HangFire多集群切换及DashBoard登录验证

项目中是有多个集群的，现在存在一个是：在切换web集群时，如何切换HangFire的周期性任务。

先采取的解决办法是：

• 每个集群分一个队列，在周期性任务入队时分配当前web集群的集群id单做队列名称。
• 之前已存在的周期性任务，在其入队时修正到正确的集群执行

通过BackgroundJobServerOptions配置，只监听当前web集群的队列（ps:可参考文档：https://docs.hangfire.io/en/latest/background-processing/configuring-queues.html）

 //只监听当前集群的队列
                     var options = new BackgroundJobServerOptions()
                     {
                         Queues = new[] { GlobalConfigSection.Current.WebClusterId }
                     };
                     HangfireAspNet.Use(() => new[] { new BackgroundJobServer(options) });

通过实现IElectStateFilter，重写OnStateElection方法，在任务入队前修正其入当前集群队列执行。

配置使用自定义熟悉

GlobalJobFilters.Filters.Add(new CustomJobFilterAttribute());

重写OnStateElection方法，通过修改enqueuedState的queue熟悉修正队列

 /// <summary>
     /// HangFire Filter
     /// </summary>
     public class CustomJobFilterAttribute : JobFilterAttribute, IElectStateFilter
     {
         public void OnStateElection(ElectStateContext context)
         {
             if (context.CandidateState is EnqueuedState enqueuedState)
             {
                 var tenantConfigProvider = ObjectContainer.GetService<ITenantConfigProvider>();
                 var contextMessage = context.GetJobParameter<ContextMessage>("_ld_contextMessage");
                 var webClusterId = tenantConfigProvider.GetWebClusterIdByTenant(contextMessage.TenantId);
                 if (enqueuedState.Queue != webClusterId)//修正队列
                 {
                     enqueuedState.Queue = webClusterId;
                 }
             }
         }

     }

ps(更多的filter可以参考文档：https://docs.hangfire.io/en/latest/extensibility/using-job-filters.html)

附上HangFire执行失败记录日志实现

  /// <summary>
     /// HangFire Filter
     /// </summary>
     public class CustomJobFilterAttribute : JobFilterAttribute, IServerFilter
     {

         public void OnPerforming(PerformingContext filterContext)
         {

         }

         /// <summary>
         /// 未成功执行的
         /// </summary>
         /// <param name="filterContext"></param>
         public void OnPerformed(PerformedContext filterContext)
         {
             var error = filterContext.Exception;
             if (error==null)
             {
                 return;
             }
             //记录日志到后台
             ILoggerFactory loggerFactory = ObjectContainer.GetService<ILoggerFactory>();
             ILogger logger;
             if (error.TargetSite != null && error.TargetSite.DeclaringType != null)
             {
                 logger = loggerFactory.Create(error.TargetSite.DeclaringType.GetUnProxyType());
             }
             else
             {
                 logger = loggerFactory.Create(GetType());
             }
             var contextMessage = filterContext.GetJobParameter<ContextMessage>("_ld_contextMessage");
             var message = GetLogMessage(contextMessage, error.ToString(), filterContext.BackgroundJob.Id);

             var logLevel = ErrorLevelType.Fatal;

             if (error.InnerException is AppException ex)
             {
                 logLevel = ex.ErrorLevel;
             }

             switch (logLevel)
             {
                 case ErrorLevelType.Info:
                     logger.Info(message, error);
                     break;
                 case ErrorLevelType.Warning:
                     logger.Warn(message, error);
                     break;
                 case ErrorLevelType.Error:
                     logger.Error(message, error);
                     break;
                 default:
                     logger.Fatal(message, error);
                     break;
             }
         }

         /// <summary>
         /// 获取当前日志对象
         /// </summary>
         /// <returns></returns>
         private LogMessage GetLogMessage(ContextMessage contextMessage, string errorMessage, string backgroundJobId)
         {
             var logMessage = new LogMessage(contextMessage, errorMessage)
             {
                 RawUrl = backgroundJobId
             };
             return logMessage;
         }

     }

---

现在还有一个问题是，HangFire DashBoard 默认只支持localhost访问，现在我需要可以很方便的在外网通过web集群就能访问到其对应的HangFire DashBoard。

通过文档https://docs.hangfire.io/en/latest/configuration/using-dashboard.html，可以知道其提供了一个登录验证的实现，但是由于其是直接写死了密码在代码中的，觉得不好。（ps:具体的实现可以参考：https://gitee.com/LucasDot/Hangfire.Dashboard.Authorization，https://www.cnblogs.com/lightmao/p/7910139.html）

我实现的思路是，在web集群界面直接打开标签页访问。在web集群后台生成token并在url中携带，在hangfire站点中校验token，验证通过则放行。同时校验url是否携带可修改的参数，如果有的话设置IsReadOnlyFunc放回false。（ps:可参考文档：https://docs.hangfire.io/en/latest/configuration/using-dashboard.html）

在startup页面配置使用dashboard，通过DashboardOptions选择配置我们自己实现的身份验证，以及是否只读设置。

 public void Configuration(IAppBuilder app)
         {
             try
             {  

                 Bootstrapper.Instance.Start();

                 var dashboardOptions = new DashboardOptions()
                 {
                     Authorization = new[] { new HangFireAuthorizationFilter() },
                     IsReadOnlyFunc = HangFireIsReadOnly
                 };
                 app.UseHangfireDashboard("/hangfire", dashboardOptions);

             }
             catch (Exception ex)
             {
                 Debug.WriteLine(ex);
             }

         }

         /// <summary>
         /// HangFire仪表盘是否只读
         /// </summary>
         /// <param name="context"></param>
         /// <returns></returns>
         private bool HangFireIsReadOnly(DashboardContext context)
         {
             var owinContext = new OwinContext(context.GetOwinEnvironment());
             if (owinContext.Request.Host.ToString().StartsWith("localhost"))
             {
                 return false;
             }

             try
             {
                 var cookie = owinContext.Request.Cookies["Ld.HangFire"];
                 char[] spilt = { ',' };
                 var userData = FormsAuthentication.Decrypt(cookie)?.UserData.Split(spilt, StringSplitOptions.RemoveEmptyEntries);
                 if (userData != null)
                 {
                     var isAdmin = userData[].Replace("isAdmin:", "");
                     return !bool.Parse(isAdmin);
                 }
             }
             catch (Exception e)
             {

             }

             return true;
         }

在HangFireAuthorizationFilter的具体实现中，先校验是否已存在验证后的cookie如果有就不再验证，或者如果是通过localhost访问也不进行校验，否则验证签名是否正确，如果正确就将信息写入cookie。

 /// <summary>
     /// HangFire身份验证
     /// </summary>
     public class HangFireAuthorizationFilter : IDashboardAuthorizationFilter
     {
         public bool Authorize(DashboardContext context)
         {
             var owinContext = new OwinContext(context.GetOwinEnvironment());

             if (owinContext.Request.Host.ToString().StartsWith("localhost")|| owinContext.Request.Cookies["Ld.HangFire"] != null)//通过localhost访问不校验，与cookie也不校验
             {
                 return true;
             }

             var cluster = owinContext.Request.Query.Get("cluster");//集群名称
             var isAdminS = owinContext.Request.Query.Get("isAdmin");//是否管理员（是则允许修改hangfire）
             var token = owinContext.Request.Query.Get("token");
             var t = owinContext.Request.Query.Get("t");//时间戳
             if (!string.IsNullOrEmpty(token) && bool.TryParse(isAdminS, out var isAdmin) && long.TryParse(t, out var timestamp))
             {
                 try
                 {
                     var isValid = LicenceHelper.ValidSignature($"{cluster}_{isAdmin}", token, timestamp, TimeSpan.FromMinutes());//五分钟有效
                     if (isValid)
                     {
                         var ticket = new FormsAuthenticationTicket(, cluster, DateTime.Now, DateTime.Now + FormsAuthentication.Timeout, false, $"isAdmin:{isAdmin}");
                         var authToken = FormsAuthentication.Encrypt(ticket);

                         owinContext.Response.Cookies.Append("Ld.HangFire", authToken, new CookieOptions()
                         {
                             HttpOnly = true,
                             Path = "/hangfire"
                         });
                         return true;
                     }
                 }
                 catch (Exception ex)
                 {

                 }
             }
             return false;

         }

     }

在web的管理后台具体实现为，同选中集群点击后台任务直接访问改集群的HangFire DashBoard

点击后台任务按钮，后台放回token相关信息，然后js打开一个新的标签页展示dashboard

 public ActionResult GetHangFireToken(string clusterName)
         {
             var isAdmin=WorkContext.User.IsAdmin;
             var timestamp = DateTime.UtcNow.Ticks;
             var token = LicenceHelper.Signature($"{clusterName}_{isAdmin}", timestamp);
             return this.Direct(new
             {
                 isAdmin,
                 token,
                 timestamp=timestamp.ToString()
             });
         }

 openHangFire:function() {
         var me = this, rows = me.getGridSelection('查看后台任务的集群', true);
         if (!rows) {
             return;
         }
         if (rows.length > 1) {
             me.alert('只能选择一行');
             return;
         }
         var clusterName = rows[0].get('ClusterName');
         var opts = {
             actionName: 'GetHangFireToken',
             extraParams: {
                 clusterName: clusterName
             },
             success: function (result) {
                 var data = result.result;
                 var url = Ext.String.format("{0}/hangfire?cluster={1}&isAdmin={2}&token={3}&t={4}",
                     rows[0].get("AccessUrl"),
                     clusterName,
                     data.isAdmin,
                     data.token,
                     data.timestamp);
                 window.open(url, clusterName);
             }
         };
         me.directRequest(opts);
     }