初始化 MiGu.Server 项目，包含基本的 ASP.NET Core 8 配置、JWT 鉴权、RBAC 权限管理、YARP 反向代理及相关配置文件。新增 build-and-run 脚本以简化构建与运行流程，添加 README 文档以指导用户快速上手。

2026-06-22 09:29:31 +08:00
parent f2ef32a22b
commit f4dec3c120
45 changed files with 0 additions and 0 deletions
@@ -0,0 +1,82 @@
+using MiGu.Server.Configs;
+
+namespace MiGu.Server.Auth;
+
+/// <summary>
+/// RBAC 角色。一个角色 = 一组「页面 + 操作码 + 控件可见性」授权，归属某个 scope。
+/// <list type="bullet">
+///   <item><see cref="Scope"/>：<c>Platform</c> / <c>RCSMonitor</c> / <c>*</c>（通用，对两个 scope 都生效）。</item>
+///   <item><see cref="Pages"/>：可访问页面 Key 集合（见 <see cref="PageCatalog"/>）；含 <c>*</c> 表示该 scope 全部页面。</item>
+///   <item><see cref="Ops"/>：细粒度操作码（如 <c>ops.car.pause</c>）；含 <c>*</c> 表示全部操作。</item>
+///   <item><see cref="WidgetGrants"/>：控件级可见性（hidden / readonly / interactive）。</item>
+///   <item><see cref="System"/>：内置系统角色，禁止删除（可改名/调权限但保底不被误删）。</item>
+/// </list>
+/// </summary>
+public sealed class RbacRole
+{
+    public string Id { get; set; } = "";
+    public string Name { get; set; } = "";
+    public string Description { get; set; } = "";
+    public string Scope { get; set; } = PageCatalog.ScopePlatform;
+    public List<string> Pages { get; set; } = new();
+    public List<string> Ops { get; set; } = new();
+    public List<WidgetGrantDto> WidgetGrants { get; set; } = new();
+    public bool System { get; set; }
+}
+
+/// <summary>
+/// RBAC 用户。密码以 PBKDF2-SHA256 哈希存储（<see cref="Salt"/> / <see cref="PasswordHash"/> 均为 base64）。
+/// 一个用户可拥有多个角色，其有效权限 = 当前 scope 下各角色授权的并集。
+/// </summary>
+public sealed class RbacUser
+{
+    public string Id { get; set; } = "";
+    public string Username { get; set; } = "";
+    public string DisplayName { get; set; } = "";
+    public bool Enabled { get; set; } = true;
+    public List<string> RoleIds { get; set; } = new();
+    public string Salt { get; set; } = "";
+    public string PasswordHash { get; set; } = "";
+}
+
+/// <summary>rbac.json 的根对象（内存 + 文件持久化）。</summary>
+public sealed class RbacSnapshot
+{
+    public int Version { get; set; } = 1;
+    public List<RbacRole> Roles { get; set; } = new();
+    public List<RbacUser> Users { get; set; } = new();
+}
+
+// ─────────────────────────── API DTO ───────────────────────────
+
+/// <summary>对外用户视图：绝不含 Salt / PasswordHash。<see cref="Scopes"/> 为该用户可登录的 scope 集合。</summary>
+public sealed record RbacUserDto(
+    string Id,
+    string Username,
+    string DisplayName,
+    bool Enabled,
+    List<string> RoleIds,
+    List<string> Scopes);
+
+public sealed record CreateUserRequest(
+    string Username,
+    string? DisplayName,
+    string Password,
+    List<string>? RoleIds,
+    bool Enabled = true);
+
+public sealed record UpdateUserRequest(
+    string? DisplayName,
+    List<string>? RoleIds,
+    bool? Enabled);
+
+public sealed record SetPasswordRequest(string Password);
+
+public sealed record SaveRoleRequest(
+    string? Id,
+    string Name,
+    string? Description,
+    string Scope,
+    List<string>? Pages,
+    List<string>? Ops,
+    List<WidgetGrantDto>? WidgetGrants);