根据roles / api_key生成Swashbuckle API文档

1 回答

• 3

  我现在找到了一个适合我的解决方案 .

  我使用 CustomAuthenticationMessageHandler （与我的问题相同）将规则放入HttpContext .

  public class CustomAuthenticationMessageHandler : DelegatingHandler
      {
          private static Dictionary<string, String[]> allowedApps = new Dictionary<string, String[]>();
          private readonly string authenticationScheme = "Bearer";
          private readonly string queryStringApiKey = "api_key";
  
          public bool AllowMultiple
          {
              get { return false; }
          }
  
          public CustomAuthenticationMessageHandler()
          {
              if (allowedApps.Count == 0)
              {
                  allowedApps.Add("PetLover_api_key", new[] {"PetLover"});
                  allowedApps.Add("CarOwner_api_key", new[] {"CarOwner"});
                  allowedApps.Add("Admin_api_key", new[] {"PetLover", "CarOwner"});
              }
          }
  
          protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
          {
              var req = request;
              Dictionary<string, string> queryStrings = req.GetQueryNameValuePairs().ToDictionary(x => x.Key.ToLower(), x => x.Value);
              string rawAuthzHeader = null;
              if (queryStrings.ContainsKey(queryStringApiKey))
              {
                  rawAuthzHeader = queryStrings[queryStringApiKey];
              }
              else if (req.Headers.Authorization != null && authenticationScheme.Equals(req.Headers.Authorization.Scheme, StringComparison.OrdinalIgnoreCase))
              {
                  rawAuthzHeader = req.Headers.Authorization.Parameter;
              }
              if (rawAuthzHeader != null && allowedApps.ContainsKey(rawAuthzHeader))
              {
                  var currentPrincipal = new GenericPrincipal(new GenericIdentity(rawAuthzHeader), allowedApps[rawAuthzHeader]);
                  request.GetRequestContext().Principal = currentPrincipal;
              }
              else
              {
  
              }
  
              return await base.SendAsync(request, cancellationToken);
          }
      }
  

  我介绍了一个自定义Swashbuckle IDocumentFilter ，它从HttpContext中读出规则，并从SwaggerDocument中删除不允许使用此规则的操作和资源（基于api_key） .

  public class AuthorizeRoleFilter : IDocumentFilter
      {
          public void Apply(SwaggerDocument swaggerDoc, SchemaRegistry schemaRegistry, IApiExplorer apiExplorer)
          {
              IPrincipal user = HttpContext.Current.User;
  
              foreach (ApiDescription apiDescription in apiExplorer.ApiDescriptions)
              {
                  var authorizeAttributes = apiDescription
                      .ActionDescriptor.GetCustomAttributes<AuthorizeAttribute>().ToList();
                  authorizeAttributes.AddRange(apiDescription
                      .ActionDescriptor.ControllerDescriptor.GetCustomAttributes<AuthorizeAttribute>());
  
                  if (!authorizeAttributes.Any())
                      continue;
  
                  var roles =
                      authorizeAttributes
                          .SelectMany(attr => attr.Roles.Split(','))
                          .Distinct()
                          .ToList();
                  if (!user.Identity.IsAuthenticated || !roles.Any(role => user.IsInRole(role) || role == ""))
                  {
                      string key = "/" + apiDescription.RelativePath;
                      PathItem pathItem = swaggerDoc.paths[key];
                      switch (apiDescription.HttpMethod.Method.ToLower())
                      {
                          case "get":
                              pathItem.get = null;
                              break;
                          case "put":
                              pathItem.put = null;
                              break;
                          case "post":
                              pathItem.post = null;
                              break;
                          case "delete":
                              pathItem.delete = null;
                              break;
                          case "options":
                              pathItem.options = null;
                              break;
                          case "head":
                              pathItem.head = null;
                              break;
                          case "patch":
                              pathItem.patch = null;
                              break;
                      }
                      if (pathItem.get == null &&
                          pathItem.put == null &&
                          pathItem.post == null &&
                          pathItem.delete == null &&
                          pathItem.options == null &&
                          pathItem.head == null &&
                          pathItem.patch == null)
                      {
                          swaggerDoc.paths.Remove(key);
                      }
                  }
              }
  
              swaggerDoc.paths = swaggerDoc.paths.Count == 0 ? null : swaggerDoc.paths;
              swaggerDoc.definitions = swaggerDoc.paths == null ? null : swaggerDoc.definitions;
          }
      }
  

  我的WebApiConfig现在看起来像这样 . 我删除了 ApiKeyFilter 因为它不再需要了 .

  WebApiConfig

  public static class WebApiConfig
  {
      public static void Register(HttpConfiguration config)
      {
          // Web API configuration and services
  
          // Web API routes
          config.MapHttpAttributeRoutes();
  
          //config.Filters.Add(new ApiKeyFilter());
  
          config.MessageHandlers.Add(new CustomAuthenticationMessageHandler());
      }
  }
  

  SwaggerConfig

  public class SwaggerConfig
  {
      public static void Register()
      {
          GlobalConfiguration.Configuration
              .EnableSwagger(c =>
              {
                  c.SingleApiVersion("v1", "SwashbuckleExample");
                  c.DocumentFilter<AuthorizeRoleFilter>();
              })
              .EnableSwaggerUi(c => { });
      }
  }
  

  Additional

  在我的项目中，我使用了一个CustomProvider，它根据api_key缓存SwaggerDocument .

  public class CachingSwaggerProvider : ISwaggerProvider
      {
          private static ConcurrentDictionary<string, SwaggerDocument> _cache =
              new ConcurrentDictionary<string, SwaggerDocument>();
  
          private readonly ISwaggerProvider _swaggerProvider;
  
          public CachingSwaggerProvider(ISwaggerProvider swaggerProvider)
          {
              _swaggerProvider = swaggerProvider;
          }
  
          public SwaggerDocument GetSwagger(string rootUrl, string apiVersion)
          {
              HttpContext httpContext = HttpContext.Current;
              string name = httpContext.User.Identity.Name;
              var cacheKey = string.Format("{0}_{1}_{2}", rootUrl, apiVersion, name);
              return _cache.GetOrAdd(cacheKey, (key) => _swaggerProvider.GetSwagger(rootUrl, apiVersion));
          }
      }
  

  回复于 2024-05-02T17:04:49+08:00