feat: harden SaaS authentication and authorization

Tiku.IntegrationTests/Api/TenantAdminDirectEndpointTests.cs

@@ -251,38 +251,18 @@ public sealed class TenantAdminDirectEndpointTests
     }
 
     [Fact]
-    public async Task Tenant_admin_can_manage_role_templates_members_and_audit_logs()
+    public async Task Tenant_admin_can_manage_members_and_audit_logs()
     {
         await using var factory = new ApiTestFactory();
         var seed = await SeedAdminAsync(factory);
         using var client = factory.CreateClient();
         await LoginAsync(client, seed);
 
-        var roleResponse = await client.PutAsJsonAsync(
-            "/api/tenant-admin/role-templates",
-            new UpsertTenantAdminRoleTemplateDto
-            {
-                Code = "teacher-basic",
-                Name = "教师基础权限",
-                BaseRole = "teacher",
-                Permissions = JsonSerializer.SerializeToElement(new Dictionary<string, bool>
-                {
-                    ["classes:read"] = true,
-                    ["students:read"] = true
-                }),
-                FieldPermissions = JsonSerializer.SerializeToElement(new Dictionary<string, bool>
-                {
-                    ["student.phone"] = false
-                })
-            });
-        var roleJson = await ReadJsonAsync(roleResponse);
-        var roleTemplateId = roleJson.RootElement.GetProperty("item").GetProperty("id").GetGuid();
-
         var memberResponse = await client.PutAsJsonAsync(
             "/api/tenant-admin/members",
             new UpsertTenantAdminMemberDto
             {
-                RoleTemplateId = roleTemplateId,
+                Role = "teacher",
                 User = new TenantAdminUserLookupDto
                 {
                     Phone = "13900000004",
@@ -290,15 +270,12 @@ public sealed class TenantAdminDirectEndpointTests
                 }
             });
         var membersResponse = await client.GetAsync("/api/tenant-admin/members?role=teacher");
-        var permissionsResponse = await client.GetAsync("/api/tenant-admin/permissions");
-        var auditResponse = await client.GetAsync("/api/tenant-admin/audit-logs?action=tenant.role_template");
+        var auditResponse = await client.GetAsync("/api/tenant-admin/audit-logs?action=tenant.member");
         var membersJson = await ReadJsonAsync(membersResponse);
         var auditJson = await ReadJsonAsync(auditResponse);
 
-        Assert.Equal(HttpStatusCode.OK, roleResponse.StatusCode);
         Assert.Equal(HttpStatusCode.OK, memberResponse.StatusCode);
         Assert.Equal(HttpStatusCode.OK, membersResponse.StatusCode);
-        Assert.Equal(HttpStatusCode.OK, permissionsResponse.StatusCode);
         Assert.Single(membersJson.RootElement.GetProperty("items").EnumerateArray());
         Assert.NotEmpty(auditJson.RootElement.GetProperty("items").EnumerateArray());
     }
@@ -394,8 +371,6 @@ public sealed class TenantAdminDirectEndpointTests
         var tenantId = Guid.NewGuid();
         var userId = Guid.NewGuid();
         var phone = $"137{Random.Shared.Next(10000000, 99999999)}";
-        var passwordHash = new PasswordHasher().Hash("passw0rd!");
-
         await factory.SeedAsync(
             new Tenant
             {
@@ -410,21 +385,13 @@ public sealed class TenantAdminDirectEndpointTests
                 Id = userId,
                 Phone = phone,
                 Name = "Tenant Admin"
-            },
+            }.WithTestPassword(),
             new TenantMembership
             {
                 TenantId = tenantId,
                 UserId = userId,
                 Role = role,
                 Status = MembershipStatus.Active
-            },
-            new UserIdentity
-            {
-                UserId = userId,
-                Provider = "password",
-                ProviderSubject = phone,
-                Phone = phone,
-                SecretPayload = CreateSecretPayload(passwordHash)
             });
 
         return (tenantId, userId, phone);
@@ -434,20 +401,7 @@ public sealed class TenantAdminDirectEndpointTests
         HttpClient client,
         (Guid TenantId, Guid UserId, string Phone) seed)
     {
-        var loginResponse = await client.PostAsJsonAsync(
-            "/api/auth/login/password",
-            new PasswordLoginDto
-            {
-                TenantCode = seed.TenantId.ToString("N"),
-                Phone = seed.Phone,
-                Password = "passw0rd!"
-            });
-        var loginJson = await ReadJsonAsync(loginResponse);
-        var accessToken = loginJson.RootElement
-            .GetProperty("tokens")
-            .GetProperty("accessToken")
-            .GetString();
-        client.DefaultRequestHeaders.Authorization = new("Bearer", accessToken);
+        client.UseAccessToken(await client.LoginAsTenantAsync(seed.TenantId, seed.Phone));
     }
 
     private static async Task<JsonDocument> ReadJsonAsync(HttpResponseMessage response)
@@ -456,10 +410,4 @@ public sealed class TenantAdminDirectEndpointTests
         return await JsonDocument.ParseAsync(stream);
     }
 
-    private static JsonElement CreateSecretPayload(string passwordHash)
-    {
-        using var document = JsonDocument.Parse(
-            $$"""{"passwordHash":{{JsonSerializer.Serialize(passwordHash)}}}""");
-        return document.RootElement.Clone();
-    }
 }