动态注册RBAC

1.PermissionPolicyProvider:每次[Authorize(Policy="xxx")]调用时动态生成Policy

using Microsoft.AspNetCore.Authorization;
using Microsoft.Extensions.DependencyInjection;namespace Infrastructure.Security
{public class PermissionPolicyProvider : IAuthorizationPolicyProvider{private readonly DefaultAuthorizationPolicyProvider _fallbackPolicyProvider;public PermissionPolicyProvider(IServiceProvider serviceProvider){var options = serviceProvider.GetRequiredService<Microsoft.Extensions.Options.IOptions<AuthorizationOptions>>();_fallbackPolicyProvider = new DefaultAuthorizationPolicyProvider(options);}public Task<AuthorizationPolicy> GetDefaultPolicyAsync(){return _fallbackPolicyProvider.GetDefaultPolicyAsync();}public Task<AuthorizationPolicy?> GetFallbackPolicyAsync(){return _fallbackPolicyProvider.GetFallbackPolicyAsync();}public Task<AuthorizationPolicy> GetPolicyAsync(string policyName){// 每次请求动态生成 Policyvar policy = new AuthorizationPolicyBuilder().AddRequirements(new PermissionRequirement(policyName)).Build();return Task.FromResult(policy);}}
}

2.PermissionHandler:判断JWT Claim "permission"是否包含所需权限

using Microsoft.AspNetCore.Authorization;namespace Infrastructure.Security
{public class PermissionHandler : AuthorizationHandler<PermissionRequirement>{protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, PermissionRequirement requirement){var permissions = context.User?.Claims.Where(c => c.Type == "permission").Select(c => c.Value).ToList();if (permissions != null && permissions.Contains(requirement.Permission)){context.Succeed(requirement);}return Task.CompletedTask;}}public class PermissionRequirement : IAuthorizationRequirement{public string Permission { get; }public PermissionRequirement(string permission){Permission = permission;}}[AttributeUsage(AttributeTargets.Method)]public class PermissionAttribute : AuthorizeAttribute{public PermissionAttribute(string permission){Policy = permission;}}
}