biss
5ec62a03ca
Web：访问令牌 10 分钟；活跃时自动轮换刷新令牌；连续无操作 30 分钟后清除登录并跳转登录页。 App：会话窗口 3 天；打开 App、恢复前台或请求接口时自动刷新并重新顺延 3 天。 普通登录和 SSO 使用同一策略。 刷新令牌只以 SHA-256 摘要入库，每次刷新都会轮换，旧令牌无法再次使用；退出登录会吊销刷新令牌。 网络临时故障不会误清登录状态，多标签页同时刷新也做了竞争处理。
41 lines
1.2 KiB
C#
41 lines
1.2 KiB
C#
using System.IdentityModel.Tokens.Jwt;
|
|
using System.Security.Claims;
|
|
using Jiaowu.Api.Domain.Identity;
|
|
using Jiaowu.Api.Infrastructure.Auth;
|
|
using Microsoft.Extensions.Options;
|
|
|
|
namespace Jiaowu.Api.Tests;
|
|
|
|
public sealed class TokenServiceTests
|
|
{
|
|
[Fact]
|
|
public void Token_contains_identity_and_roles()
|
|
{
|
|
var options = Options.Create(new JwtOptions
|
|
{
|
|
Issuer = "tests",
|
|
Audience = "tests-web",
|
|
Key = "a-test-signing-key-that-is-at-least-32-bytes-long"
|
|
});
|
|
var user = new ApplicationUser
|
|
{
|
|
Id = Guid.NewGuid(),
|
|
UserName = "teacher01",
|
|
DisplayName = "陈老师"
|
|
};
|
|
var service = new TokenService(options);
|
|
|
|
var result = service.Create(user, [SystemRoles.Teacher]);
|
|
var token = new JwtSecurityTokenHandler().ReadJwtToken(result.Token);
|
|
|
|
Assert.Contains(token.Claims, x =>
|
|
x.Type == ClaimTypes.Role && x.Value == SystemRoles.Teacher);
|
|
Assert.Contains(token.Claims, x =>
|
|
x.Type == ClaimTypes.Name && x.Value == "陈老师");
|
|
Assert.InRange(
|
|
result.ExpiresAt,
|
|
DateTime.UtcNow.AddMinutes(9),
|
|
DateTime.UtcNow.AddMinutes(11));
|
|
}
|
|
}
|