添加项目文件。

StoreHub.Framework/Security/TokenService.cs

@@ -0,0 +1,130 @@
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.JsonWebTokens;
+using Microsoft.IdentityModel.Tokens;
+using System.Security.Claims;
+using System.Text;
+
+namespace StoreHub.Framework.Security;
+
+/// <summary>
+/// 基于 <see cref="JwtOptions"/> 的 JWT 令牌服务。
+/// </summary>
+public class TokenService : ITokenService
+{
+	private readonly JwtOptions _options;
+	private readonly IOnlineUserStore _onlineUserStore;
+
+	public TokenService(IOptions<JwtOptions> options, IOnlineUserStore onlineUserStore)
+	{
+		_options = options.Value;
+		_onlineUserStore = onlineUserStore;
+	}
+
+	/// <inheritdoc />
+	public TokenResult CreateToken(IEnumerable<Claim> claims)
+	{
+		ArgumentNullException.ThrowIfNull(claims);
+
+		DateTime now = DateTime.Now;
+		DateTime expires = now.AddMinutes(_options.ExpiresMinutes);
+		string jti = Guid.NewGuid().ToString("N");
+
+		List<Claim> allClaims = [.. claims, new Claim(JwtClaimTypes.Jti, jti)];
+
+		SymmetricSecurityKey key = new(Encoding.UTF8.GetBytes(_options.SigningKey));
+		JsonWebTokenHandler handler = new();
+
+		string token = handler.CreateToken(new SecurityTokenDescriptor
+		{
+			Issuer = _options.Issuer,
+			Audience = _options.Audience,
+			Claims = ToClaimDictionary(allClaims),
+			NotBefore = now,
+			Expires = expires,
+			SigningCredentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256),
+		});
+
+		// 注册在线会话（单点登录：同用户的新登录会顶替旧会话，旧令牌立即失效）
+		RegisterSession(allClaims, jti, now, expires);
+
+		return new TokenResult
+		{
+			Token = token,
+			ExpiresAt = expires,
+		};
+	}
+
+	/// <inheritdoc />
+	public async Task<ClaimsPrincipal?> ValidateTokenAsync(string token)
+	{
+		if (string.IsNullOrWhiteSpace(token))
+		{
+			return null;
+		}
+
+		try
+		{
+			JsonWebTokenHandler handler = new();
+			TokenValidationResult result = await handler.ValidateTokenAsync(token, _options.ToTokenValidationParameters());
+			if (!result.IsValid)
+			{
+				return null;
+			}
+
+			ClaimsPrincipal principal = new(result.ClaimsIdentity);
+
+			// 单点登录校验：会话必须仍然有效（未被退出、未被新登录顶替）
+			string? userIdValue = principal.FindFirst(JwtClaimTypes.UserId)?.Value;
+			string? jti = principal.FindFirst(JwtClaimTypes.Jti)?.Value;
+			if (!int.TryParse(userIdValue, out int userId) || string.IsNullOrWhiteSpace(jti) || !_onlineUserStore.IsTokenActive(userId, jti))
+			{
+				return null;
+			}
+
+			return principal;
+		}
+		catch
+		{
+			return null;
+		}
+	}
+
+	/// <summary>
+	/// 将令牌声明注册为在线会话。
+	/// </summary>
+	private void RegisterSession(IEnumerable<Claim> claims, string jti, DateTime loginTime, DateTime expiresAt)
+	{
+		string? userIdValue = claims.FirstOrDefault(c => c.Type == JwtClaimTypes.UserId)?.Value;
+		if (!int.TryParse(userIdValue, out int userId))
+		{
+			return; // 未携带用户ID的令牌不纳入在线会话管理
+		}
+
+		_onlineUserStore.SignIn(new OnlineUserInfo
+		{
+			UserId = userId,
+			UserName = claims.FirstOrDefault(c => c.Type == JwtClaimTypes.UserName)?.Value ?? string.Empty,
+			NickName = claims.FirstOrDefault(c => c.Type == JwtClaimTypes.NickName)?.Value ?? string.Empty,
+			Jti = jti,
+			LoginTime = loginTime,
+			ExpiresAt = expiresAt,
+		});
+	}
+
+	/// <summary>
+	/// 将声明集合转换为 <see cref="SecurityTokenDescriptor.Claims"/> 所需的字典；
+	/// 相同类型的多个声明合并为数组。
+	/// </summary>
+	private static Dictionary<string, object> ToClaimDictionary(IEnumerable<Claim> claims)
+	{
+		Dictionary<string, object> result = new(StringComparer.Ordinal);
+		foreach (IGrouping<string, Claim> group in claims.GroupBy(c => c.Type, StringComparer.Ordinal))
+		{
+			object[] values = group.Select(c => (object)c.Value).ToArray();
+			result[group.Key] = values.Length == 1 ? values[0] : values;
+		}
+
+		return result;
+	}
+}
+