/// <summary>
 /// 自定義授權(quán)中間件
 /// </summary>
 public class JwtCustomerAuthorizeMiddleware
 {
  private readonly RequestDelegate next;

  public JwtCustomerAuthorizeMiddleware(RequestDelegate next, string secret, List<string> anonymousPathList)
  {
   #region 設(shè)置自定義jwt 的秘鑰
   if(!string.IsNullOrEmpty(secret))
   {
    TokenContext.securityKey = secret;
   }
   #endregion
   this.next = next;
   UserContext.AllowAnonymousPathList.AddRange(anonymousPathList);
  }

  public async Task Invoke(HttpContext context, UserContext userContext,IOptions<JwtOption> optionContainer)
  {
   if (userContext.IsAllowAnonymous(context.Request.Path))
   {
    await next(context);
    return;
   }

   var option = optionContainer.Value;

   #region 身份驗證，并設(shè)置用戶Ruser值
 
   var result = context.Request.Headers.TryGetValue("Authorization", out StringValues authStr);
   if (!result || string.IsNullOrEmpty(authStr.ToString()))
   {
    throw new UnauthorizedAccessException("未授權(quán)");
   }
   result = TokenContext.Validate(authStr.ToString().Substring("Bearer ".Length).Trim(), payLoad =>
   {
    var success = true;
    //可以添加一些自定義驗證，用法參照測試用例
    //驗證是否包含aud 并等于 roberAudience
    success = success && payLoad["aud"]?.ToString() == option.Audience;
    if (success)
    {
     //設(shè)置Ruse值,把user信息放在payLoad中，（在獲取jwt的時候把當(dāng)前用戶存放在payLoad的ruser鍵中）
     //如果用戶信息比較多，建議放在緩存中，payLoad中存放緩存的Key值
     userContext.TryInit(payLoad["ruser"]?.ToString());
    }
    return success;
   });
   if (!result)
   {
    throw new UnauthorizedAccessException("未授權(quán)");
   }

   #endregion
   #region 權(quán)限驗證
   if (!userContext.Authorize(context.Request.Path))
   {
    throw new UnauthorizedAccessException("未授權(quán)");
   }
   #endregion

   await next(context);
  }
 }

app.UseMiddleware<JwtCustomerAuthorizeMiddleware>(Configuration["JwtOption:SecurityKey"], new List<string>() { "/api/values/getjwt","/" });

public class CommonAuthorizeHandler : AuthorizationHandler<CommonAuthorize>
 {
  /// <summary>
  /// 常用自定義驗證策略，模仿自定義中間件JwtCustomerauthorizeMiddleware的驗證范圍
  /// </summary>
  /// <param name="context"></param>
  /// <param name="requirement"></param>
  /// <returns></returns>
  protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, CommonAuthorize requirement)
  {
   var httpContext = (context.Resource as AuthorizationFilterContext).HttpContext;
   var userContext = httpContext.RequestServices.GetService(typeof(UserContext)) as UserContext;

   var jwtOption = (httpContext.RequestServices.GetService(typeof(IOptions<JwtOption>)) as IOptions<JwtOption>).Value;

   #region 身份驗證，并設(shè)置用戶Ruser值

   var result = httpContext.Request.Headers.TryGetValue("Authorization", out StringValues authStr);
   if (!result || string.IsNullOrEmpty(authStr.ToString()))
   {
    return Task.CompletedTask;
   }
   result = TokenContext.Validate(authStr.ToString().Substring("Bearer ".Length).Trim(), payLoad =>
   {
    var success = true;
    //可以添加一些自定義驗證，用法參照測試用例
    //驗證是否包含aud 并等于 roberAudience
    success = success && payLoad["aud"]?.ToString() == jwtOption.Audience;
    if (success)
    {
     //設(shè)置Ruse值,把user信息放在payLoad中，（在獲取jwt的時候把當(dāng)前用戶存放在payLoad的ruser鍵中）
     //如果用戶信息比較多，建議放在緩存中，payLoad中存放緩存的Key值
     userContext.TryInit(payLoad["ruser"]?.ToString());
    }
    return success;
   });
   if (!result)
   {
    return Task.CompletedTask;
   }

   #endregion
   #region 權(quán)限驗證
   if (!userContext.Authorize(httpContext.Request.Path))
   {
    return Task.CompletedTask;
   }
   #endregion

   context.Succeed(requirement);
   return Task.CompletedTask;
  }
 }
 public class CommonAuthorize: IAuthorizationRequirement
 {

 }

services.AddAuthorization(option =>
   {
    

    #region 自定義驗證策略
    option.AddPolicy("common", policy => policy.Requirements.Add(new CommonAuthorize()));
    #endregion


   }).AddAuthentication(option =>
   {
    option.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
   }).AddJwtBearer(option =>
   {
    if (!string.IsNullOrEmpty(config["JwtOption:SecurityKey"]))
    {
     TokenContext.securityKey = config["JwtOption:SecurityKey"];
    }
    //設(shè)置需要驗證的項目
    option.TokenValidationParameters = new TokenValidationParameters
    {
     
     IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(TokenContext.securityKey))//拿到SecurityKey
    };
   });

   //自定義策略IOC添加
   
   services.AddSingleton<IAuthorizationHandler, CommonAuthorizeHandler>();