feat: add api security foundation

Tiku.Api/Security/TenantRoleAuthorization.cs

@@ -0,0 +1,30 @@
+using System.Security.Claims;
+using Tiku.Application.Security;
+using Tiku.Domain.Tenancy;
+
+namespace Tiku.Api.Security;
+
+internal static class TenantRoleAuthorization
+{
+    private static readonly HashSet<string> AdminRoles = new(StringComparer.Ordinal)
+    {
+        TenantRole.PlatformAdmin.ToString(),
+        TenantRole.TenantOwner.ToString(),
+        TenantRole.TenantAdmin.ToString()
+    };
+
+    public static bool IsTenantMember(ClaimsPrincipal principal)
+    {
+        return principal.Identity?.IsAuthenticated == true &&
+               principal.HasClaim(claim => claim.Type == TikuClaimTypes.TenantId);
+    }
+
+    public static bool IsTenantAdmin(ClaimsPrincipal principal)
+    {
+        return IsTenantMember(principal) &&
+               principal.Claims
+                   .Where(claim => claim.Type == TikuClaimTypes.TenantRole)
+                   .Select(claim => claim.Value)
+                   .Any(role => AdminRoles.Contains(role));
+    }
+}