安全与认证授权

builder.Services.AddDbContext<IdentityDbContext>(opt =>
    opt.UseSqlServer(builder.Configuration.GetConnectionString("Default")));

builder.Services.AddDefaultIdentity<IdentityUser>(options =>
{
    options.Password.RequireDigit = true;
    options.Password.RequiredLength = 8;
    options.User.RequireUniqueEmail = true;
})
.AddRoles<IdentityRole>()
.AddEntityFrameworkStores<IdentityDbContext>();

var app = builder.Build();

app.UseAuthentication(); // 建立用户身份
app.UseAuthorization();  // 执行授权策略

// 受保护的页面/接口
app.MapGet("/account", (ClaimsPrincipal user) =>
    $"你好，{user.Identity?.Name}")
   .RequireAuthorization();

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidIssuer = "orders-api",
            ValidateAudience = true,
            ValidAudience = "orders-clients",
            ValidateLifetime = true,
            IssuerSigningKey = new SymmetricSecurityKey(
                Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]!)),
            ClockSkew = TimeSpan.FromMinutes(1)
        };
    });

builder.Services.AddAuthorization();

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();

// 签发令牌
public static string CreateToken(IdentityUser user, string secret)
{
    var claims = new[]
    {
        new Claim(JwtRegisteredClaimNames.Sub, user.Id),
        new Claim(JwtRegisteredClaimNames.Email, user.Email ?? "")
    };
    var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secret));
    var token = new JwtSecurityToken(
        issuer: "orders-api",
        audience: "orders-clients",
        claims: claims,
        expires: DateTime.UtcNow.AddHours(2),
        signingCredentials: new SigningCredentials(key, SecurityAlgorithms.HmacSha256));
    return new JwtSecurityTokenHandler().WriteToken(token);
}

builder.Services.AddAuthentication()
    .AddOpenIdConnect("oidc", options =>
    {
        options.Authority = "https://login.example.com";   // IdP 地址
        options.ClientId = "orders-web";
        options.ClientSecret = "client-secret";
        options.ResponseType = "code";                      // 授权码模式
        options.Scope.Add("openid");
        options.Scope.Add("profile");
        options.SaveTokens = true;
        options.GetClaimsFromUserInfoEndpoint = true;
    });

builder.Services.AddAuthorization(options =>
{
    // 基于角色的策略
    options.AddPolicy("AdminOnly", policy => policy.RequireRole("Admin"));

    // 基于声明的策略
    options.AddPolicy("CanDeleteOrder", policy =>
        policy.RequireAssertion(ctx =>
            ctx.User.IsInRole("Admin") ||
            ctx.User.HasClaim(c => c.Type == "order.scope" && c.Value == "delete")));

    // 基于资源的策略
    options.AddPolicy("OwnOrder", policy =>
        policy.Requirements.Add(new OrderOwnerRequirement()));
});

public class OrderOwnerRequirement : IAuthorizationRequirement { }

public class OrderOwnerHandler(IOrderRepository repo) : AuthorizationHandler<OrderOwnerRequirement>
{
    protected override async Task HandleRequirementAsync(
        AuthorizationHandlerContext ctx, OrderOwnerRequirement req)
    {
        var orderId = ctx.Resource?.ToString();
        var order = await repo.GetByIdAsync(int.Parse(orderId ?? "0"));
        if (order is not null && order.OwnerId == ctx.User.FindFirstValue(ClaimTypes.NameIdentifier))
            ctx.Succeed(req);
    }
}

// 使用
[Authorize(Policy = "CanDeleteOrder")]
app.MapDelete("/orders/{id:int}", (int id) => ...);

// 危险：字符串拼接 SQL
// var sql = $"SELECT * FROM Orders WHERE Id = {id}";  // 绝不这样做

// 安全：EF Core 参数化
var order = await _db.Orders
    .FirstOrDefaultAsync(o => o.Id == id);

// 安全：原生 SQL 用参数
var rows = await _db.Database
    .ExecuteSqlInterpolatedAsync($"UPDATE Orders SET Status={status} WHERE Id={id}");

// 数据保护：加密敏感字段
builder.Services.AddDataProtection()
    .PersistKeysToFileSystem(new DirectoryInfo("/app/keys"));

public class TokenProtector(IDataProtectionProvider provider)
{
    private readonly IDataProtector _protector =
        provider.CreateProtector("TokenProtector.v1");

    public string Protect(string plain) => _protector.Protect(plain);
    public string Unprotect(string cipher) => _protector.Unprotect(cipher);
}

app.Use(async (context, next) =>
{
    context.Response.Headers["Content-Security-Policy"] =
        "default-src 'self'; script-src 'self'; img-src 'self' data:;";
    context.Response.Headers["X-Content-Type-Options"] = "nosniff";
    context.Response.Headers["X-Frame-Options"] = "DENY";
    context.Response.Headers["Referrer-Policy"] = "no-referrer";
    await next();
});

// CORS：只允许可信前端源
builder.Services.AddCors(options =>
{
    options.AddPolicy("frontend", policy =>
        policy.WithOrigins("https://app.example.com")
              .AllowCredentials()
              .WithMethods("GET", "POST")
              .WithHeaders("Authorization", "Content-Type"));
});

app.UseCors("frontend");

// 开发：User Secrets
// dotnet user-secrets set "Jwt:Key" "dev-only-key"

// 生产：环境变量（Docker/K8s Secret 注入）
// Jwt__Key 会被绑定到 configuration["Jwt:Key"]

builder.Services.AddSingleton<IJwtKeyProvider>(sp =>
{
    var key = builder.Configuration["Jwt:Key"]
              ?? throw new InvalidOperationException("Jwt:Key 缺失");
    return new JwtKeyProvider(key);
});

// 敏感配置不进配置文件，用 IConfiguration 抽象读取
var conn = builder.Configuration.GetConnectionString("Default");
// 实际连接串来自环境变量或 Vault，而非 appsettings.json