public RolePermissionsAppService(  
        IRepository<RolePermissions> rolePermissionsRepository,  
        IRepository<SysPermission> sysPermissionsRepository  
        )  
    {  
        \_rolePermissionsRepository = rolePermissionsRepository;  
        \_sysPermissionsRepository = sysPermissionsRepository;  
    }  
    #endregion

    #region 获取角色所有权限  
    /// <summary>  
    /// 获取角色所有权限  
    /// </summary>  
    /// <param name="roleId">角色ID</param>  
    /// <returns></returns>  
    public async Task<List<PermissionTreeDto>> GetPermission(Guid roleId)  
    {  
        var query = from rp in (await \_rolePermissionsRepository.GetQueryableAsync())  
                .Where(x => x.RoleId == roleId)  
            join permission in (await \_sysPermissionsRepository.GetQueryableAsync())  
                on rp.PermissionId equals permission.Id  
            select permission;  
        var permissions = await AsyncExecuter.ToListAsync(query);  
        var lst = ObjectMapper.Map<List<SysPermission>, List<PermissionTreeDto>>(permissions);  
        return PermissionTreeBuilder.Build(lst);  
    }  
    #endregion

    #region 设置角色权限  
    /// <summary>  
    /// 设置角色权限  
    /// </summary>  
    /// <param name="roleId">橘色编号</param>  
    /// <param name="permissions">权限编号</param>  
    /// <returns></returns>  
    public async Task SetPermission(SetRolePermissionsDto dto)  
    {  
        await \_rolePermissionsRepository.DeleteAsync(x => x.RoleId == dto.RoleId);  
        foreach (var permissionId in dto.Permissions)  
        {  
            RolePermissions entity = new RolePermissions()  
            {  
                PermissionId = permissionId,  
                RoleId = dto.RoleId,  
            };  
            await \_rolePermissionsRepository.InsertAsync(entity);  
        }  
    }  
    #endregion

}  

}

在Demo.Identity.EntityFrameworkCore项目IdentityDbContext类中加入以下属性：

public DbSet SysPermissions { get; set; }
public DbSet RolePermissions { get; set; }

在Demo.Identity.EntityFrameworkCore项目目录下启动命令提示符，执行以下命令分别创建和执行数据迁移：

dotnet-ef migrations add AddPermissions
dotnet-ef database update

在Demo.Identity.EntityFrameworkCore项目IdentityEntityFrameworkCoreModule类ConfigureServices方法中找到 options.AddDefaultRepositories(includeAllEntities: true); ，在其后面加入以下代码：

options.AddDefaultRepository();

完成后运行身份管理服务，可正常运行和访问各接口，则基础服务层修改完成。

3. 公共组件

添加公共类库Demo.Permissions，编辑Demo.Permissions.csproj文件，将  改为：

为Demo.Permissions项目添加Nuget引用Volo.Abp.Core和Microsoft.AspNetCore.Http，并应用Demo.Identity.HttpApi.Client项目。

在Demo.Permissions中添加权限关系枚举PermissionRelation如下：

namespace Demo.Permissions;

///

}

在Demo.Permissions中添加CusPermissionAttribute特性，用于标记接口所需要的权限，如下：

namespace Demo.Permissions;

///

/// <summary>  
/// 权限之间的关系  
/// </summary>  
public PermissionRelation Relation { get; } = PermissionRelation.And;

/// <summary>  
/// 构造函数  
/// </summary>  
/// <param name="relation">权限关系</param>  
/// <param name="permissionCodes">权限编码</param>  
public CusPermissionAttribute(PermissionRelation relation,params string\[\] permissionCodes)  
{  
    Relation = relation;  
    PermissionCode = permissionCodes;  
}

/// <summary>  
/// 构造函数  
/// </summary>  
/// <param name="permissionCodes">权限编码</param>  
public CusPermissionAttribute(params string\[\] permissionCodes)  
{  
    PermissionCode = permissionCodes;  
}  

}

其中一个特性可以声明多个权限码，Relation表示该特性中所有权限码间的关系，如果为And，需要用户具有该特性声明的所有权限码才可通过验证，若为Or，则表示用户只要具有任意一个或多个该特性中声明的权限就可通过验证。一个接口可以声明多个特性，特性与特性之间是And关系。

在Demo.Permissions中添加权限验证中间件CusPermissionMiddleware如下：

using Demo.Identity.Permissions;
using Microsoft.AspNetCore.Http.Features;
using Volo.Abp.Users;

namespace Demo.Permissions;

///

public CusPermissionMiddleware(RequestDelegate next, ICurrentUser currentUser, ISysPermissionAppService service)  
{  
    \_next = next;  
    \_currentUser = currentUser;  
    \_service = service;  
}

public async Task InvokeAsync(HttpContext context)  
{  
    var attributes =  
        context.GetEndpoint()?.Metadata.GetOrderedMetadata<CusPermissionAttribute>();

    //如果不存在CusPermissionAttribute特性则该接口不需要权限验证，直接跳过  
    if (attributes==null||attributes.Count==0)  
    {  
        await \_next(context);  
        return;  
    }  
    //如果需要权限验证则必须是已登录用户，否则返回401  
    if (\_currentUser.Id == null)  
    {  
        context.Response.StatusCode = 401;  
        return;  
    }  
    //获取用户权限  
    var userPermisions = (await \_service.GetUserPermissionCode((Guid) \_currentUser.Id)).ToHashSet();  
    //比对权限 如果无权限则返回403  
    foreach (var cusPermissionAttribute in attributes)  
    {  
        var flag = cusPermissionAttribute.Relation == PermissionRelation.And  
            ? cusPermissionAttribute.PermissionCode.All(code => userPermisions.Contains(code))  
            : cusPermissionAttribute.PermissionCode.Any(code => userPermisions.Contains(code));  
        if (!flag)  
        {  
            context.Response.StatusCode = 403;  
            return;  
        }  
    }

    await \_next(context);  
}  

}

在接口调用时，该中间件会获取接口所声明的权限特性，并调用身份管理服务接口获取当前用户所持有的权限码，按特性顺序依次验证。

在Demo.Permissions中添加PermissionRegistor类，用于在聚合服务启动时读取代码中声明的所有权限码，并注册到身份管理服务。代码如下：

using System.ComponentModel;
using Demo.Identity.Permissions.Dto;

namespace Demo.Permissions;

///

/// <summary>  
/// 在指定类型中获取权限集合  
/// </summary>  
/// <param name="serviceName">服务名称</param>  
/// <typeparam name="T">类型</typeparam>  
/// <returns></returns>  
internal static List<SysPermissionDto> GetPermissions<T>(string serviceName)  
{  
    List<SysPermissionDto> result = new List<SysPermissionDto>();  
    Type type = typeof(T);  
    var fields = type.GetFields().Where(x=>x.IsPublic&&x.IsStatic);  
    foreach (var field in fields)  
    {  
        string code = field.GetValue(null).ToString();  
        string name = "";  
        object\[\] objs = field.GetCustomAttributes(typeof(DescriptionAttribute), false);  //获取描述属性  
        if (objs != null && objs.Length > 0)  
        {  
            DescriptionAttribute descriptionAttribute = (DescriptionAttribute) objs\[0\];  
            name = descriptionAttribute.Description;  
        }

        string parentCode = null;  
        if (code.Contains("."))  
        {  
            parentCode = code.Substring(0, code.LastIndexOf('.'));  
        }

        result.Add(new SysPermissionDto()  
        {  
            Name = name,  
            Code = code,  
            ParentCode = parentCode,  
            ServiceName = serviceName,  
        });  
    }

    return result;  
}  

}

在Demo.Permissions中添加CusPermissionExtensions类，提供IApplicationBuilder的扩展方法，用于注册中间件和注册权限，代码如下：

using Demo.Identity.Permissions;

namespace Demo.Permissions;

public static class CusPermissionExtensions
{
///

/// <summary>  
/// 注册权限  
/// </summary>  
/// <param name="app"></param>  
/// <param name="serviceName">服务名称</param>  
/// <typeparam name="T"></typeparam>  
private static async Task RegistPermissions<T>(this IApplicationBuilder app, string serviceName)  
{  
    var service = app.ApplicationServices.GetService<ISysPermissionAppService>();  
    var permissions = PermissionRegistor.GetPermissions<T>(serviceName);  
    await service.RegistPermission(serviceName, permissions);  
}  

\[Description("创建订单")\]  
public const string ORDER\_CREATE = $"{ORDER}.Create";

\[Description("查询订单")\]  
public const string ORDER\_SELECT = $"{ORDER}.Select";

//添加其他权限 ……