使用.NET从零实现基于用户角色的访问权限控制

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true, Inherited = true)]
public class ResourceAttribute: AuthorizeAttribute, IAuthorizationRequirement
{
    private string _resouceName;
    private string? _action;
    /// <summary>
    /// 设置资源类型
    /// </summary>
    /// <param name="name">资源名称</param>
    /// <exception cref="ArgumentNullException">资源名称不能为空</exception>
    public ResourceAttribute(string name)
    {
        if (string.IsNullOrEmpty(name))
        {
            throw new ArgumentNullException(nameof(name));
        }
        string[] resourceValues = name.Split('-');
        _resouceName = resourceValues[0];
        if (resourceValues.Length > 1)
        {
            Action = resourceValues[1];
        }
        else
        {
            Policy = resourceValues[0];
        }
    }

    /// <summary>
    /// 获取资源名称
    /// </summary>
    /// <returns></returns>
    public string GetResource()
    {
        return _resouceName;
    }

    /// <summary>
    /// 获取操作名称
    /// </summary>
    public string? Action
    {
        get
        {
            return _action;
        }
        set
        {
            _action = value;
            if (!string.IsNullOrEmpty(value))
            {
                //把资源名称跟操作名称组装成Policy
                Policy = _resouceName + "-" + value;
            }
        }
    }
}

/// <summary>
/// 基于其 Order 属性以倒序调用
/// </summary>
/// <param name="context"></param>
public void OnProvidersExecuted(ApplicationModelProviderContext context)
{
    if (context == null)
    {
        throw new ArgumentNullException(nameof(context));
    }
    //获取所有的控制器
    List<ResourceAttribute> attributeData = new List<ResourceAttribute>();
    foreach (var controllerModel in context.Result.Controllers)
    {
        //得到ResourceAttribute

        //Controller 的特性
        var resourceData = controllerModel.Attributes.OfType<ResourceAttribute>().ToArray();
        if (resourceData.Length > 0)
        {
            attributeData.AddRange(resourceData);
        }
        //Controller 中的每个方法的特性
        foreach (var actionModel in controllerModel.Actions)
        {
            var actionResourceData = actionModel.Attributes.OfType<ResourceAttribute>().ToArray();
            if (actionResourceData.Length > 0)
            {
                attributeData.AddRange(actionResourceData);
            }
        }
    }
    // 整理信息集中存入全局
    foreach (var item in attributeData)
    {
        ResourceData.AddResource(item.GetResource(), item.Action);
    }
}

/// <summary>
/// 自定义授权策略
/// 自动增加 Policy 授权策略
/// </summary>
/// <param name="policyName">授权名称</param>
/// <returns></returns>
public Task<AuthorizationPolicy> GetPolicyAsync(string policyName)
{
    // 检查这个授权策略有没有
    AuthorizationPolicy? policy = _options.GetPolicy(policyName);

    if (policy is null)
    {
        _options.AddPolicy(policyName, builder =>
        {
            builder.AddRequirements(new ResourceAttribute(policyName));
        });
    }

    return Task.FromResult(_options.GetPolicy(policyName));
}

internal class ResourceAuthorizationHandler : AuthorizationHandler<ResourceAttribute>
{
    /// <summary>
    /// 授权处理
    /// </summary>
    /// <param name="context">请求上下文</param>
    /// <param name="requirement">资源验证要求</param>
    /// <returns></returns>
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, ResourceAttribute requirement)
    {
        // 需要有用户
        if (context.User is null) return Task.CompletedTask;


        if (context.User.IsInRole(ResourceRole.Administrator) // 超级管理员权限，拥有 SangRBAC_Administrator 角色不检查权限
            || CheckClaims(context.User.Claims, requirement) // 符合 Resource 或 Resource-Action 组合的 Permission
            )
        {
            context.Succeed(requirement);
        }
        return Task.CompletedTask;

    }

    /// <summary>
    /// 检查 Claims 是否符合要求
    /// </summary>
    /// <param name="claims">待检查的claims</param>
    /// <param name="requirement">检查的依据</param>
    /// <returns></returns>
    private bool CheckClaims(IEnumerable<Claim> claims, ResourceAttribute requirement)
    {
        return claims.Any(c =>
                    string.Equals(c.Type, ResourceClaimTypes.Permission, StringComparison.OrdinalIgnoreCase)
                    && (string.Equals(c.Value, requirement.GetResource(), StringComparison.Ordinal)
                    || string.Equals(c.Value, $"{requirement.GetResource()}-{requirement.Action}", StringComparison.Ordinal))
                    );
    }
}

new Claim(ResourceClaimTypes.Permission,"查询")