feat: harden SaaS authentication and authorization

Tiku.IntegrationTests/Api/ReferralEndpointTests.cs

@@ -225,9 +225,6 @@ public sealed class ReferralEndpointTests
             User(referrer.UserId, referrer.Phone, "Referral Teacher", "teacher"),
             User(student.UserId, student.Phone, "Referral Student", "student"),
             User(admin.UserId, admin.Phone, "Referral Admin", "tenant_admin"),
-            Identity(referrer),
-            Identity(student),
-            Identity(admin),
             new TenantMembership
             {
                 TenantId = tenantId,
@@ -273,45 +270,12 @@ public sealed class ReferralEndpointTests
             Phone = phone,
             Name = name,
             PrimaryRole = role
-        };
-    }
-
-    private static UserIdentity Identity(LoginSeed seed)
-    {
-        return new UserIdentity
-        {
-            UserId = seed.UserId,
-            Provider = "password",
-            ProviderSubject = seed.Phone,
-            Phone = seed.Phone,
-            SecretPayload = CreateSecretPayload(new PasswordHasher().Hash("passw0rd!"))
-        };
+        }.WithTestPassword();
     }
 
     private static async Task LoginAsync(HttpClient client, LoginSeed seed)
     {
-        var loginResponse = await client.PostAsJsonAsync(
-            "/api/auth/login/password",
-            new PasswordLoginDto
-            {
-                TenantCode = seed.TenantId.ToString("N"),
-                Phone = seed.Phone,
-                Password = "passw0rd!"
-            });
-        loginResponse.EnsureSuccessStatusCode();
-        using var loginJson = await JsonDocument.ParseAsync(await loginResponse.Content.ReadAsStreamAsync());
-        var accessToken = loginJson.RootElement
-            .GetProperty("tokens")
-            .GetProperty("accessToken")
-            .GetString();
-        client.DefaultRequestHeaders.Authorization = new("Bearer", accessToken);
-    }
-
-    private static JsonElement CreateSecretPayload(string passwordHash)
-    {
-        using var document = JsonDocument.Parse(
-            $$"""{"passwordHash":{{JsonSerializer.Serialize(passwordHash)}}}""");
-        return document.RootElement.Clone();
+        client.UseAccessToken(await client.LoginAsTenantAsync(seed.TenantId, seed.Phone));
     }
 
     private sealed class FakeReferralQrcodeGenerator : IReferralQrcodeGenerator