调整 .gitignore 以适配 backends 目录结构

将 MiGu.Server 相关忽略规则迁移至 backends/MiGu.Server，并新增对 .tmp-build* 和 /.cursor/rules 的忽略，优化敏感数据与临时文件的管理。
2026-06-22 08:55:55 +08:00
parent 45f0261ed7
commit 87629a8537
46 changed files with 10 additions and 3 deletions
@@ -0,0 +1,100 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Security.Cryptography;
+using System.Text;
+using Microsoft.IdentityModel.Tokens;
+
+namespace MiGu.Server.Auth;
+
+/// <summary>
+/// 平台 JWT 颁发与验签。Secret 从 <c>appsettings.json</c> 的 <c>Jwt:Secret</c> 读取；
+/// 若为占位值 <c>"REPLACE_ME"</c> 则启动期生成临时随机 secret 并在日志里强制告警，
+/// 防止生产部署忘改 secret 导致历史 hardcoded "simple-mock-secret" 风险复现。
+/// </summary>
+public sealed class JwtIssuer
+{
+    /// <summary>占位 secret；启动期检测到时自动换成进程随机值，并在日志里 critical 告警。</summary>
+    public const string PlaceholderSecret = "REPLACE_ME";
+
+    public string Issuer { get; }
+    public string Audience { get; }
+    public TimeSpan Lifetime { get; }
+    public string SecretInUse { get; }
+    public bool SecretIsEphemeral { get; }
+
+    private readonly SymmetricSecurityKey _key;
+    private readonly SigningCredentials _signing;
+    private readonly TokenValidationParameters _validation;
+
+    public JwtIssuer(string secret, string issuer, string audience, TimeSpan lifetime, ILogger<JwtIssuer> logger)
+    {
+        Issuer = issuer;
+        Audience = audience;
+        Lifetime = lifetime;
+
+        if (string.IsNullOrWhiteSpace(secret) || secret == PlaceholderSecret)
+        {
+            // 兜底：用进程随机 secret，保证签名不被预知，但 token 在 MiGu.Server 重启后失效。
+            // 这条路径只应出现在「开发机首次启动」/「忘改配置的部署」，**日志里强制告警让运维注意**。
+            secret = RandomBase64Secret(64);
+            SecretIsEphemeral = true;
+            logger.LogCritical(
+                "Jwt:Secret 是占位值或未配置 —— 已生成进程随机 secret（重启后所有 token 失效）。" +
+                "生产环境必须在 appsettings.Production.json 或环境变量 PLATFORM__JWT__SECRET 配置一个 ≥ 32 字节的稳定 secret。");
+        }
+        else if (Encoding.UTF8.GetByteCount(secret) < 32)
+        {
+            logger.LogWarning("Jwt:Secret 长度不足 32 字节，HS256 推荐 ≥ 32 字节 secret 以达到 256bit 强度。");
+        }
+
+        SecretInUse = secret;
+        _key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secret));
+        _signing = new SigningCredentials(_key, SecurityAlgorithms.HmacSha256);
+        _validation = new TokenValidationParameters
+        {
+            ValidateIssuer = true,
+            ValidateAudience = true,
+            ValidateIssuerSigningKey = true,
+            ValidateLifetime = true,
+            ValidIssuer = Issuer,
+            ValidAudience = Audience,
+            IssuerSigningKey = _key,
+            ClockSkew = TimeSpan.FromSeconds(30),
+        };
+    }
+
+    /// <summary>颁发 access token。<paramref name="ops"/> 写入私有 claim <c>ops</c>（空格分隔，便于后端 <c>[Authorize]</c> policy 解析）。</summary>
+    public string Issue(string userId, string username, string scope, IReadOnlyList<string> roles, IReadOnlyList<string> ops)
+    {
+        var now = DateTime.UtcNow;
+        var claims = new List<Claim>
+        {
+            new(JwtRegisteredClaimNames.Sub, userId),
+            new(JwtRegisteredClaimNames.UniqueName, username),
+            new("scope", scope),
+            new(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString("N")),
+            new(JwtRegisteredClaimNames.Iat, new DateTimeOffset(now).ToUnixTimeSeconds().ToString(), ClaimValueTypes.Integer64),
+            new("ops", string.Join(' ', ops ?? Array.Empty<string>())),
+        };
+        foreach (var r in roles ?? Array.Empty<string>())
+            claims.Add(new Claim(ClaimTypes.Role, r));
+
+        var token = new JwtSecurityToken(
+            issuer: Issuer,
+            audience: Audience,
+            claims: claims,
+            notBefore: now,
+            expires: now.Add(Lifetime),
+            signingCredentials: _signing);
+        return new JwtSecurityTokenHandler().WriteToken(token);
+    }
+
+    /// <summary>给框架的 JwtBearer middleware 用的验证参数（启动期注入到 AddJwtBearer）。</summary>
+    public TokenValidationParameters BuildValidationParameters() => _validation;
+
+    private static string RandomBase64Secret(int byteLen)
+    {
+        var buf = RandomNumberGenerator.GetBytes(byteLen);
+        return Convert.ToBase64String(buf);
+    }
+}