1

src/Jiaowu.Api/Infrastructure/Auth/JwtOptions.cs

@@ -0,0 +1,10 @@
+namespace Jiaowu.Api.Infrastructure.Auth;
+
+public sealed class JwtOptions
+{
+    public const string SectionName = "Jwt";
+    public string Issuer { get; set; } = "Jiaowu.Api";
+    public string Audience { get; set; } = "Jiaowu.Web";
+    public string Key { get; set; } = string.Empty;
+    public int ExpireMinutes { get; set; } = 480;
+}

src/Jiaowu.Api/Infrastructure/Auth/TokenService.cs

@@ -0,0 +1,48 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Text;
+using Jiaowu.Api.Domain.Identity;
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Tokens;
+
+namespace Jiaowu.Api.Infrastructure.Auth;
+
+public interface ITokenService
+{
+    string Create(ApplicationUser user, IEnumerable<string> roles);
+}
+
+public sealed class TokenService(IOptions<JwtOptions> options) : ITokenService
+{
+    private readonly JwtOptions _options = options.Value;
+
+    public string Create(ApplicationUser user, IEnumerable<string> roles)
+    {
+        var claims = new List<Claim>
+        {
+            new(JwtRegisteredClaimNames.Sub, user.Id.ToString()),
+            new(JwtRegisteredClaimNames.UniqueName, user.UserName ?? string.Empty),
+            new(ClaimTypes.NameIdentifier, user.Id.ToString()),
+            new(ClaimTypes.Name, user.DisplayName)
+        };
+
+        claims.AddRange(roles.Select(role => new Claim(ClaimTypes.Role, role)));
+        if (user.CollegeId is { } collegeId)
+        {
+            claims.Add(new Claim("college_id", collegeId.ToString()));
+        }
+
+        var credentials = new SigningCredentials(
+            new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_options.Key)),
+            SecurityAlgorithms.HmacSha256);
+
+        var token = new JwtSecurityToken(
+            issuer: _options.Issuer,
+            audience: _options.Audience,
+            claims: claims,
+            expires: DateTime.UtcNow.AddMinutes(_options.ExpireMinutes),
+            signingCredentials: credentials);
+
+        return new JwtSecurityTokenHandler().WriteToken(token);
+    }
+}