224 lines
9.5 KiB
C#
224 lines
9.5 KiB
C#
using Atomx.Admin.Client.Utils;
|
||
using Atomx.Common.Models;
|
||
using Blazored.LocalStorage;
|
||
using Microsoft.AspNetCore.Components;
|
||
using System.Net.Http.Headers;
|
||
using System.Text;
|
||
using System.Text.Json;
|
||
|
||
namespace Atomx.Admin.Client.Utils
|
||
{
|
||
/// <summary>
|
||
/// 请求拦截器（WASM 模式主要运行在浏览器端）
|
||
/// 功能：
|
||
/// - 在每次请求时将 access token 附带到 Authorization header
|
||
/// - 在收到 401 或响应头包含 "Token-Expired" 时，尝试使用本地保存的 refresh token 调用 /api/sign/refresh
|
||
/// - 刷新成功：更新本地存储中的 accessToken/refreshToken，然后重试原请求一次
|
||
/// - 刷新失败：跳转到登录页
|
||
/// 说明：
|
||
/// - 该实现依赖于 Blazored.LocalStorage（key 名称为 "accessToken" 和 "refreshToken"），
|
||
/// 若你在项目中使用不同的键名，请统一替换。
|
||
/// - 为避免并发刷新，使用一个静态 SemaphoreSlim 进行序列化刷新请求。
|
||
/// </summary>
|
||
public class AuthHeaderHandler : DelegatingHandler
|
||
{
|
||
private readonly ITokenProvider _tokenProvider;
|
||
private readonly NavigationManager _navigationManager;
|
||
private readonly ILogger<AuthHeaderHandler> _logger;
|
||
private readonly ILocalStorageService _localStorage;
|
||
private readonly IHttpClientFactory _httpClientFactory;
|
||
private static readonly SemaphoreSlim _refreshLock = new(1, 1);
|
||
|
||
// 本地存储键名（可按需修改）
|
||
private const string AccessTokenKey = "accessToken";
|
||
private const string RefreshTokenKey = "refreshToken";
|
||
|
||
public AuthHeaderHandler(
|
||
ITokenProvider tokenProvider,
|
||
NavigationManager navigationManager,
|
||
ILogger<AuthHeaderHandler> logger,
|
||
ILocalStorageService localStorage,
|
||
IHttpClientFactory httpClientFactory)
|
||
{
|
||
_tokenProvider = tokenProvider;
|
||
_navigationManager = navigationManager;
|
||
_logger = logger;
|
||
_localStorage = localStorage;
|
||
_httpClientFactory = httpClientFactory;
|
||
}
|
||
|
||
protected override async Task<HttpResponseMessage> SendAsync(
|
||
HttpRequestMessage request, CancellationToken cancellationToken)
|
||
{
|
||
try
|
||
{
|
||
// 1) 尝试从 token provider 获取并添加 Authorization header
|
||
var token = await _tokenProvider.GetTokenAsync();
|
||
if (!string.IsNullOrEmpty(token))
|
||
{
|
||
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
|
||
}
|
||
else
|
||
{
|
||
_logger.LogDebug("No token from ITokenProvider for request {Url}", request.RequestUri);
|
||
}
|
||
|
||
var response = await base.SendAsync(request, cancellationToken);
|
||
|
||
// 2) 检查 401 或 Token-Expired header
|
||
if (response.StatusCode == System.Net.HttpStatusCode.Unauthorized ||
|
||
response.Headers.Contains("Token-Expired"))
|
||
{
|
||
_logger.LogInformation("Unauthorized or Token-Expired detected for {Url}", request.RequestUri);
|
||
|
||
// 仅在浏览器（WASM）模式下自动刷新；在 Server 模式交由服务器端处理
|
||
if (OperatingSystem.IsBrowser())
|
||
{
|
||
var refreshed = await TryRefreshTokenAsync(cancellationToken);
|
||
|
||
if (refreshed)
|
||
{
|
||
// 获取新的 token 并重试请求（一次）
|
||
var newToken = await _localStorage.GetItemAsync<string>(AccessTokenKey);
|
||
if (!string.IsNullOrEmpty(newToken))
|
||
{
|
||
// 克隆原始请求（HttpRequestMessage 只能发送一次）
|
||
var clonedRequest = await CloneHttpRequestMessageAsync(request, newToken);
|
||
return await base.SendAsync(clonedRequest, cancellationToken);
|
||
}
|
||
}
|
||
|
||
// 刷新失败，重定向登录
|
||
_navigationManager.NavigateTo("/account/login", true);
|
||
}
|
||
else
|
||
{
|
||
// Server 模式：记录日志，允许上层中间件决定下一步（不进行自动跳转）
|
||
_logger.LogWarning("Unauthorized in server mode for {Url}", request.RequestUri);
|
||
}
|
||
}
|
||
|
||
return response;
|
||
}
|
||
catch (Exception ex)
|
||
{
|
||
_logger.LogError(ex, "Error sending HTTP request to {Url}", request.RequestUri);
|
||
throw;
|
||
}
|
||
}
|
||
|
||
/// <summary>
|
||
/// 尝试使用本地保存的 refresh token 调用刷新接口
|
||
/// API 约定：
|
||
/// POST /api/sign/refresh
|
||
/// Body: { token: "...", refreshToken: "..." }
|
||
/// 返回: AuthResponse { Token, RefreshToken, TokenExpiry }
|
||
/// </summary>
|
||
private async Task<bool> TryRefreshTokenAsync(CancellationToken cancellationToken)
|
||
{
|
||
// 串行化刷新，防止多请求同时触发重复刷新
|
||
await _refreshLock.WaitAsync(cancellationToken);
|
||
try
|
||
{
|
||
var currentAccess = await _localStorage.GetItemAsync<string>(AccessTokenKey);
|
||
var currentRefresh = await _localStorage.GetItemAsync<string>(RefreshTokenKey);
|
||
|
||
if (string.IsNullOrEmpty(currentAccess) || string.IsNullOrEmpty(currentRefresh))
|
||
{
|
||
_logger.LogInformation("No local tokens to refresh");
|
||
return false;
|
||
}
|
||
|
||
// 调用刷新接口（使用 IHttpClientFactory 创建短期 HttpClient）
|
||
var client = _httpClientFactory.CreateClient(); // 默认 client，建议在 Program.cs 中配置 BaseAddress
|
||
var reqModel = new
|
||
{
|
||
token = currentAccess,
|
||
refreshToken = currentRefresh
|
||
};
|
||
var reqJson = JsonSerializer.Serialize(reqModel);
|
||
using var req = new HttpRequestMessage(HttpMethod.Post, "api/sign/refresh")
|
||
{
|
||
Content = new StringContent(reqJson, Encoding.UTF8, "application/json")
|
||
};
|
||
|
||
try
|
||
{
|
||
var resp = await client.SendAsync(req, cancellationToken);
|
||
if (!resp.IsSuccessStatusCode)
|
||
{
|
||
_logger.LogWarning("Refresh request failed with status {Status}", resp.StatusCode);
|
||
return false;
|
||
}
|
||
|
||
var json = await resp.Content.ReadAsStringAsync(cancellationToken);
|
||
var authResp = JsonSerializer.Deserialize<AuthResponse>(json, new JsonSerializerOptions
|
||
{
|
||
PropertyNameCaseInsensitive = true
|
||
});
|
||
|
||
if (authResp == null || string.IsNullOrEmpty(authResp.Token) || string.IsNullOrEmpty(authResp.RefreshToken))
|
||
{
|
||
_logger.LogWarning("Invalid response from refresh endpoint");
|
||
return false;
|
||
}
|
||
|
||
// 保存新的 token（本地存储）
|
||
await _localStorage.SetItemAsync(AccessTokenKey, authResp.Token, cancellationToken);
|
||
await _localStorage.SetItemAsync(RefreshTokenKey, authResp.RefreshToken, cancellationToken);
|
||
|
||
_logger.LogInformation("Token refreshed successfully");
|
||
return true;
|
||
}
|
||
catch (Exception ex)
|
||
{
|
||
_logger.LogError(ex, "Exception while requesting token refresh");
|
||
return false;
|
||
}
|
||
}
|
||
finally
|
||
{
|
||
_refreshLock.Release();
|
||
}
|
||
}
|
||
|
||
/// <summary>
|
||
/// 复制 HttpRequestMessage 并替换 Authorization header 为新的 token
|
||
/// </summary>
|
||
private static async Task<HttpRequestMessage> CloneHttpRequestMessageAsync(HttpRequestMessage original, string newToken)
|
||
{
|
||
var clone = new HttpRequestMessage(original.Method, original.RequestUri);
|
||
|
||
// Copy request content (if any)
|
||
if (original.Content != null)
|
||
{
|
||
var ms = new MemoryStream();
|
||
await original.Content.CopyToAsync(ms).ConfigureAwait(false);
|
||
ms.Position = 0;
|
||
clone.Content = new StreamContent(ms);
|
||
|
||
// copy content headers
|
||
if (original.Content.Headers != null)
|
||
{
|
||
foreach (var h in original.Content.Headers)
|
||
clone.Content.Headers.Add(h.Key, h.Value);
|
||
}
|
||
}
|
||
|
||
// copy headers
|
||
foreach (var header in original.Headers)
|
||
clone.Headers.TryAddWithoutValidation(header.Key, header.Value);
|
||
|
||
// set new auth header
|
||
clone.Headers.Authorization = new AuthenticationHeaderValue("Bearer", newToken);
|
||
|
||
// copy properties
|
||
foreach (var prop in original.Options)
|
||
{
|
||
// HttpRequestOptions 不直接序列化拷贝，这里通常无需处理
|
||
}
|
||
|
||
return clone;
|
||
}
|
||
}
|
||
} |