feat: harden SaaS authentication and authorization

Tiku.IntegrationTests/Api/CommerceEndpointTests.cs

@@ -1,11 +1,8 @@
-using System.IdentityModel.Tokens.Jwt;
 using System.Net;
 using System.Net.Http.Json;
 using System.Security.Claims;
-using System.Text;
 using System.Text.Json;
 using Microsoft.Extensions.DependencyInjection;
-using Microsoft.IdentityModel.Tokens;
 using Tiku.Api.Contracts;
 using Tiku.Api.Options;
 using Tiku.Application.Auth;
@@ -21,13 +18,6 @@ namespace Tiku.IntegrationTests.Api;
 
 public sealed class CommerceEndpointTests
 {
-    private static readonly JwtOptions JwtOptions = new()
-    {
-        Issuer = "tiku-backend",
-        Audience = "tiku-api",
-        SigningKey = "development-only-tiku-signing-key-change-before-production"
-    };
-
     [Fact]
     public async Task Anonymous_commerce_request_returns_401()
     {
@@ -60,11 +50,10 @@ public sealed class CommerceEndpointTests
         using var client = factory.CreateClient();
         client.DefaultRequestHeaders.Authorization = new(
             "Bearer",
-            CreateToken([
+            TestJwtKeys.CreateToken([
                 new Claim(TikuClaimTypes.UserId, userId.ToString()),
                 new Claim(TikuClaimTypes.SessionId, sessionId.ToString()),
-                new Claim(TikuClaimTypes.TenantId, tenantId.ToString()),
-                new Claim(TikuClaimTypes.TenantRole, TenantRole.Student.ToString())
+                new Claim(TikuClaimTypes.TenantId, tenantId.ToString())
             ]));
 
         var response = await client.PostAsJsonAsync(
@@ -343,7 +332,6 @@ public sealed class CommerceEndpointTests
         var userId = Guid.NewGuid();
         var planId = Guid.NewGuid();
         var phone = "13800000000";
-        var passwordHash = new PasswordHasher().Hash("passw0rd!");
         var entities = new List<object>
         {
             new Tenant
@@ -357,15 +345,7 @@ public sealed class CommerceEndpointTests
                 Id = userId,
                 Phone = phone,
                 Name = "Commerce User"
-            },
-            new UserIdentity
-            {
-                UserId = userId,
-                Provider = "password",
-                ProviderSubject = phone,
-                Phone = phone,
-                SecretPayload = CreateSecretPayload(passwordHash)
-            },
+            }.WithTestPassword(),
             new SvipPlan
             {
                 Id = planId,
@@ -401,44 +381,7 @@ public sealed class CommerceEndpointTests
 
     private static async Task LoginAsync(HttpClient client, LoginSeed seed)
     {
-        var loginResponse = await client.PostAsJsonAsync(
-            "/api/auth/login/password",
-            new PasswordLoginDto
-            {
-                TenantCode = seed.TenantId.ToString("N"),
-                Phone = seed.Phone,
-                Password = "passw0rd!"
-            });
-        loginResponse.EnsureSuccessStatusCode();
-        using var loginJson = await JsonDocument.ParseAsync(await loginResponse.Content.ReadAsStreamAsync());
-        var accessToken = loginJson.RootElement
-            .GetProperty("tokens")
-            .GetProperty("accessToken")
-            .GetString();
-        client.DefaultRequestHeaders.Authorization = new("Bearer", accessToken);
-    }
-
-    private static JsonElement CreateSecretPayload(string passwordHash)
-    {
-        using var document = JsonDocument.Parse(
-            $$"""{"passwordHash":{{JsonSerializer.Serialize(passwordHash)}}}""");
-        return document.RootElement.Clone();
-    }
-
-    private static string CreateToken(IEnumerable<Claim> claims)
-    {
-        var credentials = new SigningCredentials(
-            new SymmetricSecurityKey(Encoding.UTF8.GetBytes(JwtOptions.SigningKey)),
-            SecurityAlgorithms.HmacSha256);
-
-        var token = new JwtSecurityToken(
-            JwtOptions.Issuer,
-            JwtOptions.Audience,
-            claims,
-            expires: DateTime.UtcNow.AddMinutes(5),
-            signingCredentials: credentials);
-
-        return new JwtSecurityTokenHandler().WriteToken(token);
+        client.UseAccessToken(await client.LoginAsTenantAsync(seed.TenantId, seed.Phone));
     }
 
     private sealed record LoginSeed(Guid TenantId, Guid UserId, Guid PlanId, string Phone);