.NET Core Azure函数中基于HTTP头TenantId的全局查询过滤器失效

1. OnModelCreating执行时机错误：EF Core的OnModelCreating仅在DbContext模型首次初始化时执行一次，并非每个请求/触发器执行时都会运行。你当前的代码在OnModelCreating中判断TenantId > 0并生成查询过滤器，只会使用模型初始化时的TenantId值（通常是0），后续请求中设置的TenantId无法更新已生成的过滤器。
2. 查询过滤器表达式硬编码：你构建的过滤器表达式将当前DbContext实例的TenantId作为常量嵌入，而非动态从ITenantProvider获取实时值，导致过滤器无法随请求更新租户信息。
3. 非HTTP触发器无中间件支持：Service Bus、Timer等非HTTP触发器没有HttpContext，AuthorizationMiddleware不会执行，TenantProvider的TenantId永远不会被设置，直接导致过滤器失效。

1. 修正全局查询过滤器的动态构建 #

修改DbContext的OnModelCreating，让查询过滤器动态从ITenantProvider获取TenantId，而非依赖DbContext初始化时的值：

protected override void OnModelCreating(ModelBuilder modelBuilder)
{
    base.OnModelCreating(modelBuilder);

    foreach (var entityType in modelBuilder.Model.GetEntityTypes())
    {
        var clrType = entityType.ClrType;
        var tenantProperty = clrType.GetProperty("TenantId");
        if (tenantProperty == null) continue;

        // 构建访问ITenantProvider.Tenant的表达式
        var tenantProviderParam = Expression.Parameter(typeof(ITenantProvider), "tenantProvider");
        var tenantPropertyExpr = Expression.Property(tenantProviderParam, nameof(ITenantProvider.Tenant));
        var convertedTenantId = Expression.Convert(tenantPropertyExpr, tenantProperty.PropertyType);

        // 构建实体的TenantId属性表达式
        var entityParam = Expression.Parameter(clrType, "e");
        var entityTenantProperty = Expression.Property(entityParam, tenantProperty);

        // 构建相等表达式：e.TenantId == tenantProvider.Tenant
        var equalityExpr = Expression.Equal(entityTenantProperty, convertedTenantId);

        // 结合DbContext的ITenantProvider字段，生成最终的过滤器lambda
        var dbContextParam = Expression.Parameter(typeof(Context), "context");
        var tenantProviderProperty = Expression.Property(dbContextParam, nameof(_tenantService));
        var resolvedTenantProvider = Expression.Convert(tenantProviderProperty, typeof(ITenantProvider));
        var lambdaBody = Expression.Invoke(Expression.Lambda(equalityExpr, entityParam, tenantProviderParam), entityParam, resolvedTenantProvider);
        
        var filterLambda = Expression.Lambda(lambdaBody, entityParam);

        modelBuilder.Entity(clrType).HasQueryFilter(filterLambda);
    }
}

同时，调整DbContext的TenantId属性为便捷访问用，不再让过滤器依赖它：

private readonly ITenantProvider _tenantService;

public Context(DbContextOptions<Context> options, ITenantProvider service)
    : base(options)
{
    _tenantService = service;
}

// 仅作为便捷访问，过滤器不再依赖此属性
public long TenantId => _tenantService?.Tenant ?? 0;

2. 处理非HTTP触发器的TenantId设置 #

对于非HTTP触发器，需要手动设置TenantProvider的TenantId：

Service Bus Trigger示例 #

从Service Bus消息的自定义属性中获取TenantId并设置：

public class ServiceBusFunction
{
    private readonly ITenantProvider _tenantProvider;
    private readonly Context _dbContext;

    public ServiceBusFunction(ITenantProvider tenantProvider, Context dbContext)
    {
        _tenantProvider = tenantProvider;
        _dbContext = dbContext;
    }

    [FunctionName("ServiceBusProcessor")]
    public async Task Run(
        [ServiceBusTrigger("myqueue", Connection = "ServiceBusConnection")] Message message,
        ILogger log)
    {
        // 从消息属性中获取TenantId
        if (message.UserProperties.TryGetValue("TenantId", out var tenantIdObj) && long.TryParse(tenantIdObj.ToString(), out var tenantId))
        {
            _tenantProvider.Tenant = tenantId;
        }
        else
        {
            // 处理TenantId缺失的情况，比如抛出异常
            throw new ArgumentException("TenantId is missing from Service Bus message properties");
        }

        // 后续数据库操作会自动应用租户过滤器
        var data = await _dbContext.MyEntities.ToListAsync();
        // 业务逻辑...
    }
}

Timer Trigger示例 #

如果Timer Trigger针对特定租户，可从配置文件获取TenantId：

public class TimerFunction
{
    private readonly ITenantProvider _tenantProvider;
    private readonly Context _dbContext;
    private readonly IConfiguration _configuration;

    public TimerFunction(ITenantProvider tenantProvider, Context dbContext, IConfiguration configuration)
    {
        _tenantProvider = tenantProvider;
        _dbContext = dbContext;
        _configuration = configuration;
    }

    [FunctionName("TimerProcessor")]
    public async Task Run([TimerTrigger("0 */5 * * * *")] TimerInfo myTimer, ILogger log)
    {
        // 从配置获取TenantId（多租户定时任务可遍历租户列表）
        var tenantId = long.Parse(_configuration["DefaultTenantId"]);
        _tenantProvider.Tenant = tenantId;

        // 数据库操作...
        var data = await _dbContext.MyEntities.ToListAsync();
    }
}

3. 确保HTTP触发器中间件正确注册 #

在Azure Functions中，将中间件注册到HTTP请求管道：

// Program.cs
var host = new HostBuilder()
    .ConfigureFunctionsWorkerDefaults(builder =>
    {
        // 注册AuthorizationMiddleware
        builder.UseMiddleware<AuthorizationMiddleware>();
    })
    .ConfigureServices(services =>
    {
        services.AddScoped<ITenantProvider, TenantProvider>();
        // 注册DbContext
        services.AddDbContext<Context>(options =>
            options.UseSqlServer(Environment.GetEnvironmentVariable("ConnectionString")));
    })
    .Build();

host.Run();

4. 增强TenantProvider的合法性校验 #

你的TenantProvider使用AsyncLocal<long>的方案是正确的，可添加合法性校验避免无效值：

public class TenantProvider : ITenantProvider
{
    private readonly ILogger<TenantProvider> _logger;
    private static readonly AsyncLocal<long> _tenantId = new();

    public TenantProvider(ILogger<TenantProvider> logger)
    {
        _logger = logger;
    }

    public long Tenant
    {
        get => _tenantId.Value;
        set
        {
            if (value <= 0)
            {
                _logger.LogWarning("Invalid TenantId set: {TenantId}", value);
                // 可选：抛出异常阻止无效值
                // throw new ArgumentOutOfRangeException(nameof(value), "TenantId must be greater than 0");
            }
            _tenantId.Value = value;
        }
    }
}

• 若需要绕过租户过滤器（如管理员查询全量数据），可使用IgnoreQueryFilters()：_dbContext.MyEntities.IgnoreQueryFilters().ToListAsync()
• 所有触发器执行数据库操作前，必须确保已设置正确的TenantId，否则过滤器会使用默认值0
• Azure Functions中Scoped服务的生命周期与每个触发器执行实例绑定，无需担心跨实例数据污染

内容的提问来源于stack exchange，提问作者foxhound