IESETL/CMS/Extension/Jwt/JwtHelper.cs

using CMS.Context;
using CMS.Extension.Jwt;
using IdentityModel;
using Microsoft.Extensions.Configuration;
using Microsoft.IdentityModel.Tokens;
using Newtonsoft.Json.Linq;
using System;
using System.Collections;
using System.Collections.Generic;
using System.IdentityModel.Tokens.Jwt;
using System.Linq;
using System.Security.Claims;
using System.Security.Cryptography;
using System.Threading.Tasks;
using TEAMModelOS.SDK.Extension.JwtAuth.Models;
using TEAMModelOS.SDK.Helper.Common.JsonHelper;
using TEAMModelOS.SDK.Helper.Security.RSACrypt;

namespace HiTeachCE.Extension
{
    public class JwtHelper
    {
        /// <summary>
        /// 颁发JWT Token
        /// </summary>
        /// <param name="claimModel"></param>
        /// <param name="tokenModel"></param>
        /// <returns></returns>
        public static JwtResponse IssueJWT(ClaimModel claimModel)
        {
            // JwtClient jwtClient = null;
            Extension.JwtSetting setting = BaseConfigModel.Configuration.GetSection("JwtSetting").Get<Extension.JwtSetting>();
            JwtClient jwtClient = setting.JwtClient.Where(x => x.Name.Equals(claimModel.Scope)).First();
            //foreach (JwtClient client in setting.JwtClient) {
            //    if (claimModel.Scope.Equals(client.Name)) {
            //        jwtClient = client;
            //        break; 
            //    }
            //}
            List<Claim> claims = new List<Claim>();
            var dateTime = new DateTimeOffset(DateTime.UtcNow).ToUnixTimeSeconds();
            claims.AddRange(claimModel.Claims);
            claims.Add(new Claim(JwtClaimTypes.IssuedAt, dateTime + "", ClaimValueTypes.Integer64));
            claims.Add(new Claim(JwtClaimTypes.NotBefore, dateTime + "", ClaimValueTypes.Integer64));
            claims.Add(new Claim(JwtClaimTypes.Expiration, dateTime + jwtClient.Exp + "", ClaimValueTypes.Integer64));
            claims.Add(new Claim(JwtClaimTypes.Audience, setting.Audience));
            claims.Add(new Claim(JwtClaimTypes.Issuer, setting.Issuer));
            claims.Add(new Claim(JwtClaimTypes.Scope, claimModel.Scope));
            claims.Add(new Claim(JwtClaimTypes.JwtId, Guid.NewGuid().ToString()));
            //claims.AddRange(claimModel.Roles.Select(s=>new Claim(JwtClaimTypes.Role, s)));
            //claims.AddRange(claimModel.Claims.Select(s => new Claim(ClaimTypes.Role, s)));
            string path = BaseConfigModel.ContentRootPath;
            var creds = RsaHelper.GenerateSigningCredentials(path + "/private.pem");
            var jwt = new JwtSecurityToken(
                issuer: setting.Issuer,
                claims: claims,
                signingCredentials: creds
                );
            var jwtHandler = new JwtSecurityTokenHandler();
            return new JwtResponse
            {
               // Token_type = "Bearer",
                Access_token = jwtHandler.WriteToken(jwt),
                Scope = claimModel.Scope
            };
        }
        /// <summary>
        /// 解析jwt
        /// </summary>
        /// <param name="jwtStr"></param>
        /// <returns></returns>
        public static ClaimModel SerializeJWT(string jwtStr)
        {

            ///https://www.cnblogs.com/JacZhu/p/6837676.html#Update2.0  刷新     用户的 Token 在过期时间之内根本无法手动设置失效，随之而来的还有重放攻击等等问题


            var jwtHandler = new JwtSecurityTokenHandler();
            if (string.IsNullOrEmpty(jwtStr))
            {
                return null;
            }
            JwtSecurityToken jwtToken = jwtHandler.ReadJwtToken(jwtStr);
            jwtToken.Payload.TryGetValue(JwtClaimTypes.Role, out object role);
            ClaimModel claimModel = new ClaimModel();
            Dictionary<string, object> claimDict = new Dictionary<string, object>();
            foreach (Claim claim in jwtToken.Claims)
            {
                claimDict.TryAdd(claim.Type, claim.Value);
            }
            claimDict[JwtClaimTypes.Role] = role;
            claimModel.Claim = claimDict;
            claimModel.Claims = jwtToken.Claims.ToList();
            return claimModel;
        }
    }
}