feat: add api security foundation

Directory.Packages.props

@@ -11,6 +11,8 @@
       <PrivateAssets>all</PrivateAssets>
     </PackageVersion>
     <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.10" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.10" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
@@ -24,6 +26,7 @@
     <PackageVersion Include="Npgsql" Version="10.0.3" />
     <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
     <PackageVersion Include="Scalar.AspNetCore" Version="2.16.16" />
+    <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.19.2" />
     <PackageVersion Include="xunit" Version="2.9.3" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.4">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>

Tiku.Api/Controllers/SecurityDiagnosticsController.cs

@@ -0,0 +1,46 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Tiku.Application.Security;
+
+namespace Tiku.Api.Controllers;
+
+[ApiController]
+[ApiExplorerSettings(IgnoreApi = true)]
+[Route("api/_security")]
+public sealed class SecurityDiagnosticsController(
+    ICurrentUser currentUser,
+    ICurrentTenant currentTenant) : ControllerBase
+{
+    [Authorize(Policy = TikuPolicies.AuthenticatedUser)]
+    [HttpGet("authenticated")]
+    public ActionResult<object> Authenticated()
+    {
+        return Ok(new
+        {
+            currentUser.UserId,
+            currentUser.IsAuthenticated
+        });
+    }
+
+    [Authorize(Policy = TikuPolicies.CurrentTenantMember)]
+    [HttpGet("tenant-member")]
+    public ActionResult<object> TenantMember()
+    {
+        return Ok(new
+        {
+            currentTenant.TenantId,
+            currentTenant.Role
+        });
+    }
+
+    [Authorize(Policy = TikuPolicies.TenantAdmin)]
+    [HttpGet("tenant-admin")]
+    public ActionResult<object> TenantAdmin()
+    {
+        return Ok(new
+        {
+            currentTenant.TenantId,
+            currentTenant.Role
+        });
+    }
+}

Tiku.Api/Middleware/CurrentPrincipalMiddleware.cs

@@ -0,0 +1,16 @@
+using Tiku.Application.Security;
+
+namespace Tiku.Api.Middleware;
+
+public sealed class CurrentPrincipalMiddleware(RequestDelegate next)
+{
+    public async Task InvokeAsync(
+        HttpContext context,
+        ICurrentUser currentUser,
+        ICurrentTenant currentTenant)
+    {
+        currentUser.Load(context.User);
+        currentTenant.Load(context.User);
+        await next(context);
+    }
+}

Tiku.Api/Middleware/ExceptionHandlingMiddleware.cs

@@ -0,0 +1,33 @@
+using Microsoft.AspNetCore.Mvc;
+
+namespace Tiku.Api.Middleware;
+
+public sealed class ExceptionHandlingMiddleware(
+    RequestDelegate next,
+    ILogger<ExceptionHandlingMiddleware> logger,
+    IHostEnvironment environment)
+{
+    public async Task InvokeAsync(HttpContext context)
+    {
+        try
+        {
+            await next(context);
+        }
+        catch (Exception exception)
+        {
+            logger.LogError(exception, "Unhandled API exception");
+
+            var problem = new ProblemDetails
+            {
+                Title = "An unexpected error occurred.",
+                Status = StatusCodes.Status500InternalServerError,
+                Detail = environment.IsDevelopment() ? exception.Message : null,
+                Instance = context.Request.Path
+            };
+
+            problem.Extensions["traceId"] = context.TraceIdentifier;
+            context.Response.StatusCode = StatusCodes.Status500InternalServerError;
+            await context.Response.WriteAsJsonAsync(problem);
+        }
+    }
+}

Tiku.Api/Options/JwtOptions.cs

@@ -0,0 +1,19 @@
+using Microsoft.IdentityModel.Tokens;
+using System.Text;
+
+namespace Tiku.Api.Options;
+
+public sealed class JwtOptions
+{
+    public string Issuer { get; set; } = "tiku-backend";
+    public string Audience { get; set; } = "tiku-api";
+    public string SigningKey { get; set; } = "development-only-tiku-signing-key-change-before-production";
+    public int AccessTokenMinutes { get; set; } = 30;
+    public int RefreshTokenDays { get; set; } = 30;
+
+    public SymmetricSecurityKey CreateSecurityKey()
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(SigningKey);
+        return new SymmetricSecurityKey(Encoding.UTF8.GetBytes(SigningKey));
+    }
+}

Tiku.Api/Program.cs

@@ -1,40 +1,86 @@
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.IdentityModel.Tokens;
+using Scalar.AspNetCore;
+using Tiku.Api.Middleware;
+using Tiku.Api.Options;
+using Tiku.Api.Security;
+using Tiku.Application;
+using Tiku.Application.Security;
+using Tiku.Infrastructure;
+
 var builder = WebApplication.CreateBuilder(args);
 
-// Add services to the container.
+builder.Services.AddControllers();
-// Learn more about configuring OpenAPI at https://aka.ms/aspnet/openapi
 builder.Services.AddOpenApi();
+builder.Services.AddProblemDetails();
+builder.Services.AddApplication();
+
+var connectionString =
+    builder.Configuration.GetConnectionString("Database") ??
+    builder.Configuration["DATABASE_URL"] ??
+    "Host=localhost;Database=tiku;Username=postgres";
+
+builder.Services.AddInfrastructure(connectionString);
+
+builder.Services.Configure<JwtOptions>(builder.Configuration.GetSection("Security:Jwt"));
+var jwtOptions = builder.Configuration
+    .GetSection("Security:Jwt")
+    .Get<JwtOptions>() ?? new JwtOptions();
+
+builder.Services
+    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+    .AddJwtBearer(options =>
+    {
+        options.TokenValidationParameters = new TokenValidationParameters
+        {
+            ValidateIssuer = true,
+            ValidIssuer = jwtOptions.Issuer,
+            ValidateAudience = true,
+            ValidAudience = jwtOptions.Audience,
+            ValidateIssuerSigningKey = true,
+            IssuerSigningKey = jwtOptions.CreateSecurityKey(),
+            ValidateLifetime = true,
+            ClockSkew = TimeSpan.FromMinutes(1)
+        };
+    });
+
+builder.Services.AddAuthorization(options =>
+{
+    options.AddPolicy(
+        TikuPolicies.AuthenticatedUser,
+        policy => policy.RequireAuthenticatedUser());
+    options.AddPolicy(
+        TikuPolicies.CurrentTenantMember,
+        policy => policy
+            .RequireAuthenticatedUser()
+            .RequireAssertion(context => TenantRoleAuthorization.IsTenantMember(context.User)));
+    options.AddPolicy(
+        TikuPolicies.TenantAdmin,
+        policy => policy
+            .RequireAuthenticatedUser()
+            .RequireAssertion(context => TenantRoleAuthorization.IsTenantAdmin(context.User)));
+});
 
 var app = builder.Build();
 
-// Configure the HTTP request pipeline.
 if (app.Environment.IsDevelopment())
 {
     app.MapOpenApi();
+    app.MapScalarApiReference();
 }
 
+app.UseMiddleware<ExceptionHandlingMiddleware>();
 app.UseHttpsRedirection();
+app.UseAuthentication();
+app.UseMiddleware<CurrentPrincipalMiddleware>();
+app.UseAuthorization();
 
-var summaries = new[]
+app.MapControllers();
-{
-    "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
-};
-
-app.MapGet("/weatherforecast", () =>
-{
-    var forecast = Enumerable.Range(1, 5).Select(index =>
-        new WeatherForecast
-        (
-            DateOnly.FromDateTime(DateTime.Now.AddDays(index)),
-            Random.Shared.Next(-20, 55),
-            summaries[Random.Shared.Next(summaries.Length)]
-        ))
-        .ToArray();
-    return forecast;
-})
-.WithName("GetWeatherForecast");
 
 app.Run();
 
+public partial class Program;
+
 record WeatherForecast(DateOnly Date, int TemperatureC, string? Summary)
 {
     public int TemperatureF => 32 + (int)(TemperatureC / 0.5556);

Tiku.Api/Security/TenantRoleAuthorization.cs

@@ -0,0 +1,30 @@
+using System.Security.Claims;
+using Tiku.Application.Security;
+using Tiku.Domain.Tenancy;
+
+namespace Tiku.Api.Security;
+
+internal static class TenantRoleAuthorization
+{
+    private static readonly HashSet<string> AdminRoles = new(StringComparer.Ordinal)
+    {
+        TenantRole.PlatformAdmin.ToString(),
+        TenantRole.TenantOwner.ToString(),
+        TenantRole.TenantAdmin.ToString()
+    };
+
+    public static bool IsTenantMember(ClaimsPrincipal principal)
+    {
+        return principal.Identity?.IsAuthenticated == true &&
+               principal.HasClaim(claim => claim.Type == TikuClaimTypes.TenantId);
+    }
+
+    public static bool IsTenantAdmin(ClaimsPrincipal principal)
+    {
+        return IsTenantMember(principal) &&
+               principal.Claims
+                   .Where(claim => claim.Type == TikuClaimTypes.TenantRole)
+                   .Select(claim => claim.Value)
+                   .Any(role => AdminRoles.Contains(role));
+    }
+}

Tiku.Api/Tiku.Api.csproj

@@ -12,9 +12,11 @@
   </ItemGroup>
 
   <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" />
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" />
     <PackageReference Include="Microsoft.OpenApi" />
     <PackageReference Include="Scalar.AspNetCore" />
+    <PackageReference Include="System.IdentityModel.Tokens.Jwt" />
   </ItemGroup>
 
 </Project>

Tiku.Api/appsettings.json

@@ -5,5 +5,14 @@
       "Microsoft.AspNetCore": "Warning"
     }
   },
+  "Security": {
+    "Jwt": {
+      "Issuer": "tiku-backend",
+      "Audience": "tiku-api",
+      "SigningKey": "development-only-tiku-signing-key-change-before-production",
+      "AccessTokenMinutes": 30,
+      "RefreshTokenDays": 30
+    }
+  },
   "AllowedHosts": "*"
 }

Tiku.Application/DependencyInjection.cs

@@ -0,0 +1,15 @@
+using Microsoft.Extensions.DependencyInjection;
+using Tiku.Application.Security;
+
+namespace Tiku.Application;
+
+public static class DependencyInjection
+{
+    public static IServiceCollection AddApplication(this IServiceCollection services)
+    {
+        services.AddScoped<ICurrentUser, CurrentUser>();
+        services.AddScoped<ICurrentTenant, CurrentTenant>();
+
+        return services;
+    }
+}

Tiku.Application/Security/ClaimsPrincipalExtensions.cs

@@ -0,0 +1,17 @@
+using System.Security.Claims;
+
+namespace Tiku.Application.Security;
+
+internal static class ClaimsPrincipalExtensions
+{
+    public static string? FindValue(this ClaimsPrincipal principal, string claimType)
+    {
+        return principal.FindFirst(claimType)?.Value;
+    }
+
+    public static Guid? FindGuid(this ClaimsPrincipal principal, string claimType)
+    {
+        var value = principal.FindValue(claimType);
+        return Guid.TryParse(value, out var guid) ? guid : null;
+    }
+}

Tiku.Application/Security/CurrentTenant.cs

@@ -0,0 +1,16 @@
+using System.Security.Claims;
+
+namespace Tiku.Application.Security;
+
+public sealed class CurrentTenant : ICurrentTenant
+{
+    public Guid? TenantId { get; private set; }
+    public string? Role { get; private set; }
+    public bool IsResolved => TenantId.HasValue;
+
+    public void Load(ClaimsPrincipal principal)
+    {
+        TenantId = principal.FindGuid(TikuClaimTypes.TenantId);
+        Role = principal.FindValue(TikuClaimTypes.TenantRole);
+    }
+}

Tiku.Application/Security/CurrentUser.cs

@@ -0,0 +1,21 @@
+using System.Security.Claims;
+
+namespace Tiku.Application.Security;
+
+public sealed class CurrentUser : ICurrentUser
+{
+    public Guid? UserId { get; private set; }
+    public Guid? SessionId { get; private set; }
+    public string? Phone { get; private set; }
+    public string? Email { get; private set; }
+    public bool IsAuthenticated { get; private set; }
+
+    public void Load(ClaimsPrincipal principal)
+    {
+        IsAuthenticated = principal.Identity?.IsAuthenticated == true;
+        UserId = principal.FindGuid(TikuClaimTypes.UserId);
+        SessionId = principal.FindGuid(TikuClaimTypes.SessionId);
+        Phone = principal.FindValue(TikuClaimTypes.Phone);
+        Email = principal.FindValue(TikuClaimTypes.Email);
+    }
+}

Tiku.Application/Security/ICurrentTenant.cs

@@ -0,0 +1,11 @@
+using System.Security.Claims;
+
+namespace Tiku.Application.Security;
+
+public interface ICurrentTenant
+{
+    Guid? TenantId { get; }
+    string? Role { get; }
+    bool IsResolved { get; }
+    void Load(ClaimsPrincipal principal);
+}

Tiku.Application/Security/ICurrentUser.cs

@@ -0,0 +1,13 @@
+using System.Security.Claims;
+
+namespace Tiku.Application.Security;
+
+public interface ICurrentUser
+{
+    Guid? UserId { get; }
+    Guid? SessionId { get; }
+    string? Phone { get; }
+    string? Email { get; }
+    bool IsAuthenticated { get; }
+    void Load(ClaimsPrincipal principal);
+}

Tiku.Application/Security/TikuClaimTypes.cs

@@ -0,0 +1,13 @@
+using System.Security.Claims;
+
+namespace Tiku.Application.Security;
+
+public static class TikuClaimTypes
+{
+    public const string UserId = "tiku:user_id";
+    public const string TenantId = "tiku:tenant_id";
+    public const string SessionId = "tiku:session_id";
+    public const string TenantRole = "tiku:tenant_role";
+    public const string Phone = ClaimTypes.MobilePhone;
+    public const string Email = ClaimTypes.Email;
+}

Tiku.Application/Security/TikuPolicies.cs

@@ -0,0 +1,8 @@
+namespace Tiku.Application.Security;
+
+public static class TikuPolicies
+{
+    public const string AuthenticatedUser = "authenticated_user";
+    public const string CurrentTenantMember = "current_tenant_member";
+    public const string TenantAdmin = "tenant_admin";
+}

Tiku.Application/Tiku.Application.csproj

@@ -4,6 +4,10 @@
     <ProjectReference Include="..\Tiku.Domain\Tiku.Domain.csproj" />
   </ItemGroup>
 
+  <ItemGroup>
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
+  </ItemGroup>
+
   <PropertyGroup>
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>

Tiku.IntegrationTests/Api/SecurityFoundationTests.cs

@@ -0,0 +1,90 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Net;
+using System.Security.Claims;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.IdentityModel.Tokens;
+using Tiku.Api.Options;
+using Tiku.Application.Security;
+using Tiku.Domain.Tenancy;
+
+namespace Tiku.IntegrationTests.Api;
+
+public sealed class SecurityFoundationTests
+{
+    private static readonly JwtOptions JwtOptions = new()
+    {
+        Issuer = "tiku-backend",
+        Audience = "tiku-api",
+        SigningKey = "development-only-tiku-signing-key-change-before-production"
+    };
+
+    [Fact]
+    public async Task Authenticated_policy_returns_unauthorized_without_token()
+    {
+        await using var factory = CreateFactory();
+        using var client = factory.CreateClient();
+
+        var response = await client.GetAsync("/api/_security/authenticated");
+
+        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Tenant_admin_policy_returns_forbidden_for_non_admin_member()
+    {
+        await using var factory = CreateFactory();
+        using var client = factory.CreateClient();
+        client.DefaultRequestHeaders.Authorization = new(
+            "Bearer",
+            CreateToken([
+                new Claim(TikuClaimTypes.UserId, Guid.NewGuid().ToString()),
+                new Claim(TikuClaimTypes.TenantId, Guid.NewGuid().ToString()),
+                new Claim(TikuClaimTypes.TenantRole, TenantRole.Student.ToString())
+            ]));
+
+        var response = await client.GetAsync("/api/_security/tenant-admin");
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Controller_pipeline_loads_authenticated_current_user()
+    {
+        var userId = Guid.NewGuid();
+        await using var factory = CreateFactory();
+        using var client = factory.CreateClient();
+        client.DefaultRequestHeaders.Authorization = new(
+            "Bearer",
+            CreateToken([
+                new Claim(TikuClaimTypes.UserId, userId.ToString())
+            ]));
+
+        var response = await client.GetAsync("/api/_security/authenticated");
+        var body = await response.Content.ReadAsStringAsync();
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        Assert.Contains(userId.ToString(), body, StringComparison.OrdinalIgnoreCase);
+        Assert.Contains("true", body, StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static WebApplicationFactory<Program> CreateFactory()
+    {
+        return new WebApplicationFactory<Program>();
+    }
+
+    private static string CreateToken(IEnumerable<Claim> claims)
+    {
+        var credentials = new SigningCredentials(
+            JwtOptions.CreateSecurityKey(),
+            SecurityAlgorithms.HmacSha256);
+
+        var token = new JwtSecurityToken(
+            JwtOptions.Issuer,
+            JwtOptions.Audience,
+            claims,
+            expires: DateTime.UtcNow.AddMinutes(5),
+            signingCredentials: credentials);
+
+        return new JwtSecurityTokenHandler().WriteToken(token);
+    }
+}

Tiku.IntegrationTests/Tiku.IntegrationTests.csproj

@@ -22,6 +22,7 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="xunit" />
     <PackageReference Include="xunit.runner.visualstudio">