调整 zserver-api 的 JWT 配置

Author: zlzforever

.github/workflows/docker-image.yml

@@ -17,6 +17,6 @@ jobs:
       - name: Login docker regsitry
         run: docker login -u ${{ secrets.DOCKER_USER }} -p  ${{ secrets.DOCKER_USER_PASSWORD }}
       - name: Build the Docker image
-        run: docker build --target zserver-api -f API.Dockerfile -t zlzforever/zserver-api:20251201-1 .
+        run: docker build --target zserver-api -f API.Dockerfile -t zlzforever/zserver-api:20260304-1 .
       - name: Publish the Docker image
-        run: docker push zlzforever/zserver-api:20251201-1
+        run: docker push zlzforever/zserver-api:20260304-1

src/ZMap.Source.Postgre/ZMap.Source.Postgre.csproj

@@ -7,7 +7,7 @@
     </ItemGroup>
     <ItemGroup>
 <!--        <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="6.0.8" />-->
-        <PackageReference Include="FreeSql.Provider.PostgreSQL" Version="3.5.303" />
+        <PackageReference Include="FreeSql.Provider.PostgreSQL" Version="3.5.305" />
         <PackageReference Include="Npgsql.NetTopologySuite" Version="9.0.4" />
     </ItemGroup>
     <ItemGroup>

src/ZServer.API/JwtBearerAuthenticationExtensions.cs

@@ -24,10 +24,9 @@ public static AuthenticationBuilder AddJwtBearerAuthentication(this IServiceColl
         IConfiguration configuration)
     {
         var jwtBearerOptions = configuration.GetSection("JwtBearer").Get<JwtBearerSettings>();
-        RsaSecurityKey rsaSecurityKey = null;
-        if (jwtBearerOptions.Key != null)
+        var rsaSecurityKey = jwtBearerOptions.GetRsaSecurityKey();
+        if (rsaSecurityKey != null)
         {
-            rsaSecurityKey = jwtBearerOptions.Key.GetRsaSecurityKey();
             services.AddKeyedSingleton(JwtBearerSettings.JwtBearerRsaSecurityKey, rsaSecurityKey);
         }
 
@@ -66,25 +65,10 @@ public static AuthenticationBuilder AddJwtBearerAuthentication(this IServiceColl
                 }
                 else
                 {
-                    options.Authority = jwtBearerOptions.Authority ??
-                                        throw new ApplicationException("JwtBearer:Authority is null or empty. ");
-
+                    options.Authority = jwtBearerOptions.Authority ?? throw new ApplicationException(
+                        "JwtBearer:Authority is null or empty. Please check your configuration. https://qcn6sgdfwyfj.feishu.cn/wiki/O4QEwz6idiwHFsk8V3EcLE7Unpf?fromScene=spaceOverview#share-VPlFdJAwSo2Oyyxs7XPcWHy4nQd");
                     options.RequireHttpsMetadata = jwtBearerOptions.RequireHttpsMetadata;
-                    options.MetadataAddress = jwtBearerOptions.MetadataAddress ?? string.Empty;
-
-                    // 试验性代码，authority 不设计 https/requireHttpsMetadata
-                    if (!options.RequireHttpsMetadata && string.IsNullOrEmpty(options.MetadataAddress) &&
-                        !string.IsNullOrEmpty(options.Authority))
-                    {
-                        var metadataAddress =
-                            options.Authority.Replace("https://", "http://", StringComparison.OrdinalIgnoreCase);
-                        if (!metadataAddress.EndsWith("/", StringComparison.Ordinal))
-                        {
-                            metadataAddress += "/";
-                        }
-
-                        options.MetadataAddress = metadataAddress + ".well-known/openid-configuration";
-                    }
+                    options.MetadataAddress = jwtBearerOptions.GetMetadataAddress();
                 }
             });
 

src/ZServer.API/JwtBearerSettings.cs

@@ -1,3 +1,7 @@
+using System;
+using System.Text.Json;
+using Microsoft.IdentityModel.Tokens;
+
 namespace ZServer.API;
 
 /// <summary>
@@ -54,4 +58,53 @@ public class JwtBearerSettings
     /// 
     /// </summary>
     public string MetadataAddress { get; set; }
+
+    /// <summary>
+    /// 
+    /// </summary>
+    public string KeyPath { get; set; }
+
+    /// <summary>
+    /// 
+    /// </summary>
+    /// <returns></returns>
+    public string GetMetadataAddress()
+    {
+        // 试验性代码，authority 不设计 https/requireHttpsMetadata
+        if (!RequireHttpsMetadata && string.IsNullOrEmpty(MetadataAddress) &&
+            !string.IsNullOrEmpty(Authority))
+        {
+            var metadataAddress =
+                Authority.Replace("https://", "http://", StringComparison.OrdinalIgnoreCase);
+            if (!metadataAddress.EndsWith("/", StringComparison.Ordinal))
+            {
+                metadataAddress += "/";
+            }
+
+            return metadataAddress + ".well-known/openid-configuration";
+        }
+
+        return MetadataAddress ?? string.Empty;
+    }
+
+    /// <summary>
+    /// 
+    /// </summary>
+    /// <returns></returns>
+    public RsaSecurityKey GetRsaSecurityKey()
+    {
+        if (string.IsNullOrEmpty(KeyPath))
+        {
+            return Key?.GetRsaSecurityKey();
+        }
+
+        var json = System.IO.File.ReadAllText(KeyPath);
+        Key = JsonSerializer.Deserialize<RSAParametersInfo>(json, new JsonSerializerOptions
+        {
+            PropertyNameCaseInsensitive = false,
+            PropertyNamingPolicy = JsonNamingPolicy.CamelCase
+        });
+
+        return Key?.GetRsaSecurityKey();
+    }
 }