.net6中 如何在中间件的httpcontext中判断请求的action是否包含Authorize特性或Authorize特性的子类

在.NET 6中，如果你想要在全局中间件中检查HTTP Context的Action是否有`Authorize`属性或其子类，你可以使用Microsoft.AspNetCore.Authorization库提供的功能。以下是一个简单的步骤：

1. 首先，你需要添加`Microsoft.AspNetCore.Authorization` NuGet包到项目中。

dotnet add package Microsoft.AspNetCore.Authorization

2. 创建一个自定义的授权检查器。这通常会扩展`AuthorizationHandler<TRequirement>`，TRequirement是你想要检查的特性（如`[Authorize]`）。例如，我们可以创建一个名为`CustomAuthorizeHandler`的类：

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc.Filters;

public class CustomAuthorizeHandler : AuthorizationHandler<CustomAuthorizeAttribute>
{
    protected override Task HandleChallengeAsync(AuthorizationHandlerContext context, CustomAuthorizeAttribute requirement)
    {
        // 检查Action是否有Authorize或其子类
        var actionDescriptor = context.Resource as ActionDescriptor;
        if (actionDescriptor != null && !IsAuthorizeRequired(actionDescriptor))
        {
            context.Fail();
        }

        return Task.CompletedTask;
    }

    private static bool IsAuthorizeRequired(ActionDescriptor descriptor)
    {
        var attribute = descriptor.GetCustomAttributes<AuthorizeAttribute>(inherit: true);
        return attribute.Any();
    }
}

3. 注册你的自定义授权处理程序，并将其添加到应用服务注册中：

services.AddAuthorization(options =>
{
    options.AddPolicy("CustomAuthorization", policy => policy.Requirements.Add(new CustomAuthorizeAttribute()));
});

services.AddSingleton<IAuthorizationHandler, CustomAuthorizeHandler>();

4. 最后，在Startup.cs的ConfigureServices方法中添加中间件，用于在所有请求之前检查授权：

app.UseAuthorization();
app.UseMiddleware<YourMiddlewareClass>();

在`YourMiddlewareClass`中，你可以访问`HttpContext`并调用`AuthorizationService`来检查当前请求：

public class YourMiddlewareClass
{
    private readonly RequestDelegate _next;

    public YourMiddlewareClass(RequestDelegate next)
    {
        _next = next;
    }

    public async Task Invoke(HttpContext context)
    {
        // 获取授权服务
        var authzService = context.RequestServices.GetService(typeof(IAuthorizationService)) as IAuthorizationService;

        // 使用授权服务检查授权
        var authorizationResult = await authzService.AuthorizeAsync(context.User, context.ActionDescriptor, "CustomAuthorization");

        if (!authorizationResult.Succeeded)
        {
            // 如果未授权，可以执行相应的操作（如重定向、返回错误等）
            await HandleUnauthorizedResponse(context);
        }

        await _next(context);
    }

    private Task HandleUnauthorizedResponse(HttpContext context)
    {
        // 处理未经授权的情况...
    }
}