public class User:IdentityUser<long>
    {
        //創(chuàng)建時(shí)間
        public DateTime CreationTime { get; set; }
        //昵稱
        public string? NickName { get; set; }
        //JWT版本（解決JWT撤回問(wèn)題）
        public long JWTVersion { get; set; }
    }

public class Role:IdentityRole<long>{}

public class IdDbContext : IdentityDbContext<User, Role, long>
    {
        public IdDbContext(DbContextOptions<IdDbContext> options) : base(options)
        {

        }
        protected override void OnModelCreating(ModelBuilder modelBuilder)
        {
            base.OnModelCreating(modelBuilder);
            modelBuilder.ApplyConfigurationsFromAssembly(this.GetType().Assembly);
        }
    }

IServiceCollection services = builder.Services;
//對(duì)IdDbContext進(jìn)行配置
services.AddDbContext<IdDbContext>(opt =>
{
    string connStr = builder.Configuration.GetConnectionString("Default");
    Console.WriteLine("字符連接："+connStr);
    opt.UseSqlServer(connStr);
});
services.AddDataProtection();
//調(diào)用AddIdentityCore添加標(biāo)識(shí)框架的一些重要的基礎(chǔ)服務(wù)
//(我們沒有調(diào)用AddIdentity方法，因?yàn)锳ddIdentity方法實(shí)現(xiàn)的初始化
// 比較適合傳統(tǒng)的MVC模式的項(xiàng)目，而現(xiàn)在我們推薦用前后端分離開發(fā)模式。)
services.AddIdentityCore<User>(options =>
{
    // 對(duì)密碼復(fù)雜度苛刻設(shè)置
    options.Password.RequireDigit = false;
    options.Password.RequireLowercase = false;
    options.Password.RequireNonAlphanumeric = false;
    options.Password.RequireUppercase = false;
    options.Password.RequiredLength = 6;
    options.Tokens.PasswordResetTokenProvider = TokenOptions.DefaultEmailProvider;
    options.Tokens.EmailConfirmationTokenProvider = TokenOptions.DefaultEmailProvider;
});
var idBuilder = new IdentityBuilder(typeof(User), typeof(Role), services);
//因?yàn)閁serManager、RoleManager等服務(wù)被創(chuàng)建的時(shí)候需要注入非常多的服務(wù)，
//所以我們?cè)谑褂脴?biāo)識(shí)框架的時(shí)候也需要注入和初始化非常多的服務(wù)
idBuilder.AddEntityFrameworkStores<IdDbContext>()
    .AddDefaultTokenProviders()
    .AddRoleManager<RoleManager<Role>>()
    .AddUserManager<UserManager<User>>();

"ConnectionStrings": {
    "Default": "Data Source=.;Database=Identity;User ID=sa;Password=123456;MultipleActiveResultSets=True;Encrypt=False"
  }

class MyDesignTimeDbContextFactory : IDesignTimeDbContextFactory<IdDbContext>
{
    public IdDbContext CreateDbContext(string[] args)
    {
        DbContextOptionsBuilder<IdDbContext> builder = new();
        string connStr = Environment.GetEnvironmentVariable("ConnectionStrings:Default");
        builder.UseSqlServer(connStr);
        return new IdDbContext(builder.Options);
    }
}

"JWT": {
    "SigningKey": "這里請(qǐng)自定義輸入一串復(fù)雜的密鑰",
    "ExpireSeconds": "86400"
  }

public class JWTOptions
    {
        public string SigningKey { get; set; }
        public int ExpireSeconds { get; set; }
    }

//jwt驗(yàn)證授權(quán)
services.Configure<JWTOptions>(builder.Configuration.GetSection("JWT"));//獲取配置文件的JWT的key和過(guò)期時(shí)間放到JWTOptions類中
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(x =>
{
    var jwtOpt = builder.Configuration.GetSection("JWT").Get<JWTOptions>();
    byte[] keyBytes = Encoding.UTF8.GetBytes(jwtOpt.SigningKey);
    var secKey = new SymmetricSecurityKey(keyBytes);
    x.TokenValidationParameters = new()
    {
        ValidateIssuer = false,
        ValidateAudience = false,
        ValidateLifetime = true,
        ValidateIssuerSigningKey = true,
        IssuerSigningKey = secKey
    };
});

app.UseAuthentication();

[Route("api/[controller]/[action]")]
    [ApiController]
    public class JWTController : ControllerBase
    {
        private readonly UserManager<User> _userManager;

        public JWTController(UserManager<User> userManager)
        {
            _userManager = userManager;
        }
        /// <summary>
        /// 生成token的方法
        /// </summary>
        /// <param name="claims"></param>
        /// <param name="options"></param>
        /// <returns></returns>
        private static string BuildToken(IEnumerable<Claim> claims, JWTOptions options)
        {
            //token到期時(shí)間
            DateTime expires = DateTime.Now.AddSeconds(options.ExpireSeconds);
            //取出配置文件的key
            byte[] keyBytes = Encoding.UTF8.GetBytes(options.SigningKey);
            //對(duì)稱安全密鑰
            var secKey = new SymmetricSecurityKey(keyBytes);
            //加密證書
            var credentials = new SigningCredentials(secKey, SecurityAlgorithms.HmacSha256Signature);
            //jwt安全token
            var tokenDescriptor = new JwtSecurityToken(expires: expires, signingCredentials: credentials, claims: claims);

            return new JwtSecurityTokenHandler().WriteToken(tokenDescriptor);
        }
        /// <summary>
        /// 前端獲取token的接口
        /// </summary>
        /// <param name="req"></param>
        /// <param name="jwtOptions"></param>
        /// <returns></returns>
        [HttpPost]
        public async Task<IActionResult> Login2(LoginRequest req, [FromServices] IOptions<JWTOptions> jwtOptions)
        {
            string userName = req.UserName;
            string password = req.Password;
            var user = await _userManager.FindByNameAsync(userName);
            if (user == null)
            {
                return NotFound($"用戶名不存在{userName}");
            }
            var success = await _userManager.CheckPasswordAsync(user, password);
            if (!success)
            {
                return BadRequest("Failed");
            }
            user.JWTVersion++;//版本號(hào)
            await _userManager.UpdateAsync(user);//先把數(shù)據(jù)庫(kù)用戶版本號(hào)更新！?。。?/span>
            var claims = new List<Claim>();
            claims.Add(new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()));
            claims.Add(new Claim(ClaimTypes.Name, user.UserName));
            claims.Add(new Claim(ClaimTypes.Version, user.JWTVersion.ToString()));
            var roles = await _userManager.GetRolesAsync(user);
            foreach (string role in roles)
            {
                claims.Add(new Claim(ClaimTypes.Role, role));
            }
            string jwtToken = BuildToken(claims, jwtOptions.Value);
            return Ok(jwtToken);
        }
    }

[Route("api/[controller]")]
    [ApiController]
    [Authorize]
    public class Test2Controller : ControllerBase
    {
        [HttpGet]
        public IActionResult Hello()
        {
            string id = this.User.FindFirst(ClaimTypes.NameIdentifier)!.Value;
            string userName = this.User.FindFirst(ClaimTypes.NameIdentifier)!.Value;
            IEnumerable<Claim> roleClaims = this.User.FindAll(ClaimTypes.Role);
            string roleNames = string.Join(',', roleClaims.Select(c => c.Value));
            return Ok($"id={id},userName={userName},roleNames ={roleNames}");
        }
    }

builder.Services.AddSwaggerGen(c =>
{
    var scheme = new OpenApiSecurityScheme()
    {
        Description = "Authorization header. \r\nExample: 'Bearer 12345abcdef'",
        Reference = new OpenApiReference
        {
            Type = ReferenceType.SecurityScheme,
            Id = "Authorization"
        },
        Scheme = "oauth2",
        Name = "Authorization",
        In = ParameterLocation.Header,
        Type = SecuritySchemeType.ApiKey,
    };
    c.AddSecurityDefinition("Authorization", scheme);
    var requirement = new OpenApiSecurityRequirement();
    requirement[scheme] = new List<string>();
    c.AddSecurityRequirement(requirement);
});

public class JWTValidationFilter : IAsyncActionFilter
    {
        private IMemoryCache memCache;
        private UserManager<User> userMgr;

        public JWTValidationFilter(IMemoryCache memCache, UserManager<User> userMgr)
        {
            this.memCache = memCache;
            this.userMgr = userMgr;
        }

        public async Task   OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
        {
            var claimUserId = context.HttpContext.User.FindFirst(ClaimTypes.NameIdentifier);
            //對(duì)于登錄接口等沒有登錄的，直接跳過(guò)
            if (claimUserId == null)
            {
                await next();
                return;
            }
            long userId = long.Parse(claimUserId!.Value);
            string cacheKey = $"JWTValidationFilter.UserInfo.{userId}";
            User user = await memCache.GetOrCreateAsync(cacheKey, async e => {
                e.AbsoluteExpirationRelativeToNow = TimeSpan.FromSeconds(5);
                return await userMgr.FindByIdAsync(userId.ToString());
            });
            if (user == null)
            {
                var result = new ObjectResult($"UserId({userId}) not found");
                result.StatusCode = (int)HttpStatusCode.Unauthorized;
                context.Result = result;
                return;
            }
            //jwt數(shù)據(jù)庫(kù)中保存的版本號(hào)
            var claimVersion = context.HttpContext.User.FindFirst(ClaimTypes.Version);            
            long jwtVerOfReq = long.Parse(claimVersion!.Value);
            //由于內(nèi)存緩存等導(dǎo)致的并發(fā)問(wèn)題，
            //假如集群的A服務(wù)器中緩存保存的還是版本為5的數(shù)據(jù)，但客戶端提交過(guò)來(lái)的可能已經(jīng)是版本號(hào)為6的數(shù)據(jù)。因此只要是客戶端提交的版本號(hào)>=服務(wù)器上取出來(lái)（可能是從Db，也可能是從緩存）的版本號(hào)，那么也是可以的
            if (jwtVerOfReq >= user.JWTVersion)
            {
                await next();
            }
            else
            {
                var result = new ObjectResult($"JWTVersion mismatch");
                result.StatusCode = (int)HttpStatusCode.Unauthorized;
                context.Result = result;
                return;
            }
        }
    }

//過(guò)濾器
builder.Services.Configure<MvcOptions>(ops =>
{
    ops.Filters.Add<JWTValidationFilter>();
});

//內(nèi)存緩存
builder.Services.AddMemoryCache();