"DefaultConnection": "Server=localhost;Database=DynamicPermissions;
Trusted_Connection=True;MultipleActiveResultSets=true"

我已创建NavigationMenu来存储菜单名称和RoleMenuPermission实体来存储角色权限。

[Table(name: "AspNetNavigationMenu")]
public class NavigationMenu
{[Key][DatabaseGenerated(DatabaseGeneratedOption.Identity)]public Guid Id { get; set; }public string Name { get; set; }[ForeignKey("ParentNavigationMenu")]public Guid? ParentMenuId { get; set; }public virtual NavigationMenu ParentNavigationMenu { get; set; }public string Area { get; set; }public string ControllerName { get; set; }public string ActionName { get; set; }public bool IsExternal { get; set; }public string ExternalUrl { get; set; }public int DisplayOrder { get; set; }[NotMapped]public bool Permitted { get; set; }public bool Visible { get; set; }
}[Table(name: "AspNetRoleMenuPermission")]
public class RoleMenuPermission
{public string RoleId { get; set; }public Guid NavigationMenuId { get; set; }public NavigationMenu NavigationMenu { get; set; }
}

这里是我的数据库上下文，我们重写OnModelCreating来定义RoleId及NavigationMenuId作为键，因为我们并不需要为这个表标识键。

public class ApplicationDbContext : IdentityDbContext
{public ApplicationDbContext(DbContextOptions<ApplicationDbContext> options): base(options){}public DbSet<RoleMenuPermission> RoleMenuPermission { get; set; }public DbSet<NavigationMenu> NavigationMenu { get; set; }protected override void OnModelCreating(ModelBuilder builder){builder.Entity<RoleMenuPermission>().HasKey(c => new { c.RoleId, c.NavigationMenuId});base.OnModelCreating(builder);}
}

迁移

add-migration InitialVersion

这是我的数据库表，如下所示：

new NavigationMenu()
{Id = new Guid("F704BDFD-D3EA-4A6F-9463-DA47ED3657AB"),Name = "External Google Link",ControllerName = "",ActionName = "",IsExternal = true,ExternalUrl = "https://www.google.com/",ParentMenuId = new Guid("13e2f21a-4283-4ff8-bb7a-096e7b89e0f0"),DisplayOrder=2,Visible = true,
},
new NavigationMenu()
{Id = new Guid("913BF559-DB46-4072-BD01-F73F3C92E5D5"),Name = "Create Role",ControllerName = "Admin",ActionName = "CreateRole",ParentMenuId = new Guid("13e2f21a-4283-4ff8-bb7a-096e7b89e0f0"),DisplayOrder=3,Visible = true,
},
new NavigationMenu()
{Id = new Guid("3C1702C5-C34F-4468-B807-3A1D5545F734"),Name = "Edit User",ControllerName = "Admin",ActionName = "EditUser",ParentMenuId = new Guid("13e2f21a-4283-4ff8-bb7a-096e7b89e0f0"),DisplayOrder=3,Visible = false,
},
new NavigationMenu()
{Id = new Guid("94C22F11-6DD2-4B9C-95F7-9DD4EA1002E6"),Name = "Edit Role Permission",ControllerName = "Admin",ActionName = "EditRolePermission",ParentMenuId = new Guid("13e2f21a-4283-4ff8-bb7a-096e7b89e0f0"),DisplayOrder=3,Visible = false,
},

在先前的实现中，我在数据服务中添加了两个新功能。

public async Task<List<NavigationMenuViewModel>> GetPermissionsByRoleIdAsync(string id)
{var items = await (from m in _context.NavigationMenujoin rm in _context.RoleMenuPermissionon new { X1 = m.Id, X2 = id } equals new { X1 = rm.NavigationMenuId, X2 = rm.RoleId }into rmpfrom rm in rmp.DefaultIfEmpty()select new NavigationMenuViewModel(){Id = m.Id,Name = m.Name,Area = m.Area,ActionName = m.ActionName,ControllerName = m.ControllerName,IsExternal = m.IsExternal,ExternalUrl = m.ExternalUrl,DisplayOrder = m.DisplayOrder,ParentMenuId = m.ParentMenuId,Visible = m.Visible,Permitted = rm.RoleId == id}).AsNoTracking().ToListAsync();return items;
}//Remove old permissions for that role id and assign changed permissionspublic async Task<bool> SetPermissionsByRoleIdAsync(string id, IEnumerable<Guid> permissionIds)
{var existing = await _context.RoleMenuPermission.Where(x => x.RoleId == id).ToListAsync();_context.RemoveRange(existing);foreach (var item in permissionIds){await _context.RoleMenuPermission.AddAsync(new RoleMenuPermission(){RoleId = id,NavigationMenuId = item,});}var result = await _context.SaveChangesAsync();return result > 0;
}

这是我的Admin控制器，有关操作的详细实现，我们可以在zip中查看代码。简单的实现，没有魔术代码:)。我们只需要将[Authorize("Authorization")]放在任何要告诉应用程序验证授权的操作上，或者如果所有操作都受到保护，则可以在控制器级别使用它。

[Authorize("Authorization")]
public class AdminController : Controller
{private readonly UserManager<IdentityUser> _userManager;private readonly RoleManager<IdentityRole> _roleManager;private readonly IDataAccessService _dataAccessService;private readonly ILogger<AdminController> _logger;public AdminController(UserManager<IdentityUser> userManager,RoleManager<IdentityRole> roleManager,IDataAccessService dataAccessService,ILogger<AdminController> logger){_userManager = userManager;_roleManager = roleManager;_dataAccessService = dataAccessService;_logger = logger;}public async Task<IActionResult> Roles() {}[HttpPost]public async Task<IActionResult> CreateRole(RoleViewModel viewModel) {}public async Task<IActionResult> Users() {}public async Task<IActionResult> EditUser(string id){}[HttpPost]public async Task<IActionResult> EditUser(UserViewModel viewModel){}        public async Task<IActionResult> EditRolePermission(string id){}[HttpPost]public async Task<IActionResult> EditRolePermission(string id, List<NavigationMenuViewModel> viewModel){}
}

这是我们呈现复选框列表的方式。

<form asp-action="EditRolePermission"><div class="form-group"><ul style="list-style-type: none;">@for (var i = 0; i < Model.Count; i++){<li><input type="checkbox" asp-for="@Model[i].Permitted" /><label style="margin-left:10px;" asp-for="@Model[i].Permitted">@Model[i].Name</label><input type="hidden" asp-for="@Model[i].Id" /><input type="hidden" asp-for="@Model[i].Name" /></li>}</ul></div><div class="form-group"><input type="submit" value="Save" class="btn btn-primary" /><a asp-action="Roles">Back to List</a></div>
</form>

现在，我们可以通过以下方式使用“Admin User”来运行和测试系统：

public class AuthorizationRequirement : IAuthorizationRequirement { }public class PermissionHandler : AuthorizationHandler<AuthorizationRequirement>
{private readonly IDataAccessService _dataAccessService;public PermissionHandler(IDataAccessService dataAccessService){_dataAccessService = dataAccessService;}protected async override Task HandleRequirementAsync(AuthorizationHandlerContext context, AuthorizationRequirement requirement){if (context.Resource is RouteEndpoint endpoint){endpoint.RoutePattern.RequiredValues.TryGetValue("controller", out var _controller);endpoint.RoutePattern.RequiredValues.TryGetValue("action", out var _action);endpoint.RoutePattern.RequiredValues.TryGetValue("page", out var _page);endpoint.RoutePattern.RequiredValues.TryGetValue("area", out var _area);var isAuthenticated = context.User.Identity.IsAuthenticated;if (isAuthenticated && _controller != null && _action != null &&await _dataAccessService.GetMenuItemsAsync(context.User, _controller.ToString(), _action.ToString())){context.Succeed(requirement);}}}
}

为了演示和限制讨论范围，我们将从数据库中即时检查/验证它，以提高性能，我们可以使用Cache来保留权限，以减少对每个资源访问进行授权检查的数据库调用。可以将角色权限添加到缓存中的用户声明和权限，以提高性能。