//前端请参考Abp文档https://docs.abp.io/en/abp/latest/Authorization
//后端使用方法参考:AuthorizationPolicyProvider_Test

//1.在需要输出Dto上加入PermissionAttribute
public class DemoDto : FullAuditedEntityDto<Guid>, IHasConcurrencyStamp
    {
        public string? Name { get; set; }
        [Permission(DataPermissionPermissions.Demos.Read)]//Add
        public string? DisplayName { get; set; }
        public RowPermissionItemDto Permission { get; set; } = new RowPermissionItemDto();

        public string ConcurrencyStamp { get; set; }
    }
//2.在需要控制输出的方法中使用，若无权，会替换成默认值输出
   private readonly IDataPermissionAuthorizationPolicyProvider _dataPermissionAuthorizationPolicyProvider;
   await _dataPermissionAuthorizationPolicyProvider.CheckListAsync(dtos);

context.Services.Replace(ServiceDescriptor.Singleton<IOrganizationStore, MyOrganizationStore>());

public class MyOrganizationStore:OrganizationStore
{
public MyOrganizationStore(IIdentityUserRepository identityUserRepository, IOrganizationUnitRepository organizationUnitRepository) : base(identityUserRepository, organizationUnitRepository)
{

    }
    public override async Task<List<string>> GetMenberInOrganizationUnitAsync(Guid id)
    {
        List<string> result = new List<string>();
        result.Add(id.ToString());
        return result;
    }


}

  Configure<DataPermissionOptions>(options =>
  {
  options.CacheExpirationTime = 60;
  });

 protected IDataPermissionStore dataPermissionStore => LazyServiceProvider.LazyGetRequiredService<IDataPermissionStore>();

protected virtual IQueryable<Demo> ApplyFilter(
            IQueryable<Demo> query,
            string filterText,
            string name = null,
            string displayName = null)
        {
            query = DataPermissionExtensions.EntityFilter(query,  dataPermissionStore.GetAll());//add
            return query
                    .WhereIf(!string.IsNullOrWhiteSpace(filterText), e => e.Name.Contains(filterText) || e.DisplayName.Contains(filterText))
                    .WhereIf(!string.IsNullOrWhiteSpace(name), e => e.Name.Contains(name))
                    .WhereIf(!string.IsNullOrWhiteSpace(displayName), e => e.DisplayName.Contains(displayName));
        }

 public async Task<Demo> GetAsync(Guid id, CancellationToken cancellationToken = default)
        {
            var query = await GetQueryableAsync();
            query = DataPermissionExtensions.EntityFilter(query,  await dataPermissionStore.GetAllAsync());//add
            var item =  await query.FirstOrDefaultAsync(e => e.Id == id, GetCancellationToken(cancellationToken));
            await dataPermissionStore.GetPermissionAsync(id.ToString(), item);//add
            return item;
        }

 protected IPermissionApplicationService permissionApplicationService => LazyServiceProvider.LazyGetRequiredService<IPermissionApplicationService>();

var demo = await DemosAppService.GetAsync(input.Id);
CanEditDemo =  PermissionApplicationService.GetAsync(demo.Id.ToString(),DataPermissionPermissions.Demos.Edit, PermissionType.Update).Result.IsGranted;//add

 public async Task<Demo> UpdateAsync(Guid id, UpdateDemoDto input, CancellationToken cancellationToken = default)
        {
            var item = await GetAsync(id, cancellationToken);
            var checkPermission =await dataPermissionStore.CheckPermissionAsync(item, PermissionType.Update);//add
            //Todo:无权的操作
            ObjectMapper.Map(input, item);
            await ValidateAsync(item);
            await Repository.UpdateAsync(item, autoSave: true);
            return item;
        }

//add permission check
if (!dataPermissionStore.CheckPermission(demo, PermissionType.Create))
            {
                throw new UserFriendlyException(
                    "The current user does not have permission to create data!"
                );
            }

//创建一个数据权限的Dto
public class PermissionItemDto
{
    public bool CanUpdate { get; set; }
    public bool CanDelete { get; set; }
}
//在查询返回的Dto中加入
public PermissionItemDto Permission { get; set; } = new PermissionItemDto();
//AutoMapper中需要先忽略Permission
 .ForMember(dest => dest.Permission, opt => opt.Ignore());

//在查询结果返回前把权限取出
 var dtos = items.Select(queryResultItem =>
            {
                var dto = ObjectMapper.Map<Demo, DemoDto>(queryResultItem);
                dto.Permission = ObjectMapper.Map<PermissionCacheItem, PermissionItemDto>(dataPermissionStore.GetPermissionAsync(queryResultItem).Result);//add
                return dto;
            }).ToList();

 protected IDataPermissionItemStore dataPermissionItemStore => LazyServiceProvider.LazyGetRequiredService<IDataPermissionItemStore>();//字段级数据权限
 
    if (dataPermissionItemStore.CheckUpdate(nameof(Demo), "Name"))
                demo.Name = name;
   if (dataPermissionItemStore.CheckUpdate(nameof(Demo), "DisplayName"))
                demo.DisplayName = displayName;
 

@inject IPermissionApplicationService PermissionApplicationService
      private DataPermissionItemDto DataPermissionItem { get; set; }
      //这里把字段级权限获取，再传递给前端，前端根据权限判断是否显示编辑
            //需要注意判断是否有权限规则如下参考：
            //if (!DataPermissionItem.PermissionItems.Any(x => x.TargetType == "DisplayName")||DataPermissionItem.PermissionItems.FirstOrDefault(x => x.TargetType == "DisplayName").CanEdit)
            DataPermissionItem =
                await PermissionApplicationService.GetDataPermissionItemAsync(new GetPermissionItemInput()
                {
                    ObjectName = "Demo",
                });

 public class DemoDto : FullAuditedEntityDto<Guid>, IHasConcurrencyStamp
    {
        public string? Name { get; set; }
        [PermissionVerifier("Demo", "DisplayName")]//优先度高
        [Permission("DataPermission.Demos")]//如果希望直接使用Abp权限，可以使用这个
        public string? DisplayName { get; set; }
        public RowPermissionItemDto Permission { get; set; } = new RowPermissionItemDto();

        public string ConcurrencyStamp { get; set; }
    }

public virtual async Task<DemoDto> GetAsync(Guid id)
        {
            var demo = await _demoRepository.GetAsync(id);
            var item =  ObjectMapper.Map<Demo, DemoDto>(demo);
            await dataPermissionItemStore.CheckAsync(item);//add
            //await dataPermissionItemStore.CheckListAsync(dtos);//如果是列表需要使用这个方法
            item.Permission = ObjectMapper.Map<PermissionCacheItem, RowPermissionItemDto>( await dataPermissionStore.GetPermissionAsync(demo));
            return item;
        }