perf: optimize authorization scoreline and workers

Tiku.Infrastructure/Auth/AuthSessionStore.cs

@@ -152,28 +152,43 @@ public sealed class AuthSessionStore(
         CancellationToken cancellationToken = default)
     {
         var now = DateTimeOffset.UtcNow;
-        var session = await dbContext.AuthSessions.AsNoTracking().SingleOrDefaultAsync(
-            item => item.Id == sessionId && item.UserId == userId && item.Realm == realm &&
-                    item.TenantId == tenantId && item.RevokedAt == null && item.ExpiresAt > now,
-            cancellationToken);
-        if (session is null)
-        {
-            return null;
-        }
-
-        var user = await dbContext.Users.AsNoTracking().SingleOrDefaultAsync(item => item.Id == userId, cancellationToken);
-        if (user is null || user.Status != UserStatus.Active ||
-            !string.Equals(user.SecurityStamp, session.SecurityStamp, StringComparison.Ordinal))
-        {
-            return null;
-        }
-
-        try
-        {
-            await AssertRealmAccessAsync(
-                realm, tenantId, userId, cancellationToken);
-        }
-        catch (TenantAccessDeniedException)
+        var state = await (
+                from session in dbContext.AuthSessions.AsNoTracking()
+                join user in dbContext.Users.AsNoTracking() on session.UserId equals user.Id
+                where session.Id == sessionId &&
+                      session.UserId == userId &&
+                      session.Realm == realm &&
+                      session.TenantId == tenantId &&
+                      session.RevokedAt == null &&
+                      session.ExpiresAt > now
+                select new
+                {
+                    UserStatus = user.Status,
+                    UserSecurityStamp = user.SecurityStamp,
+                    SessionSecurityStamp = session.SecurityStamp,
+                    TenantAllowed = realm != AuthRealm.Tenant ||
+                        (tenantId != null &&
+                         dbContext.Tenants.Any(item => item.Id == tenantId && item.Status == TenantStatus.Active) &&
+                         dbContext.TenantMemberships.Any(item =>
+                             item.TenantId == tenantId &&
+                             item.UserId == userId &&
+                             item.Status == MembershipStatus.Active)),
+                    PlatformAllowed = realm != AuthRealm.Platform ||
+                        (from userRole in dbContext.PlatformBackendUserRoles
+                         join role in dbContext.PlatformBackendRoles on userRole.RoleId equals role.Id
+                         join binding in dbContext.PlatformBackendRolePermissions on role.Id equals binding.RoleId
+                         join permission in dbContext.BackendPermissions on binding.PermissionCode equals permission.Code
+                         where userRole.UserId == userId &&
+                               role.Status == BackendRoleStatus.Active &&
+                               (permission.Area == BackendPermissionArea.Platform || permission.Area == BackendPermissionArea.Both)
+                         select permission.Id).Any()
+                })
+            .SingleOrDefaultAsync(cancellationToken);
+        if (state is null ||
+            state.UserStatus != UserStatus.Active ||
+            !string.Equals(state.UserSecurityStamp, state.SessionSecurityStamp, StringComparison.Ordinal) ||
+            !state.TenantAllowed ||
+            !state.PlatformAllowed)
         {
             return null;
         }