ABP框架源码学习之授权逻辑

asp.net core的默认的几种授权方法参考“雨夜朦胧”的系列博客，这里要强调的是asp.net core mvc中的授权和asp.net mvc中的授权不一样，建议先看前面“雨夜朦胧”的博客。

Abp中Controller里面用到的权限验证类为：AbpMvcAuthorizeAttribute，ApplicationService里面用到的权限验证类为：AbpAuthorizeAttribute（见下图）。

AbpMvcAuthorizeAttribute和AbpAuthorizeAttribute这两个类全部继承自IAbpAuthorizeAttribute（重要！！！），下面是这两个类的源码。

 namespace Abp.Authorization
 {
     /// <summary>
     /// This attribute is used on a method of an Application Service (A class that implements <see cref="IApplicationService"/>)
     /// to make that method usable only by authorized users.
     /// </summary>
     [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true)]
     public class AbpAuthorizeAttribute : Attribute, IAbpAuthorizeAttribute
     {
         /// <summary>
         /// A list of permissions to authorize.
         /// </summary>
         public string[] Permissions { get; }

         /// <summary>
         /// If this property is set to true, all of the <see cref="Permissions"/> must be granted.
         /// If it's false, at least one of the <see cref="Permissions"/> must be granted.
         /// Default: false.
         /// </summary>
         public bool RequireAllPermissions { get; set; }

         /// <summary>
         /// Creates a new instance of <see cref="AbpAuthorizeAttribute"/> class.
         /// </summary>
         /// <param name="permissions">A list of permissions to authorize</param>
         public AbpAuthorizeAttribute(params string[] permissions)
         {
             Permissions = permissions;
         }
     }
 }

 namespace Abp.AspNetCore.Mvc.Authorization
 {
     /// <summary>
     /// This attribute is used on an action of an MVC <see cref="Controller"/>
     /// to make that action usable only by authorized users.
     /// </summary>
     [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true)]
     public class AbpMvcAuthorizeAttribute : AuthorizeAttribute, IAbpAuthorizeAttribute
     {
         /// <inheritdoc/>
         public string[] Permissions { get; set; }

         /// <inheritdoc/>
         public bool RequireAllPermissions { get; set; }

         /// <summary>
         /// Creates a new instance of <see cref="AbpMvcAuthorizeAttribute"/> class.
         /// </summary>
         /// <param name="permissions">A list of permissions to authorize</param>
         public AbpMvcAuthorizeAttribute(params string[] permissions)
         {
             Permissions = permissions;
         }
     }
 }

重点来啦！！！

 namespace Abp.AspNetCore.Mvc.Authorization
 {
     public class AbpAuthorizationFilter : IAsyncAuthorizationFilter, ITransientDependency
     {
         public ILogger Logger { get; set; }

         private readonly IAuthorizationHelper _authorizationHelper;
         private readonly IErrorInfoBuilder _errorInfoBuilder;
         private readonly IEventBus _eventBus;

         public AbpAuthorizationFilter(
             IAuthorizationHelper authorizationHelper,
             IErrorInfoBuilder errorInfoBuilder,
             IEventBus eventBus)
         {
             _authorizationHelper = authorizationHelper;
             _errorInfoBuilder = errorInfoBuilder;
             _eventBus = eventBus;
             Logger = NullLogger.Instance;
         }

         public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
         {
             // 判断context中是否有继承IAllowAnoymousFilter,有则跳出方法即验证成功
             if (context.Filters.Any(item => item is IAllowAnonymousFilter))
             {
                 return;
             }
 　　　　　　　//判断是否是Controller，具体方法见下面第一张截图
             if (!context.ActionDescriptor.IsControllerAction())
             {
                 return;
             }

             //TODO: Avoid using try/catch, use conditional checking
             try
             {
                 await _authorizationHelper.AuthorizeAsync(
                     context.ActionDescriptor.GetMethodInfo(),
                     context.ActionDescriptor.GetMethodInfo().DeclaringType
                 );
             }
             catch (AbpAuthorizationException ex)
             {
                 Logger.Warn(ex.ToString(), ex);

                 _eventBus.Trigger(this, new AbpHandledExceptionData(ex));

                 if (ActionResultHelper.IsObjectResult(context.ActionDescriptor.GetMethodInfo().ReturnType))
                 {
                     context.Result = new ObjectResult(new AjaxResponse(_errorInfoBuilder.BuildForException(ex), true))
                     {
                         StatusCode = context.HttpContext.User.Identity.IsAuthenticated
                             ? (int) System.Net.HttpStatusCode.Forbidden
                             : (int) System.Net.HttpStatusCode.Unauthorized
                     };
                 }
                 else
                 {
                     context.Result = new ChallengeResult();
                 }
             }
             catch (Exception ex)
             {
                 Logger.Error(ex.ToString(), ex);

                 _eventBus.Trigger(this, new AbpHandledExceptionData(ex));

                 if (ActionResultHelper.IsObjectResult(context.ActionDescriptor.GetMethodInfo().ReturnType))
                 {
                     context.Result = new ObjectResult(new AjaxResponse(_errorInfoBuilder.BuildForException(ex)))
                     {
                         StatusCode = (int) System.Net.HttpStatusCode.InternalServerError
                     };
                 }
                 else
                 {
                     //TODO: How to return Error page?
                     context.Result = new StatusCodeResult((int)System.Net.HttpStatusCode.InternalServerError);
                 }
             }
         }
     }
 }

 

AbpAuthorizationFilter继承自IAsyncAuthorizationFilter和ITransientDependency，其中继承自ITransientDependency 是为了注入这个类，继承IAsyncAuthorizationFilter这个接口下面会写到。

其中AbpAuthorizationFilter类的OnAuthorizationAsync这个方法是验证授权的最重要的一个地方，其中_authorizationHelper.AuthorizeAsync是通过反射得到是否有继承自IAbpAuthorizeAttribute接口的特性，即AbpMvcAuthorizeAttribute和AbpAuthorizeAttribute，然后得到这个特性标识的权限，然后PermissionChecker检验用户是否具有这个权限。

 

现在我们知道AbpAuthorizationFilter的主要任务就是通过判断controller或者service的标识的权限对比用户是否具有这个权限来达到授权验证。那AbpAuthorizationFilter怎么触发的呢，也就是什么时候调用的呢，，从下图我们可以看出当我们调用AddAbp这个方法时，也就是在Startup类里面调用AddAbp时，就会在MvcOptions里面FilterCollection里面添加AbpAuthorizationFilter，当我们访问一个Controller或者ApplicationService时就会触发这个filter，判断权限。

拓展：当我们有某个业务需要用到AOP时，但又不想使用一些第三方框架，我们就可以借鉴上面的方法，定义一个特性，然后定义一个Filter，在Filter里面判断Controller等是否使用这些特性，并且特性的属性是否符合我们的需求，最后在Startup里面AddMvc时将这个Filter添加到FilterCollection里面。例如下图，自动验证AntiforgeryToken