feat: enforce tenant isolation and shared question bank

Tiku.Application/QuestionBanks/IQuestionReferenceService.cs

@@ -0,0 +1,27 @@
+using Tiku.Domain.Content;
+
+namespace Tiku.Application.QuestionBanks;
+
+public interface IPublicQuestionAccessPolicy
+{
+    Task EnsureCanStartAsync(Guid tenantId, CancellationToken cancellationToken = default);
+}
+
+public interface IQuestionReferenceService
+{
+    Task<TenantQuestionReference> ResolveAsync(
+        Guid tenantId,
+        Guid? userId,
+        QuestionLocator locator,
+        CancellationToken cancellationToken = default);
+}
+
+public sealed class PublicQuestionAccessDeniedException(string code, string message) : Exception(message)
+{
+    public string Code { get; } = code;
+}
+
+public sealed class QuestionLocatorException(string code, string message) : Exception(message)
+{
+    public string Code { get; } = code;
+}

Tiku.Application/QuestionBanks/QuestionBankQueryModels.cs

@@ -1,5 +1,6 @@
 using System.Text.Json;
 using Tiku.Domain.QuestionBanks;
+using Tiku.Domain.Content;
 
 namespace Tiku.Application.QuestionBanks;
 
@@ -17,13 +18,14 @@ public sealed record QuestionBankFilter(
     IReadOnlyCollection<Guid>? QuestionIds = null,
     string? Type = null,
     string? Keyword = null,
-    int? Limit = null);
+    int? Limit = null,
+    QuestionSource? Source = null);
 
 public sealed record QuestionBankCatalogItem(
     Guid Id,
     Guid? RegionId,
     string Name,
-    QuestionBankScope SourceScope,
+    QuestionSource Source,
     QuestionBankStatus Status,
     JsonElement Metadata);
 
@@ -58,7 +60,10 @@ public sealed record QuestionCatalogItem(
     string? Explanation,
     JsonElement SubQuestions,
     string? CodeLang,
-    string? CodeTemplate);
+    string? CodeTemplate,
+    QuestionLocator Locator);
+
+public sealed record QuestionLocator(QuestionSource Source, Guid QuestionId);
 
 public sealed record QuestionVersionCatalogItem(
     Guid Id,