3.通用权限设计——SnailAspNetCoreFramework快速开发框架之后端设计

总体设计思路

在设计本项目的通用权限前，我参阅过很多设计方案，最终定下RBAC（基于角色的权限控制）。微软本身是有一套默认的权限控制的（asp.net core identity)，但有如下几个缺点
1、表结构固定，不好扩展。
2、不能动态的对接口进行角色的授权，只能写在代码里。所以本框架的设计会考虑如下几点

---

• 不定义表结构，各权限表的结构完全可由用户自己定义，只需按规范实现接口即可
• 能动态分配接口的角色

具体设计摘要

• 权限包含人员、角色、人员角色关系、资源、角色资源这5个表，各表不自定具体的结构，只通过接口进行约定
• 权限核心逻辑由IPermission和IPermissionStore来定义。
• IPermission定义了用户的登录、鉴权、初始化资源、从请求上下文识别出资源id、获取所有资源及对应角色、登录密码加密算法等方法，默认实现为DefaultPermission->BasePermission->IPermission
• IPermissionStore定义各权限相关数据的获取、更新、缓存刷新方法。所有的权限相关数据都在缓存里，当数据有变化时，要调用IPermissionStore的缓存刷新方法来进行。默认实现为DefaultPermissionStore->BasePermissionStore->IPermissionStore
• 用“基于策略”的方式进行鉴权。策略的实现逻辑为PermissionRequirementHandler，依赖于IPermission，通过IPermission.HasPermission方法来判断是否有权限。
• 支持cookies和jwt两种方式。在登录时，由
• 通过在Action上加ResourceAttribute来定义哪些接口是需要进行鉴权的，并自动加入到Resource数据表里

各表结构的接口约定

• 人员、角色、人员角色关系、资源、角色资源关系的接口如下

    public interface IHasKeyAndName
    {
        /// <summary>
        /// 一般为id，主键
        /// </summary>
        /// <returns></returns>
        string GetKey();
        /// <summary>
        /// 一般为描述
        /// </summary>
        /// <returns></returns>
        string GetName();
    }

人员接口

    public interface IUser:IHasKeyAndName
    {
        string GetAccount();
        string GetPassword();
    }

角色接口

    public interface IRole:IHasKeyAndName
    {
    }

人员角色关系接口

    public interface IUserRole
    {
        string GetUserKey();
        string GetRoleKey();
    }

资源接口

    /// <summary>
    /// 资源（指所有要权限控制的资源，如接口,菜单）
    /// </summary>
    public interface IResource:IHasKeyAndName
    {
        /// <summary>
        /// 用于绑定到前端，前端在做权限和界面元素的绑定时，一般不会用id（id可读性差）和name（name可能会改变），一般以code做约定
        /// </summary>
        /// <returns></returns>
        string GetResourceCode();
    }

角色资源关系接口

    public interface IRoleResource
    {
        string GetRoleKey();
        string GetResourceKey();
    }

核心权限接口定义

IPermission接口定义

    /// <summary>
    /// 权限接口，这此接口是对外的，非对外的方法，不要写在接口里。
    /// </summary>
    public interface IPermission
    {
        #region 用于判断用户是否有资源权限的必要方法
        /// <summary>
        /// 通过访问的资源，获取资源的key。如obj可能为action，url
        /// </summary>
        /// <param name="obj"></param>
        /// <returns></returns>
        string GetRequestResourceKey(object obj);
        /// <summary>
        /// 通过对象获取资源code
        /// </summary>
        /// <param name="obj"></param>
        /// <returns></returns>
        string GetRequestResourceCode(object obj);

        /// <summary>
        /// 用户是否有资源的权限
        /// </summary>
        /// <param name="resourceKey">资源key</param>
        /// <param name="userKey">用户key</param>
        /// <returns></returns>
        bool HasPermission(string resourceKey, string userKey);
        /// <summary>
        /// 从ClaimsPrincipal获取用户信息
        /// </summary>
        /// <param name="claimsPrincipal">ClaimsPrincipal</param>
        /// <returns></returns>
        UserInfo GetUserInfo(ClaimsPrincipal claimsPrincipal);
        #endregion

        #region 登录、前端界面权限控制必要方法

        /// <summary>
        /// 登录
        /// </summary>
        /// <param name="loginDto">登录dto</param>
        /// <returns>如果登录成功，返回的结果；如果登录不成功，会抛出异常</returns>
        /// <remarks>
        /// 配置GetAllResourceRoles方法，可实现前端的权限控制
        /// </remarks>
        LoginResult Login(LoginDto loginDto);

        /// <summary>
        /// 获取所有的资源以及资源角色的对应关系信息
        /// </summary>
        /// <returns></returns>
        /// <remarks>
        /// 前端调用此接口，获取所有的资源及资源的角色，用于渲染界面权限控制
        /// </remarks>
        List<ResourceRoleInfo> GetAllResourceRoles();


        /// <summary>
        /// 通过userInfo生成Claims，Claims会用于生成token
        /// </summary>
        /// <param name="userInfo"></param>
        /// <returns></returns>
        List<Claim> GetClaims(IUserInfo userInfo);

        ///// <summary>
        ///// 获取登录token
        ///// </summary>
        ///// <param name="account"></param>
        ///// <param name="pwd"></param>
        ///// <returns></returns>
        //string GetLoginToken(string account, string pwd);

        ///// <summary>
        ///// 获取用户信息，用于给前端用户展示
        ///// </summary>
        ///// <param name="token"></param>
        //IUserInfo GetUserInfo(string token);

        #endregion

        #region 其它
        /// <summary>
        /// 获取password的hash，可能加salt或是不加，hash的算法也可以由用户自己配置。
        /// 如果用户密码在存储时不做hash处理，则此方法返回pwd的明文即可
        /// 此方法用于两处
        /// 1、登录验证
        /// 2、修改、增加密码时
        /// </summary>
        /// <param name="pwd">用户输入的密码明文</param>
        /// <returns>密码明文的hash</returns>
        string HashPwd(string pwd);

        /// <summary>
        /// 初始化权限资源
        /// </summary>
        void InitResource();
        #endregion

    }

IPermissionStore接口定义

   /// <summary>
    /// 权限存储相关的接口约定
    /// </summary>
    public interface IPermissionStore
    {
        #region 查询权限数据
        /// <summary>
        /// 获取所有的用户
        /// </summary>
        /// <returns></returns>
        List<IUser> GetAllUser();
        /// <summary>
        /// 获取所有的角色
        /// </summary>
        /// <returns></returns>
        List<IRole> GetAllRole();
        /// <summary>
        /// 获取所有角色和用户的关系
        /// </summary>
        /// <returns></returns>
        List<IUserRole> GetAllUserRole();
        /// <summary>
        /// 获取所有的资源
        /// </summary>
        /// <returns></returns>
        List<IResource> GetAllResource();
        /// <summary>
        /// 获取所有角色和资源的关系
        /// </summary>
        /// <returns></returns>
        List<IRoleResource> GetAllRoleResource();
        #endregion

        #region 管理权限数据

        /// <summary>
        /// 保存用户
        /// </summary>
        /// <param name="user"></param>
        void SaveUser(IUser user);
        /// <summary>
        /// 删除用户
        /// </summary>
        /// <param name="userKey"></param>
        void RemoveUser(string userKey);
        /// <summary>
        /// 保存角色
        /// </summary>
        /// <param name="role"></param>
        void SaveRole(IRole role);
        /// <summary>
        /// 删除角色 
        /// </summary>
        /// <param name="roleKey"></param>
        void RemoveRole(string roleKey);
        /// <summary>
        /// 保存资源
        /// </summary>
        /// <param name="resource"></param>
        void SaveResource(IResource resource);
        /// <summary>
        /// 删除资源
        /// </summary>
        /// <param name="resourceKey"></param>
        void RemoveResource(string resourceKey);
        /// <summary>
        /// 设备用户的角色
        /// </summary>
        /// <param name="userKey"></param>
        /// <param name="roleKeys"></param>
        void SetUserRoles(string userKey, List<string> roleKeys);
        /// <summary>
        /// 设置角色的资源
        /// </summary>
        /// <param name="roleKey">角色key</param>
        /// <param name="resourceKeys">资源keys</param>
        void SetRoleResources(string roleKey, List<string> resourceKeys);

        /// <summary>
        /// IPermissionStore的实现里如果用了缓存，此方法用于刷新缓存为最新数据。
        /// 如果用户是通过非IPermissionStore接口方法操作权限数据，则要调用此方法进行数据刷新 
        /// </summary>
        void ReloadPemissionDatas();
        #endregion

    }

怎么用？

下面按将权限控制接入到项目的开发步骤进行示例和解读

1、定义权限表实体

• 包含人员、角色、人员角色关系、资源、角色资源这5个表
• 分别定义User,Role,UserRole,Resource,RoleResource5个实体，分别继承IUser,IRole,IUserRole,IResource,IRoleResource接口
• 由于代码比较简单，就不附源码了，详细可以查看ApplicationCore的Entities文件夹里的实现定义

2、创建IPermissionStore接口的实现类

• 数据库框架用的是entityframework core，将已经定义好的实体加到DbContext里(参考Infrastracture项目里的AppDbContext)
• 为方便扩展，我创建了基类BasePermissionStore，并实现IPermissionStore，在项目接入时，可继承BasePermissionStore类，并实现部分虚方法即可。如DefaultPermissionStore。（由于只是简单的数据库CRUD操作，详细代码请查看Web项目里Permission里的代码）
• 默认的实现里，我加了缓存，避免每次权限验证时去查库，并在权限相关数据改变时清空对应的缓存

3、创建IPermission接口的实现类

• 为方便是快速接入，可继承BasePermission。或自己实现IPermission接口
• 本框架默认的实现为DefaultPermission
• IPermission的大致思路为，用IPermissionStore里提供的权限相关数据，判断用户的角色，进而知道用户有哪些授权资源。
• 附BasePermission和DefaultPermission的源码
  BasePermission

    /// <summary>
    /// 权限控制抽象基类，外部在实现权限控制时，如果继承此类，会简化实现的过程，也可以继承IPermission接口，自己实现 
    /// </summary>
    /// <remarks>
    /// todo 由于鉴权是频繁的操作，后期计划将鉴权方法里linq相关的操作用hash和缓存技术实现，进一步提高性能
    /// </remarks>
    public abstract class BasePermission : IPermission
    {
        protected IPermissionStore _permissionStore;
        protected abstract PermissionOptions PermissionOptions {set;get;}
        public BasePermission(IPermissionStore permissionStore)
        {
            _permissionStore = permissionStore;
        }

        #region 用于判断用户是否有资源权限的必要方法
        public virtual string GetRequestResourceKey(object obj)
        {
            var resourceKey = string.Empty;
            var resourceCode = GetRequestResourceCode(obj);
            if (!string.IsNullOrEmpty(resourceCode))
            {
                resourceKey = _permissionStore.GetAllResource().FirstOrDefault(a => a.GetResourceCode() == resourceCode)?.GetKey();
            }
            return resourceKey;
        }
        public abstract string GetRequestResourceCode(object obj);

        public virtual bool HasPermission(string resourceKey, string userKey)
        {
            var userRoleKeys = _permissionStore.GetAllUserRole().Where(a => a.GetUserKey() == userKey).Select(a => a.GetRoleKey());
            var resource = _permissionStore.GetAllResource().FirstOrDefault(a => a.GetKey() == resourceKey);
            
            //未纳入到资源表里的资源，如果进入到鉴权过程时，不允许访问。请将不需要做权限控制的资源设置成允许匿名访问，避免进入到鉴权流程
            if (resource==null)
            {
                return false;
            }
            var resourceRoleKeys = _permissionStore.GetAllRoleResource().Where(a => a.GetResourceKey() == resource.GetKey()).Select(a => a.GetRoleKey());
            return userRoleKeys.Intersect(resourceRoleKeys).Any();
        }
        public virtual UserInfo GetUserInfo(ClaimsPrincipal claimsPrincipal)
        {
            return new UserInfo
            {
                Account = claimsPrincipal.FindFirst(PermissionConstant.accountClaim)?.Value,
                RoleKeys = (claimsPrincipal.FindFirst(PermissionConstant.roleIdsClaim)?.Value ?? "").Split(',').ToList(),
                RoleNames = (claimsPrincipal.FindFirst(PermissionConstant.rolesNamesClaim)?.Value ?? "").Split(',').ToList(),
                UserKey = claimsPrincipal.FindFirst(PermissionConstant.userIdClaim)?.Value,
                UserName = claimsPrincipal.FindFirst(PermissionConstant.userNameClaim)?.Value,
            };
        }
        #endregion

        #region 登录、前端界面权限控制必要方法
        /// <summary>
        /// 登录，返回用户的基本信息和token
        /// </summary>
        /// <param name="loginDto">登录dto</param>
        /// <returns>用户的基本信息和token对象</returns>
        public virtual LoginResult Login(LoginDto loginDto)
        {
            var user = _permissionStore.GetAllUser().FirstOrDefault(a => a.GetAccount().Equals(loginDto.Account,StringComparison.OrdinalIgnoreCase));
            if (user != null && HashPwd(loginDto.Pwd).Equals(user.GetPassword(),StringComparison.OrdinalIgnoreCase))
            {
                var roleKeys = _permissionStore.GetAllUserRole().Where(a => a.GetUserKey() == user.GetKey()).Select(a => a.GetRoleKey()) ?? new List<string>();
                var roleNames = _permissionStore.GetAllRole().Where(a => roleKeys.Contains(a.GetKey())).Select(a => a.GetName()) ?? new List<string>();
                var userInfo = new UserInfo
                {
                    Account = user.GetAccount(),
                    RoleKeys = roleKeys.ToList(),
                    RoleNames = roleNames.ToList(),
                    UserKey = user.GetKey(),
                    UserName = user.GetName()
                };
                var claims = GetClaims(userInfo);
                var tokenStr= GenerateTokenStr(claims);
                return new LoginResult
                {
                    Token = tokenStr,
                    UserInfo = userInfo
                };
            }
            else
            {
                throw new BusinessException($"用户名或密码错误");
            }
        }
        public virtual List<ResourceRoleInfo> GetAllResourceRoles()
        {
            var result = new List<ResourceRoleInfo>();
            var allResource = _permissionStore.GetAllResource();
            var allRole = _permissionStore.GetAllRole();
            var allRoleResource = _permissionStore.GetAllRoleResource();
            allResource.ForEach(resource =>
            {
                var resourceRoleKeys = allRoleResource.Where(a => a.GetResourceKey() == resource.GetKey()).Select(a => a.GetRoleKey()).Distinct().ToList();
                result.Add(new ResourceRoleInfo
                {
                    ResourceCode=resource.GetResourceCode(),
                    ResourceKey=resource.GetKey(),
                    ResourceName=resource.GetName(),
                    RoleKeys= resourceRoleKeys
                });
            });
            return result;
        }
        public virtual List<Claim> GetClaims(IUserInfo userInfo)
        {
            return new List<Claim>
            {
                new Claim(PermissionConstant.userIdClaim,userInfo.UserKey),
                new Claim(PermissionConstant.userNameClaim,userInfo.UserName),
                new Claim(PermissionConstant.accountClaim,userInfo.Account),
                new Claim(PermissionConstant.roleIdsClaim,string.Join(",",userInfo.RoleKeys??new List<string>()) ),
                new Claim(PermissionConstant.rolesNamesClaim,string.Join(",",userInfo.RoleNames??new List<string>()) ),
            };
        }
        #endregion




        /// <summary>
        /// 默认的密码hash算法
        /// </summary>
        /// <param name="pwd">密码明文</param>
        /// <returns></returns>
        public virtual string HashPwd(string pwd)
        {
            return BitConverter.ToString(HashAlgorithm.Create(HashAlgorithmName.MD5.Name).ComputeHash(Encoding.UTF8.GetBytes(pwd))).Replace("-", "");
        }
   
        public abstract string GenerateTokenStr(List<Claim> claims);

        public abstract void InitResource();
        
    }

DefaultPermission

 /// <summary>
    /// 权限的默认实现类
    /// </summary>
    public class DefaultPermission : BasePermission
    {
        public static readonly string superAdminRoleName = "SuperAdmin";

        protected override PermissionOptions PermissionOptions { get; set; }

        public DefaultPermission(IPermissionStore permissionStore, IOptionsMonitor<PermissionOptions> permissionOptions) : base(permissionStore)
        {
            PermissionOptions = permissionOptions.CurrentValue ?? new PermissionOptions();
        }

        public override bool HasPermission(string resourceKey, string userKey)
        {
            if (IsSuperAdmin(userKey))
            {
                return true;
            }
            return base.HasPermission(resourceKey, userKey);
        }

        public override string GenerateTokenStr(List<Claim> claims)
        {
            var expireTimeSpan = (PermissionOptions.ExpireTimeSpan == null || PermissionOptions.ExpireTimeSpan == TimeSpan.Zero) ? new TimeSpan(6, 0, 0) : PermissionOptions.ExpireTimeSpan;
            SigningCredentials creds;
            if (PermissionOptions.IsAsymmetric)
            {
                var key = new RsaSecurityKey(RSAHelper.GetRSAParametersFromFromPrivatePem(PermissionOptions.RsaPrivateKey));
                creds = new SigningCredentials(key, SecurityAlgorithms.RsaSha256);
            }
            else
            {
                var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(PermissionOptions.SymmetricSecurityKey));
                creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
            }
            var token = new JwtSecurityToken(PermissionOptions.Issuer, PermissionOptions.Audience, claims, DateTime.Now, DateTime.Now.Add(expireTimeSpan), creds);
            var tokenStr = new JwtSecurityTokenHandler().WriteToken(token);
            return tokenStr;
        }
        public override string HashPwd(string pwd)
        {
            return HashHelper.Md5($"{pwd}{PermissionOptions.PasswordSalt}");
        }

        /// <summary>
        /// 获取资源对象的code,已经适配如下类型:AuthorizationFilterContext,ControllerActionDescriptor,methodInfo
        /// 默认为className_methodName，或是resourceAttribute里设置的code
        /// </summary>
        /// <param name="obj"></param>
        /// <returns></returns>
        public override string GetRequestResourceCode(object obj)
        {
            if (obj is MethodInfo)
            {
                return GetResourceCode((MethodInfo)obj);
            }
            MethodInfo methodInfo;
            if (obj is AuthorizationFilterContext authorizationFilterContext)
            {
                if (authorizationFilterContext.ActionDescriptor is ControllerActionDescriptor controllerActionDescriptor)
                {
                    methodInfo = controllerActionDescriptor.MethodInfo;
                    return GetResourceCode(methodInfo);
                    //resourceCode = GetResourceCode(controllerActionDescriptor.ControllerName, controllerActionDescriptor.ActionName);
                }
            }
            if (obj is ControllerActionDescriptor controllerActionDescriptor1)
            {
                methodInfo = controllerActionDescriptor1.MethodInfo;
                return GetResourceCode(methodInfo);
                //resourceCode = GetResourceCode(controllerActionDescriptor1.ControllerName, controllerActionDescriptor1.ActionName);
            }

            if (obj is RouteEndpoint endpoint)
            {
                //.net core 3.1后，AuthorizationHandlerContext.Resource为endpoint
                methodInfo = endpoint.Metadata.GetMetadata<ControllerActionDescriptor>()?.MethodInfo;
                return GetResourceCode(methodInfo);

            }
            return string.Empty;
        }

        /// <summary>
        /// 初始化所有的权限资源。
        /// 所有有定义ResourceAttribute的方法都为权限资源，否则不是。要使方法受权限控制，必须做到如下两点：1、在方法上加ResourceAttribute，2、在controller或是action上加Authorize
        /// </summary>
        public override void InitResource()
        {
            var resources = new List<Resource>();
            if (PermissionOptions.ResourceAssemblies == null)
            {
                PermissionOptions.ResourceAssemblies = new List<Assembly>();
            }
            var existResources = _permissionStore.GetAllResource();
            PermissionOptions.ResourceAssemblies.Add(this.GetType().Assembly);
            PermissionOptions.ResourceAssemblies?.Distinct().ToList().ForEach(assembly =>
            {
                //对所有的controller类进行扫描
                assembly.GetTypes().Where(type => typeof(ControllerBase).IsAssignableFrom(type)).ToList().ForEach(controller =>
                {
                    var controllerIsAdded = false;//父是否增加
                    var parentId = IdGenerator.Generate<string>();
                    var parentResource = controller.GetCustomAttribute<ResourceAttribute>();
                    controller.GetMethods().ToList().ForEach(method =>
                    {
                        if (method.IsDefined(typeof(ResourceAttribute), true))
                        {
                            var methodResource = method.GetCustomAttribute<ResourceAttribute>();
                            if (!controllerIsAdded)
                            {
                                // 增加父
                                resources.Add(new Resource
                                {
                                    Id = parentId,
                                    Code = parentResource?.ResourceCode??controller.Name,
                                    CreateTime = DateTime.Now,
                                    IsDeleted = false,
                                    Name = parentResource?.Description??controller.Name
                                });
                                controllerIsAdded = true;
                            }
                            // 增加子
                            resources.Add(new Resource
                            {
                                Id = IdGenerator.Generate<string>(),
                                Code = GetResourceCode(method),
                                CreateTime = DateTime.Now,
                                IsDeleted = false,
                                ParentId = parentId,
                                Name = methodResource?.Description??method.Name
                            });
                        }
                    });
                });
            });
            resources.ForEach(item =>
            {
                var temp = new Resource
                {
                    Id = item.Id,
                    Code = item.Code,
                    CreateTime = DateTime.Now,
                    IsDeleted = false,
                    Name = item.Name,
                    ParentId = item.ParentId,
                    UpdateTime = DateTime.Now
                };
                // 设置资源的id
                var matchRs = existResources.FirstOrDefault(i => i.GetResourceCode() == temp.Code);
                if (matchRs!=null)
                {
                    temp.Id = matchRs.GetKey();
                }

                // 设置资源的父id
                if (!string.IsNullOrEmpty(temp.ParentId))
                {
                    var pa = resources.FirstOrDefault(a => a.Id == temp.ParentId);
                    var matchPa = existResources.FirstOrDefault(i => i.GetResourceCode() == pa?.Code);
                    if (matchPa!=null)
                    {
                        item.ParentId = matchPa.GetKey();
                    }
                }
                _permissionStore.SaveResource(item);
            });
        }

        private bool IsSuperAdmin(string userKey)
        {
            var superRole = _permissionStore.GetAllRole().FirstOrDefault(a => a.GetName().Equals(DefaultPermission.superAdminRoleName,StringComparison.OrdinalIgnoreCase));
            return _permissionStore.GetAllUserRole().Any(a => a.GetUserKey() == userKey && a.GetRoleKey() == superRole.GetKey());
        }

        /// <summary>
        /// 通过类名和方法名，获取
        /// </summary>
        /// <param name="className"></param>
        /// <param name="methodName"></param>
        /// <returns></returns>
        private string GetResourceCode(MethodInfo methodInfo)
        {
            if (Attribute.IsDefined(methodInfo, typeof(ResourceAttribute)))
            {
                var attr = methodInfo.GetCustomAttribute<ResourceAttribute>();
                if (attr != null && !string.IsNullOrEmpty(attr.ResourceCode))
                {
                    return attr.ResourceCode;
                }
            }
            return $"{methodInfo.DeclaringType.Name.Replace("Controller", "")}_{methodInfo.Name}";
        }

    }

4、编写鉴权处理类PermissionRequirementHandler

• 鉴权的原理请参考微软的官方文档https://docs.microsoft.com/zh-cn/aspnet/core/security/authorization/introduction?view=aspnetcore-3.1
• 原理概要解说

我用的是基于策略的鉴权方式，一个项目里可以有多种方法（策略）来判断一个资源是否有访问权限。策略的实现里是以“是否获得某个Requirement”来判断是否有权限，获得Requirement即有授权，反之则无。而判断是否有某某Requirement是由此Requirement的AuthorizationHandler来处理

配置策略

  services.AddAuthorization(options =>
            {
                // 增加鉴权策略，并告知这个策略要判断用户是否获得了PermissionRequirement这个Requirement
                options.AddPolicy(PermissionConstant.PermissionAuthorizePolicy, policyBuilder =>
                {
                    policyBuilder.AddRequirements(new PermissionRequirement());
                });
            });

PermissionRequirementHandler源码如下

 public class PermissionRequirementHandler : AuthorizationHandler<PermissionRequirement>
    {
        private IPermission _permission;
        public PermissionRequirementHandler(IPermission permission)
        {
            _permission = permission;
        }
        protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, PermissionRequirement requirement)
        {
            var resourceKey=_permission.GetRequestResourceKey(context.Resource);// 获取资源的key
            var userKey = _permission.GetUserInfo(context.User).UserKey; // 根据用户的claims获取用户的key
            if (_permission.HasPermission(resourceKey,userKey)) // 判断用户是否有权限
            {
                context.Succeed(requirement); // 如果有权限，则获得此Requirement
            }
            return Task.CompletedTask;
        }
    }

5、配置身份验证和权限验证

• 在Startup.cs里注入权限组件services.AddPermission,并在asp.net core管理里配置好身份验证和鉴权，即增加 app.UseAuthentication()和app.UseAuthorization();
• 默认的身份验证现实支持cookies和token，当请求过来时，如果不包含token则走cookies方式，否则走token。
  AddPermission源码如下

  /// <summary>
        /// 权限控制核心，即必须的配置
        /// </summary>
        /// <param name="services"></param>
        /// <param name="action"></param>
        public static void AddPermission(this IServiceCollection services, Action<PermissionOptions> action)
        {
            services.TryAddScoped<IPermission, DefaultPermission>();
            services.TryAddScoped<IPermissionStore, DefaultPermissionStore>();
            #region 身份验证
            var permissionOption = new PermissionOptions();
            action(permissionOption);
            //addAuthentication不放到AddPermissionCore方法里，是为了外部可自己配置
            // 当未通过authenticate时（如无token或是token出错时），会返回401，当通过了authenticate但没通过authorize时，会返回403。
            services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
               .AddCookie(
                   CookieAuthenticationDefaults.AuthenticationScheme, options =>
                   {
                   //下面的委托方法只会在第一次cookie验证时调用，调用时会用到上面的permissionOption变量，但其实permissionOption变量是在以前已经初始化的，所以在此方法调用之前，permissionOption变量不会被释放
                   options.Cookie.Name = "auth";
                       options.AccessDeniedPath = permissionOption.AccessDeniedPath;
                       options.LoginPath = permissionOption.LoginPath;
                       options.ExpireTimeSpan = permissionOption.ExpireTimeSpan != default ? permissionOption.ExpireTimeSpan : new TimeSpan(12, 0, 0);
                       options.ForwardDefaultSelector = context =>
                       {
                           string authorization = context.Request.Headers["Authorization"];
                           //身份验证的顺序为jwt、cookie
                           if (authorization != null && authorization.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase))
                           {
                               return JwtBearerDefaults.AuthenticationScheme;
                           }
                           else
                           {
                               return CookieAuthenticationDefaults.AuthenticationScheme;
                           }
                       };
                       var cookieAuthenticationEvents = new CookieAuthenticationEvents
                       {
                           OnSignedIn = context =>
                           {
                               return Task.CompletedTask;
                           },
                           OnSigningOut = context =>
                           {
                               return Task.CompletedTask;
                            }
                       };
                       options.Events = cookieAuthenticationEvents;
                   })
               .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
               {
                   // jwt可用对称和非对称算法进行验签
                   SecurityKey key;
                   if (permissionOption.IsAsymmetric)
                   {
                       key = new RsaSecurityKey(RSAHelper.GetRSAParametersFromFromPublicPem(permissionOption.RsaPublicKey));
                   }
                   else
                   {
                       key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(permissionOption.SymmetricSecurityKey));
                   }
                   options.TokenValidationParameters = new TokenValidationParameters()
                   {

                       NameClaimType = PermissionConstant.userIdClaim,
                       RoleClaimType = PermissionConstant.roleIdsClaim,
                       ValidIssuer = permissionOption.Issuer,
                       ValidAudience = permissionOption.Audience,
                       IssuerSigningKey = key,
                       ValidateIssuer = false,
                       ValidateAudience = false
                   };
                   var jwtBearerEvents = new JwtBearerEvents
                   {
                       OnMessageReceived = context =>
                       {
                           return Task.CompletedTask;
                       },
                       OnTokenValidated = context =>
                       {
                           return Task.CompletedTask;
                       },
                       OnAuthenticationFailed = context =>
                       {
                           return Task.CompletedTask;
                       }

                   };
                   options.Events = jwtBearerEvents;
               });
            #endregion
            #region 授权

            //权限控制只要在配置IServiceCollection，不需要额外配置app管道
            //权限控制参考：https://docs.microsoft.com/en-us/aspnet/core/security/authorization/policies?view=aspnetcore-2.2
            //handler和requirement有几种关系：1 handler对多requirement(此时handler实现IAuthorizationHandler)；1对1（实现AuthorizationHandler<PermissionRequirement>），和多对1
            //所有的handler都要注入到services，用services.AddSingleton<IAuthorizationHandler, xxxHandler>()，而哪个requirement用哪个handler，低层会自动匹配。最后将requirement对到policy里即可
            services.AddAuthorization(options =>
            {
                options.AddPolicy(PermissionConstant.PermissionAuthorizePolicy, policyBuilder =>
                {
                    policyBuilder.AddRequirements(new PermissionRequirement());
                });
            });
            services.AddScoped<IAuthorizationHandler, PermissionRequirementHandler>();
            services.AddMemoryCache();
            services.TryAddScoped<IApplicationContext, ApplicationContext>();
            services.AddHttpContextAccessor();
            services.Configure(action);
            #endregion
        }

6、在需要进行权限控制的action或是Controller上加Authorize特性

[Authorize(Policy = PermissionConstant.PermissionAuthorizePolicy)]

其它要点

如何根据代码的接口自动生成权限资源

• IPermission接口里定义了InitResource方法，此方法即是自动生成权限资源的入口。
• 默认将所有的Controller里的Action设置为权限资源，如果不需要，则加上AllowAnonymous特性可即
• 资源的code为ControllerName_ActionName，描述信息可以用Resource特性来定义
• 参考DefaultPermission.InitResource的实现逻辑