Role验证原理

1. AuthorizationPolicy类有三个静态函数：
   
   1. static AuthorizationPolicy Combine(params AuthorizationPolicy[] policies)
   2. static AuthorizationPolicy Combine(IEnumerable<AuthorizationPolicy> policies)
   3. static async Task<AuthorizationPolicy> CombineAsync(IAuthorizationPolicyProvider policyProvider, IEnumerable<IAuthorizeData> authorizeData)
   4. 分析第三个函数，这个函数的第三个参数类型为IEnumerable<IAuthorizeData>，IAuthorizeData唯一直接子类为AuthorizeAttribute，简洁说明了这个函数是AuthorizeAttribute解析的帮助函数：通过AuthorizationPolicyBuilder解析IAuthorizeData的Policy Roles AuthenticationSchemes，然后靠Build()创建AuthorizationPolicy

2. 现在走解析Roles分支

   1. 将IAuthorizeData authorizeDatum的Roles按逗号分隔

      string[] array = authorizeDatum.Roles?.Split(new char[1]
      {
          ','
      });

   2. 调用AuthorizationPolicyBuilder类的AuthorizationPolicyBuilder RequireRole(IEnumerable<string> roles)函数

      if (array != null && array.Any())
      {
          policyBuilder.RequireRole(from r in array
          where !string.IsNullOrWhiteSpace(r)
          select r.Trim());
          flag = false;
      }

   3. 显然对Role的限制是依靠RolesAuthorizationRequirement类的

      public AuthorizationPolicyBuilder RequireRole(IEnumerable<string> roles)
      {
          if (roles == null)
          {
              throw new ArgumentNullException("roles");
          }
          Requirements.Add(new RolesAuthorizationRequirement(roles));
          return this;
      }

   4. 怎么验证Role呢？使用ClaimPrincipal.IsInRole()

      public class RolesAuthorizationRequirement : AuthorizationHandler<RolesAuthorizationRequirement>, IAuthorizationRequirement
      {
          public IEnumerable<string> AllowedRoles
          {
              get;
          }
      
          public RolesAuthorizationRequirement(IEnumerable<string> allowedRoles)
          {
              if (allowedRoles == null)
              {
                  throw new ArgumentNullException("allowedRoles");
              }
              if (allowedRoles.Count() == 0)
              {
                  throw new InvalidOperationException(Resources.Exception_RoleRequirementEmpty);
              }
              AllowedRoles = allowedRoles;
          }
      
          protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, RolesAuthorizationRequirement requirement)
          {
              if (context.User != null)
              {
                  bool flag = false;
                  if (requirement.AllowedRoles != null && requirement.AllowedRoles.Any())
                  {
                      flag = requirement.AllowedRoles.Any((string r) => context.User.IsInRole(r));
                  }
                  if (flag)
                  {
                      context.Succeed(requirement);
                  }
              }
              return Task.CompletedTask;
          }
      }