提交管理员操作一切

Core/MAX.Framework/DependencyInjection/JwtServiceCollectionExtensions.cs

@@ -4,6 +4,7 @@ using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
 using Microsoft.IdentityModel.Tokens;
 using Microsoft.OpenApi;
 using System.Security.Claims;
@@ -63,6 +64,29 @@ public static class JwtServiceCollectionExtensions
 				{
 					OnChallenge = JwtBearerResponseHandler.OnChallenge,
 					OnForbidden = JwtBearerResponseHandler.OnForbidden,
+					OnMessageReceived = context =>
+					{
+						// 固定测试凭据只在 Development 环境生效，不依赖 JWT 过期时间或在线会话。
+						var environment = context.HttpContext.RequestServices.GetRequiredService<IHostEnvironment>();
+						var development = configuration.GetSection("Jwt:DevelopmentToken");
+						var token = development["Token"];
+						var userName = development["UserName"];
+						var authorization = context.Request.Headers.Authorization.ToString();
+						if (environment.IsDevelopment()
+							&& development.GetValue<bool>("Enabled")
+							&& !string.IsNullOrWhiteSpace(token)
+							&& !string.IsNullOrWhiteSpace(userName)
+							&& authorization.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase)
+							&& string.Equals(authorization[7..].Trim(), token, StringComparison.Ordinal))
+						{
+							context.Principal = new ClaimsPrincipal(new ClaimsIdentity(
+								[new Claim(JwtClaimTypes.UserName, userName),
+								 new Claim(JwtClaimTypes.NickName, "开发测试用户")],
+								JwtBearerDefaults.AuthenticationScheme));
+							context.Success();
+						}
+						return Task.CompletedTask;
+					},
 					// 单点登录校验：会话必须仍有效（未退出、未被新登录顶替）
 					OnTokenValidated = context =>
 					{