Validate Dapr App API Tokens.

framework/src/Volo.Abp.AspNetCore.Mvc.Dapr.EventBus/Volo/Abp/AspNetCore/Mvc/Dapr/EventBus/Controllers/AbpAspNetCoreMvcDaprPubSubController.cs

@@ -21,6 +21,8 @@ public class AbpAspNetCoreMvcDaprPubSubController : AbpController
     [HttpPost(AbpAspNetCoreMvcDaprPubSubConsts.DaprEventCallbackUrl)]
     public virtual async Task<IActionResult> EventsAsync()
     {
+        this.HttpContext.ValidateDaprAppApiToken();
+        
         var bodyJsonDocument = await JsonDocument.ParseAsync(HttpContext.Request.Body);
         var request = JsonSerializer.Deserialize<AbpAspNetCoreMvcDaprSubscriptionRequest>(bodyJsonDocument.RootElement.GetRawText(),
             HttpContext.RequestServices.GetRequiredService<IOptions<JsonOptions>>().Value.JsonSerializerOptions);

framework/src/Volo.Abp.AspNetCore.Mvc.Dapr/Volo/Abp/AspNetCore/Mvc/Dapr/DaprAppApiTokenValidator.cs

@@ -0,0 +1,62 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+using Volo.Abp.Authorization;
+using Volo.Abp.Dapr;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.AspNetCore.Mvc.Dapr;
+
+public class DaprAppApiTokenValidator : IDaprAppApiTokenValidator, ISingletonDependency
+{
+    public virtual void CheckDaprAppApiToken(HttpContext httpContext)
+    {
+        var expectedAppApiToken = GetConfiguredAppApiToken(httpContext);
+        if (expectedAppApiToken.IsNullOrWhiteSpace())
+        {
+            return;
+        }
+        
+        var headerAppApiToken = GetDaprAppApiTokenOrNull(httpContext);
+        if (headerAppApiToken.IsNullOrWhiteSpace())
+        {
+            throw new AbpAuthorizationException("Expected Dapr App API Token is not provided! Dapr should set the 'dapr-api-token' HTTP header.");
+        }
+
+        if (expectedAppApiToken != headerAppApiToken)
+        {
+            throw new AbpAuthorizationException("The Dapr App API Token (provided in the 'dapr-api-token' HTTP header) doesn't match the expected value!");
+        }
+    }
+
+    public virtual bool IsValidDaprAppApiToken(HttpContext httpContext)
+    {
+        var expectedAppApiToken = GetConfiguredAppApiToken(httpContext);
+        if (expectedAppApiToken.IsNullOrWhiteSpace())
+        {
+            return true;
+        }
+        
+        var headerAppApiToken = GetDaprAppApiTokenOrNull(httpContext);
+        return expectedAppApiToken == headerAppApiToken;
+    }
+
+    public virtual string? GetDaprAppApiTokenOrNull(HttpContext httpContext)
+    {
+        string apiTokenHeader = httpContext.Request.Headers["dapr-api-token"];
+        if (string.IsNullOrEmpty(apiTokenHeader) || apiTokenHeader.Length < 1)
+        {
+            return null;
+        }
+
+        return apiTokenHeader;
+    }
+    
+    protected virtual string GetConfiguredAppApiToken(HttpContext httpContext)
+    {
+        var expectedAppApiToken = httpContext
+            .RequestServices
+            .GetRequiredService<IDaprApiTokenProvider>()
+            .GetAppApiToken();
+        return expectedAppApiToken;
+    }
+}

framework/src/Volo.Abp.AspNetCore.Mvc.Dapr/Volo/Abp/AspNetCore/Mvc/Dapr/DaprHttpContextExtensions.cs

@@ -0,0 +1,31 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Volo.Abp.AspNetCore.Mvc.Dapr;
+
+public static class DaprHttpContextExtensions
+{
+    public static void ValidateDaprAppApiToken(this HttpContext httpContext)
+    {
+        httpContext
+            .RequestServices
+            .GetRequiredService<IDaprAppApiTokenValidator>()
+            .CheckDaprAppApiToken(httpContext);
+    }
+    
+    public static bool IsValidDaprAppApiToken(this HttpContext httpContext)
+    {
+        return httpContext
+            .RequestServices
+            .GetRequiredService<IDaprAppApiTokenValidator>()
+            .IsValidDaprAppApiToken(httpContext);
+    }
+    
+    public static string? GetDaprAppApiTokenOrNull(HttpContext httpContext)
+    {
+        return httpContext
+            .RequestServices
+            .GetRequiredService<IDaprAppApiTokenValidator>()
+            .GetDaprAppApiTokenOrNull(httpContext);
+    }
+}

framework/src/Volo.Abp.AspNetCore.Mvc.Dapr/Volo/Abp/AspNetCore/Mvc/Dapr/IDaprAppApiTokenValidator.cs

@@ -0,0 +1,10 @@
+using Microsoft.AspNetCore.Http;
+
+namespace Volo.Abp.AspNetCore.Mvc.Dapr;
+
+public interface IDaprAppApiTokenValidator
+{
+    void CheckDaprAppApiToken(HttpContext httpContext);
+    bool IsValidDaprAppApiToken(HttpContext httpContext);
+    string? GetDaprAppApiTokenOrNull(HttpContext httpContext);
+}