| 1 | using System.Text; |
| 2 | using IntercomService.Auth; |
| 3 | using IntercomService.Data; |
| 4 | using IntercomService.Endpoints; |
| 5 | using IntercomService.Options; |
| 6 | using IntercomService.Services; |
| 7 | using Microsoft.AspNetCore.Authentication.JwtBearer; |
| 8 | using Microsoft.EntityFrameworkCore; |
| 9 | using Microsoft.IdentityModel.Tokens; |
| 10 | using OutWit.Database.EntityFramework.Extensions; |
| 11 | |
| 12 | var builder = WebApplication.CreateBuilder(args); |
| 13 | |
| 14 | builder.Services.Configure<IntercomOptions>(builder.Configuration.GetSection(IntercomOptions.SectionName)); |
| 15 | builder.Services.Configure<JwtOptions>(builder.Configuration.GetSection(JwtOptions.SectionName)); |
| 16 | builder.Services.Configure<GitHubAuthOptions>(builder.Configuration.GetSection(GitHubAuthOptions.SectionName)); |
| 17 | builder.Services.Configure<OidcAuthOptions>(builder.Configuration.GetSection(OidcAuthOptions.SectionName)); |
| 18 | builder.Services.Configure<DevAuthOptions>(builder.Configuration.GetSection(DevAuthOptions.SectionName)); |
| 19 | |
| 20 | var intercom = builder.Configuration.GetSection(IntercomOptions.SectionName).Get<IntercomOptions>() ?? new IntercomOptions(); |
| 21 | var dataDir = Path.IsPathRooted(intercom.DataDirectory) |
| 22 | ? intercom.DataDirectory |
| 23 | : Path.Combine(builder.Environment.ContentRootPath, intercom.DataDirectory); |
| 24 | Directory.CreateDirectory(dataDir); |
| 25 | var dbPath = Path.Combine(dataDir, intercom.DatabaseFileName); |
| 26 | |
| 27 | builder.Services.AddDbContext<IntercomDbContext>(options => |
| 28 | options.UseWitDb($"Data Source={dbPath}")); |
| 29 | |
| 30 | builder.Services.AddHttpClient(); |
| 31 | builder.Services.AddSingleton<SseEventHub>(); |
| 32 | builder.Services.AddScoped<JwtTokenService>(); |
| 33 | builder.Services.AddScoped<TransportEventService>(); |
| 34 | builder.Services.AddScoped<TeamInviteService>(); |
| 35 | builder.Services.AddScoped<AgentAccountService>(); |
| 36 | builder.Services.AddScoped<WorkspaceResolveService>(); |
| 37 | builder.Services.AddSingleton<AuthProviderRegistry>(); |
| 38 | builder.Services.AddScoped<TeamMembershipService>(); |
| 39 | builder.Services.AddScoped<GitHubAuthService>(); |
| 40 | builder.Services.AddScoped<OidcAuthService>(); |
| 41 | |
| 42 | var jwt = builder.Configuration.GetSection(JwtOptions.SectionName).Get<JwtOptions>() ?? new JwtOptions(); |
| 43 | if (string.IsNullOrWhiteSpace(jwt.SigningKey) || jwt.SigningKey.Length < 32) |
| 44 | { |
| 45 | if (builder.Environment.IsDevelopment()) |
| 46 | jwt.SigningKey = "dev-signing-key-change-me-32chars-min!!"; |
| 47 | else |
| 48 | throw new InvalidOperationException("Jwt:SigningKey must be at least 32 characters."); |
| 49 | } |
| 50 | |
| 51 | builder.Services |
| 52 | .AddAuthentication(options => |
| 53 | { |
| 54 | options.DefaultAuthenticateScheme = "Smart"; |
| 55 | options.DefaultChallengeScheme = "Smart"; |
| 56 | }) |
| 57 | .AddPolicyScheme("Smart", "Smart", options => |
| 58 | { |
| 59 | options.ForwardDefaultSelector = context => |
| 60 | { |
| 61 | var header = context.Request.Headers.Authorization.ToString(); |
| 62 | if (builder.Environment.IsDevelopment() |
| 63 | && header.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase)) |
| 64 | { |
| 65 | var token = header["Bearer ".Length..].Trim(); |
| 66 | var dev = context.RequestServices.GetRequiredService<Microsoft.Extensions.Options.IOptions<DevAuthOptions>>().Value; |
| 67 | if (!string.IsNullOrWhiteSpace(dev.TeamToken) |
| 68 | && string.Equals(token, dev.TeamToken, StringComparison.Ordinal)) |
| 69 | return DevBearerAuthenticationHandler.SchemeName; |
| 70 | } |
| 71 | |
| 72 | return JwtBearerDefaults.AuthenticationScheme; |
| 73 | }; |
| 74 | }) |
| 75 | .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options => |
| 76 | { |
| 77 | options.TokenValidationParameters = new TokenValidationParameters |
| 78 | { |
| 79 | ValidateIssuer = true, |
| 80 | ValidateAudience = true, |
| 81 | ValidateLifetime = true, |
| 82 | ValidateIssuerSigningKey = true, |
| 83 | ValidIssuer = jwt.Issuer, |
| 84 | ValidAudience = jwt.Audience, |
| 85 | IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwt.SigningKey)), |
| 86 | ClockSkew = TimeSpan.FromMinutes(1), |
| 87 | }; |
| 88 | }) |
| 89 | .AddScheme<Microsoft.AspNetCore.Authentication.AuthenticationSchemeOptions, DevBearerAuthenticationHandler>( |
| 90 | DevBearerAuthenticationHandler.SchemeName, |
| 91 | _ => { }); |
| 92 | |
| 93 | builder.Services.AddAuthorization(); |
| 94 | |
| 95 | var app = builder.Build(); |
| 96 | |
| 97 | using (var scope = app.Services.CreateScope()) |
| 98 | { |
| 99 | var db = scope.ServiceProvider.GetRequiredService<IntercomDbContext>(); |
| 100 | var intercomOpts = scope.ServiceProvider.GetRequiredService<Microsoft.Extensions.Options.IOptions<IntercomOptions>>().Value; |
| 101 | if (intercomOpts.RecreateDatabaseOnStart) |
| 102 | db.Database.EnsureDeleted(); |
| 103 | db.Database.EnsureCreated(); |
| 104 | } |
| 105 | |
| 106 | app.UseAuthentication(); |
| 107 | app.UseAuthorization(); |
| 108 | |
| 109 | app.MapIntercomApi(); |
| 110 | |
| 111 | app.Run(); |
| 112 | |
| 113 | public partial class Program; |
| 114 | |