基于.Net核心Api - Token的认证限制删除表中任意记录问题

[HttpDelete("{id}")]
public IActionResult DeleteRecord(int id)
{
    var user = GetUserFromToken(Request.Headers.Authorization);
    if (user == null || !user.HasPermission("DeleteRecord"))
    {
        return Unauthorized();
    }

    // 删除记录的逻辑
    _context.Records.Remove(_context.Records.Find(id));
    _context.SaveChanges();

    return NoContent();
}

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddJwtBearer(options =>
        {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = true,
                ValidateAudience = true,
                ValidateLifetime = true,
                ValidateIssuerSigningKey = true,
                ValidIssuer = Configuration["Jwt:Issuer"],
                ValidAudience = Configuration["Jwt:Audience"],
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:SecretKey"]))
            };
        });

    services.AddControllers();
}