feat(security): add distributed authorization foundation

Tiku.Api/Options/BrowserAuthOptions.cs

@@ -0,0 +1,12 @@
+namespace Tiku.Api.Options;
+
+public sealed class BrowserAuthOptions
+{
+    public const string SectionName = "BrowserAuth";
+    public const string AccessCookie = "__Host-tiku-at";
+    public const string RefreshCookie = "__Secure-tiku-rt";
+    public const string CsrfCookie = "__Host-tiku-csrf";
+    public const string CsrfHeader = "X-CSRF-Token";
+
+    public string[] AllowedOrigins { get; set; } = [];
+}

Tiku.Api/Options/OptionsValidation.cs

@@ -1,4 +1,5 @@
 using Microsoft.Extensions.Configuration;
+using System.Net;
 using Tiku.Application.Security;
 
 namespace Tiku.Api.Options;
@@ -41,6 +42,32 @@ public static class OptionsValidation
         return options.AllowedOrigins.All(IsHttpOrigin);
     }
 
+    public static bool BeValidTenantResolutionOptions(
+        TenantResolutionOptions options,
+        IConfiguration configuration,
+        bool isProduction)
+    {
+        if (!isProduction)
+        {
+            return true;
+        }
+
+        var platformHosts = options.PlatformHosts
+            .Where(host => !string.IsNullOrWhiteSpace(host))
+            .Select(host => host.Trim())
+            .ToArray();
+        var hasFormalHost = platformHosts.Any(host =>
+            !string.Equals(host, "localhost", StringComparison.OrdinalIgnoreCase) &&
+            !string.Equals(host, "127.0.0.1", StringComparison.OrdinalIgnoreCase) &&
+            !string.Equals(host, "::1", StringComparison.OrdinalIgnoreCase));
+        var allowedHosts = configuration["AllowedHosts"];
+        return hasFormalHost &&
+               options.TrustedProxyAddresses.Any(address => IPAddress.TryParse(address, out _)) &&
+               !string.IsNullOrWhiteSpace(allowedHosts) &&
+               !allowedHosts.Split(';', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
+                   .Contains("*", StringComparer.Ordinal);
+    }
+
     private static bool IsHttpOrigin(string origin)
     {
         return Uri.TryCreate(origin, UriKind.Absolute, out var uri) &&