feat: add api security foundation

Tiku.Api/Program.cs

@@ -1,40 +1,86 @@
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.IdentityModel.Tokens;
+using Scalar.AspNetCore;
+using Tiku.Api.Middleware;
+using Tiku.Api.Options;
+using Tiku.Api.Security;
+using Tiku.Application;
+using Tiku.Application.Security;
+using Tiku.Infrastructure;
+
 var builder = WebApplication.CreateBuilder(args);
 
-// Add services to the container.
-// Learn more about configuring OpenAPI at https://aka.ms/aspnet/openapi
+builder.Services.AddControllers();
 builder.Services.AddOpenApi();
+builder.Services.AddProblemDetails();
+builder.Services.AddApplication();
+
+var connectionString =
+    builder.Configuration.GetConnectionString("Database") ??
+    builder.Configuration["DATABASE_URL"] ??
+    "Host=localhost;Database=tiku;Username=postgres";
+
+builder.Services.AddInfrastructure(connectionString);
+
+builder.Services.Configure<JwtOptions>(builder.Configuration.GetSection("Security:Jwt"));
+var jwtOptions = builder.Configuration
+    .GetSection("Security:Jwt")
+    .Get<JwtOptions>() ?? new JwtOptions();
+
+builder.Services
+    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+    .AddJwtBearer(options =>
+    {
+        options.TokenValidationParameters = new TokenValidationParameters
+        {
+            ValidateIssuer = true,
+            ValidIssuer = jwtOptions.Issuer,
+            ValidateAudience = true,
+            ValidAudience = jwtOptions.Audience,
+            ValidateIssuerSigningKey = true,
+            IssuerSigningKey = jwtOptions.CreateSecurityKey(),
+            ValidateLifetime = true,
+            ClockSkew = TimeSpan.FromMinutes(1)
+        };
+    });
+
+builder.Services.AddAuthorization(options =>
+{
+    options.AddPolicy(
+        TikuPolicies.AuthenticatedUser,
+        policy => policy.RequireAuthenticatedUser());
+    options.AddPolicy(
+        TikuPolicies.CurrentTenantMember,
+        policy => policy
+            .RequireAuthenticatedUser()
+            .RequireAssertion(context => TenantRoleAuthorization.IsTenantMember(context.User)));
+    options.AddPolicy(
+        TikuPolicies.TenantAdmin,
+        policy => policy
+            .RequireAuthenticatedUser()
+            .RequireAssertion(context => TenantRoleAuthorization.IsTenantAdmin(context.User)));
+});
 
 var app = builder.Build();
 
-// Configure the HTTP request pipeline.
 if (app.Environment.IsDevelopment())
 {
     app.MapOpenApi();
+    app.MapScalarApiReference();
 }
 
+app.UseMiddleware<ExceptionHandlingMiddleware>();
 app.UseHttpsRedirection();
+app.UseAuthentication();
+app.UseMiddleware<CurrentPrincipalMiddleware>();
+app.UseAuthorization();
 
-var summaries = new[]
-{
-    "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
-};
-
-app.MapGet("/weatherforecast", () =>
-{
-    var forecast = Enumerable.Range(1, 5).Select(index =>
-        new WeatherForecast
-        (
-            DateOnly.FromDateTime(DateTime.Now.AddDays(index)),
-            Random.Shared.Next(-20, 55),
-            summaries[Random.Shared.Next(summaries.Length)]
-        ))
-        .ToArray();
-    return forecast;
-})
-.WithName("GetWeatherForecast");
+app.MapControllers();
 
 app.Run();
 
+public partial class Program;
+
 record WeatherForecast(DateOnly Date, int TemperatureC, string? Summary)
 {
     public int TemperatureF => 32 + (int)(TemperatureC / 0.5556);