.NET CORE 授权进阶-角色、策略与动态权限实现

.NET CORE 授权进阶-角色、策略与动态权限实现

作为.NET开发者，你一定对[Authorize]属性不陌生。但当你开始构建企业级应用时，简单的角色检查往往不够用------你可能需要基于用户部门、操作时间、甚至动态计算的规则来决定用户是否能访问某个接口。今天，我们就来深入探讨.NET Core授权系统的进阶玩法，从角色到策略，再到动态权限实现，让你真正掌控授权流程。## 一、从角色授权说起### 1.1 基础角色授权在.NET Core中，角色授权是最基础的方式。假设我们有一个后台管理系统，包含管理员、编辑、普通用户三种角色：csharp// Startup.cs 配置public void ConfigureServices(IServiceCollection services){ services.AddControllersWithViews(); services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme) .AddCookie(options => { options.LoginPath = "/Account/Login"; }); services.AddAuthorization(options => { // 定义角色策略 options.AddPolicy("AdminOnly", policy => policy.RequireRole("Admin")); options.AddPolicy("EditorOrAdmin", policy => policy.RequireRole("Editor", "Admin")); });}在控制器中使用：csharp[Authorize(Roles = "Admin")]public IActionResult AdminDashboard(){ return View();}[Authorize(Policy = "EditorOrAdmin")]public IActionResult ContentManagement(){ return View();}### 1.2 角色授权的局限角色授权的问题在于：角色是静态的。如果某天我们需要让"编辑"角色中的高级编辑能够删除文章，而普通编辑不能，就需要创建更细粒度的权限。这就是策略授权的用武之地。## 二、策略授权------更精细的控制策略授权允许我们定义更复杂的授权条件，而不仅仅是角色检查。### 2.1 创建自定义策略csharp// 1. 定义授权要求public class MinimumAgeRequirement : IAuthorizationRequirement{ public int MinimumAge { get; } public MinimumAgeRequirement(int minimumAge) { MinimumAge = minimumAge; }}// 2. 实现授权处理器public class MinimumAgeHandler : AuthorizationHandler<MinimumAgeRequirement>{ protected override Task HandleRequirementAsync( AuthorizationHandlerContext context, MinimumAgeRequirement requirement) { // 从用户声明中获取年龄 var dateOfBirthClaim = context.User.FindFirst(c => c.Type == "DateOfBirth"); if (dateOfBirthClaim != null) { var dateOfBirth = Convert.ToDateTime(dateOfBirthClaim.Value); var age = DateTime.Today.Year - dateOfBirth.Year; if (age >= requirement.MinimumAge) { context.Succeed(requirement); } } return Task.CompletedTask; }}// 3. 在Startup中注册public void ConfigureServices(IServiceCollection services){ services.AddSingleton<IAuthorizationHandler, MinimumAgeHandler>(); services.AddAuthorization(options => { options.AddPolicy("AtLeast21", policy => policy.Requirements.Add(new MinimumAgeRequirement(21))); });}// 4. 在控制器中使用[Authorize(Policy = "AtLeast21")]public IActionResult AlcoholShop(){ return View();}### 2.2 策略授权的优势策略授权让我们可以基于声明、角色、甚至外部数据来做出授权决策。比如我们可以创建"只能查看自己数据"的策略：csharppublic class OwnerOnlyHandler : AuthorizationHandler<OwnerOnlyRequirement, IResourceWithOwner>{ protected override Task HandleRequirementAsync( AuthorizationHandlerContext context, OwnerOnlyRequirement requirement, IResourceWithOwner resource) { var userId = context.User.FindFirst(ClaimTypes.NameIdentifier)?.Value; if (userId == resource.OwnerId) { context.Succeed(requirement); } return Task.CompletedTask; }}## 三、动态权限实现------终极解决方案在实际企业应用中，权限往往需要动态配置。用户可能今天有"编辑"权限，明天就没有了；或者某个操作需要同时满足多个条件。这时候，我们需要一个动态的权限系统。### 3.1 设计权限模型csharp// 权限实体public class Permission{ public int Id { get; set; } public string Code { get; set; } // 如 "Article.Delete" public string Name { get; set; } // 如 "删除文章" public string Description { get; set; }}// 用户-权限关系public class UserPermission{ public int UserId { get; set; } public string PermissionCode { get; set; } public bool IsGranted { get; set; } // true=授权, false=拒绝}// 角色-权限关系public class RolePermission{ public int RoleId { get; set; } public string PermissionCode { get; set; }}### 3.2 实现动态授权处理器csharppublic class DynamicPermissionHandler : AuthorizationHandler<DynamicPermissionRequirement>{ private readonly IUserPermissionService _permissionService; public DynamicPermissionHandler(IUserPermissionService permissionService) { _permissionService = permissionService; } protected override async Task HandleRequirementAsync( AuthorizationHandlerContext context, DynamicPermissionRequirement requirement) { var userId = context.User.FindFirst(ClaimTypes.NameIdentifier)?.Value; if (userId == null) { return; // 未登录 } // 从数据库获取用户的权限 var permissions = await _permissionService.GetUserPermissionsAsync(int.Parse(userId)); // 检查是否拥有指定权限 if (permissions.Any(p => p.PermissionCode == requirement.PermissionCode && p.IsGranted)) { context.Succeed(requirement); } }}// 自定义授权要求public class DynamicPermissionRequirement : IAuthorizationRequirement{ public string PermissionCode { get; } public DynamicPermissionRequirement(string permissionCode) { PermissionCode = permissionCode; }}// 创建方便的扩展方法public static class AuthorizationExtensions{ public static AuthorizationPolicyBuilder RequirePermission( this AuthorizationPolicyBuilder builder, string permissionCode) { builder.Requirements.Add(new DynamicPermissionRequirement(permissionCode)); return builder; }}### 3.3 在Startup中集成csharppublic void ConfigureServices(IServiceCollection services){ services.AddScoped<IUserPermissionService, UserPermissionService>(); services.AddSingleton<IAuthorizationHandler, DynamicPermissionHandler>(); services.AddAuthorization(options => { // 创建基于权限的策略 options.AddPolicy("DeleteArticle", policy => policy.RequirePermission("Article.Delete")); options.AddPolicy("EditArticle", policy => policy.RequirePermission("Article.Edit")); });}// 在控制器中使用[Authorize(Policy = "DeleteArticle")]public IActionResult DeleteArticle(int id){ // 只有拥有"Article.Delete"权限的用户才能访问 return Ok();}### 3.4 高级动态权限示例csharp// 更复杂的权限检查：基于资源状态的动态授权public class ResourceBasedPermissionHandler : AuthorizationHandler<ResourcePermissionRequirement, IResource>{ private readonly IUserPermissionService _permissionService; private readonly IResourceStateService _stateService; public ResourceBasedPermissionHandler( IUserPermissionService permissionService, IResourceStateService stateService) { _permissionService = permissionService; _stateService = stateService; } protected override async Task HandleRequirementAsync( AuthorizationHandlerContext context, ResourcePermissionRequirement requirement, IResource resource) { var userId = context.User.FindFirst(ClaimTypes.NameIdentifier)?.Value; if (userId == null) return; // 获取用户权限 var permissions = await _permissionService.GetUserPermissionsAsync( int.Parse(userId)); // 检查是否拥有基础权限 if (!permissions.Any(p => p.PermissionCode == requirement.PermissionCode && p.IsGranted)) { return; } // 检查资源状态限制 var resourceState = await _stateService.GetResourceStateAsync(resource.Id); if (resourceState == ResourceState.Locked && !context.User.IsInRole("Admin")) { return; // 资源被锁定，非管理员不能操作 } context.Succeed(requirement); }}## 四、性能优化建议动态权限系统虽然灵活，但需要注意性能问题：csharp// 使用缓存来减少数据库查询public class CachedPermissionService : IUserPermissionService{ private readonly IMemoryCache _cache; private readonly IUserPermissionService _innerService; public CachedPermissionService( IMemoryCache cache, IUserPermissionService innerService) { _cache = cache; _innerService = innerService; } public async Task<List<UserPermission>> GetUserPermissionsAsync(int userId) { var cacheKey = $"UserPermissions_{userId}"; return await _cache.GetOrCreateAsync(cacheKey, async entry => { entry.SlidingExpiration = TimeSpan.FromMinutes(5); return await _innerService.GetUserPermissionsAsync(userId); }); }}## 总结从简单的角色授权到复杂的动态权限系统，.NET Core的授权框架提供了足够的扩展点来满足各种需求。核心要点包括：1. 角色授权 适合简单场景，但缺乏灵活性2. 策略授权 通过自定义AuthorizationHandler实现复杂逻辑3. 动态权限 通过数据库驱动，支持运行时修改权限配置4. 性能优化使用缓存、减少数据库查询实际项目中，建议先使用角色+策略的组合，当业务复杂度提升时再引入动态权限系统。记住：授权系统的设计应该与业务模型紧密配合，而不是过度设计。希望这篇文章能帮助你构建更健壮的.NET Core应用授权系统。