feat: add phase five operations foundation

2026-07-28 09:57:50 +08:00
parent 71793a2de0
commit f22f329d33
39 changed files with 4810 additions and 160 deletions
--- a/Tiku.Api/Controllers/BackofficeController.cs
+++ b/Tiku.Api/Controllers/BackofficeController.cs
@@ -0,0 +1,122 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Tiku.Api.Contracts;
+using Tiku.Application.Backoffice;
+using Tiku.Application.Security;
+
+namespace Tiku.Api.Controllers;
+
+[ApiController]
+[Route("api/backoffice")]
+public sealed class BackofficeController(
+    IBackofficeService backofficeService,
+    ICurrentUser currentUser,
+    ITenantContext tenantContext) : ControllerBase
+{
+    [HttpGet("tenant/bootstrap")]
+    [Authorize(Policy = TikuPolicies.TenantAdmin)]
+    [ProducesResponseType<BackofficeBootstrap>(StatusCodes.Status200OK)]
+    public async Task<ActionResult<BackofficeBootstrap>> GetTenantBootstrap(CancellationToken cancellationToken)
+    {
+        return Ok(await backofficeService.GetTenantBootstrapAsync(ResolveTenantActor(), cancellationToken));
+    }
+
+    [HttpPost("tenant/roles")]
+    [Authorize(Policy = TikuPolicies.TenantAdmin)]
+    [ProducesResponseType<BackofficeRoleItem>(StatusCodes.Status200OK)]
+    public async Task<ActionResult<BackofficeRoleItem>> UpsertTenantRole(
+        UpsertBackofficeRoleDto request,
+        CancellationToken cancellationToken)
+    {
+        return Ok(await backofficeService.UpsertTenantRoleAsync(ResolveTenantActor(), request.ToCommand(), cancellationToken));
+    }
+
+    [HttpPut("tenant/roles/{roleId:guid}/bindings")]
+    [Authorize(Policy = TikuPolicies.TenantAdmin)]
+    [ProducesResponseType<BackofficeRoleItem>(StatusCodes.Status200OK)]
+    public async Task<ActionResult<BackofficeRoleItem>> ReplaceTenantRoleBindings(
+        Guid roleId,
+        ReplaceRoleBindingsDto request,
+        CancellationToken cancellationToken)
+    {
+        return Ok(await backofficeService.ReplaceTenantRoleBindingsAsync(ResolveTenantActor(), request.ToCommand(roleId), cancellationToken));
+    }
+
+    [HttpPut("tenant/users/{userId:guid}/roles")]
+    [Authorize(Policy = TikuPolicies.TenantAdmin)]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    public async Task<IActionResult> ReplaceTenantUserRoles(
+        Guid userId,
+        ReplaceUserRolesDto request,
+        CancellationToken cancellationToken)
+    {
+        await backofficeService.ReplaceTenantUserRolesAsync(ResolveTenantActor(), request.ToCommand(userId), cancellationToken);
+        return NoContent();
+    }
+
+    [HttpGet("platform/bootstrap")]
+    [Authorize(Policy = TikuPolicies.TenantAdmin)]
+    [ProducesResponseType<BackofficeBootstrap>(StatusCodes.Status200OK)]
+    public async Task<ActionResult<BackofficeBootstrap>> GetPlatformBootstrap(CancellationToken cancellationToken)
+    {
+        return Ok(await backofficeService.GetPlatformBootstrapAsync(ResolvePlatformActor(), cancellationToken));
+    }
+
+    [HttpPost("platform/roles")]
+    [Authorize(Policy = TikuPolicies.TenantAdmin)]
+    [ProducesResponseType<BackofficeRoleItem>(StatusCodes.Status200OK)]
+    public async Task<ActionResult<BackofficeRoleItem>> UpsertPlatformRole(
+        UpsertBackofficeRoleDto request,
+        CancellationToken cancellationToken)
+    {
+        return Ok(await backofficeService.UpsertPlatformRoleAsync(ResolvePlatformActor(), request.ToCommand(), cancellationToken));
+    }
+
+    [HttpPut("platform/roles/{roleId:guid}/bindings")]
+    [Authorize(Policy = TikuPolicies.TenantAdmin)]
+    [ProducesResponseType<BackofficeRoleItem>(StatusCodes.Status200OK)]
+    public async Task<ActionResult<BackofficeRoleItem>> ReplacePlatformRoleBindings(
+        Guid roleId,
+        ReplaceRoleBindingsDto request,
+        CancellationToken cancellationToken)
+    {
+        return Ok(await backofficeService.ReplacePlatformRoleBindingsAsync(ResolvePlatformActor(), request.ToCommand(roleId), cancellationToken));
+    }
+
+    [HttpPut("platform/users/{userId:guid}/roles")]
+    [Authorize(Policy = TikuPolicies.TenantAdmin)]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    public async Task<IActionResult> ReplacePlatformUserRoles(
+        Guid userId,
+        ReplaceUserRolesDto request,
+        CancellationToken cancellationToken)
+    {
+        await backofficeService.ReplacePlatformUserRolesAsync(ResolvePlatformActor(), request.ToCommand(userId), cancellationToken);
+        return NoContent();
+    }
+
+    private BackofficeActor ResolveTenantActor()
+    {
+        if (currentUser.UserId is not { } userId || tenantContext.TenantId is not { } tenantId)
+        {
+            throw new InvalidOperationException("Tenant backoffice actor was not resolved.");
+        }
+
+        return new BackofficeActor(userId, tenantId, IsPlatformAdmin());
+    }
+
+    private BackofficeActor ResolvePlatformActor()
+    {
+        if (currentUser.UserId is not { } userId)
+        {
+            throw new InvalidOperationException("Platform backoffice actor was not resolved.");
+        }
+
+        return new BackofficeActor(userId, tenantContext.TenantId, IsPlatformAdmin());
+    }
+
+    private bool IsPlatformAdmin()
+    {
+        return string.Equals(currentUser.TenantRole, "PlatformAdmin", StringComparison.OrdinalIgnoreCase);
+    }
+}