@
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Tiku.Application.Auth;
+using Tiku.Domain.Identity;
+using Tiku.Domain.Operations;
+using Tiku.Domain.Tenancy;
+using Tiku.Infrastructure.Persistence;
+
+namespace Tiku.IntegrationTests.Api;
+
+public sealed class AuthSessionLifecycleTests
+{
+    [Fact]
+    public async Task Refresh_rotation_creates_a_child_and_replay_revokes_the_entire_family()
+    {
+        await using var factory = new ApiTestFactory();
+        var seed = await SeedActiveMemberAsync(factory);
+        var original = await IssueAsync(factory, seed);
+
+        AuthTokenPair rotated;
+        using (var scope = factory.CreateSystemScope("Rotate refresh token"))
+        {
+            rotated = await scope.ServiceProvider.GetRequiredService<IAuthSessionStore>()
+                .RotateAsync(original.RefreshToken, "127.0.0.1", "integration-test");
+        }
+
+        Assert.True(TryLocate(factory, original.RefreshToken, out var originalLocator));
+        Assert.True(TryLocate(factory, rotated.RefreshToken, out var rotatedLocator));
+
+        using (var scope = factory.CreateSystemScope("Verify rotated session lineage"))
+        {
+            var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
+            var sessions = await dbContext.AuthSessions
+                .Where(session => session.Id == originalLocator.SessionId || session.Id == rotatedLocator.SessionId)
+                .OrderBy(session => session.ParentSessionId == null ? 0 : 1)
+                .ToListAsync();
+
+            Assert.Equal(2, sessions.Count);
+            Assert.Equal(originalLocator.SessionId, sessions[0].Id);
+            Assert.Equal(rotatedLocator.SessionId, sessions[0].ReplacedBySessionId);
+            Assert.Equal("rotated", sessions[0].RevokedReason);
+            Assert.Equal(originalLocator.SessionId, sessions[1].ParentSessionId);
+            Assert.Equal(sessions[0].TokenFamilyId, sessions[1].TokenFamilyId);
+        }
+
+        using (var scope = factory.CreateSystemScope("Replay rotated refresh token"))
+        {
+            await Assert.ThrowsAsync<SessionRevokedException>(() =>
+                scope.ServiceProvider.GetRequiredService<IAuthSessionStore>()
+                    .RotateAsync(original.RefreshToken, null, null));
+        }
+
+        using (var scope = factory.CreateSystemScope("Verify refresh family revocation"))
+        {
+            var store = scope.ServiceProvider.GetRequiredService<IAuthSessionStore>();
+            var validation = await store.ValidateAccessSessionAsync(
+                rotatedLocator.SessionId,
+                seed.UserId,
+                AuthRealm.Tenant,
+                seed.TenantId);
+            Assert.Null(validation);
+
+            var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
+            var family = await dbContext.AuthSessions
+                .Where(session => session.TokenFamilyId == originalLocator.SessionId)
+                .ToListAsync();
+            Assert.All(family, session => Assert.NotNull(session.RevokedAt));
+            Assert.Contains(family, session => session.RevokedReason == "refresh_token_reuse");
+        }
+    }
+
+    [Fact]
+    public async Task Concurrent_refresh_allows_only_one_rotation_and_revokes_the_replayed_family()
+    {
+        await using var factory = new ApiTestFactory();
+        var seed = await SeedActiveMemberAsync(factory);
+        var original = await IssueAsync(factory, seed);
+        Assert.True(TryLocate(factory, original.RefreshToken, out var originalLocator));
+
+        using var firstScope = factory.CreateSystemScope("First concurrent refresh");
+        using var secondScope = factory.CreateSystemScope("Second concurrent refresh");
+        var first = TryRotateAsync(
+            firstScope.ServiceProvider.GetRequiredService<IAuthSessionStore>(),
+            original.RefreshToken);
+        var second = TryRotateAsync(
+            secondScope.ServiceProvider.GetRequiredService<IAuthSessionStore>(),
+            original.RefreshToken);
+        var results = await Task.WhenAll(first, second);
+
+        Assert.Single(results, result => result is not null);
+        Assert.Single(results, result => result is null);
+
+        using var verificationScope = factory.CreateSystemScope("Verify concurrent refresh family");
+        var dbContext = verificationScope.ServiceProvider.GetRequiredService<TikuDbContext>();
+        var family = await dbContext.AuthSessions
+            .Where(session => session.TokenFamilyId == originalLocator.SessionId)
+            .ToListAsync();
+        Assert.Equal(2, family.Count);
+        Assert.All(family, session => Assert.NotNull(session.RevokedAt));
+        Assert.Contains(family, session => session.RevokedReason == "refresh_token_reuse");
+    }
+
+    [Fact]
+    public async Task Access_session_fails_immediately_after_membership_is_disabled()
+    {
+        await using var factory = new ApiTestFactory();
+        var seed = await SeedActiveMemberAsync(factory);
+        var tokens = await IssueAsync(factory, seed);
+        Assert.True(TryLocate(factory, tokens.RefreshToken, out var locator));
+
+        using (var scope = factory.CreateSystemScope("Disable tenant membership"))
+        {
+            var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
+            var membership = await dbContext.TenantMemberships.SingleAsync(item =>
+                item.TenantId == seed.TenantId && item.UserId == seed.UserId);
+            membership.Status = MembershipStatus.Disabled;
+            await dbContext.SaveChangesAsync();
+        }
+
+        using (var scope = factory.CreateSystemScope("Validate disabled membership session"))
+        {
+            var validation = await scope.ServiceProvider.GetRequiredService<IAuthSessionStore>()
+                .ValidateAccessSessionAsync(locator.SessionId, seed.UserId, AuthRealm.Tenant, seed.TenantId);
+            Assert.Null(validation);
+        }
+    }
+
+    [Fact]
+    public async Task Access_session_fails_immediately_after_security_stamp_changes()
+    {
+        await using var factory = new ApiTestFactory();
+        var seed = await SeedActiveMemberAsync(factory);
+        var tokens = await IssueAsync(factory, seed);
+        Assert.True(TryLocate(factory, tokens.RefreshToken, out var locator));
+
+        using (var scope = factory.CreateSystemScope("Change user security stamp"))
+        {
+            var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
+            var user = await dbContext.Users.SingleAsync(item => item.Id == seed.UserId);
+            user.SecurityStamp = Guid.NewGuid().ToString("N");
+            await dbContext.SaveChangesAsync();
+        }
+
+        using (var scope = factory.CreateSystemScope("Validate stale security stamp session"))
+        {
+            var validation = await scope.ServiceProvider.GetRequiredService<IAuthSessionStore>()
+                .ValidateAccessSessionAsync(locator.SessionId, seed.UserId, AuthRealm.Tenant, seed.TenantId);
+            Assert.Null(validation);
+        }
+    }
+
+    [Fact]
+    public async Task Backend_session_and_refresh_fail_immediately_after_the_last_permission_is_revoked()
+    {
+        await using var factory = new ApiTestFactory();
+        var seed = await SeedActiveMemberAsync(factory);
+        var role = new TenantBackendRole
+        {
+            TenantId = seed.TenantId,
+            Code = "session-test-admin",
+            Name = "Session test administrator"
+        };
+        const string permissionCode = "tenant:session-test:manage";
+        await factory.SeedAsync(
+            new BackendPermission
+            {
+                Code = permissionCode,
+                Name = permissionCode,
+                Area = BackendPermissionArea.Tenant,
+                Module = "test"
+            },
+            role,
+            new TenantBackendRolePermission
+            {
+                TenantId = seed.TenantId,
+                RoleId = role.Id,
+                PermissionCode = permissionCode
+            },
+            new TenantBackendUserRole
+            {
+                TenantId = seed.TenantId,
+                UserId = seed.UserId,
+                RoleId = role.Id
+            });
+        var tokens = await IssueAsync(factory, seed, mfaSatisfied: true);
+        Assert.True(TryLocate(factory, tokens.RefreshToken, out var locator));
+
+        using (var scope = factory.CreateSystemScope("Revoke final backend permission"))
+        {
+            var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
+            var binding = await dbContext.TenantBackendRolePermissions.SingleAsync(item =>
+                item.TenantId == seed.TenantId && item.RoleId == role.Id);
+            dbContext.TenantBackendRolePermissions.Remove(binding);
+            await dbContext.SaveChangesAsync();
+        }
+
+        using (var scope = factory.CreateSystemScope("Validate revoked backend session"))
+        {
+            var store = scope.ServiceProvider.GetRequiredService<IAuthSessionStore>();
+            Assert.Null(await store.ValidateAccessSessionAsync(
+                locator.SessionId, seed.UserId, AuthRealm.Tenant, seed.TenantId));
+            await Assert.ThrowsAsync<SessionRevokedException>(() =>
+                store.RotateAsync(tokens.RefreshToken, null, null));
+        }
+
+        using (var scope = factory.CreateSystemScope("Verify revoked backend family"))
+        {
+            var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
+            var session = await dbContext.AuthSessions.SingleAsync(item => item.Id == locator.SessionId);
+            Assert.NotNull(session.RevokedAt);
+            Assert.Equal("realm_access_revoked", session.RevokedReason);
+        }
+    }
+
+    private static bool TryLocate(
+        ApiTestFactory factory,
+        string refreshToken,
+        out RefreshTokenLocator locator)
+    {
+        using var scope = factory.CreateSystemScope("Parse refresh token locator");
+        return scope.ServiceProvider.GetRequiredService<IAuthSessionStore>()
+            .TryParseRefreshToken(refreshToken, out locator);
+    }
+
+    private static async Task<AuthTokenPair?> TryRotateAsync(IAuthSessionStore store, string refreshToken)
+    {
+        try
+        {
+            return await store.RotateAsync(refreshToken, null, null);
+        }
+        catch (SessionRevokedException)
+        {
+            return null;
+        }
+    }
+
+    private static async Task<AuthTokenPair> IssueAsync(
+        ApiTestFactory factory,
+        SessionSeed seed,
+        bool mfaSatisfied = false)
+    {
+        using var scope = factory.CreateSystemScope("Issue authentication session");
+        return await scope.ServiceProvider.GetRequiredService<IAuthSessionStore>().IssueAsync(
+            new AuthSessionIssueRequest(
+                seed.UserId,
+                seed.Phone,
+                null,
+                seed.SecurityStamp,
+                AuthRealm.Tenant,
+                seed.TenantId,
+                "integration-test",
+                mfaSatisfied,
+                "127.0.0.1",
+                "integration-test"));
+    }
+
+    private static async Task<SessionSeed> SeedActiveMemberAsync(ApiTestFactory factory)
+    {
+        var tenantId = Guid.NewGuid();
+        var user = new User
+        {
+            Id = Guid.NewGuid(),
+            Phone = $"13{Random.Shared.Next(100_000_000, 1_000_000_000)}",
+            Name = "Session lifecycle user"
+        };
+        await factory.SeedAsync(
+            new Tenant
+            {
+                Id = tenantId,
+                Slug = tenantId.ToString("N"),
+                Name = "Session lifecycle tenant",
+                Status = TenantStatus.Active
+            },
+            user,
+            new TenantMembership
+            {
+                TenantId = tenantId,
+                UserId = user.Id,
+                Role = TenantRole.Student,
+                Status = MembershipStatus.Active
+            });
+
+        return new SessionSeed(tenantId, user.Id, user.Phone, user.SecurityStamp!);
+    }
+
+    private sealed record SessionSeed(Guid TenantId, Guid UserId, string Phone, string SecurityStamp);
+}