update

TEAMModelOS.SDK/Extension/JwtAuthExtension.cs

@@ -107,6 +107,67 @@ namespace TEAMModelOS.SDK.Extension
             var serializeToken = tokenHandler.WriteToken(secToken);
             return (serializeToken,jti);
         }
+        /// <summary>
+        /// 
+        /// </summary>
+        /// <param name="issuer">颁发者</param>
+        /// <param name="id">第三方合作uuid</param>
+        /// <param name="salt"></param>
+        /// <param name="expire"></param>
+        /// <returns></returns>
+        public static (string jwt, string jti) CreateSchoolApiToken(string location, string id, string salt, string scope, List<int> auth, string schoolID = "")
+        {
+
+            var keys = OpenApiJtwIssuer.OpenApiJtw签发者.GetDescriptionText().Split(',');
+            string issuer = "";
+            if (location.Equals("China-Dep"))
+            {
+                issuer = keys[0];
+            }
+            else if (location.Equals("China-Test"))
+            {
+                issuer = keys[0];
+            }
+            else if (location.Equals("China"))
+            {
+                issuer = keys[1];
+            }
+            else if (location.Equals("Global-Dep"))
+            {
+                issuer = keys[2];
+            }
+            else if (location.Equals("Global-Test"))
+            {
+                issuer = keys[2];
+            }
+            else if (location.Equals("Global"))
+            {
+                issuer = keys[3];
+            }
+            string jti = Guid.NewGuid().ToString();
+            // 設定要加入到 JWT Token 中的聲明資訊(Claims)  
+            var payload = new JwtPayload {
+                { JwtRegisteredClaimNames.Iss, issuer }, //發行者 iss: jwt签发者
+                { JwtRegisteredClaimNames.Sub, id }, // APPID sub: jwt所面向的用户
+                {JwtRegisteredClaimNames.Jti, jti},
+                { "scope",scope},
+                { "auth",auth}, 
+                { JwtRegisteredClaimNames.Azp,schoolID}, // 學校簡碼，如果有的話
+            };
+
+            // 建立一組對稱式加密的金鑰，主要用於 JWT 簽章之用
+            var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(salt));
+            // HmacSha256 有要求必須要大於 128 bits，所以 salt 不能太短，至少要 16 字元以上
+            // https://stackoverflow.com/questions/47279947/idx10603-the-algorithm-hs256-requires-the-securitykey-keysize-to-be-greater
+            var signingCredentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256Signature);
+            var header = new JwtHeader(signingCredentials);
+            var secToken = new JwtSecurityToken(header, payload);
+            // 產出所需要的 JWT securityToken 物件，並取得序列化後的 Token 結果(字串格式)
+            var tokenHandler = new JwtSecurityTokenHandler();
+            //var securityToken = tokenHandler.CreateToken(tokenDescriptor);
+            var serializeToken = tokenHandler.WriteToken(secToken);
+            return (serializeToken, jti);
+        }
 
         public static string CreateApiToken(string issuer, string id, string salt, string name, List<int> auth, string schoolID = "", int expire = 1)
         {

TEAMModelOS.SDK/Models/Table/OpenApi.cs

@@ -167,6 +167,7 @@ namespace TEAMModelOS.SDK.Models
         /// 生成的token
         /// </summary>
         public string token { get; set; }
+        public string jti { get; set; }
         /// <summary>
         /// domain的域名
         /// </summary>

TEAMModelOS/Controllers/System/OpenApiController.cs

@@ -149,7 +149,8 @@ namespace TEAMModelOS.Controllers
                     {
                         using var json = await JsonDocument.ParseAsync(response.ContentStream);
                         var info = json.ToObject<OpenApp>();
-                        request.token = info.token;
+                        request.token = info.token; 
+                        request.jti = info.jti;
                         request = await client.GetContainer(Constant.TEAMModelOS, "School").ReplaceItemAsync(request, info.id, new PartitionKey($"{info.code}"));
                     }
                     else
@@ -191,10 +192,11 @@ namespace TEAMModelOS.Controllers
                     var info = json.ToObject<OpenApp>();
                     //创建Token
                     //域名  应用的id, jwtkey  学校编码
-                    var auth_token = JwtAuthExtension.CreateApiToken(_option.HostName, info.id, _option.JwtSecretKey,info.name, info.auths, info.school);
-                    info.token = auth_token;
+                    var auth_token = JwtAuthExtension.CreateSchoolApiToken(_option.HostName, info.id, _option.JwtSecretKey,info.name, info.auths, info.school);
+                    info.token = auth_token.jwt;
+                    info.jti = auth_token.jti;
                     info = await client.GetContainer(Constant.TEAMModelOS, "School").ReplaceItemAsync(info, info.id, new PartitionKey($"{info.code}"));
-                    return Ok(new { auth_token });
+                    return Ok(new { auth_token = info.token });
                 }
                 else
                 {