feat: harden SaaS authentication and authorization

Tiku.IntegrationTests/Api/ContentManagementEndpointTests.cs

@@ -168,6 +168,79 @@ public sealed class ContentManagementEndpointTests
         Assert.NotEmpty(template.RootElement.GetProperty("contentBase64").GetString() ?? string.Empty);
     }
 
+    [Fact]
+    public async Task ContentEntries_ApplySelfAndRestrictedScopesAndHideUnauthorizedUpdates()
+    {
+        await using var factory = new ApiTestFactory();
+        var seed = await SeedAdminAsync(factory);
+        var allowedRegionId = Guid.NewGuid();
+        var outsideRegionId = Guid.NewGuid();
+        var regionalCreatorId = Guid.NewGuid();
+        var outsideCreatorId = Guid.NewGuid();
+        var ownEntry = new ContentEntry
+        {
+            TenantId = seed.TenantId,
+            RegionId = outsideRegionId,
+            EntryKey = "own-entry",
+            Name = "Own Entry",
+            CreatedBy = seed.UserId
+        };
+        var regionalEntry = new ContentEntry
+        {
+            TenantId = seed.TenantId,
+            RegionId = allowedRegionId,
+            EntryKey = "regional-entry",
+            Name = "Regional Entry",
+            CreatedBy = regionalCreatorId
+        };
+        var outsideEntry = new ContentEntry
+        {
+            TenantId = seed.TenantId,
+            RegionId = outsideRegionId,
+            EntryKey = "outside-entry",
+            Name = "Outside Entry",
+            CreatedBy = outsideCreatorId
+        };
+        await factory.SeedAsync(
+            new Tiku.Domain.Catalog.Region { Id = allowedRegionId, TenantId = seed.TenantId, Name = "Allowed Region" },
+            new Tiku.Domain.Catalog.Region { Id = outsideRegionId, TenantId = seed.TenantId, Name = "Outside Region" },
+            new User { Id = regionalCreatorId, Name = "Regional Creator" },
+            new User { Id = outsideCreatorId, Name = "Outside Creator" },
+            ownEntry,
+            regionalEntry,
+            outsideEntry);
+        await SetDataScopeAsync(factory, seed.TenantId, new { mode = "self" });
+
+        using var client = factory.CreateClient();
+        await LoginAsync(client, seed);
+        using var selfResponse = await client.GetAsync("/api/tenant-content/entries?includeInactive=true");
+        using var selfJson = await ReadJsonAsync(selfResponse);
+
+        await SetDataScopeAsync(factory, seed.TenantId, new
+        {
+            mode = "restricted",
+            regionIds = new[] { allowedRegionId },
+            includesSelf = false
+        });
+        using var restrictedResponse = await client.GetAsync("/api/tenant-content/entries?includeInactive=true");
+        using var restrictedJson = await ReadJsonAsync(restrictedResponse);
+        using var deniedUpdate = await client.PostAsJsonAsync(
+            "/api/tenant-content/entries",
+            new UpsertContentEntryDto
+            {
+                Id = outsideEntry.Id,
+                RegionId = outsideRegionId,
+                EntryKey = outsideEntry.EntryKey,
+                Name = "Must stay hidden"
+            });
+
+        Assert.Equal([ownEntry.Id], selfJson.RootElement.GetProperty("items").EnumerateArray()
+            .Select(item => item.GetProperty("id").GetGuid()));
+        Assert.Equal([regionalEntry.Id], restrictedJson.RootElement.GetProperty("items").EnumerateArray()
+            .Select(item => item.GetProperty("id").GetGuid()));
+        Assert.Equal(HttpStatusCode.NotFound, deniedUpdate.StatusCode);
+    }
+
     private static async Task<Guid> CreateEntryAsync(HttpClient client)
     {
         using var response = await client.PostAsJsonAsync(
@@ -187,8 +260,6 @@ public sealed class ContentManagementEndpointTests
         var tenantId = Guid.NewGuid();
         var userId = Guid.NewGuid();
         var phone = "13700000000";
-        var passwordHash = new PasswordHasher().Hash("passw0rd!");
-
         await factory.SeedAsync(
             new Tenant
             {
@@ -203,21 +274,13 @@ public sealed class ContentManagementEndpointTests
                 Id = userId,
                 Phone = phone,
                 Name = "Tenant Admin"
-            },
+            }.WithTestPassword(),
             new TenantMembership
             {
                 TenantId = tenantId,
                 UserId = userId,
                 Role = TenantRole.TenantAdmin,
                 Status = MembershipStatus.Active
-            },
-            new UserIdentity
-            {
-                UserId = userId,
-                Provider = "password",
-                ProviderSubject = phone,
-                Phone = phone,
-                SecretPayload = CreateSecretPayload(passwordHash)
             });
 
         return (tenantId, userId, phone);
@@ -227,20 +290,17 @@ public sealed class ContentManagementEndpointTests
         HttpClient client,
         (Guid TenantId, Guid UserId, string Phone) seed)
     {
-        var loginResponse = await client.PostAsJsonAsync(
-            "/api/auth/login/password",
-            new PasswordLoginDto
-            {
-                TenantCode = seed.TenantId.ToString("N"),
-                Phone = seed.Phone,
-                Password = "passw0rd!"
-            });
-        var loginJson = await ReadJsonAsync(loginResponse);
-        var accessToken = loginJson.RootElement
-            .GetProperty("tokens")
-            .GetProperty("accessToken")
-            .GetString();
-        client.DefaultRequestHeaders.Authorization = new("Bearer", accessToken);
+        client.UseAccessToken(await client.LoginAsTenantAsync(seed.TenantId, seed.Phone));
+    }
+
+    private static async Task SetDataScopeAsync(ApiTestFactory factory, Guid tenantId, object value)
+    {
+        using var scope = factory.CreateSystemScope();
+        var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
+        var role = dbContext.TenantBackendRoles.Single(item =>
+            item.TenantId == tenantId && item.Code == "integration_test_admin");
+        role.DataScope = JsonSerializer.SerializeToElement(value);
+        await dbContext.SaveChangesAsync();
     }
 
     private static async Task<JsonDocument> ReadJsonAsync(HttpResponseMessage response)
@@ -249,10 +309,4 @@ public sealed class ContentManagementEndpointTests
         return await JsonDocument.ParseAsync(stream);
     }
 
-    private static JsonElement CreateSecretPayload(string passwordHash)
-    {
-        using var document = JsonDocument.Parse(
-            $$"""{"passwordHash":{{JsonSerializer.Serialize(passwordHash)}}}""");
-        return document.RootElement.Clone();
-    }
 }