83 lines
3.3 KiB
C#
83 lines
3.3 KiB
C#
using Microsoft.AspNetCore.Authentication.JwtBearer;
|
|
using Microsoft.EntityFrameworkCore;
|
|
using Microsoft.OpenApi.Models;
|
|
using WordVersioning.Api.Data;
|
|
using WordVersioning.Api.Services;
|
|
|
|
var builder = WebApplication.CreateBuilder(args);
|
|
|
|
builder.Services.AddControllers();
|
|
builder.Services.AddEndpointsApiExplorer();
|
|
builder.Services.AddSwaggerGen(options =>
|
|
{
|
|
options.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
|
|
{
|
|
Name = "Authorization",
|
|
Type = SecuritySchemeType.Http,
|
|
Scheme = "bearer",
|
|
BearerFormat = "JWT",
|
|
In = ParameterLocation.Header,
|
|
Description = "วาง access token จาก Keycloak (realm word-versioning)",
|
|
});
|
|
options.AddSecurityRequirement(new OpenApiSecurityRequirement
|
|
{
|
|
{
|
|
new OpenApiSecurityScheme
|
|
{
|
|
Reference = new OpenApiReference { Type = ReferenceType.SecurityScheme, Id = "Bearer" },
|
|
},
|
|
Array.Empty<string>()
|
|
},
|
|
});
|
|
});
|
|
|
|
// PostgreSQL — connection string จาก ConnectionStrings:Default (override ผ่าน env: ConnectionStrings__Default)
|
|
builder.Services.AddDbContext<AppDbContext>(options =>
|
|
options.UseNpgsql(builder.Configuration.GetConnectionString("Default")));
|
|
|
|
// MinIO / hash / current user
|
|
builder.Services.Configure<MinioOptions>(builder.Configuration.GetSection(MinioOptions.SectionName));
|
|
builder.Services.AddSingleton<IObjectStorageService, ObjectStorageService>();
|
|
builder.Services.AddSingleton<IHashService, HashService>();
|
|
builder.Services.AddHttpContextAccessor();
|
|
builder.Services.AddScoped<ICurrentUser, CurrentUser>();
|
|
|
|
// JWT — validate ผ่าน JWKS ของ Keycloak อัตโนมัติ (FR-8)
|
|
builder.Services
|
|
.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
|
|
.AddJwtBearer(options =>
|
|
{
|
|
options.Authority = builder.Configuration["Authentication:Authority"];
|
|
options.RequireHttpsMetadata = false; // ⚠️ dev เท่านั้น — production ต้องเป็น true
|
|
options.MapInboundClaims = false; // คงชื่อ claim ดิบ: "sub", "preferred_username"
|
|
|
|
// รับ token ได้ทั้ง 2 frontend client (add-in + web portal) — แต่ละตัว issue token ที่ aud ต่างกัน
|
|
var audiences = builder.Configuration.GetSection("Authentication:ValidAudiences").Get<string[]>();
|
|
if (audiences is { Length: > 0 })
|
|
options.TokenValidationParameters.ValidAudiences = audiences;
|
|
else
|
|
options.TokenValidationParameters.ValidateAudience = false; // realm-level: ตรวจ issuer + signature อย่างเดียว
|
|
});
|
|
builder.Services.AddAuthorization();
|
|
|
|
// CORS — add-in task pane (https://localhost:3000) + web portal (http://localhost:5173) เท่านั้น
|
|
const string corsPolicy = "frontends";
|
|
builder.Services.AddCors(options => options.AddPolicy(corsPolicy, policy => policy
|
|
.WithOrigins(builder.Configuration.GetSection("Cors:AllowedOrigins").Get<string[]>() ?? [])
|
|
.AllowAnyHeader()
|
|
.AllowAnyMethod()));
|
|
|
|
var app = builder.Build();
|
|
|
|
if (app.Environment.IsDevelopment())
|
|
{
|
|
app.UseSwagger();
|
|
app.UseSwaggerUI();
|
|
}
|
|
|
|
app.UseCors(corsPolicy);
|
|
app.UseAuthentication();
|
|
app.UseAuthorization();
|
|
app.MapControllers();
|
|
|
|
app.Run();
|