feat(security): add distributed authorization foundation

Tiku.Api/Options/OptionsValidation.cs

@@ -1,4 +1,5 @@
 using Microsoft.Extensions.Configuration;
+using System.Net;
 using Tiku.Application.Security;
 
 namespace Tiku.Api.Options;
@@ -41,6 +42,32 @@ public static class OptionsValidation
         return options.AllowedOrigins.All(IsHttpOrigin);
     }
 
+    public static bool BeValidTenantResolutionOptions(
+        TenantResolutionOptions options,
+        IConfiguration configuration,
+        bool isProduction)
+    {
+        if (!isProduction)
+        {
+            return true;
+        }
+
+        var platformHosts = options.PlatformHosts
+            .Where(host => !string.IsNullOrWhiteSpace(host))
+            .Select(host => host.Trim())
+            .ToArray();
+        var hasFormalHost = platformHosts.Any(host =>
+            !string.Equals(host, "localhost", StringComparison.OrdinalIgnoreCase) &&
+            !string.Equals(host, "127.0.0.1", StringComparison.OrdinalIgnoreCase) &&
+            !string.Equals(host, "::1", StringComparison.OrdinalIgnoreCase));
+        var allowedHosts = configuration["AllowedHosts"];
+        return hasFormalHost &&
+               options.TrustedProxyAddresses.Any(address => IPAddress.TryParse(address, out _)) &&
+               !string.IsNullOrWhiteSpace(allowedHosts) &&
+               !allowedHosts.Split(';', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
+                   .Contains("*", StringComparer.Ordinal);
+    }
+
     private static bool IsHttpOrigin(string origin)
     {
         return Uri.TryCreate(origin, UriKind.Absolute, out var uri) &&