feat(security): add distributed authorization foundation

2026-07-29 10:40:10 +08:00
parent c7f9a4e3c9
commit df88fa19cb
76 changed files with 22020 additions and 88 deletions
--- a/Tiku.IntegrationTests/Api/CapabilityAuthorizationTests.cs
+++ b/Tiku.IntegrationTests/Api/CapabilityAuthorizationTests.cs
@@ -0,0 +1,49 @@
+using Microsoft.Extensions.DependencyInjection;
+using Tiku.Application.Security;
+using Tiku.Domain.Commerce;
+using Tiku.Domain.Platform;
+using Tiku.Domain.Tenancy;
+using Tiku.Infrastructure.Persistence;
+
+namespace Tiku.IntegrationTests.Api;
+
+public sealed class CapabilityAuthorizationTests
+{
+    [Fact]
+    public async Task Entitlement_is_database_backed_and_past_due_is_read_only()
+    {
+        await using var factory = new ApiTestFactory();
+        var tenantId = Guid.NewGuid();
+        await factory.SeedAsync(
+            new Tenant { Id = tenantId, Slug = tenantId.ToString("N"), Name = "Capability Tenant" },
+            new PlatformSaasPlan { Code = "capability-test", Name = "Capability Test" },
+            new ProductModule { Code = "content", Name = "Content" },
+            new TenantSubscription
+            {
+                TenantId = tenantId,
+                PlanCode = "capability-test",
+                Status = TenantSubscriptionStatus.Active,
+                StartsAt = DateTimeOffset.UtcNow.AddDays(-1),
+                ExpiresAt = DateTimeOffset.UtcNow.AddDays(30)
+            });
+
+        using var scope = factory.CreateSystemScope("Verify capability authorization");
+        var evaluator = scope.ServiceProvider.GetRequiredService<ICapabilityAccessEvaluator>();
+        Assert.False(await evaluator.IsAllowedAsync(tenantId, "content", CapabilityOperation.Read));
+
+        var dbContext = scope.ServiceProvider.GetRequiredService<TikuDbContext>();
+        dbContext.PlanModuleEntitlements.Add(new PlanModuleEntitlement
+        {
+            PlanCode = "capability-test",
+            ModuleCode = "content"
+        });
+        await dbContext.SaveChangesAsync();
+        Assert.True(await evaluator.IsAllowedAsync(tenantId, "content", CapabilityOperation.Write));
+
+        var subscription = dbContext.TenantSubscriptions.Single(item => item.TenantId == tenantId);
+        subscription.Status = TenantSubscriptionStatus.PastDue;
+        await dbContext.SaveChangesAsync();
+        Assert.True(await evaluator.IsAllowedAsync(tenantId, "content", CapabilityOperation.Read));
+        Assert.False(await evaluator.IsAllowedAsync(tenantId, "content", CapabilityOperation.Write));
+    }
+}