✨

StopShopping.Api/Extensions/AuthExtensions.cs

@@ -0,0 +1,56 @@
+using System.Text;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.IdentityModel.Tokens;
+using Microsoft.Net.Http.Headers;
+using StopShopping.Services;
+
+namespace StopShopping.Api.Extensions;
+
+public static class JwtExtensions
+{
+    public static IServiceCollection AddAuthServices(this IServiceCollection services, IConfiguration jwtOptions)
+    {
+        services.Configure<JwtOptions>(jwtOptions);
+        services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+            .AddJwtBearer(jwtBearerOptions =>
+            {
+                var jwtConfiguration = jwtOptions.Get<JwtOptions>()!;
+
+                var signingKey = new SymmetricSecurityKey(
+                    Encoding.UTF8.GetBytes(jwtConfiguration.SigningKey!)
+                );
+
+                jwtBearerOptions.MapInboundClaims = false;
+                jwtBearerOptions.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidAudience = jwtConfiguration.ValidAudience,
+                    ValidIssuer = jwtConfiguration.ValidIssuer,
+                    IssuerSigningKey = signingKey,
+                    ClockSkew = TimeSpan.FromSeconds(30) //宽容时间，30秒后才失效
+                };
+                jwtBearerOptions.Events = new JwtBearerEvents
+                {
+                    OnMessageReceived = async (context) =>
+                    {
+                        var accessTokenService = context.HttpContext.RequestServices.GetRequiredService<IAccessTokenService>();
+                        var authorizationHeader = context.Request.Headers[HeaderNames.Authorization];
+                        if (authorizationHeader.Count == 0)
+                        {
+                            context.Fail($"未找到{HeaderNames.Authorization}请求头");
+                        }
+                        else
+                        {
+                            var token = authorizationHeader.First()!.Split(" ").Last();
+                            if (string.IsNullOrWhiteSpace(token))
+                                context.Fail("未找到token");
+                            if (await accessTokenService.IsAccessTokenBlacklistAsync(token))
+                                context.Fail("token已失效");
+                        }
+                    }
+                };
+            });
+        services.AddAuthorization();
+
+        return services;
+    }
+}

StopShopping.Api/Extensions/BearerOpenApiDocumentTransformer.cs

@@ -0,0 +1,37 @@
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.AspNetCore.OpenApi;
+using Microsoft.OpenApi;
+
+namespace StopShopping.Api.Extensions;
+
+// 来自网络。。。
+public class BearerOpenApiDocumentTransformer : IOpenApiDocumentTransformer
+{
+    public Task TransformAsync(OpenApiDocument document, OpenApiDocumentTransformerContext context, CancellationToken cancellationToken)
+    {
+        var bearerOpenApiSecurityScheme = new OpenApiSecurityScheme
+        {
+            In = ParameterLocation.Header,
+            Scheme = JwtBearerDefaults.AuthenticationScheme,
+            Type = SecuritySchemeType.Http,
+            Description = "jwt"
+        };
+
+        document.Components ??= new OpenApiComponents();
+        document.Components.SecuritySchemes ??= new Dictionary<string, IOpenApiSecurityScheme>();
+        document.Components.SecuritySchemes[JwtBearerDefaults.AuthenticationScheme] = bearerOpenApiSecurityScheme;
+
+        var securityRequirement = new OpenApiSecurityRequirement
+        {
+            {
+                new OpenApiSecuritySchemeReference(JwtBearerDefaults.AuthenticationScheme),
+                new List<string>()
+            }
+        };
+
+        document.Security ??= [];
+        document.Security.Add(securityRequirement);
+
+        return Task.CompletedTask;
+    }
+}

StopShopping.Api/Extensions/CommonServiceCollections.cs

@@ -0,0 +1,79 @@
+using System.Text.Json.Serialization;
+using StopShopping.Api.Middlewares;
+using StopShopping.Services;
+using StopShopping.Services.Extensions;
+
+namespace StopShopping.Api.Extensions;
+
+public static class CommonServiceCollections
+{
+    public static IServiceCollection AddCommonServices(
+        this IServiceCollection services,
+        string corsPolicy,
+        IConfigurationSection jwtConfiguration,
+        IConfigurationSection appConfiguration,
+        bool isDevelopment)
+    {
+        var appOptions = appConfiguration.Get<AppOptions>();
+        services.AddCors(options =>
+        {
+            options.AddPolicy(corsPolicy, policy =>
+            {
+                policy.AllowAnyHeader();
+                policy.AllowAnyMethod();
+                policy.WithOrigins(appOptions!.CorsAllowedOrigins);
+                policy.AllowCredentials();
+            });
+        });
+        services.ConfigureHttpJsonOptions(options =>
+        {
+            options.SerializerOptions.Converters.Add(
+                new JsonStringEnumConverter(namingPolicy: null, allowIntegerValues: true));
+        });
+        services.AddHttpContextAccessor();
+        services.AddOpenApi(options =>
+        {
+            options.AddDocumentTransformer<BearerOpenApiDocumentTransformer>();
+            options.AddSchemaTransformer<EnumOpenApiSchemaTransformer>();
+        });
+        services.AddProblemDetails(options =>
+        {
+            options.CustomizeProblemDetails = (context) =>
+            {
+                if (context.ProblemDetails is HttpValidationProblemDetails problemDetails)
+                {
+                    problemDetails.AddErrorCode(ProblemDetailsCodes.ParametersValidationFailed);
+                    var errors = problemDetails.Errors.Select(e => string.Join(',', e.Value));
+                    if (null != errors)
+                        problemDetails.Detail = string.Join(',', errors);
+                }
+            };
+        });
+        services.AddValidation();
+        services.AddDistributedMemoryCache();
+
+        services.AddAuthServices(jwtConfiguration);
+
+        services.AddAntiforgery(options =>
+        {
+            var jwtOptions = jwtConfiguration.Get<JwtOptions>();
+
+            options.HeaderName = appOptions!.CSRFHeaderName;
+            options.Cookie.MaxAge = TimeSpan.FromSeconds(jwtOptions!.RefreshTokenExpiresIn);
+            options.Cookie.HttpOnly = true;
+            options.Cookie.Name = appOptions.CSRFCookieName;
+            if (isDevelopment)
+            {
+                options.Cookie.SameSite = SameSiteMode.Lax;
+            }
+            else
+            {
+                options.Cookie.SameSite = SameSiteMode.None;
+                options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
+                options.Cookie.Domain = appOptions.CookieDomain;
+            }
+        });
+
+        return services;
+    }
+}

StopShopping.Api/Extensions/EnumOpenApiSchemaTransformer.cs

@@ -0,0 +1,49 @@
+using System.ComponentModel;
+using System.Text.Json.Nodes;
+using Microsoft.AspNetCore.OpenApi;
+using Microsoft.OpenApi;
+
+namespace StopShopping.Api.Extensions;
+
+/// <summary>
+/// 处理enum类型openapi显示
+/// </summary>
+public class EnumOpenApiSchemaTransformer : IOpenApiSchemaTransformer
+{
+    public Task TransformAsync(OpenApiSchema schema, OpenApiSchemaTransformerContext context, CancellationToken cancellationToken)
+    {
+        if (context.JsonTypeInfo.Type.IsEnum)
+        {
+            schema.Type = JsonSchemaType.Integer;
+
+            var enumValues = Enum.GetValues(context.JsonTypeInfo.Type)
+                .Cast<object>()
+                .Select(v => JsonNode.Parse(Convert.ToInt32(v).ToString())!)
+                .ToList();
+
+            schema.Enum = enumValues;
+
+            var enumNames = Enum.GetNames(context.JsonTypeInfo.Type);
+            schema.Extensions ??= new Dictionary<string, IOpenApiExtension>();
+            var namesExtension = new JsonNodeExtension(new JsonArray(
+                        enumNames
+                        .Select(n => (JsonNode)n)
+                        .ToArray()));
+            schema.Extensions.Add("x-enumNames", namesExtension);
+
+            var descMap = new JsonObject();
+            foreach (var name in enumNames)
+            {
+                if (context.JsonTypeInfo.Type.GetField(name)
+                    ?.GetCustomAttributes(typeof(DescriptionAttribute), false)
+                    .FirstOrDefault() is DescriptionAttribute attr)
+                {
+                    descMap[name] = attr.Description;
+                }
+            }
+            schema.Extensions.Add("x-enumDescriptions", new JsonNodeExtension(descMap));
+        }
+
+        return Task.CompletedTask;
+    }
+}

StopShopping.Api/Extensions/HttpExtensions.cs

@@ -0,0 +1,36 @@
+using StopShopping.Services.Extensions;
+
+namespace Microsoft.AspNetCore.Http;
+
+public static class HttpExtensions
+{
+    public const string REFRESH_TOKEN_COOKIE_KEY = "refresh_token";
+
+    public static IResponseCookies AppendRefreshToken(
+        this IResponseCookies cookies,
+        IWebHostEnvironment env,
+        AppOptions appOptions,
+        TimeSpan maxAge,
+        string token)
+    {
+        CookieOptions options = new()
+        {
+            MaxAge = maxAge,
+            HttpOnly = true,
+            SameSite = SameSiteMode.Lax,
+        };
+        if (!env.IsDevelopment())
+        {
+            options.SameSite = SameSiteMode.None;
+            options.Secure = true;
+            options.Domain = appOptions.CookieDomain;
+        }
+
+        cookies.Append(
+                REFRESH_TOKEN_COOKIE_KEY,
+                token,
+                options);
+
+        return cookies;
+    }
+}

StopShopping.Api/Extensions/MiddlewareExtensions.cs

@@ -0,0 +1,25 @@
+using StopShopping.Api.Middlewares;
+
+namespace Microsoft.AspNetCore.Builder;
+
+public static class MiddlewareExtensions
+{
+    public static IApplicationBuilder UseGlobalExceptionHandler(this IApplicationBuilder applicationBuilder)
+    {
+        applicationBuilder.UseMiddleware<GlobalExceptionHandlerMiddleware>();
+
+        return applicationBuilder;
+    }
+
+    /// <summary>
+    /// 解决开发时多客户端localhost端口串cookie的问题
+    /// </summary>
+    /// <param name="applicationBuilder"></param>
+    /// <returns></returns>
+    public static IApplicationBuilder UseDevelopmentCookie(this IApplicationBuilder applicationBuilder)
+    {
+        applicationBuilder.UseMiddleware<DevelopmentCookieMiddleware>();
+
+        return applicationBuilder;
+    }
+}

StopShopping.Api/Middlewares/DevelopmentCookieMiddleware.cs

@@ -0,0 +1,142 @@
+using System.Text;
+using Microsoft.Extensions.Options;
+using Microsoft.Extensions.Primitives;
+using Microsoft.Net.Http.Headers;
+using StopShopping.Services.Extensions;
+
+namespace StopShopping.Api.Middlewares;
+
+public class DevelopmentCookieMiddleware
+{
+    public DevelopmentCookieMiddleware(
+        RequestDelegate requestDelegate,
+        IOptions<AppOptions> options)
+    {
+        _next = requestDelegate;
+        _appOptions = options.Value;
+    }
+
+    private readonly RequestDelegate _next;
+    private readonly AppOptions _appOptions;
+
+    public async Task InvokeAsync(HttpContext httpContext)
+    {
+        int? port = null;
+        var origin = httpContext.Request.Headers[HeaderNames.Origin];
+        if (origin.Count > 0 && null != origin[0])
+        {
+            Uri uri = new(origin[0]!);
+            port = uri.Port;
+        }
+        else
+        {
+            var referer = httpContext.Request.Headers[HeaderNames.Referer];
+            if (referer.Count > 0 && null != referer[0])
+            {
+                Uri uri = new(referer[0]!);
+                port = uri.Port;
+            }
+        }
+
+        if (port.HasValue)
+        {
+            var modified = ModifyCookie(httpContext.Request.Headers[HeaderNames.Cookie], port.Value);
+            httpContext.Request.Headers[HeaderNames.Cookie] = modified;
+        }
+
+        httpContext.Response.OnStarting(() =>
+        {
+            if (port.HasValue)
+            {
+                var cookieHeader = httpContext.Response.Headers[HeaderNames.SetCookie];
+                ModifyResponseCookie(cookieHeader, httpContext, port.Value);
+            }
+            return Task.CompletedTask;
+        });
+
+        await _next(httpContext);
+    }
+
+    private void ModifyResponseCookie(StringValues cookieHeader, HttpContext httpContext, int port)
+    {
+        foreach (var cookieItem in cookieHeader)
+        {
+            if (cookieItem != null)
+            {
+                var cookies = cookieItem.Split(';');
+                foreach (var item in cookies)
+                {
+                    if (null != item)
+                    {
+                        var pairs = item.Split('=');
+                        if (2 == pairs.Length)
+                        {
+                            if (pairs[0].Trim() == _appOptions.CSRFCookieName)
+                            {
+                                var val = pairs[1];
+                                httpContext.Response.Cookies.Delete(pairs[0]);
+                                httpContext.Response.Cookies.Append($"{_appOptions.CSRFCookieName}_{port}", val);
+                            }
+                            else if (pairs[0].Trim() == HttpExtensions.REFRESH_TOKEN_COOKIE_KEY)
+                            {
+                                var val = pairs[1];
+                                httpContext.Response.Cookies.Delete(pairs[0]);
+                                httpContext.Response.Cookies.Append($"{HttpExtensions.REFRESH_TOKEN_COOKIE_KEY}_{port}", val);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    private StringValues ModifyCookie(StringValues cookie, int port)
+    {
+        List<string> result = [];
+        var csrfCookieName = $"{_appOptions.CSRFCookieName}_{port}";
+        var refreshTokenCookieName = $"{HttpExtensions.REFRESH_TOKEN_COOKIE_KEY}_{port}";
+        foreach (var cookieItem in cookie)
+        {
+            if (null != cookieItem)
+            {
+                StringBuilder itemBuilder = new();
+                var cookies = cookieItem.Split(';');
+                foreach (var item in cookies)
+                {
+                    if (null != item)
+                    {
+                        var pairs = item.Split('=');
+                        if (pairs.Length == 2)
+                        {
+                            if (0 != itemBuilder.Length)
+                                itemBuilder.Append(';');
+                            if (pairs[0].Trim() == csrfCookieName)
+                            {
+                                itemBuilder.Append(_appOptions.CSRFCookieName);
+                                itemBuilder.Append('=');
+                                itemBuilder.Append(pairs[1].Trim());
+                            }
+                            else if (pairs[0].Trim() == refreshTokenCookieName)
+                            {
+                                itemBuilder.Append(HttpExtensions.REFRESH_TOKEN_COOKIE_KEY);
+                                itemBuilder.Append('=');
+                                itemBuilder.Append(pairs[1].Trim());
+                            }
+                            else
+                            {
+                                itemBuilder.Append(item);
+                            }
+                        }
+                        else
+                        {
+                            itemBuilder.Append(item);
+                        }
+                    }
+                }
+
+                result.Add(itemBuilder.ToString());
+            }
+        }
+        return new StringValues(result.ToArray());
+    }
+}

StopShopping.Api/Middlewares/GlobalExceptionHandlerMiddleware.cs

@@ -0,0 +1,100 @@
+using Microsoft.AspNetCore.Antiforgery;
+using Microsoft.AspNetCore.Mvc;
+using StopShopping.Services.Models.Resp;
+
+namespace StopShopping.Api.Middlewares;
+
+public class GlobalExceptionHandlerMiddleware
+{
+    public GlobalExceptionHandlerMiddleware(RequestDelegate requestDelegate,
+        ILogger<GlobalExceptionHandlerMiddleware> logger,
+        IProblemDetailsService problemDetailsService)
+    {
+        _next = requestDelegate;
+        _logger = logger;
+        _problemDetailsService = problemDetailsService;
+    }
+
+    private readonly RequestDelegate _next;
+    private readonly ILogger<GlobalExceptionHandlerMiddleware> _logger;
+    private readonly IProblemDetailsService _problemDetailsService;
+
+    public async Task InvokeAsync(HttpContext httpContext)
+    {
+        try
+        {
+            await _next(httpContext);
+        }
+        catch (BadHttpRequestException ex) when (ex.InnerException is AntiforgeryValidationException)
+        {
+            var problemDetails = new ProblemDetails
+            {
+                Detail = ex.InnerException.Message,
+                Instance = httpContext.Request.Path,
+                Status = StatusCodes.Status400BadRequest,
+                Title = "CSRF 错误",
+            };
+
+            problemDetails.AddErrorCode(ProblemDetailsCodes.CsrfValidationFailed);
+
+            httpContext.Response.StatusCode = StatusCodes.Status400BadRequest;
+            httpContext.Response.ContentType = "application/problem+json";
+
+            await _problemDetailsService.WriteAsync(new ProblemDetailsContext
+            {
+                HttpContext = httpContext,
+                ProblemDetails = problemDetails
+            });
+        }
+        catch (BadHttpRequestException ex)
+        {
+            _logger.LogError(ex, "参数错误");
+
+            var problemDetails = new ProblemDetails
+            {
+                Detail = ex.Message,
+                Instance = httpContext.Request.Path,
+                Status = StatusCodes.Status400BadRequest,
+                Title = "参数错误",
+            };
+
+            problemDetails.AddErrorCode(ProblemDetailsCodes.BadParameters);
+
+            httpContext.Response.StatusCode = StatusCodes.Status400BadRequest;
+            httpContext.Response.ContentType = "application/problem+json";
+
+            await _problemDetailsService.WriteAsync(new ProblemDetailsContext
+            {
+                HttpContext = httpContext,
+                ProblemDetails = problemDetails
+            });
+        }
+        catch (ServiceException ex)//业务层抛出提示
+        {
+            await httpContext.Response.WriteAsJsonAsync(ApiResponse.Failed(ex.Message));
+        }
+        catch (Exception ex)
+        {
+            _logger.LogCritical(ex, "意外的异常");
+
+            var problemDetails = new ProblemDetails
+            {
+                Detail = ex.Message,
+                Instance = httpContext.Request.Path,
+                Status = StatusCodes.Status500InternalServerError,
+                Title = "服务器错误",
+            };
+
+            problemDetails.AddErrorCode(ProblemDetailsCodes.ServerError);
+
+            httpContext.Response.StatusCode = StatusCodes.Status500InternalServerError;
+            httpContext.Response.ContentType = "application/problem+json";
+
+            await _problemDetailsService.WriteAsync(new ProblemDetailsContext
+            {
+                HttpContext = httpContext,
+                ProblemDetails = problemDetails,
+            });
+        }
+    }
+}

StopShopping.Api/Middlewares/ProblemDetailsExtensions.cs

@@ -0,0 +1,23 @@
+using Microsoft.AspNetCore.Mvc;
+
+namespace StopShopping.Api.Middlewares;
+
+public static class ProblemDetailsExtensions
+{
+    private const string CODE_FIELD = "code";
+    public static ProblemDetails AddErrorCode(this ProblemDetails problemDetails, ProblemDetailsCodes code)
+    {
+        problemDetails.Extensions ??= new Dictionary<string, object?>();
+
+        problemDetails.Extensions.Add(CODE_FIELD, (int)code);
+        return problemDetails;
+    }
+}
+
+public enum ProblemDetailsCodes
+{
+    CsrfValidationFailed = 1000,
+    ParametersValidationFailed = 1001,
+    BadParameters = 1002,
+    ServerError = 1003,
+}

StopShopping.Api/Program.cs

@@ -0,0 +1,84 @@
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.EntityFrameworkCore;
+using Scalar.AspNetCore;
+using Serilog;
+using StopShopping.Api.Extensions;
+using StopShopping.Api.Routes;
+using StopShopping.Api.Workers;
+
+const string CORS_POLICY = "default";
+// 将启动日志写入控制台，用于捕获启动时异常，启动后WriteTo被后续配置替代
+Log.Logger = new LoggerConfiguration()
+    .WriteTo.Console()
+    .CreateBootstrapLogger();
+
+try
+{
+    var builder = WebApplication.CreateBuilder(args);
+
+    builder.Services.AddSerilog((services, seriLogger) =>
+    {
+        seriLogger.ReadFrom.Configuration(builder.Configuration)
+            .ReadFrom.Services(services);
+    });
+
+    var jwtConfiguration = builder.Configuration.GetSection("JwtOptions");
+    var appConfiguration = builder.Configuration.GetSection("AppOptions");
+
+    builder.Services.AddCommonServices(
+        CORS_POLICY,
+        jwtConfiguration,
+        appConfiguration,
+        builder.Environment.IsDevelopment());
+
+    builder.Services.AddServices(dbContextOptions =>
+    {
+        dbContextOptions.UseNpgsql(
+            builder.Configuration.GetConnectionString("StopShopping"));
+
+        if (builder.Environment.IsDevelopment())
+            dbContextOptions.EnableSensitiveDataLogging();
+    },
+        appConfiguration,
+        builder.Configuration.GetSection("OpenPlatformOptions"));
+    builder.Services.AddHostedService<DbSeederBackgroundService>();
+    /**********************************************************************/
+    var app = builder.Build();
+
+    if (app.Environment.IsDevelopment())
+    {
+        app.UseDevelopmentCookie();
+        app.MapOpenApi();
+        app.MapScalarApiReference(options =>
+        {
+            options.AddPreferredSecuritySchemes(JwtBearerDefaults.AuthenticationScheme);
+        });
+    }
+
+    app.UseGlobalExceptionHandler();
+
+    app.UseRouting();
+
+    app.UseCors(CORS_POLICY);
+
+    app.UseAuthentication();
+
+    app.UseAuthorization();
+
+    app.MapStaticAssets().ShortCircuit();
+
+    Root.MapRoutes(app);
+
+    app.UseAntiforgery();
+
+    app.Run();
+}
+catch (Exception ex)
+{
+    Log.Fatal(ex, "启动异常！");
+}
+finally
+{
+    Log.CloseAndFlush();
+}
+

StopShopping.Api/Properties/launchSettings.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://json.schemastore.org/launchsettings.json",
+  "profiles": {
+    "http": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": true,
+      "launchUrl": "scalar",
+      "applicationUrl": "http://localhost:5162",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    },
+    "https": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": true,
+      "launchUrl": "scalar",
+      "applicationUrl": "https://localhost:7121;http://localhost:5162",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    }
+  }
+}

StopShopping.Api/Routes/Admin.cs

@@ -0,0 +1,44 @@
+using Microsoft.Extensions.Options;
+using StopShopping.Services;
+using StopShopping.Services.Extensions;
+using StopShopping.Services.Models.Req;
+using StopShopping.Services.Models.Resp;
+
+namespace StopShopping.Api.Routes;
+
+public static class Admin
+{
+    public static RouteGroupBuilder MapAdmin(this RouteGroupBuilder routes)
+    {
+        routes.MapPost("/admin/signin", SignInAsync)
+            .AllowAnonymous().WithTags(OpenApiTags.管理员.ToString());
+
+        return routes;
+    }
+
+    private static async Task<ApiResponse<SignInAdmin>> SignInAsync(
+            SignInParams model,
+            IUserService userService,
+            HttpContext httpContext,
+            IWebHostEnvironment env,
+            IOptions<AppOptions> options)
+    {
+        var result = await userService.SignInAdminAsync(model);
+        var resp = new ApiResponse<SignInAdmin>
+        {
+            IsSucced = result.IsSucced,
+            Data = result.User,
+            Message = result.Message
+        };
+        if (result.IsSucced)
+        {
+            httpContext.Response.Cookies.AppendRefreshToken(
+                env,
+                options.Value,
+                TimeSpan.FromSeconds(result.RefreshToken!.ExpiresIn),
+                result.RefreshToken.Token!
+            );
+        }
+        return resp;
+    }
+}

StopShopping.Api/Routes/Category.cs

@@ -0,0 +1,60 @@
+using StopShopping.Services;
+using StopShopping.Services.Models.Req;
+using StopShopping.Services.Models.Resp;
+
+namespace StopShopping.Api.Routes;
+
+public static class Category
+{
+    public static RouteGroupBuilder MapCategoryCommon(this RouteGroupBuilder routes)
+    {
+        routes.MapGet("/category/list", GetTree)
+            .WithTags(OpenApiTags.分类.ToString())
+            .AllowAnonymous();
+
+        return routes;
+    }
+
+    public static RouteGroupBuilder MapCategory(this RouteGroupBuilder routes)
+    {
+        routes.MapPost("/category/edit", EditCategoryAsync)
+            .WithTags(OpenApiTags.分类.ToString());
+
+        routes.MapPost("/category/resort", ResortCategoryAsync)
+            .WithTags(OpenApiTags.分类.ToString());
+
+        routes.MapPost("/category/delete", DeleteCategoryAsync)
+            .WithTags(OpenApiTags.分类.ToString());
+
+        return routes;
+    }
+
+    private static ApiResponse<List<Services.Models.Resp.Category>> GetTree(
+        ICategoryService categoryService
+    )
+    {
+        return categoryService.GetCategoriesTree();
+    }
+
+    private static async Task<ApiResponse<Services.Models.Resp.Category>> EditCategoryAsync(
+        EditCategoryParams model,
+        ICategoryService categoryService)
+    {
+        return await categoryService.EditCategoryAsync(model);
+    }
+
+    private static async Task<ApiResponse> ResortCategoryAsync(
+        ResortCategoryParams model,
+        ICategoryService categoryService)
+    {
+        return await categoryService.ResortCategoryAsync(model);
+    }
+
+    private static async Task<ApiResponse> DeleteCategoryAsync(
+        CategoryIdParams model,
+        ICategoryService categoryService
+    )
+    {
+        return await categoryService.DeleteCategoryAsync(model);
+    }
+}

StopShopping.Api/Routes/Common.cs

@@ -0,0 +1,87 @@
+using Microsoft.AspNetCore.Antiforgery;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Net.Http.Headers;
+using StopShopping.Services;
+using StopShopping.Services.Models.Req;
+using StopShopping.Services.Models.Resp;
+
+namespace StopShopping.Api.Routes;
+
+public static class Common
+{
+    public static RouteGroupBuilder MapCommon(this RouteGroupBuilder routes)
+    {
+        routes.MapPost("/common/upload", UploadAsync)
+            .WithTags(OpenApiTags.公用.ToString());
+
+        routes.MapPost("/common/refreshtoken", RefreshTokenAsync)
+            .AllowAnonymous()
+            .Produces<ApiResponse<AccessToken>>()
+            .WithTags(OpenApiTags.公用.ToString());
+
+        routes.MapPost("/common/signout", SignOutAsync)
+            .AllowAnonymous().WithTags(OpenApiTags.公用.ToString());
+
+        routes.MapPost("/common/antiforgery-token", AntiForgeryToken)
+            .WithTags(OpenApiTags.公用.ToString());
+
+        return routes;
+    }
+
+    private static async Task<ApiResponse<FileUpload>> UploadAsync(
+            [FromForm] UploadParams payload,
+            IFileService fileService,
+            HttpContext httpContext)
+    {
+        return await fileService.UploadFileAsync(payload);
+    }
+
+    private static ApiResponse<AntiForgeryToken> AntiForgeryToken(
+            HttpContext httpContext,
+            IAntiforgery antiforgery)
+    {
+        var antiforgeryToken = antiforgery.GetAndStoreTokens(httpContext);
+
+        return new ApiResponse<AntiForgeryToken>(new AntiForgeryToken
+        {
+            Token = antiforgeryToken.RequestToken,
+            HeaderName = antiforgeryToken.HeaderName
+        });
+    }
+    private static async Task<IResult> RefreshTokenAsync(
+        HttpContext httpContext,
+        IAccessTokenService accessTokenService)
+    {
+        var refreshToken = httpContext.Request.Cookies[HttpExtensions.REFRESH_TOKEN_COOKIE_KEY];
+        if (string.IsNullOrWhiteSpace(refreshToken))
+            return Results.Unauthorized();
+
+        var accessToken = await accessTokenService.GenerateAccessTokenAsync(refreshToken);
+        if (null == accessToken)
+            return Results.Unauthorized();
+
+        return Results.Ok(new ApiResponse<AccessToken>(accessToken));
+    }
+
+    public static async Task<ApiResponse> SignOutAsync(
+            HttpContext httpContext,
+            IAccessTokenService accessTokenService)
+    {
+        var accessTokenHeader = httpContext.Request.Headers[HeaderNames.Authorization];
+        if (accessTokenHeader.Count != 0)
+        {
+            var accessToken = accessTokenHeader.First()!.Split(" ").Last();
+            if (!string.IsNullOrWhiteSpace(accessToken))
+                await accessTokenService.AddAccessTokenBlacklistAsync(accessToken);
+        }
+
+        var refreshToken = httpContext.Request.Cookies[HttpExtensions.REFRESH_TOKEN_COOKIE_KEY];
+        if (!string.IsNullOrWhiteSpace(refreshToken))
+        {
+            await accessTokenService.RevokeRefreshTokenAsync(refreshToken);
+            httpContext.Response.Cookies.Delete(HttpExtensions.REFRESH_TOKEN_COOKIE_KEY);
+        }
+
+        return ApiResponse.Succed();
+    }
+}

StopShopping.Api/Routes/District.cs

@@ -0,0 +1,34 @@
+using StopShopping.Services;
+using StopShopping.Services.Models.Req;
+using StopShopping.Services.Models.Resp;
+
+namespace StopShopping.Api.Routes;
+
+public static class District
+{
+    public static RouteGroupBuilder MapDistrict(this RouteGroupBuilder routes)
+    {
+        routes.MapGet("/district/top3level", GetTop3LevelDistrictsAsync)
+            .WithTags(OpenApiTags.地址.ToString());
+
+        routes.MapGet("/district/children", GetChildrenDistricts)
+            .WithTags(OpenApiTags.地址.ToString());
+
+        return routes;
+    }
+
+    private static ApiResponse<List<Services.Models.Resp.District>> GetChildrenDistricts(
+        [AsParameters] DistrictParentIdParams model,
+        IDistrictService districtService
+    )
+    {
+        return districtService.GetChildren(model);
+    }
+
+    private static async Task<ApiResponse<List<Services.Models.Resp.District>>> GetTop3LevelDistrictsAsync(
+        IDistrictService districtService
+    )
+    {
+        return await districtService.GetTop3LevelDistrictsAsync();
+    }
+}

StopShopping.Api/Routes/Product.cs

@@ -0,0 +1,61 @@
+using StopShopping.Services;
+using StopShopping.Services.Models.Req;
+using StopShopping.Services.Models.Resp;
+
+namespace StopShopping.Api.Routes;
+
+/// <summary>
+/// 商品相关路由
+/// </summary>
+public static class Product
+{
+    public static RouteGroupBuilder MapProduct(this RouteGroupBuilder routes)
+    {
+        routes.MapGet("/product/list", SearchProductsAsync)
+            .WithTags(OpenApiTags.商品.ToString());
+
+        routes.MapGet("/product/detail", Detail)
+            .WithTags(OpenApiTags.商品.ToString());
+
+        routes.MapPost("/product/edit", EditAsync)
+            .WithTags(OpenApiTags.商品.ToString());
+
+        routes.MapPost("/product/delete", DeleteAsync)
+            .WithTags(OpenApiTags.商品.ToString());
+
+        return routes;
+    }
+
+    private static async
+        Task<ApiResponse<PagedResult<Services.Models.Resp.Product>>>
+        SearchProductsAsync(
+            [AsParameters] ProductSearchParms model,
+            IProductService productService
+        )
+    {
+        return await productService.SearchAsync(model);
+    }
+
+    private static ApiResponse<ProductInfo> Detail(
+        [AsParameters] ProductIdParams model,
+        IProductService productService)
+    {
+        return productService.Detail(model);
+    }
+
+    private static async Task<ApiResponse> EditAsync(
+        EditProductParams model,
+        IProductService productService
+    )
+    {
+        return await productService.EditAsync(model);
+    }
+
+    private static async Task<ApiResponse> DeleteAsync(
+        ProductIdParams model,
+        IProductService productService
+    )
+    {
+        return await productService.DeleteAsync(model);
+    }
+}

StopShopping.Api/Routes/Reply.cs

@@ -0,0 +1,45 @@
+using StopShopping.Services;
+using StopShopping.Services.Models.Req;
+using StopShopping.Services.Models.Resp;
+
+namespace StopShopping.Api.Routes;
+
+public static class Reply
+{
+    public static RouteGroupBuilder MapReply(this RouteGroupBuilder routes)
+    {
+        routes.MapPost("/reply/post", SubmitReplyAsync)
+            .WithTags(OpenApiTags.竞标.ToString());
+
+        routes.MapGet("/reply/list", ListAsync)
+            .WithTags(OpenApiTags.竞标.ToString());
+
+        routes.MapGet("/reply/orders", OrderSearchAsync)
+            .WithTags(OpenApiTags.竞标.ToString());
+
+        return routes;
+    }
+
+    private static async Task<ApiResponse> SubmitReplyAsync(
+        ReplyParams model,
+        IReplyService replyService)
+    {
+        return await replyService.ReplyAsync(model);
+    }
+
+    private static async Task<ApiResponse<List<Services.Models.Resp.Reply>>> ListAsync(
+        [AsParameters] RequestIdParams model,
+        IReplyService replyService
+    )
+    {
+        return await replyService.GetRepliesAsync(model);
+    }
+
+    private static async Task<ApiResponse<PagedResult<Services.Models.Resp.Request>>> OrderSearchAsync(
+        [AsParameters] RequestSearchWithStatusParams model,
+        IRequestService requestService
+    )
+    {
+        return await requestService.RequestOrderSearchAsync(model);
+    }
+}

StopShopping.Api/Routes/Request.cs

@@ -0,0 +1,57 @@
+using StopShopping.Services;
+using StopShopping.Services.Models.Req;
+using StopShopping.Services.Models.Resp;
+
+namespace StopShopping.Api.Routes;
+
+public static class Request
+{
+    public static RouteGroupBuilder MapRequest(this RouteGroupBuilder routes)
+    {
+        routes.MapPost("/request/publish", PublishRequestAsync)
+            .WithTags(OpenApiTags.需求.ToString());
+
+        routes.MapGet("/request/search", SearchAsync)
+            .WithTags(OpenApiTags.需求.ToString())
+            .AllowAnonymous();
+
+        routes.MapGet("/request/orders", OrderSearchAsync)
+            .WithTags(OpenApiTags.需求.ToString());
+
+        routes.MapPost("/request/delete", DeleteRequestAsync)
+            .WithTags(OpenApiTags.需求.ToString());
+
+        return routes;
+    }
+
+    private static async Task<ApiResponse> PublishRequestAsync(
+        CreateRequestParams model,
+        IRequestService requestService)
+    {
+        return await requestService.PublishRequestAsync(model);
+    }
+
+    private static async Task<ApiResponse<PagedResult<Services.Models.Resp.Request>>> SearchAsync(
+        [AsParameters] RequestSearchParams model,
+        IRequestService requestService
+    )
+    {
+        return await requestService.SearchAsync(model);
+    }
+
+    private static async Task<ApiResponse<PagedResult<Services.Models.Resp.Request>>> OrderSearchAsync(
+        [AsParameters] RequestSearchWithStatusParams model,
+        IRequestService requestService
+    )
+    {
+        return await requestService.RequestOrderSearchAsync(model);
+    }
+
+    private static async Task<ApiResponse> DeleteRequestAsync(
+        RequestIdParams model,
+        IRequestService requestService
+    )
+    {
+        return await requestService.DeleteRequestAsync(model);
+    }
+}

StopShopping.Api/Routes/Root.cs

@@ -0,0 +1,45 @@
+
+using Scalar.AspNetCore;
+using StopShopping.Services.Models;
+
+namespace StopShopping.Api.Routes;
+
+/// <summary>
+/// 其他路由从RouteGroupBuilder扩展并添加到MapGroup之后
+/// </summary>
+public static class Root
+{
+    public static void MapRoutes(WebApplication app)
+    {
+        app.MapGroup("")
+            .MapUser()
+            .MapProduct()
+            .MapRequest()
+            .MapReply()
+            .MapDistrict()
+            .WithDescription("用户端调用")
+            .RequireAuthorization(policy => policy.RequireRole(SystemRoles.User.ToString()));
+        app.MapGroup("")
+            .MapCommon()
+            .MapCategoryCommon()
+            .WithDescription("公共调用")
+            .RequireAuthorization();
+        app.MapGroup("")
+            .MapAdmin()
+            .MapCategory()
+            .WithDescription("管理端调用")
+            .RequireAuthorization(policy => policy.RequireRole(SystemRoles.Admin.ToString()));
+    }
+}
+
+public enum OpenApiTags
+{
+    用户,
+    分类,
+    商品,
+    需求,
+    竞标,
+    地址,
+    管理员,
+    公用,
+}

StopShopping.Api/Routes/User.cs

@@ -0,0 +1,95 @@
+using Microsoft.Extensions.Options;
+using StopShopping.Services;
+using StopShopping.Services.Extensions;
+using StopShopping.Services.Models.Req;
+using StopShopping.Services.Models.Resp;
+
+namespace StopShopping.Api.Routes;
+
+public static class User
+{
+    public static RouteGroupBuilder MapUser(this RouteGroupBuilder routes)
+    {
+        routes.MapPost("/user/signup", SignUpAsync)
+            .AllowAnonymous().WithTags(OpenApiTags.用户.ToString());
+
+        routes.MapPost("/user/signin", SignInAsync)
+            .AllowAnonymous().WithTags(OpenApiTags.用户.ToString());
+
+        routes.MapPost("/user/changepassword", ChangePasswordAsync)
+            .WithTags(OpenApiTags.用户.ToString());
+
+        routes.MapGet("/user/info", GetUserAsync)
+            .WithTags(OpenApiTags.用户.ToString());
+
+        routes.MapPost("/user/edit", EditUserAsync)
+            .WithTags(OpenApiTags.用户.ToString());
+
+        return routes;
+    }
+
+    private static async Task<ApiResponse> SignUpAsync(
+        SignUpParams model,
+        IUserService userService)
+    {
+        await userService.SignUpAsync(model);
+
+        return ApiResponse.Succed();
+    }
+
+    private static async Task<ApiResponse<SignInUser>> SignInAsync(
+            SignInParams model,
+            IUserService userService,
+            HttpContext httpContext,
+            IWebHostEnvironment env,
+            IOptions<AppOptions> options)
+    {
+        var result = await userService.SignInAsync(model);
+        var resp = new ApiResponse<SignInUser>
+        {
+            IsSucced = result.IsSucced,
+            Data = result.User,
+            Message = result.Message
+        };
+        if (result.IsSucced)
+        {
+            httpContext.Response.Cookies.AppendRefreshToken(
+                env,
+                options.Value,
+                TimeSpan.FromSeconds(result.RefreshToken!.ExpiresIn),
+                result.RefreshToken.Token!
+            );
+        }
+        return resp;
+    }
+
+    private static async Task<ApiResponse> ChangePasswordAsync(
+        ChangePasswordParams model,
+        IUserService userService,
+        HttpContext httpContext,
+        IAccessTokenService accessTokenService
+    )
+    {
+        var resp = await userService.ChangePasswordAsync(model);
+
+        if (resp.IsSucced)
+            await Common.SignOutAsync(httpContext, accessTokenService);
+
+        return resp;
+    }
+
+    private static async Task<ApiResponse<Services.Models.Resp.User>> GetUserAsync(
+        IUserService userService
+    )
+    {
+        return await userService.GetUserInfoAsync();
+    }
+
+    private static async Task<ApiResponse> EditUserAsync(
+        EditUserParams model,
+        IUserService userService
+    )
+    {
+        return await userService.EditAsync(model);
+    }
+}

StopShopping.Api/StopShopping.Api.csproj

@@ -0,0 +1,26 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.3" />
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.1" />
+    <PackageReference Include="Scalar.AspNetCore" Version="2.13.5" />
+    <PackageReference Include="Serilog.AspNetCore" Version="10.0.0" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\StopShopping.Services\StopShopping.Services.csproj" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Content Update="wwwroot\images\**\*">
+      <CopyToPublishDirectory>Never</CopyToPublishDirectory>
+    </Content>
+  </ItemGroup>
+
+</Project>

StopShopping.Api/Workers/DbSeederBackgroundService.cs

@@ -0,0 +1,27 @@
+using StopShopping.Services;
+
+namespace StopShopping.Api.Workers;
+
+public class DbSeederBackgroundService : BackgroundService
+{
+    public DbSeederBackgroundService(IServiceProvider sp)
+    {
+        _sp = sp;
+    }
+
+    private readonly IServiceProvider _sp;
+
+    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+    {
+        using var scope = _sp.CreateScope();
+        using var scope1 = _sp.CreateScope();
+
+        var districtService = scope.ServiceProvider.GetRequiredService<IDistrictService>();
+        var userService = scope1.ServiceProvider.GetRequiredService<IUserService>();
+
+        var districtTask = districtService.InitialDatabaseAsync(stoppingToken);
+        var adminTask = userService.GenerateDefaultAdminAsync();
+
+        await Task.WhenAll(districtTask, adminTask);
+    }
+}

StopShopping.Api/appsettings.Template.json

@@ -0,0 +1,36 @@
+{
+  "ConnectionStrings": {
+    "StopShopping": "PG_CONNECTION_STRING"
+  },
+  "JwtOptions": {
+    "ValidAudience": "StopShopping.Client",
+    "ValidIssuer": "StopShopping.Api",
+    "SigningKey": "128_BIT_SIGNING_KEY",
+    "AccessTokenExpiresIn": "3600",
+    "RefreshTokenExpiresIn": "604800"
+  },
+  "AppOptions": {
+    "CookieDomain": ".example.com或者localhost（开发环境）",
+    "DomainPath": "https://example.com或者http://localhost（开发环境）",
+    "CSRFHeaderName": "X-CSRF-TOKEN",
+    "CSRFCookieName": "csrf_token",
+    "CorsAllowedOrigins": ["https://web.example.com（跨域）"]
+  },
+  "OpenPlatformOptions": {
+    "TencentDistrict": {
+      "SecretKey": "TENCENT_API_KEY",
+      "Top3LevelUrl": "https://apis.map.qq.com/ws/district/v1/list",
+      "GetChildrenUrl": "https://apis.map.qq.com/ws/district/v1/getchildren"
+    }
+  },
+  "Serilog": {
+    "Using": ["Serilog.Sinks.Console"],
+    "MinimumLevel": {
+      "Default": "Information",
+      "Override": {
+        "Microsoft.AspNetCore": "Warning"
+      }
+    },
+    "WriteTo": [{ "Name": "Console" }]
+  }
+}