feat: add user and role view sheets with detailed information display

- Created UserViewSheet component to display user details including username, full name, role, status, and timestamps.
- Created RoleViewSheet component to display role details including name, level, status, creation date, and associated permissions.
- Introduced permissions configuration in a new permissions.ts file, defining categories and permission codes for better management.
- Implemented middleware for authentication, ensuring access control for protected routes.

Distribution/Middleware/AuthMiddleware.cs

@@ -1,5 +1,5 @@
 using System.IdentityModel.Tokens.Jwt;
-using System.Text;
+using System.Security.Cryptography;
 using Microsoft.IdentityModel.Tokens;
 
 namespace Distribution.Middleware;
@@ -13,18 +13,24 @@ public class AuthMiddleware(RequestDelegate next, IConfiguration config)
             .Replace("Bearer ", "", StringComparison.OrdinalIgnoreCase)
             .Trim();
 
+        if (string.IsNullOrEmpty(token))
+            token = context.Request.Cookies["access-token"] ?? string.Empty;
+
         if (!string.IsNullOrEmpty(token))
         {
-            var key = config["Jwt:Key"];
-            if (!string.IsNullOrEmpty(key))
+            var publicKeyXml = config["Jwt:PublicKey"];
+            if (!string.IsNullOrEmpty(publicKeyXml))
             {
                 try
                 {
+                    var rsa = RSA.Create();
+                    rsa.FromXmlString(publicKeyXml);
                     var principal = new JwtSecurityTokenHandler().ValidateToken(token,
                         new TokenValidationParameters
                         {
                             ValidateIssuerSigningKey = true,
-                            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(key)),
+                            IssuerSigningKey = new RsaSecurityKey(rsa),
+                            ValidAlgorithms = [SecurityAlgorithms.RsaSha256],
                             ValidateIssuer = true,
                             ValidIssuer = config["Jwt:Issuer"],
                             ValidateAudience = true,

Distribution/Middleware/BearerResponseHandler.cs

@@ -0,0 +1,31 @@
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.Extensions.Options;
+using System.Text.Encodings.Web;
+
+namespace Distribution.Middleware;
+
+/// <summary>
+/// Authentication handler that exists solely to provide Challenge (401) and Forbid (403)
+/// responses for UseAuthorization(). Token validation is handled upstream by AuthMiddleware,
+/// so HandleAuthenticateAsync returns NoResult to leave HttpContext.User untouched.
+/// </summary>
+public class BearerResponseHandler(
+    IOptionsMonitor<AuthenticationSchemeOptions> options,
+    ILoggerFactory logger,
+    UrlEncoder encoder) : AuthenticationHandler<AuthenticationSchemeOptions>(options, logger, encoder)
+{
+    protected override Task<AuthenticateResult> HandleAuthenticateAsync() =>
+        Task.FromResult(AuthenticateResult.NoResult());
+
+    protected override Task HandleChallengeAsync(AuthenticationProperties properties)
+    {
+        Response.StatusCode = StatusCodes.Status401Unauthorized;
+        return Task.CompletedTask;
+    }
+
+    protected override Task HandleForbiddenAsync(AuthenticationProperties properties)
+    {
+        Response.StatusCode = StatusCodes.Status403Forbidden;
+        return Task.CompletedTask;
+    }
+}