chore: 同步当前开发内容

2025-11-23 01:25:20 +08:00
parent ddf584f212
commit 1169e1f220
58 changed files with 1886 additions and 82 deletions
--- a/src/Infrastructure/TakeoutSaaS.Infrastructure/Identity/Services/JwtTokenService.cs
+++ b/src/Infrastructure/TakeoutSaaS.Infrastructure/Identity/Services/JwtTokenService.cs
@@ -0,0 +1,93 @@
+using System;
+using System.Collections.Generic;
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Tokens;
+using TakeoutSaaS.Application.Identity.Abstractions;
+using TakeoutSaaS.Application.Identity.Contracts;
+using TakeoutSaaS.Infrastructure.Identity.Options;
+
+namespace TakeoutSaaS.Infrastructure.Identity.Services;
+
+/// <summary>
+/// JWT 令牌生成器。
+/// </summary>
+public sealed class JwtTokenService : IJwtTokenService
+{
+    private readonly JwtSecurityTokenHandler _tokenHandler = new();
+    private readonly IRefreshTokenStore _refreshTokenStore;
+    private readonly JwtOptions _options;
+
+    public JwtTokenService(IRefreshTokenStore refreshTokenStore, IOptions<JwtOptions> options)
+    {
+        _refreshTokenStore = refreshTokenStore;
+        _options = options.Value;
+    }
+
+    public async Task<TokenResponse> CreateTokensAsync(CurrentUserProfile profile, bool isNewUser = false, CancellationToken cancellationToken = default)
+    {
+        var now = DateTime.UtcNow;
+        var accessExpires = now.AddMinutes(_options.AccessTokenExpirationMinutes);
+        var refreshExpires = now.AddMinutes(_options.RefreshTokenExpirationMinutes);
+
+        var claims = BuildClaims(profile);
+        var signingCredentials = new SigningCredentials(
+            new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_options.Secret)),
+            SecurityAlgorithms.HmacSha256);
+
+        var jwt = new JwtSecurityToken(
+            issuer: _options.Issuer,
+            audience: _options.Audience,
+            claims: claims,
+            notBefore: now,
+            expires: accessExpires,
+            signingCredentials: signingCredentials);
+
+        var accessToken = _tokenHandler.WriteToken(jwt);
+        var refreshDescriptor = await _refreshTokenStore.IssueAsync(profile.UserId, refreshExpires, cancellationToken);
+
+        return new TokenResponse
+        {
+            AccessToken = accessToken,
+            AccessTokenExpiresAt = accessExpires,
+            RefreshToken = refreshDescriptor.Token,
+            RefreshTokenExpiresAt = refreshDescriptor.ExpiresAt,
+            User = profile,
+            IsNewUser = isNewUser
+        };
+    }
+
+    private static IEnumerable<Claim> BuildClaims(CurrentUserProfile profile)
+    {
+        var userId = profile.UserId.ToString();
+        var claims = new List<Claim>
+        {
+            new(JwtRegisteredClaimNames.Sub, userId),
+            new(ClaimTypes.NameIdentifier, userId),
+            new(JwtRegisteredClaimNames.UniqueName, profile.Account),
+            new("tenant_id", profile.TenantId.ToString()),
+            new(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())
+        };
+
+        if (profile.MerchantId.HasValue)
+        {
+            claims.Add(new Claim("merchant_id", profile.MerchantId.Value.ToString()));
+        }
+
+        foreach (var role in profile.Roles)
+        {
+            claims.Add(new Claim(ClaimTypes.Role, role));
+        }
+
+        foreach (var permission in profile.Permissions)
+        {
+            claims.Add(new Claim("permission", permission));
+        }
+
+        return claims;
+    }
+}
--- a/src/Infrastructure/TakeoutSaaS.Infrastructure/Identity/Services/RedisLoginRateLimiter.cs
+++ b/src/Infrastructure/TakeoutSaaS.Infrastructure/Identity/Services/RedisLoginRateLimiter.cs
@@ -0,0 +1,52 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Caching.Distributed;
+using Microsoft.Extensions.Options;
+using TakeoutSaaS.Application.Identity.Abstractions;
+using TakeoutSaaS.Infrastructure.Identity.Options;
+using TakeoutSaaS.Shared.Abstractions.Constants;
+using TakeoutSaaS.Shared.Abstractions.Exceptions;
+
+namespace TakeoutSaaS.Infrastructure.Identity.Services;
+
+/// <summary>
+/// Redis 登录限流实现。
+/// </summary>
+public sealed class RedisLoginRateLimiter : ILoginRateLimiter
+{
+    private readonly IDistributedCache _cache;
+    private readonly LoginRateLimitOptions _options;
+
+    public RedisLoginRateLimiter(IDistributedCache cache, IOptions<LoginRateLimitOptions> options)
+    {
+        _cache = cache;
+        _options = options.Value;
+    }
+
+    public async Task EnsureAllowedAsync(string key, CancellationToken cancellationToken = default)
+    {
+        var cacheKey = BuildKey(key);
+        var current = await _cache.GetStringAsync(cacheKey, cancellationToken);
+        var count = string.IsNullOrWhiteSpace(current) ? 0 : int.Parse(current);
+        if (count >= _options.MaxAttempts)
+        {
+            throw new BusinessException(ErrorCodes.Forbidden, "尝试次数过多，请稍后再试");
+        }
+
+        count++;
+        await _cache.SetStringAsync(
+            cacheKey,
+            count.ToString(),
+            new DistributedCacheEntryOptions
+            {
+                AbsoluteExpirationRelativeToNow = TimeSpan.FromSeconds(_options.WindowSeconds)
+            },
+            cancellationToken);
+    }
+
+    public Task ResetAsync(string key, CancellationToken cancellationToken = default)
+        => _cache.RemoveAsync(BuildKey(key), cancellationToken);
+
+    private static string BuildKey(string key) => $"identity:login:{key}";
+}
--- a/src/Infrastructure/TakeoutSaaS.Infrastructure/Identity/Services/RedisRefreshTokenStore.cs
+++ b/src/Infrastructure/TakeoutSaaS.Infrastructure/Identity/Services/RedisRefreshTokenStore.cs
@@ -0,0 +1,63 @@
+using System;
+using System.Security.Cryptography;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Caching.Distributed;
+using Microsoft.Extensions.Options;
+using TakeoutSaaS.Application.Identity.Abstractions;
+using TakeoutSaaS.Application.Identity.Models;
+using TakeoutSaaS.Infrastructure.Identity.Options;
+
+namespace TakeoutSaaS.Infrastructure.Identity.Services;
+
+/// <summary>
+/// Redis 刷新令牌存储。
+/// </summary>
+public sealed class RedisRefreshTokenStore : IRefreshTokenStore
+{
+    private static readonly JsonSerializerOptions JsonOptions = new(JsonSerializerDefaults.Web);
+    private readonly IDistributedCache _cache;
+    private readonly RefreshTokenStoreOptions _options;
+
+    public RedisRefreshTokenStore(IDistributedCache cache, IOptions<RefreshTokenStoreOptions> options)
+    {
+        _cache = cache;
+        _options = options.Value;
+    }
+
+    public async Task<RefreshTokenDescriptor> IssueAsync(Guid userId, DateTime expiresAt, CancellationToken cancellationToken = default)
+    {
+        var token = Convert.ToBase64String(RandomNumberGenerator.GetBytes(48));
+        var descriptor = new RefreshTokenDescriptor(token, userId, expiresAt, false);
+
+        var key = BuildKey(token);
+        var entryOptions = new DistributedCacheEntryOptions { AbsoluteExpiration = expiresAt };
+        await _cache.SetStringAsync(key, JsonSerializer.Serialize(descriptor, JsonOptions), entryOptions, cancellationToken);
+
+        return descriptor;
+    }
+
+    public async Task<RefreshTokenDescriptor?> GetAsync(string refreshToken, CancellationToken cancellationToken = default)
+    {
+        var json = await _cache.GetStringAsync(BuildKey(refreshToken), cancellationToken);
+        return string.IsNullOrWhiteSpace(json)
+            ? null
+            : JsonSerializer.Deserialize<RefreshTokenDescriptor>(json, JsonOptions);
+    }
+
+    public async Task RevokeAsync(string refreshToken, CancellationToken cancellationToken = default)
+    {
+        var descriptor = await GetAsync(refreshToken, cancellationToken);
+        if (descriptor == null)
+        {
+            return;
+        }
+
+        var updated = descriptor with { Revoked = true };
+        var entryOptions = new DistributedCacheEntryOptions { AbsoluteExpiration = updated.ExpiresAt };
+        await _cache.SetStringAsync(BuildKey(refreshToken), JsonSerializer.Serialize(updated, JsonOptions), entryOptions, cancellationToken);
+    }
+
+    private string BuildKey(string token) => $"{_options.Prefix}{token}";
+}
--- a/src/Infrastructure/TakeoutSaaS.Infrastructure/Identity/Services/WeChatAuthService.cs
+++ b/src/Infrastructure/TakeoutSaaS.Infrastructure/Identity/Services/WeChatAuthService.cs
@@ -0,0 +1,79 @@
+using System;
+using System.Net.Http;
+using System.Net.Http.Json;
+using System.Text.Json.Serialization;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Options;
+using TakeoutSaaS.Application.Identity.Abstractions;
+using TakeoutSaaS.Infrastructure.Identity.Options;
+using TakeoutSaaS.Shared.Abstractions.Constants;
+using TakeoutSaaS.Shared.Abstractions.Exceptions;
+
+namespace TakeoutSaaS.Infrastructure.Identity.Services;
+
+/// <summary>
+/// 微信 code2Session 实现
+/// </summary>
+public sealed class WeChatAuthService : IWeChatAuthService
+{
+    private readonly HttpClient _httpClient;
+    private readonly WeChatMiniOptions _options;
+
+    public WeChatAuthService(HttpClient httpClient, IOptions<WeChatMiniOptions> options)
+    {
+        _httpClient = httpClient;
+        _options = options.Value;
+    }
+
+    public async Task<WeChatSessionInfo> Code2SessionAsync(string code, CancellationToken cancellationToken = default)
+    {
+        var requestUri = $"sns/jscode2session?appid={Uri.EscapeDataString(_options.AppId)}&secret={Uri.EscapeDataString(_options.Secret)}&js_code={Uri.EscapeDataString(code)}&grant_type=authorization_code";
+        using var response = await _httpClient.GetAsync(requestUri, cancellationToken);
+        response.EnsureSuccessStatusCode();
+
+        var payload = await response.Content.ReadFromJsonAsync<WeChatSessionResponse>(cancellationToken: cancellationToken);
+        if (payload == null)
+        {
+            throw new BusinessException(ErrorCodes.Unauthorized, "微信登录失败：响应为空");
+        }
+
+        if (payload.ErrorCode.HasValue && payload.ErrorCode.Value != 0)
+        {
+            var message = string.IsNullOrWhiteSpace(payload.ErrorMessage)
+                ? $"微信登录失败，错误码：{payload.ErrorCode}"
+                : payload.ErrorMessage;
+            throw new BusinessException(ErrorCodes.Unauthorized, message);
+        }
+
+        if (string.IsNullOrWhiteSpace(payload.OpenId) || string.IsNullOrWhiteSpace(payload.SessionKey))
+        {
+            throw new BusinessException(ErrorCodes.Unauthorized, "微信登录失败：返回数据无效");
+        }
+
+        return new WeChatSessionInfo
+        {
+            OpenId = payload.OpenId,
+            UnionId = payload.UnionId,
+            SessionKey = payload.SessionKey
+        };
+    }
+
+    private sealed class WeChatSessionResponse
+    {
+        [JsonPropertyName("openid")]
+        public string? OpenId { get; set; }
+
+        [JsonPropertyName("unionid")]
+        public string? UnionId { get; set; }
+
+        [JsonPropertyName("session_key")]
+        public string? SessionKey { get; set; }
+
+        [JsonPropertyName("errcode")]
+        public int? ErrorCode { get; set; }
+
+        [JsonPropertyName("errmsg")]
+        public string? ErrorMessage { get; set; }
+    }
+}