/// <summary>
 /// 自定义授权中间件
 /// </summary>
 public class JwtCustomerAuthorizeMiddleware
 {
  private readonly RequestDelegate next;

  public JwtCustomerAuthorizeMiddleware(RequestDelegate next, string secret, List<string> anonymousPathList)
  {
   #region 设置自定义jwt 的秘钥
   if(!string.IsNullOrEmpty(secret))
   {
    TokenContext.securityKey = secret;
   }
   #endregion
   this.next = next;
   UserContext.AllowAnonymousPathList.AddRange(anonymousPathList);
  }

  public async Task Invoke(HttpContext context, UserContext userContext,IOptions<JwtOption> optionContainer)
  {
   if (userContext.IsAllowAnonymous(context.Request.Path))
   {
    await next(context);
    return;
   }

   var option = optionContainer.Value;

   #region 身份验证，并设置用户Ruser值
 
   var result = context.Request.Headers.TryGetValue("Authorization", out StringValues authStr);
   if (!result || string.IsNullOrEmpty(authStr.ToString()))
   {
    throw new UnauthorizedAccessException("未授权");
   }
   result = TokenContext.Validate(authStr.ToString().Substring("Bearer ".Length).Trim(), payLoad =>
   {
    var success = true;
    //可以添加一些自定义验证，用法参照测试用例
    //验证是否包含aud 并等于 roberAudience
    success = success && payLoad["aud"]?.ToString() == option.Audience;
    if (success)
    {
     //设置Ruse值,把user信息放在payLoad中，（在获取jwt的时候把当前用户存放在payLoad的ruser键中）
     //如果用户信息比较多，建议放在缓存中，payLoad中存放缓存的Key值
     userContext.TryInit(payLoad["ruser"]?.ToString());
    }
    return success;
   });
   if (!result)
   {
    throw new UnauthorizedAccessException("未授权");
   }

   #endregion
   #region 权限验证
   if (!userContext.Authorize(context.Request.Path))
   {
    throw new UnauthorizedAccessException("未授权");
   }
   #endregion

   await next(context);
  }
 }

app.UseMiddleware<JwtCustomerAuthorizeMiddleware>(Configuration["JwtOption:SecurityKey"], new List<string>() { "/api/values/getjwt","/" });

public class CommonAuthorizeHandler : AuthorizationHandler<CommonAuthorize>
 {
  /// <summary>
  /// 常用自定义验证策略，模仿自定义中间件JwtCustomerauthorizeMiddleware的验证范围
  /// </summary>
  /// <param name="context"></param>
  /// <param name="requirement"></param>
  /// <returns></returns>
  protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, CommonAuthorize requirement)
  {
   var httpContext = (context.Resource as AuthorizationFilterContext).HttpContext;
   var userContext = httpContext.RequestServices.GetService(typeof(UserContext)) as UserContext;

   var jwtOption = (httpContext.RequestServices.GetService(typeof(IOptions<JwtOption>)) as IOptions<JwtOption>).Value;

   #region 身份验证，并设置用户Ruser值

   var result = httpContext.Request.Headers.TryGetValue("Authorization", out StringValues authStr);
   if (!result || string.IsNullOrEmpty(authStr.ToString()))
   {
    return Task.CompletedTask;
   }
   result = TokenContext.Validate(authStr.ToString().Substring("Bearer ".Length).Trim(), payLoad =>
   {
    var success = true;
    //可以添加一些自定义验证，用法参照测试用例
    //验证是否包含aud 并等于 roberAudience
    success = success && payLoad["aud"]?.ToString() == jwtOption.Audience;
    if (success)
    {
     //设置Ruse值,把user信息放在payLoad中，（在获取jwt的时候把当前用户存放在payLoad的ruser键中）
     //如果用户信息比较多，建议放在缓存中，payLoad中存放缓存的Key值
     userContext.TryInit(payLoad["ruser"]?.ToString());
    }
    return success;
   });
   if (!result)
   {
    return Task.CompletedTask;
   }

   #endregion
   #region 权限验证
   if (!userContext.Authorize(httpContext.Request.Path))
   {
    return Task.CompletedTask;
   }
   #endregion

   context.Succeed(requirement);
   return Task.CompletedTask;
  }
 }
 public class CommonAuthorize: IAuthorizationRequirement
 {

 }

services.AddAuthorization(option =>
   {
    

    #region 自定义验证策略
    option.AddPolicy("common", policy => policy.Requirements.Add(new CommonAuthorize()));
    #endregion


   }).AddAuthentication(option =>
   {
    option.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
   }).AddJwtBearer(option =>
   {
    if (!string.IsNullOrEmpty(config["JwtOption:SecurityKey"]))
    {
     TokenContext.securityKey = config["JwtOption:SecurityKey"];
    }
    //设置需要验证的项目
    option.TokenValidationParameters = new TokenValidationParameters
    {
     
     IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(TokenContext.securityKey))//拿到SecurityKey
    };
   });

   //自定义策略IOC添加
   
   services.AddSingleton<IAuthorizationHandler, CommonAuthorizeHandler>();