添加项目文件。

2022-03-28 15:27:40 +08:00
parent b620fcb0cf
commit dc78fd1a09
898 changed files with 173053 additions and 0 deletions
@@ -0,0 +1,38 @@
+using IRaCIS.Core.Infrastructure.Extention;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using Newtonsoft.Json;
+using System;
+using System.Text.Encodings.Web;
+using System.Threading.Tasks;
+
+namespace IRaCIS.Core.API
+{
+    public class ApiResponseHandler : AuthenticationHandler<AuthenticationSchemeOptions>
+    {
+        public ApiResponseHandler(IOptionsMonitor<AuthenticationSchemeOptions> options, ILoggerFactory logger, UrlEncoder encoder, ISystemClock clock) : base(options, logger, encoder, clock)
+        {
+        }
+
+        protected override Task<AuthenticateResult> HandleAuthenticateAsync()
+        {
+            throw new NotImplementedException();
+        }
+        protected override async Task HandleChallengeAsync(AuthenticationProperties properties)
+        {
+            Response.ContentType = "application/json";
+            Response.StatusCode = StatusCodes.Status401Unauthorized;
+            await Response.WriteAsync(JsonConvert.SerializeObject(ResponseOutput.NotOk("您无权访问该接口")));
+        }
+
+        protected override async Task HandleForbiddenAsync(AuthenticationProperties properties)
+        {
+            Response.ContentType = "application/json";
+            Response.StatusCode = StatusCodes.Status403Forbidden;
+            await Response.WriteAsync(JsonConvert.SerializeObject(ResponseOutput.NotOk("您的权限不允许进行该操作")));
+        }
+
+    }
+}
@@ -0,0 +1,32 @@
+using IRaCIS.Core.Domain.Share;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace IRaCIS.Core.API
+{
+    public static class AuthorizationPolicySetup
+    {
+
+        public static void AddAuthorizationPolicySetup(this IServiceCollection services, IConfiguration configuration)
+        {
+            services.AddAuthorization(options =>
+            {
+                //影像质控策略  只允许 CRC  QA进行操作
+                options.AddPolicy("ImageQCPolicy", policyBuilder =>
+                {
+                    policyBuilder.RequireClaim("userTypeEnumInt", ((int)UserTypeEnum.ClinicalResearchCoordinator).ToString(), ((int)UserTypeEnum.IQC).ToString());
+                });
+
+                //一致性核查策略  只允许 CRC  PM APM 进行操作
+                options.AddPolicy("ImageCheckPolicy", policyBuilder =>
+                {
+                    policyBuilder.RequireClaim("userTypeEnumInt", ((int)UserTypeEnum.ProjectManager).ToString(), ((int)UserTypeEnum.ClinicalResearchCoordinator).ToString(), ((int)UserTypeEnum.APM).ToString());
+                });
+
+
+
+
+            });
+        }
+    }
+}
@@ -0,0 +1,91 @@
+using Invio.Extensions.Authentication.JwtBearer;
+using IRaCIS.Core.Application.Auth;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.IdentityModel.Tokens;
+using System;
+using System.Text;
+
+namespace IRaCIS.Core.API
+{
+    public static class JWTAuthSetup
+    {
+        public static void AddJWTAuthSetup(this IServiceCollection services, IConfiguration configuration)
+        {
+            services.Configure<JwtSetting>(configuration.GetSection("JwtSetting"));
+
+            var jwtSetting = new JwtSetting();
+            configuration.Bind("JwtSetting", jwtSetting);
+
+            services
+               .AddAuthentication(o=> {
+                   o.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
+                   o.DefaultChallengeScheme = nameof(ApiResponseHandler);
+                   o.DefaultForbidScheme = nameof(ApiResponseHandler);
+               })
+               .AddJwtBearer(options =>
+               {
+                   options.TokenValidationParameters = new TokenValidationParameters
+                   {
+                       ValidIssuer = jwtSetting.Issuer,
+                       ValidAudience = jwtSetting.Audience,
+                       IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtSetting.SecurityKey)),
+                       // 默认 300s
+                       ClockSkew = TimeSpan.Zero
+                   };
+
+                   // OPTION 1: use `Invio.Extensions.Authentication.JwtBearer`
+
+                   options.AddQueryStringAuthentication();
+
+                   // OPTION 2: do it manually
+
+                   #region
+                   //options.Events = new JwtBearerEvents
+                   //{
+                   //    OnMessageReceived = (context) => {
+
+                   //        if (!context.Request.Query.TryGetValue("access_token", out StringValues values))
+                   //        {
+                   //            return Task.CompletedTask;
+                   //        }
+
+                   //        if (values.Count > 1)
+                   //        {
+                   //            context.Response.StatusCode = (int)HttpStatusCode.Unauthorized;
+                   //            context.Fail(
+                   //                "Only one 'access_token' query string parameter can be defined. " +
+                   //                $"However, {values.Count:N0} were included in the request."
+                   //            );
+
+                   //            return Task.CompletedTask;
+                   //        }
+
+                   //        var token = values.Single();
+
+                   //        if (String.IsNullOrWhiteSpace(token))
+                   //        {
+                   //            context.Response.StatusCode = (int)HttpStatusCode.Unauthorized;
+                   //            context.Fail(
+                   //                "The 'access_token' query string parameter was defined, " +
+                   //                "but a value to represent the token was not included."
+                   //            );
+
+                   //            return Task.CompletedTask;
+                   //        }
+
+                   //        context.Token = token;
+
+                   //        return Task.CompletedTask;
+                   //    }
+                   //};
+                   #endregion
+
+               })
+               .AddScheme<AuthenticationSchemeOptions, ApiResponseHandler>(nameof(ApiResponseHandler), o => { });
+                       
+        }
+    }
+}