ow

CloudBuilder/CloudBuilder.Security.Service/Authorization/PermissionHandler.cs

@@ -27,13 +27,19 @@ namespace CloudBuilder.Security.Service.Authorization
 {
     public class PermissionHandler : AuthorizationHandler<PermissionRequirement>, IAuthorize
     {
-        private readonly WebService service;
+        private readonly IServiceProvider serviceProvider;
         private readonly IContext loginContext;
         private readonly IHttpContextAccessor httpContextAccessor;
 
-        public PermissionHandler(WebService service, IContext loginContext, IHttpContextAccessor httpContextAccessor)
+        /// <summary>
+        /// 注意：这里必须注入当前请求作用域的 IServiceProvider，
+        /// 不能使用 WebService.Services.BuildServiceProvider() 新建容器，
+        /// 否则每次鉴权都会独立构建一整套服务实例(单例/作用域都会重建，且无法释放)，
+        /// 取到的 IApplicationService 也会与当前请求的作用域不一致。
+        /// </summary>
+        public PermissionHandler(IServiceProvider serviceProvider, IContext loginContext, IHttpContextAccessor httpContextAccessor)
         {
-            this.service = service;
+            this.serviceProvider = serviceProvider;
             this.loginContext = loginContext;
             this.httpContextAccessor = httpContextAccessor;
         }
@@ -66,7 +72,7 @@ namespace CloudBuilder.Security.Service.Authorization
             loginContext.SetToken(ClaimPolicy.GetJwtBearerToken(httpContextAccessor.HttpContext));
             loginContext.SetCulture(ClaimPolicy.GetClaimValue(httpContextAccessor, ClaimPolicy.CLAINM_LOCALE) ?? CulturePolicy.ZH_CN);
 
-            IApplicationService applicationService = service.Services.BuildServiceProvider().GetRequiredService<IApplicationService>();
+            IApplicationService applicationService = serviceProvider.GetRequiredService<IApplicationService>();
             PermissionContext permissionContext = new PermissionContext(applicationService);
 
             bool result = false;