TenantSelectCredentialCipher.cs
2.73 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
using System.Security.Cryptography;
using System.Text;
using FoodLabeling.Th.Application.Contracts.Options;
using Microsoft.Extensions.Options;
using Volo.Abp;
using Volo.Abp.DependencyInjection;
namespace FoodLabeling.Th.Application.MultiTenancy;
/// <summary>
/// 租户下拉默认管理员密码 AES-CBC 加密（随机 IV 作为 passwordSalt 返回前端）
/// </summary>
public class TenantSelectCredentialCipher : ITransientDependency
{
private readonly byte[] _key;
public TenantSelectCredentialCipher(IOptions<FoodLabelingThTenantSelectCryptoOptions> options)
{
var secretKey = options.Value.SecretKey?.Trim();
if (string.IsNullOrEmpty(secretKey))
{
throw new AbpException("未配置 FoodLabeling:TenantSelectCrypto:SecretKey");
}
_key = SHA256.HashData(Encoding.UTF8.GetBytes(secretKey));
}
/// <summary>
/// 加密明文密码，返回 Base64 密文与 Base64 IV（passwordSalt）
/// </summary>
public (string Password, string PasswordSalt) EncryptPassword(string plainPassword)
{
if (plainPassword is null)
{
throw new ArgumentNullException(nameof(plainPassword));
}
var iv = RandomNumberGenerator.GetBytes(16);
using var aes = Aes.Create();
aes.Key = _key;
aes.IV = iv;
aes.Mode = CipherMode.CBC;
aes.Padding = PaddingMode.PKCS7;
using var encryptor = aes.CreateEncryptor();
var plainBytes = Encoding.UTF8.GetBytes(plainPassword);
var cipherBytes = encryptor.TransformFinalBlock(plainBytes, 0, plainBytes.Length);
return (Convert.ToBase64String(cipherBytes), Convert.ToBase64String(iv));
}
/// <summary>
/// 解密前端传入的 AES-CBC 密码（Base64 密文 + Base64 IV）
/// </summary>
public string DecryptPassword(string password, string passwordSalt)
{
if (string.IsNullOrEmpty(password) || string.IsNullOrEmpty(passwordSalt))
{
throw new UserFriendlyException("密码解密失败");
}
try
{
var cipherBytes = Convert.FromBase64String(password);
var iv = Convert.FromBase64String(passwordSalt);
using var aes = Aes.Create();
aes.Key = _key;
aes.IV = iv;
aes.Mode = CipherMode.CBC;
aes.Padding = PaddingMode.PKCS7;
using var decryptor = aes.CreateDecryptor();
var plainBytes = decryptor.TransformFinalBlock(cipherBytes, 0, cipherBytes.Length);
return Encoding.UTF8.GetString(plainBytes);
}
catch (Exception ex) when (ex is not UserFriendlyException)
{
throw new UserFriendlyException("密码解密失败");
}
}
}