[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true, Inherited = true)]public class ResourceAttribute: AuthorizeAttribute, IAuthorizationRequirement{ private string _resouceName; private string? _action; /// <summary> /// 设置资源类型 /// </summary> /// <param name="name">资源名称</param> /// <exception cref="ArgumentException">资源名称不能为空</exception> public ResourceAttribute(string name) { if (string.IsOrEmpty(name)) { throw new ArgumentException(nameof(name)); } string[] resourceValues = name.Split('-'); _resouceName = resourceValues[0]; if (resourceValues.Length > 1) { Action = resourceValues[1]; } else { Policy = resourceValues[0]; } }
 /// <summary> /// 获取资源名称 /// </summary> /// <returns></returns> public string GetResource() { return _resouceName; }
 /// <summary> /// 获取操作名称 /// </summary> public string? Action { get { return _action; } set { _action = value; if (!string.IsOrEmpty(value)) { //把资源名称跟操作名称组装成Policy Policy = _resouceName + "-" + value; } } }}

/// <summary>/// 基于其 Order 属性以倒序调用/// </summary>/// <param name="context"></param>public void OnProvidersExecuted(ApplicationModelProviderContext context){ if (context == ) { throw new ArgumentException(nameof(context)); } //获取所有的控制器 List<ResourceAttribute> attributeData = new List<ResourceAttribute>(); foreach (var controllerModel in context.Result.Controllers) { //得到ResourceAttribute
 //Controller 的特性 var resourceData = controllerModel.Attributes.OfType<ResourceAttribute>().ToArray(); if (resourceData.Length > 0) { attributeData.AddRange(resourceData); } //Controller 中的每个方法的特性 foreach (var actionModel in controllerModel.Actions) { var actionResourceData = actionModel.Attributes.OfType<ResourceAttribute>().ToArray(); if (actionResourceData.Length > 0) { attributeData.AddRange(actionResourceData); } } } // 整理信息集中存入全局 foreach (var item in attributeData) { ResourceData.AddResource(item.GetResource(), item.Action); }}

/// <summary>/// 自定义授权策略/// 自动增加 Policy 授权策略/// </summary>/// <param name="policyName">授权名称</param>/// <returns></returns>public Task<AuthorizationPolicy> GetPolicyAsync(string policyName){ // 检查这个授权策略有没有 AuthorizationPolicy? policy = _options.GetPolicy(policyName);
 if (policy is ) { _options.AddPolicy(policyName, builder => { builder.AddRequirements(new ResourceAttribute(policyName)); }); }
 return Task.FromResult(_options.GetPolicy(policyName));}

internal class ResourceAuthorizationHandler : AuthorizationHandler<ResourceAttribute>{ /// <summary> /// 授权处理 /// </summary> /// <param name="context">请求上下文</param> /// <param name="requirement">资源验证要求</param> /// <returns></returns> protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, ResourceAttribute requirement) { // 需要有用户 if (context.User is ) return Task.CompletedTask;

 if (context.User.IsInRole(ResourceRole.Administrator) // 超级管理员权限，拥有 SangRBAC_Administrator 角色不检查权限 || CheckClaims(context.User.Claims, requirement) // 符合 Resource 或 Resource-Action 组合的 Permission ) { context.Succeed(requirement); } return Task.CompletedTask;
 }
 /// <summary> /// 检查 Claims 是否符合要求 /// </summary> /// <param name="claims">待检查的claims</param> /// <param name="requirement">检查的依据</param> /// <returns></returns> private bool CheckClaims(IEnumerable<Claim> claims, ResourceAttribute requirement) { return claims.Any(c => string.Equals(c.Type, ResourceClaimTypes.Permission, StringComparison.OrdinalIgnoreCase) && (string.Equals(c.Value, requirement.GetResource(), StringComparison.Ordinal) || string.Equals(c.Value, $"{requirement.GetResource()}-{requirement.Action}", StringComparison.Ordinal)) ); }}

new Claim(ResourceClaimTypes.Permission,"查询")