xiongyuxing/tiku-backend.net
1
0
Fork 1
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

feat: add api security foundation

Browse Source
This commit is contained in:
xiong
2026-07-26 12:46:42 +08:00
parent f31977ef9a
commit e8b03c57bc
20 changed files with 436 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
Directory.Packages.props
View File

@@ -11,6 +11,8 @@
<PrivateAssets>all</PrivateAssets>
</PackageVersion>
<PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.10" />
<PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.10" />
<PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.10" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10">
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
@@ -24,10 +26,11 @@
<PackageVersion Include="Npgsql" Version="10.0.3" />
<PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.3" />
<PackageVersion Include="Scalar.AspNetCore" Version="2.16.16" />
<PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.19.2" />
<PackageVersion Include="xunit" Version="2.9.3" />
<PackageVersion Include="xunit.runner.visualstudio" Version="3.1.4">
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
<PrivateAssets>all</PrivateAssets>
</PackageVersion>
</ItemGroup>
</Project>
</Project>

46
Tiku.Api/Controllers/SecurityDiagnosticsController.cs Normal file
View File

@@ -0,0 +1,46 @@
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Tiku.Application.Security;
namespace Tiku.Api.Controllers;
[ApiController]
[ApiExplorerSettings(IgnoreApi = true)]
[Route("api/_security")]
public sealed class SecurityDiagnosticsController(
ICurrentUser currentUser,
ICurrentTenant currentTenant) : ControllerBase
{
[Authorize(Policy = TikuPolicies.AuthenticatedUser)]
[HttpGet("authenticated")]
public ActionResult<object> Authenticated()
{
return Ok(new
{
currentUser.UserId,
currentUser.IsAuthenticated
});
}
[Authorize(Policy = TikuPolicies.CurrentTenantMember)]
[HttpGet("tenant-member")]
public ActionResult<object> TenantMember()
{
return Ok(new
{
currentTenant.TenantId,
currentTenant.Role
});
}
[Authorize(Policy = TikuPolicies.TenantAdmin)]
[HttpGet("tenant-admin")]
public ActionResult<object> TenantAdmin()
{
return Ok(new
{
currentTenant.TenantId,
currentTenant.Role
});
}
}

16
Tiku.Api/Middleware/CurrentPrincipalMiddleware.cs Normal file
View File

@@ -0,0 +1,16 @@
using Tiku.Application.Security;
namespace Tiku.Api.Middleware;
public sealed class CurrentPrincipalMiddleware(RequestDelegate next)
{
public async Task InvokeAsync(
HttpContext context,
ICurrentUser currentUser,
ICurrentTenant currentTenant)
{
currentUser.Load(context.User);
currentTenant.Load(context.User);
await next(context);
}
}

33
Tiku.Api/Middleware/ExceptionHandlingMiddleware.cs Normal file
View File

@@ -0,0 +1,33 @@
using Microsoft.AspNetCore.Mvc;
namespace Tiku.Api.Middleware;
public sealed class ExceptionHandlingMiddleware(
RequestDelegate next,
ILogger<ExceptionHandlingMiddleware> logger,
IHostEnvironment environment)
{
public async Task InvokeAsync(HttpContext context)
{
try
{
await next(context);
}
catch (Exception exception)
{
logger.LogError(exception, "Unhandled API exception");
var problem = new ProblemDetails
{
Title = "An unexpected error occurred.",
Status = StatusCodes.Status500InternalServerError,
Detail = environment.IsDevelopment() ? exception.Message : null,
Instance = context.Request.Path
};
problem.Extensions["traceId"] = context.TraceIdentifier;
context.Response.StatusCode = StatusCodes.Status500InternalServerError;
await context.Response.WriteAsJsonAsync(problem);
}
}
}

19
Tiku.Api/Options/JwtOptions.cs Normal file
View File

@@ -0,0 +1,19 @@
using Microsoft.IdentityModel.Tokens;
using System.Text;
namespace Tiku.Api.Options;
public sealed class JwtOptions
{
public string Issuer { get; set; } = "tiku-backend";
public string Audience { get; set; } = "tiku-api";
public string SigningKey { get; set; } = "development-only-tiku-signing-key-change-before-production";
public int AccessTokenMinutes { get; set; } = 30;
public int RefreshTokenDays { get; set; } = 30;
public SymmetricSecurityKey CreateSecurityKey()
{
ArgumentException.ThrowIfNullOrWhiteSpace(SigningKey);
return new SymmetricSecurityKey(Encoding.UTF8.GetBytes(SigningKey));
}
}

88
Tiku.Api/Program.cs
View File

@@ -1,40 +1,86 @@
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using Scalar.AspNetCore;
using Tiku.Api.Middleware;
using Tiku.Api.Options;
using Tiku.Api.Security;
using Tiku.Application;
using Tiku.Application.Security;
using Tiku.Infrastructure;
var builder = WebApplication.CreateBuilder(args);
// Add services to the container.
// Learn more about configuring OpenAPI at https://aka.ms/aspnet/openapi
builder.Services.AddControllers();
builder.Services.AddOpenApi();
builder.Services.AddProblemDetails();
builder.Services.AddApplication();
var connectionString =
builder.Configuration.GetConnectionString("Database") ??
builder.Configuration["DATABASE_URL"] ??
"Host=localhost;Database=tiku;Username=postgres";
builder.Services.AddInfrastructure(connectionString);
builder.Services.Configure<JwtOptions>(builder.Configuration.GetSection("Security:Jwt"));
var jwtOptions = builder.Configuration
.GetSection("Security:Jwt")
.Get<JwtOptions>() ?? new JwtOptions();
builder.Services
.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options =>
{
options.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuer = true,
ValidIssuer = jwtOptions.Issuer,
ValidateAudience = true,
ValidAudience = jwtOptions.Audience,
ValidateIssuerSigningKey = true,
IssuerSigningKey = jwtOptions.CreateSecurityKey(),
ValidateLifetime = true,
ClockSkew = TimeSpan.FromMinutes(1)
};
});
builder.Services.AddAuthorization(options =>
{
options.AddPolicy(
TikuPolicies.AuthenticatedUser,
policy => policy.RequireAuthenticatedUser());
options.AddPolicy(
TikuPolicies.CurrentTenantMember,
policy => policy
.RequireAuthenticatedUser()
.RequireAssertion(context => TenantRoleAuthorization.IsTenantMember(context.User)));
options.AddPolicy(
TikuPolicies.TenantAdmin,
policy => policy
.RequireAuthenticatedUser()
.RequireAssertion(context => TenantRoleAuthorization.IsTenantAdmin(context.User)));
});
var app = builder.Build();
// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
app.MapOpenApi();
app.MapScalarApiReference();
}
app.UseMiddleware<ExceptionHandlingMiddleware>();
app.UseHttpsRedirection();
app.UseAuthentication();
app.UseMiddleware<CurrentPrincipalMiddleware>();
app.UseAuthorization();
var summaries = new[]
{
"Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
};
app.MapGet("/weatherforecast", () =>
{
var forecast = Enumerable.Range(1, 5).Select(index =>
new WeatherForecast
(
DateOnly.FromDateTime(DateTime.Now.AddDays(index)),
Random.Shared.Next(-20, 55),
summaries[Random.Shared.Next(summaries.Length)]
))
.ToArray();
return forecast;
})
.WithName("GetWeatherForecast");
app.MapControllers();
app.Run();
public partial class Program;
record WeatherForecast(DateOnly Date, int TemperatureC, string? Summary)
{
public int TemperatureF => 32 + (int)(TemperatureC / 0.5556);

30
Tiku.Api/Security/TenantRoleAuthorization.cs Normal file
View File

@@ -0,0 +1,30 @@
using System.Security.Claims;
using Tiku.Application.Security;
using Tiku.Domain.Tenancy;
namespace Tiku.Api.Security;
internal static class TenantRoleAuthorization
{
private static readonly HashSet<string> AdminRoles = new(StringComparer.Ordinal)
{
TenantRole.PlatformAdmin.ToString(),
TenantRole.TenantOwner.ToString(),
TenantRole.TenantAdmin.ToString()
};
public static bool IsTenantMember(ClaimsPrincipal principal)
{
return principal.Identity?.IsAuthenticated == true &&
principal.HasClaim(claim => claim.Type == TikuClaimTypes.TenantId);
}
public static bool IsTenantAdmin(ClaimsPrincipal principal)
{
return IsTenantMember(principal) &&
principal.Claims
.Where(claim => claim.Type == TikuClaimTypes.TenantRole)
.Select(claim => claim.Value)
.Any(role => AdminRoles.Contains(role));
}
}

2
Tiku.Api/Tiku.Api.csproj
View File

@@ -12,9 +12,11 @@
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" />
<PackageReference Include="Microsoft.AspNetCore.OpenApi" />
<PackageReference Include="Microsoft.OpenApi" />
<PackageReference Include="Scalar.AspNetCore" />
<PackageReference Include="System.IdentityModel.Tokens.Jwt" />
</ItemGroup>
</Project>

9
Tiku.Api/appsettings.json
View File

@@ -5,5 +5,14 @@
"Microsoft.AspNetCore": "Warning"
}
},
"Security": {
"Jwt": {
"Issuer": "tiku-backend",
"Audience": "tiku-api",
"SigningKey": "development-only-tiku-signing-key-change-before-production",
"AccessTokenMinutes": 30,
"RefreshTokenDays": 30
}
},
"AllowedHosts": "*"
}

15
Tiku.Application/DependencyInjection.cs Normal file
View File

@@ -0,0 +1,15 @@
using Microsoft.Extensions.DependencyInjection;
using Tiku.Application.Security;
namespace Tiku.Application;
public static class DependencyInjection
{
public static IServiceCollection AddApplication(this IServiceCollection services)
{
services.AddScoped<ICurrentUser, CurrentUser>();
services.AddScoped<ICurrentTenant, CurrentTenant>();
return services;
}
}

17
Tiku.Application/Security/ClaimsPrincipalExtensions.cs Normal file
View File

@@ -0,0 +1,17 @@
using System.Security.Claims;
namespace Tiku.Application.Security;
internal static class ClaimsPrincipalExtensions
{
public static string? FindValue(this ClaimsPrincipal principal, string claimType)
{
return principal.FindFirst(claimType)?.Value;
}
public static Guid? FindGuid(this ClaimsPrincipal principal, string claimType)
{
var value = principal.FindValue(claimType);
return Guid.TryParse(value, out var guid) ? guid : null;
}
}

16
Tiku.Application/Security/CurrentTenant.cs Normal file
View File

@@ -0,0 +1,16 @@
using System.Security.Claims;
namespace Tiku.Application.Security;
public sealed class CurrentTenant : ICurrentTenant
{
public Guid? TenantId { get; private set; }
public string? Role { get; private set; }
public bool IsResolved => TenantId.HasValue;
public void Load(ClaimsPrincipal principal)
{
TenantId = principal.FindGuid(TikuClaimTypes.TenantId);
Role = principal.FindValue(TikuClaimTypes.TenantRole);
}
}

21
Tiku.Application/Security/CurrentUser.cs Normal file
View File

@@ -0,0 +1,21 @@
using System.Security.Claims;
namespace Tiku.Application.Security;
public sealed class CurrentUser : ICurrentUser
{
public Guid? UserId { get; private set; }
public Guid? SessionId { get; private set; }
public string? Phone { get; private set; }
public string? Email { get; private set; }
public bool IsAuthenticated { get; private set; }
public void Load(ClaimsPrincipal principal)
{
IsAuthenticated = principal.Identity?.IsAuthenticated == true;
UserId = principal.FindGuid(TikuClaimTypes.UserId);
SessionId = principal.FindGuid(TikuClaimTypes.SessionId);
Phone = principal.FindValue(TikuClaimTypes.Phone);
Email = principal.FindValue(TikuClaimTypes.Email);
}
}

11
Tiku.Application/Security/ICurrentTenant.cs Normal file
View File

@@ -0,0 +1,11 @@
using System.Security.Claims;
namespace Tiku.Application.Security;
public interface ICurrentTenant
{
Guid? TenantId { get; }
string? Role { get; }
bool IsResolved { get; }
void Load(ClaimsPrincipal principal);
}

13
Tiku.Application/Security/ICurrentUser.cs Normal file
View File

@@ -0,0 +1,13 @@
using System.Security.Claims;
namespace Tiku.Application.Security;
public interface ICurrentUser
{
Guid? UserId { get; }
Guid? SessionId { get; }
string? Phone { get; }
string? Email { get; }
bool IsAuthenticated { get; }
void Load(ClaimsPrincipal principal);
}

13
Tiku.Application/Security/TikuClaimTypes.cs Normal file
View File

@@ -0,0 +1,13 @@
using System.Security.Claims;
namespace Tiku.Application.Security;
public static class TikuClaimTypes
{
public const string UserId = "tiku:user_id";
public const string TenantId = "tiku:tenant_id";
public const string SessionId = "tiku:session_id";
public const string TenantRole = "tiku:tenant_role";
public const string Phone = ClaimTypes.MobilePhone;
public const string Email = ClaimTypes.Email;
}

8
Tiku.Application/Security/TikuPolicies.cs Normal file
View File

@@ -0,0 +1,8 @@
namespace Tiku.Application.Security;
public static class TikuPolicies
{
public const string AuthenticatedUser = "authenticated_user";
public const string CurrentTenantMember = "current_tenant_member";
public const string TenantAdmin = "tenant_admin";
}

4
Tiku.Application/Tiku.Application.csproj
View File

@@ -4,6 +4,10 @@
<ProjectReference Include="..\Tiku.Domain\Tiku.Domain.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
</ItemGroup>
<PropertyGroup>
<TargetFramework>net10.0</TargetFramework>
<ImplicitUsings>enable</ImplicitUsings>

90
Tiku.IntegrationTests/Api/SecurityFoundationTests.cs Normal file
View File

@@ -0,0 +1,90 @@
using System.IdentityModel.Tokens.Jwt;
using System.Net;
using System.Security.Claims;
using Microsoft.AspNetCore.Mvc.Testing;
using Microsoft.IdentityModel.Tokens;
using Tiku.Api.Options;
using Tiku.Application.Security;
using Tiku.Domain.Tenancy;
namespace Tiku.IntegrationTests.Api;
public sealed class SecurityFoundationTests
{
private static readonly JwtOptions JwtOptions = new()
{
Issuer = "tiku-backend",
Audience = "tiku-api",
SigningKey = "development-only-tiku-signing-key-change-before-production"
};
[Fact]
public async Task Authenticated_policy_returns_unauthorized_without_token()
{
await using var factory = CreateFactory();
using var client = factory.CreateClient();
var response = await client.GetAsync("/api/_security/authenticated");
Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
}
[Fact]
public async Task Tenant_admin_policy_returns_forbidden_for_non_admin_member()
{
await using var factory = CreateFactory();
using var client = factory.CreateClient();
client.DefaultRequestHeaders.Authorization = new(
"Bearer",
CreateToken([
new Claim(TikuClaimTypes.UserId, Guid.NewGuid().ToString()),
new Claim(TikuClaimTypes.TenantId, Guid.NewGuid().ToString()),
new Claim(TikuClaimTypes.TenantRole, TenantRole.Student.ToString())
]));
var response = await client.GetAsync("/api/_security/tenant-admin");
Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
}
[Fact]
public async Task Controller_pipeline_loads_authenticated_current_user()
{
var userId = Guid.NewGuid();
await using var factory = CreateFactory();
using var client = factory.CreateClient();
client.DefaultRequestHeaders.Authorization = new(
"Bearer",
CreateToken([
new Claim(TikuClaimTypes.UserId, userId.ToString())
]));
var response = await client.GetAsync("/api/_security/authenticated");
var body = await response.Content.ReadAsStringAsync();
Assert.Equal(HttpStatusCode.OK, response.StatusCode);
Assert.Contains(userId.ToString(), body, StringComparison.OrdinalIgnoreCase);
Assert.Contains("true", body, StringComparison.OrdinalIgnoreCase);
}
private static WebApplicationFactory<Program> CreateFactory()
{
return new WebApplicationFactory<Program>();
}
private static string CreateToken(IEnumerable<Claim> claims)
{
var credentials = new SigningCredentials(
JwtOptions.CreateSecurityKey(),
SecurityAlgorithms.HmacSha256);
var token = new JwtSecurityToken(
JwtOptions.Issuer,
JwtOptions.Audience,
claims,
expires: DateTime.UtcNow.AddMinutes(5),
signingCredentials: credentials);
return new JwtSecurityTokenHandler().WriteToken(token);
}
}

3
Tiku.IntegrationTests/Tiku.IntegrationTests.csproj
View File

@@ -22,6 +22,7 @@
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
<PrivateAssets>all</PrivateAssets>
</PackageReference>
<PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" />
<PackageReference Include="Microsoft.NET.Test.Sdk" />
<PackageReference Include="xunit" />
<PackageReference Include="xunit.runner.visualstudio">
@@ -30,4 +31,4 @@
</PackageReference>
</ItemGroup>
</Project>
</Project>