public class AdminUserAccountConst
{
    public const string AdminUserCookie = "AdminUserCookies";

    public const string AdminUserCookieName = "AdminUserCookieName";

    public const string AdminUserLoginPath = "/account/login";

    public const string AdminUserJwt = "AdminUserJwt";

    public const string AdminUserRole = "adminuser";
}

public class JWTConfig
{
    public string Issuer { get; set; }
    public string Audience { get; set; }
    public string IssuerSigningKey { get; set; }
    public int AccessTokenExpiresMinutes { get; set; }

    public string RefreshTokenAudience { get; set; }
    public int RefreshTokenExpiresMinutes { get; set; }
}

"Authentication": {
  "JwtBearer": {
    "Issuer": "Bingle",
    "Audience": "Bingle",
    "IssuerSigningKey": "Bingle_C421AAEE0D114EAAACVD",
    "AccessTokenExpiresMinutes": "14400",

    "RefreshTokenAudience": "RefreshTokenAudience",
    "RefreshTokenExpiresMinutes": "43200" //60*24*30
  }
},

 public interface ITokenHelper
 {
     ComplexToken CreateToken(User user);
     ComplexToken CreateToken(Claim[] claims);
     (Result result, string userCode) ConfirmRefreshToken(string refreshToken);
 }

 public class TokenHelper : ITokenHelper
 {
     private readonly IOptions<JWTConfig> _options;
     public TokenHelper(IOptions<JWTConfig> options)
     {
         _options = options;
     }

     public ComplexToken CreateToken(User user)
     {
         Claim[] claims = new Claim[]
         {
             new Claim(JwtClaimTypes.Id, user.UserCode),
             new Claim(JwtClaimTypes.Name, user.UserName),
             new Claim(JwtClaimTypes.Role, user.UserRole.GetExtendDescription()),
             new Claim(ClaimTypes.Role, user.UserRole.GetExtendDescription()),
             new Claim(JwtClaimTypes.Actor, user.PartyId)
         };
         return CreateToken(claims);
     }

     public ComplexToken CreateToken(Claim[] claims)
     {
         return new ComplexToken
         {
             AccessToken = CreateToken(claims, TokenType.AccessToken),
             RefreshToken = CreateToken(new Claim[]{claims.First(x=>x.Type == JwtClaimTypes.Id)}, TokenType.RefreshToken)
         };
     }

     /// <summary>
     /// 用于創(chuàng)建AccessToken和RefreshToken。
     /// 這里AccessToken和RefreshToken只是過期時間不同，【實(shí)際項(xiàng)目】中二者的claims內(nèi)容可能會不同。
     /// 因?yàn)镽efreshToken只是用于刷新AccessToken，其內(nèi)容可以簡單一些。
     /// 而AccessToken可能會附加一些其他的Claim。
     /// </summary>
     /// <param name="claims"></param>
     /// <param name="tokenType"></param>
     /// <returns></returns>
     private Token CreateToken(Claim[] claims, TokenType tokenType)
     {
         var now = DateTime.Now;
         var expires = now.Add(TimeSpan.FromMinutes(tokenType.Equals(TokenType.AccessToken) ? _options.Value.AccessTokenExpiresMinutes : _options.Value.RefreshTokenExpiresMinutes));
         var token = new JwtSecurityToken(
             issuer: _options.Value.Issuer,
             audience: tokenType.Equals(TokenType.AccessToken) ? _options.Value.Audience : _options.Value.RefreshTokenAudience,
             claims: claims,
             notBefore: now,
             expires: expires,
             signingCredentials: new SigningCredentials(new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_options.Value.IssuerSigningKey)), SecurityAlgorithms.HmacSha256));
         return new Token { TokenContent = new JwtSecurityTokenHandler().WriteToken(token), Expires = expires };
     }

     public (Result result, string userCode) ConfirmRefreshToken(string refreshToken)
     {
         var tokenHandler = new JwtSecurityTokenHandler();
         if (!tokenHandler.CanReadToken(refreshToken))
             return (Result.FromCode(ResultCode.InvalidToken, "RefreshToken不正確"), null);
         var jwtSecurityToken = tokenHandler.ReadJwtToken(refreshToken);
         if (jwtSecurityToken.Issuer != _options.Value.Issuer || !jwtSecurityToken.Audiences.Contains(_options.Value.RefreshTokenAudience))
             return (Result.FromCode(ResultCode.InvalidToken, "RefreshToken不正確"), null);
         if (jwtSecurityToken.ValidTo < DateTime.Now)
             return (Result.FromCode(ResultCode.InvalidToken, "RefreshToken已經(jīng)過期了"), null);

         return (Result.Ok(), jwtSecurityToken.Claims.First(x => x.Type == JwtClaimTypes.Id).Value);
     }

 }