feat: add api security foundation

Tiku.Application/Security/ClaimsPrincipalExtensions.cs

@@ -0,0 +1,17 @@
+using System.Security.Claims;
+
+namespace Tiku.Application.Security;
+
+internal static class ClaimsPrincipalExtensions
+{
+    public static string? FindValue(this ClaimsPrincipal principal, string claimType)
+    {
+        return principal.FindFirst(claimType)?.Value;
+    }
+
+    public static Guid? FindGuid(this ClaimsPrincipal principal, string claimType)
+    {
+        var value = principal.FindValue(claimType);
+        return Guid.TryParse(value, out var guid) ? guid : null;
+    }
+}

Tiku.Application/Security/CurrentTenant.cs

@@ -0,0 +1,16 @@
+using System.Security.Claims;
+
+namespace Tiku.Application.Security;
+
+public sealed class CurrentTenant : ICurrentTenant
+{
+    public Guid? TenantId { get; private set; }
+    public string? Role { get; private set; }
+    public bool IsResolved => TenantId.HasValue;
+
+    public void Load(ClaimsPrincipal principal)
+    {
+        TenantId = principal.FindGuid(TikuClaimTypes.TenantId);
+        Role = principal.FindValue(TikuClaimTypes.TenantRole);
+    }
+}

Tiku.Application/Security/CurrentUser.cs

@@ -0,0 +1,21 @@
+using System.Security.Claims;
+
+namespace Tiku.Application.Security;
+
+public sealed class CurrentUser : ICurrentUser
+{
+    public Guid? UserId { get; private set; }
+    public Guid? SessionId { get; private set; }
+    public string? Phone { get; private set; }
+    public string? Email { get; private set; }
+    public bool IsAuthenticated { get; private set; }
+
+    public void Load(ClaimsPrincipal principal)
+    {
+        IsAuthenticated = principal.Identity?.IsAuthenticated == true;
+        UserId = principal.FindGuid(TikuClaimTypes.UserId);
+        SessionId = principal.FindGuid(TikuClaimTypes.SessionId);
+        Phone = principal.FindValue(TikuClaimTypes.Phone);
+        Email = principal.FindValue(TikuClaimTypes.Email);
+    }
+}

Tiku.Application/Security/ICurrentTenant.cs

@@ -0,0 +1,11 @@
+using System.Security.Claims;
+
+namespace Tiku.Application.Security;
+
+public interface ICurrentTenant
+{
+    Guid? TenantId { get; }
+    string? Role { get; }
+    bool IsResolved { get; }
+    void Load(ClaimsPrincipal principal);
+}

Tiku.Application/Security/ICurrentUser.cs

@@ -0,0 +1,13 @@
+using System.Security.Claims;
+
+namespace Tiku.Application.Security;
+
+public interface ICurrentUser
+{
+    Guid? UserId { get; }
+    Guid? SessionId { get; }
+    string? Phone { get; }
+    string? Email { get; }
+    bool IsAuthenticated { get; }
+    void Load(ClaimsPrincipal principal);
+}

Tiku.Application/Security/TikuClaimTypes.cs

@@ -0,0 +1,13 @@
+using System.Security.Claims;
+
+namespace Tiku.Application.Security;
+
+public static class TikuClaimTypes
+{
+    public const string UserId = "tiku:user_id";
+    public const string TenantId = "tiku:tenant_id";
+    public const string SessionId = "tiku:session_id";
+    public const string TenantRole = "tiku:tenant_role";
+    public const string Phone = ClaimTypes.MobilePhone;
+    public const string Email = ClaimTypes.Email;
+}

Tiku.Application/Security/TikuPolicies.cs

@@ -0,0 +1,8 @@
+namespace Tiku.Application.Security;
+
+public static class TikuPolicies
+{
+    public const string AuthenticatedUser = "authenticated_user";
+    public const string CurrentTenantMember = "current_tenant_member";
+    public const string TenantAdmin = "tenant_admin";
+}