ABP Dynamic Permissions，動態異動 ABP Permissions，不需重啟系統即可使用 Permissions

問題

預設 ABP 的權限會定義在繼承自PermissionDefinitionProvider的類別中，
當系統跑起來時，會自動將它們加到 Memory 之中，並存到AbpPermissionGroups及AbpPermissions資料表之中。
但是，如果要動態地去新增權限，要怎麼做呢?

解法

預設如果在AbpPermissions 資料表中的資料，卻沒定義在程式中，就不會被 Load 到 Memory 之中。
如果共用權限系統，那麼會變成需要將那些程式都各自加到各別系統中，而且只要有調整，就需要重新編譯程式!!!
所以，ABP Support dynamic permissions, 只要將設定PermissionManagementOptions的IsDynamicPermissionStoreEnabled屬性為true。
這樣就會連同資料庫中的 Permissions 資料一併加到 Memory 之中。
所以要如何動態新增權限呢?
可以參考ABP DynamicPermission Sample的方式，
透過IPermissionGroupDefinitionRecordRepository及IPermissionDefinitionRecordRepository將權限加到資料庫，
再將 Cache 設定為過期，這樣就可以新增權限後，該權限就會在 Memory Cache 之中。

1.透過 ABP 建立 BookStore Web 系統

2.加入FixedLocalizableStringSerializer避免沒設定多國語系而發生錯誤，

[Dependency(ReplaceServices = true)]
[ExposeServices(typeof(LocalizableStringSerializer), typeof(ILocalizableStringSerializer), typeof(FixedLocalizableStringSerializer))]
public class FixedLocalizableStringSerializer : LocalizableStringSerializer, ITransientDependency
{
    public FixedLocalizableStringSerializer(IOptions<AbpLocalizationOptions> localizationOptions) : base(localizationOptions)
    {
    }

    public override ILocalizableString Deserialize(string? value)
    {
        if (value == null)
        {
            return new FixedLocalizableString("");
        }
        try
        {
            return base.Deserialize(value);
        }
        catch
        {
            return new FixedLocalizableString(value);
        }

    }
}

3.設定IsDynamicPermissionStoreEnabled為true
在BookStoreModule.cs中ConfigureServices最後加入設定，

Configure<PermissionManagementOptions>(options =>
{
    options.IsDynamicPermissionStoreEnabled = true;
});
context.Services.Replace(ServiceDescriptor.Singleton<ILocalizableStringSerializer, FixedLocalizableStringSerializer>());
Configure<Microsoft.AspNetCore.Mvc.JsonOptions>(options =>
{
    options.JsonSerializerOptions.ReferenceHandler = ReferenceHandler.IgnoreCycles;
});

4.建立PermissionDefinitionAppService.cs來負責新增權限，
權限資料可以加入額外的一些屬性，例如 Url, Icon, Target ，可用在 Menu

public class PermissionDefinitionAppService : BookStoreAppService
{

    private readonly IPermissionGroupDefinitionRecordRepository _permissionGroupRepository;
    private readonly IPermissionDefinitionRecordRepository _permissionRepository;
    private readonly IDistributedCache _distributedCache;
    private readonly DynamicPermissionDefinitionStore _dynamicPermissionDefinitionStore;
    protected readonly AbpDistributedCacheOptions _cacheOptions;
    private readonly IDynamicPermissionDefinitionStoreInMemoryCache _cache;
    private readonly IPermissionDefinitionManager _permissionDefManager;
    public PermissionDefinitionAppService(IPermissionGroupDefinitionRecordRepository permissionGroupRepository,
        IPermissionDefinitionRecordRepository permissionRepository,
        IDistributedCache distributedCache,
        DynamicPermissionDefinitionStore dynamicPermissionDefinitionStore,
        IOptions<AbpDistributedCacheOptions> cacheOptions,
        IDynamicPermissionDefinitionStoreInMemoryCache cache,
        IPermissionDefinitionManager permissionDefManager)
    {
        _permissionGroupRepository = permissionGroupRepository;
        _permissionRepository = permissionRepository;
        _distributedCache = distributedCache;
        _dynamicPermissionDefinitionStore = dynamicPermissionDefinitionStore;
        _cacheOptions = cacheOptions.Value;
        _cache = cache;
        _permissionDefManager = permissionDefManager;
    }


    public async Task PostPermissionAsync(string groupName, string parentName, string name, string url, string icon, string target)
    {

        var permissionGroup = new PermissionGroupDefinitionRecord
        {
            Name = groupName,
            DisplayName = GetDisplayName(groupName)
        };
        var group = await _permissionGroupRepository.GetListAsync();
        if (group.All(x => x.Name != groupName))
        {
            await _permissionGroupRepository.InsertAsync(permissionGroup);
        }
        var permissions = await _permissionRepository.GetListAsync();
        if (permissions.All(x => x.Name != name))
        {
            var testPermission = new PermissionDefinitionRecord
            {
                Name = name,
                DisplayName = GetDisplayName(name),
                GroupName = groupName,
                IsEnabled = true,
                ParentName = parentName,
                MultiTenancySide = MultiTenancySides.Both
            };
            if(!string.IsNullOrEmpty(url))
            {
                testPermission.SetProperty("Url", url);
            }
            if (!string.IsNullOrEmpty(icon))
            {
                testPermission.SetProperty("Icon", icon);
            }
            if (!string.IsNullOrEmpty(target))
            {
                testPermission.SetProperty("Target", target);
            }
            await _permissionRepository.InsertAsync(testPermission);

            await _distributedCache.RemoveAsync($"{_cacheOptions.KeyPrefix}_AbpInMemoryPermissionCacheStamp");
        }
    }

    private string GetDisplayName(string name)
    {
        //L:BookStore,Permission:BookStore => 對應到語系檔內容
        var resourceName = "BookStore";
        var permissionName = $"Permission";
        return $"L:{resourceName},{permissionName}:{name}";
    }

    public Task<PermissionDefinition> GetPermissionAsync(string name)
    {
        return _permissionDefManager.GetAsync(name);
    }

    private static LocalizableString L(string name)
    {
        return LocalizableString.Create<BookStoreResource>(name);
    }
}

5.在 Page 中讓使用者設定權限資料，並呼叫PermissionDefinitionAppService來新增權限
Index.cshtml.cs

public class IndexModel : AbpPageModel
{

    private readonly PermissionDefinition2AppService _permissionDefAppService;
    public IndexModel(PermissionDefinition2AppService permissionDefAppService)
    {
        _permissionDefAppService = permissionDefAppService;
    }

    [BindProperty]
    public string GroupName { get; set; }

    [BindProperty]
    public string? ParentPermissionName { get; set; }

    [BindProperty]
    public string PermissionName { get; set; }
    [BindProperty]
    public string? Icon { get; set; }

    [BindProperty]
    public string? Url { get; set; }

    [BindProperty]
    public string? Target { get; set; }

    public  Task OnPostAddPermission()
    {
        return _permissionDefAppService.PostPermissionAsync(GroupName, ParentPermissionName, PermissionName, Url, Icon, Target);
    }
}

Index.cshtml.cs

<div class="row">
    <div class="col-6">
        <div class="card">
            <div class="card-header">
                <div class="card-title text-body">Add Permissions</div>
            </div>
            <div class="card-body pt-0">
                <form method="post" class="m-2">
                    <div class="mb-3 col-12">
                        <label for="formula" class="form-label"
                            >Group Name:</label
                        >
                        <input
                            type="text"
                            class="form-control"
                            asp-for="GroupName"
                        />
                    </div>
                    <div class="mb-3 col-12">
                        <label for="formula" class="form-label"
                            >Parent Permission Name:</label
                        >
                        <input
                            type="text"
                            class="form-control"
                            asp-for="ParentPermissionName"
                        />
                    </div>
                    <div class="mb-3 col-12">
                        <label for="formula" class="form-label"
                            >Permission Name:</label
                        >
                        <input
                            type="text"
                            class="form-control"
                            asp-for="PermissionName"
                        />
                    </div>
                    <div class="mb-3 col-12">
                        <label for="formula" class="form-label">Url:</label>
                        <input type="text" class="form-control" asp-for="Url" />
                    </div>
                    <div class="mb-3 col-12">
                        <label for="formula" class="form-label">Icon:</label>
                        <input
                            type="text"
                            class="form-control"
                            asp-for="Icon"
                        />
                    </div>
                    <div class="mb-3 col-12">
                        <label for="formula" class="form-label">Target:</label>
                        <input
                            type="text"
                            class="form-control"
                            asp-for="Target"
                        />
                    </div>
                    <button
                        type="submit"
                        class="btn btn-success col-12"
                        asp-page-handler="AddPermission"
                    >
                        增加功能
                    </button>
                </form>
            </div>
        </div>
    </div>
</div>

6.在 BookStoreMenuContributor.cs 中，動態來依使用者的權限新增 Menu，

public class BookStoreMenuContributor : IMenuContributor
{
    private readonly IServiceCollection _services;
    private readonly IPermissionChecker _permissionChecker;
    public BookStoreMenuContributor(IServiceCollection services)
    {
        _services = services;
        _permissionChecker = services.GetRequiredService<IPermissionChecker>();
    }
    public async Task ConfigureMenuAsync(MenuConfigurationContext context)
    {
        if (context.Menu.Name == StandardMenus.Main)
        {
            await ConfigureMainMenuAsync(context);
        }
    }

    private async Task ConfigureMainMenuAsync( MenuConfigurationContext context)
    {

        var administration = context.Menu.GetAdministration();
        var l = context.GetLocalizer<BookStoreResource>();

        context.Menu.Items.Insert(
            0,
            new ApplicationMenuItem(
                BookStoreMenus.Home,
                l["Menu:Home"],
                "~/",
                icon: "fas fa-home",
                order: 0
            )
        );


        var rootPermissionName = "BookStore.RootFun";
        var permissionDefManager = _services.GetRequiredService<IPermissionDefinitionManager>();
        var rootPermission = await permissionDefManager.GetOrNullAsync(rootPermissionName);
        var isGrant = await _permissionChecker.IsGrantedAsync(rootPermissionName);
        if (rootPermission != null && isGrant)
        {
            var menu = await ConfigureAPMenuAsync(context, rootPermission);
            context.Menu.Items.Add(menu);
        }
        if (BookStoreModule.IsMultiTenant)
        {
            administration.SetSubItemOrder(TenantManagementMenuNames.GroupName, 1);
        }
        else
        {
            administration.TryRemoveMenuItem(TenantManagementMenuNames.GroupName);
        }

    }

    private async Task<ApplicationMenuItem> ConfigureAPMenuAsync(MenuConfigurationContext context, PermissionDefinition permission)
    {
        var l = context.GetLocalizer<BookStoreResource>();
        var menu = new ApplicationMenuItem(
                permission.Name,
                 l[$"Permission:{permission.Name}"]
            );
        if (permission.Properties.ContainsKey("Icon"))
        {
            menu.Icon = permission.Properties["Icon"] as string;
        }
        if (permission.Properties.ContainsKey("Url"))
        {
            menu.Url = permission.Properties["Url"] as string;
        }
        if (permission.Properties.ContainsKey("Target"))
        {
            menu.Target = permission.Properties["Target"] as string;
        }
        foreach (var child in permission.Children)
        {
            var grant = await _permissionChecker.IsGrantedAsync(child.Name);
            if (grant)
            {
                var childMenu = await ConfigureAPMenuAsync(context, child);
                menu.Items.Add(childMenu);
            }

        }
        return menu;
    }
}

使用 admin 登入後，動態加入權限

在設定權限功能，可以看到上一步新增的權限，已經可以看到並設定，

重整畫面，就可以依權限來呈現 Menu。

參考資源

How to Dynamic Add/Update Permissions and Refresh Cache in ABP
ABP DynamicPermission Sample
Generate Permission Automatically from external service