feat: add local authentication

Tiku.Infrastructure/Auth/TokenService.cs

@@ -0,0 +1,54 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Text;
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Tokens;
+using Tiku.Application.Auth;
+using Tiku.Application.Security;
+using Tiku.Domain.Tenancy;
+
+namespace Tiku.Infrastructure.Auth;
+
+public sealed class TokenService(IOptions<JwtOptions> options) : ITokenService
+{
+    private readonly JwtOptions options = options.Value;
+
+    public (string Token, DateTimeOffset ExpiresAt) CreateAccessToken(
+        Guid userId,
+        Guid sessionId,
+        string? phone,
+        string? email,
+        TenantMembership membership)
+    {
+        var expiresAt = DateTimeOffset.UtcNow.AddMinutes(options.AccessTokenMinutes);
+        var claims = new List<Claim>
+        {
+            new(TikuClaimTypes.UserId, userId.ToString()),
+            new(TikuClaimTypes.SessionId, sessionId.ToString()),
+            new(TikuClaimTypes.TenantId, membership.TenantId.ToString()),
+            new(TikuClaimTypes.TenantRole, membership.Role.ToString())
+        };
+
+        if (!string.IsNullOrWhiteSpace(phone))
+        {
+            claims.Add(new Claim(TikuClaimTypes.Phone, phone));
+        }
+
+        if (!string.IsNullOrWhiteSpace(email))
+        {
+            claims.Add(new Claim(TikuClaimTypes.Email, email));
+        }
+
+        var credentials = new SigningCredentials(
+            new SymmetricSecurityKey(Encoding.UTF8.GetBytes(options.SigningKey)),
+            SecurityAlgorithms.HmacSha256);
+        var token = new JwtSecurityToken(
+            options.Issuer,
+            options.Audience,
+            claims,
+            expires: expiresAt.UtcDateTime,
+            signingCredentials: credentials);
+
+        return (new JwtSecurityTokenHandler().WriteToken(token), expiresAt);
+    }
+}