namespace Microsoft.AspNetCore.Authorization
{
/// < summary>
/// Defines the set of data required to apply authorization rules to a resource.
/// < /summary>
public interface IAuthorizeData
{
/// < summary>
/// Gets or sets the policy name that determines access to the resource.
/// < /summary>
string Policy { get; set; }
/// < summary>
/// Gets or sets a comma delimited list of roles that are allowed to access the resource.
/// < /summary>
string Roles { get; set; }
/// < summary>
/// Gets or sets a comma delimited list of schemes from which user information is constructed.
/// < /summary>
string AuthenticationSchemes { get; set; }
}
}

[Authorize]
[Authorize("SomePolicy")]
[Authorize(Roles = "角色1,角色2")]
[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]

public interface IPermissionAuthorizeData : IAuthorizeData
{
string Groups { get; set; }
string Permissions { get; set; }
}

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true, Inherited = true)]
public class PermissionAuthorizeAttribute : Attribute, IPermissionAuthorizeData
{
public string Policy { get; set; }
public string Roles { get; set; }
public string AuthenticationSchemes { get; set; }
public string Groups { get; set; }
public string Permissions { get; set; }
}

[PermissionAuthorize(Roles = "经理,副经理")] // 经理或部门经理
[PermissionAuthorize(Groups = "研发部,生产部", Roles = "经理"] // 研发部经理或生成部经理。Groups 和 Roles 是 `And` 的关系。
[PermissionAuthorize(Groups = "研发部,生产部", Roles = "经理", Permissions = "请假审批"] // 研发部经理或生成部经理，并且有请假审批的权限。Groups 、Roles 和 Permission 是 `And` 的关系。

public static AuthorizeFilter GetFilter(IAuthorizationPolicyProvider policyProvider, IEnumerable< IAuthorizeData> authData)
{
// The default policy provider will make the same policy for given input, so make it only once.
// This will always execute synchronously.
if (policyProvider.GetType() == typeof(DefaultAuthorizationPolicyProvider))
{
var policy = CombineAsync(policyProvider, authData).GetAwaiter().GetResult();
return new AuthorizeFilter(policy);
}
else
{
return new AuthorizeFilter(policyProvider, authData);
}
}
private static async Task< AuthorizationPolicy> CombineAsync(IAuthorizationPolicyProvider policyProvider, IEnumerable< IAuthorizeData> authorizeData)
{
if (policyProvider == null)
{
throw new ArgumentNullException(nameof(policyProvider));
}
if (authorizeData =https://www.songbingjia.com/android/= null)
{
throw new ArgumentNullException(nameof(authorizeData));
}
var policyBuilder = new AuthorizationPolicyBuilder();
var any = false;
foreach (var authorizeDatum in authorizeData)
{
any = true;
var useDefaultPolicy = true;
if (!string.IsNullOrWhiteSpace(authorizeDatum.Policy))
{
var policy = await policyProvider.GetPolicyAsync(authorizeDatum.Policy);
if (policy == null)
{
//throw new InvalidOperationException(Resources.FormatException_AuthorizationPolicyNotFound(authorizeDatum.Policy));
throw new InvalidOperationException(nameof(authorizeDatum.Policy));
}
policyBuilder.Combine(policy);
useDefaultPolicy = false;
}
var rolesSplit = authorizeDatum.Roles?.Split(‘,‘);
if (rolesSplit != null & & rolesSplit.Any())
{
var trimmedRolesSplit = rolesSplit.Where(r => !string.IsNullOrWhiteSpace(r)).Select(r => r.Trim());
policyBuilder.RequireRole(trimmedRolesSplit);
useDefaultPolicy = false;
}
if(authorizeDatum is IPermissionAuthorizeData permissionAuthorizeDatum )
{
var groupsSplit = permissionAuthorizeDatum.Groups?.Split(‘,‘);
if (groupsSplit != null & & groupsSplit.Any())
{
var trimmedGroupsSplit = groupsSplit.Where(r => !string.IsNullOrWhiteSpace(r)).Select(r => r.Trim());
policyBuilder.RequireClaim("Group", trimmedGroupsSplit); // TODO: 注意硬编码
useDefaultPolicy = false;
}
var permissionsSplit = permissionAuthorizeDatum.Permissions?.Split(‘,‘);
if (permissionsSplit != null & & permissionsSplit.Any())
{
var trimmedPermissionsSplit = permissionsSplit.Where(r => !string.IsNullOrWhiteSpace(r)).Select(r => r.Trim());
policyBuilder.RequireClaim("Permission", trimmedPermissionsSplit); // TODO: 注意硬编码
useDefaultPolicy = false;
}
}
var authTypesSplit = authorizeDatum.AuthenticationSchemes?.Split(‘,‘);
if (authTypesSplit != null & & authTypesSplit.Any())
{
foreach (var authType in authTypesSplit)
{
if (!string.IsNullOrWhiteSpace(authType))
{
policyBuilder.AuthenticationSchemes.Add(authType.Trim());
}
}
}
if (useDefaultPolicy)
{
policyBuilder.Combine(await policyProvider.GetDefaultPolicyAsync());
}
}
return any ? policyBuilder.Build() : null;
}

services.AddMvc();
services.Replac(ServiceDescriptor.Transient< IApplicationModelProvider,PermissionAuthorizationApplicationModelProvider> ());

[Route("api/[controller]")]
[ApiController]
public class ValuesController : ControllerBase
{
private readonly JwtSecurityTokenHandler _tokenHandler = new JwtSecurityTokenHandler();
[HttpGet]
[Route("SignIn")]
public async Task< ActionResult< string> > SignIn()
{
var user = new ClaimsPrincipal(new ClaimsIdentity(new[]
{
// 备注：Claim Type: Group 和 Permission 这里使用的是硬编码，应该定义为类似于 ClaimTypes.Role 的常量；另外，下列模拟数据不一定合逻辑。
new Claim(ClaimTypes.Name, "Bob"),
new Claim(ClaimTypes.Role, "经理"),// 注意：不能使用逗号分隔来达到多个角色的目的，下同。
new Claim(ClaimTypes.Role, "副经理"),
new Claim("Group", "研发部"),
new Claim("Group", "生产部"),
new Claim("Permission", "请假审批"),
new Claim("Permission", "权限1"),
new Claim("Permission", "权限2"),
}, JwtBearerDefaults.AuthenticationScheme));
var token = new JwtSecurityToken(
"SignalRAuthenticationSample",
"SignalRAuthenticationSample",
user.Claims,
expires: DateTime.UtcNow.AddDays(30),
signingCredentials: SignatureHelper.GenerateSigningCredentials("1234567890123456"));
return _tokenHandler.WriteToken(token);
}
[HttpGet]
[Route("Test")]
[PermissionAuthorize(Groups = "研发部,生产部", Roles = "经理", Permissions = "请假审批"] // 研发部经理或生成部经理，并且有请假审批的权限。Groups 、Roles 和 Permission 是 `And` 的关系。
public async Task< ActionResult< IEnumerable< string> > > Test()
{
var user = HttpContext.User;
return new string[] { "value1", "value2" };
}
}

IFilterMetadata IFilterFactory.CreateInstance(IServiceProvider serviceProvider)
{
if (Policy != null || PolicyProvider != null)
{
// The filter is fully constructed. Use the current instance to authorize.
return this;
}

Debug.Assert(AuthorizeData != null);
var policyProvider = serviceProvider.GetRequiredService< IAuthorizationPolicyProvider> ();
return AuthorizationApplicationModelProvider.GetFilter(policyProvider, AuthorizeData);
}

[PermissionAuthorize(Rule = "(Groups:研发部,生产部)& & (Roles:请假审批||Permissions:超级权限)"]