Program.cs

using DemoSite.Config;
using DemoSite.Data;
using DemoSite.Security;
using DemoSite.Services;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using Microsoft.OpenApi.Models;
using MongoDB.Driver;
using System.Security.Claims;
using System.Text;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container
builder.Services.AddControllers();
builder.Services.AddEndpointsApiExplorer();

// Swagger with JWT support
builder.Services.AddSwaggerGen(c =>
{
    c.SwaggerDoc("v1", new OpenApiInfo { Title = "User Management API", Version = "v1" });

    var securityScheme = new OpenApiSecurityScheme
    {
        Name = "Authorization",
        Type = SecuritySchemeType.Http,
        Scheme = "bearer",
        BearerFormat = "JWT",
        In = ParameterLocation.Header,
        Description = "Enter JWT Bearer token"
    };

    c.AddSecurityDefinition("Bearer", securityScheme);

    // Use a reference to the defined scheme for the requirement
    c.AddSecurityRequirement(new OpenApiSecurityRequirement
    {
        {
            new OpenApiSecurityScheme
            {
                Reference = new OpenApiReference { Type = ReferenceType.SecurityScheme, Id = "Bearer" }
            },
            Array.Empty<string>()
        }
    });
});


// Add CORS services
builder.Services.AddCors(options =>
{
    options.AddPolicy("AllowFrontend", policy =>
    {
        policy.WithOrigins("http://localhost:3000") // React dev server
            .AllowAnyHeader()
            .AllowAnyMethod();
    });
});

// MongoDB setup
builder.Services.AddSingleton<IMongoClient>(sp =>
{
    var connString = builder.Configuration["Mongo:ConnectionString"] ?? "mongodb://localhost:27017";
    return new MongoClient(connString);
});

builder.Services.AddSingleton(sp =>
{
    var dbName = builder.Configuration["Mongo:Database"] ?? "user_management";
    var client = sp.GetRequiredService<IMongoClient>();

    return client.GetDatabase(dbName);
});


// Bind Jwt options for TokenService (required because TokenService uses IOptions<JwtOptions>)
builder.Services.Configure<JwtOptions>(builder.Configuration.GetSection("Jwt"));

// Register TokenService
builder.Services.AddSingleton<ITokenService, TokenService>();
builder.Services.AddScoped<IUserRepository, UserRepository>();
builder.Services.AddScoped<IRefreshTokenRepository, RefreshTokenRepository>();
builder.Services.AddScoped<IUserProfileRepository, UserProfileRepository>();
builder.Services.AddHostedService<TokenCleanupService>();

// JWT Authentication
var jwtKey = builder.Configuration["Jwt:Key"] ?? "dev-secret-change-me";
var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtKey));

builder.Services
    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.RequireHttpsMetadata = !builder.Environment.IsDevelopment();
        options.SaveToken = true;

        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidIssuer = builder.Configuration["Jwt:Issuer"] ?? "UserManagement",

            ValidateAudience = true,
            ValidAudience = builder.Configuration["Jwt:Audience"] ?? "UserManagementAudience",

            ValidateIssuerSigningKey = true,
            IssuerSigningKey = key,

            ValidateLifetime = true,
            ClockSkew = TimeSpan.FromSeconds(30),

            // Ensure Role/Name claims resolve as expected if you use ClaimTypes.Role/Name
            NameClaimType = System.Security.Claims.ClaimTypes.Name,
            RoleClaimType = System.Security.Claims.ClaimTypes.Role
        };
    });

builder.Services.AddAuthorization();

var app = builder.Build();

// Middleware pipeline
//if (app.Environment.IsDevelopment())
//{
app.UseSwagger();
app.UseSwaggerUI();
//}

app.UseCors("AllowFrontend");

//app.UseHttpsRedirection();
app.UseAuthentication();
app.UseAuthorization();

app.MapControllers();

// Quick health check
app.MapGet("/health", () => Results.Ok(new { status = "ok", timeUtc = DateTime.UtcNow }))
   .AllowAnonymous();

//app.MapPost("/dev-token", ([FromServices] ITokenService tokens) =>
//    {
//        // Minimal user shape your TokenService expects
//        var user = new User
//        {
//            Id = Guid.NewGuid(),
//            UserName = "alice",
//            Email = "alice@example.com",
//            Roles = new List<string>() { "User" }
//        };

//        var (access, exp) = tokens.GenerateAccessToken(user);
//        return Results.Ok(new { accessToken = access, expiresAtUtc = exp });
//    })
//    .AllowAnonymous();


// ...
app.MapGet("/whoami", [Microsoft.AspNetCore.Authorization.Authorize] (ClaimsPrincipal user) =>
{
    var id = user.FindFirst(ClaimTypes.NameIdentifier)?.Value;
    var name = user.Identity?.Name;
    var email = user.FindFirst(ClaimTypes.Email)?.Value;
    var roles = user.FindAll(ClaimTypes.Role).Select(r => r.Value).ToArray();
    return Results.Ok(new { id, name, email, roles });
});


app.Run();