Authentication

// Program.csbuilder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)    .AddJwtBearer(options =>    {        options.TokenValidationParameters = new TokenValidationParameters        {            ValidateIssuer = true,            ValidateAudience = true,            ValidateLifetime = true,            ValidateIssuerSigningKey = true,            ValidIssuer = builder.Configuration["Jwt:Issuer"],            ValidAudience = builder.Configuration["Jwt:Audience"],            IssuerSigningKey = new SymmetricSecurityKey(                Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]!)),            ClockSkew = TimeSpan.Zero        };    });
builder.Services.AddAuthorization();

public sealed class TokenService(IConfiguration config, TimeProvider clock){    private static readonly JsonWebTokenHandler TokenHandler = new();
    public string GenerateToken(User user, IEnumerable<string> roles)    {        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(config["Jwt:Key"]!));        var now = clock.GetUtcNow();
        var descriptor = new SecurityTokenDescriptor        {            Issuer = config["Jwt:Issuer"],            Audience = config["Jwt:Audience"],            IssuedAt = now.UtcDateTime,            Expires = now.AddHours(1).UtcDateTime,            Claims = new Dictionary<string, object>            {                [JwtRegisteredClaimNames.Sub] = user.Id,                [JwtRegisteredClaimNames.Email] = user.Email!,                [JwtRegisteredClaimNames.Name] = user.UserName!,                ["roles"] = roles.ToArray()            },            SigningCredentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256)        };
        return TokenHandler.CreateToken(descriptor);    }}

// Define policiesbuilder.Services.AddAuthorizationBuilder()    .AddPolicy("AdminOnly", policy => policy.RequireRole("Admin"))    .AddPolicy("CanManageOrders", policy => policy        .RequireAuthenticatedUser()        .RequireClaim("permission", "orders:write"))    .AddPolicy("MinimumAge", policy => policy        .AddRequirements(new MinimumAgeRequirement(18)));
// Custom requirement + handlerpublic class MinimumAgeRequirement(int minimumAge) : IAuthorizationRequirement{    public int MinimumAge => minimumAge;}
public class MinimumAgeHandler(TimeProvider clock) : AuthorizationHandler<MinimumAgeRequirement>{    protected override Task HandleRequirementAsync(        AuthorizationHandlerContext context,        MinimumAgeRequirement requirement)    {        var dateOfBirthClaim = context.User.FindFirst("date_of_birth");        if (dateOfBirthClaim is not null &&            DateOnly.TryParse(dateOfBirthClaim.Value, out var dob) &&            dob.AddYears(requirement.MinimumAge) <= DateOnly.FromDateTime(clock.GetUtcNow().DateTime))        {            context.Succeed(requirement);        }        return Task.CompletedTask;    }}

// Protect an entire groupapp.MapGroup("/api/admin")    .WithTags("Admin")    .RequireAuthorization("AdminOnly")    .MapAdminEndpoints();
// Protect individual endpointsgroup.MapPost("/", CreateOrder)    .RequireAuthorization("CanManageOrders");
// Allow anonymous on a protected groupgroup.MapGet("/public-info", GetPublicInfo)    .AllowAnonymous();

builder.Services.AddAuthentication(options =>{    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;}).AddCookie().AddOpenIdConnect(options =>{    options.Authority = builder.Configuration["Oidc:Authority"];    options.ClientId = builder.Configuration["Oidc:ClientId"];    options.ClientSecret = builder.Configuration["Oidc:ClientSecret"];    options.ResponseType = "code";    options.SaveTokens = true;    options.Scope.Add("openid");    options.Scope.Add("profile");    options.Scope.Add("email");});

// In minimal API handlers — inject ClaimsPrincipal or HttpContextgroup.MapGet("/me", (ClaimsPrincipal user) =>{    var userId = user.FindFirstValue(ClaimTypes.NameIdentifier);    var email = user.FindFirstValue(ClaimTypes.Email);    return TypedResults.Ok(new { userId, email });}).RequireAuthorization();

// BAD — magic strings, hard to refactor, not testable[Authorize(Roles = "Admin,SuperAdmin,Manager")]public class AdminController { }
// GOOD — policy-basedbuilder.Services.AddAuthorizationBuilder()    .AddPolicy("AdminAccess", p => p.RequireRole("Admin", "SuperAdmin", "Manager"));
group.MapGet("/", Handler).RequireAuthorization("AdminAccess");

// BAD — disabling validationoptions.TokenValidationParameters = new TokenValidationParameters{    ValidateIssuer = false,      // DON'T    ValidateAudience = false,    // DON'T    ValidateLifetime = false,    // DEFINITELY DON'T};
// GOOD — validate everything (see JWT Bearer Authentication pattern above for full setup)