/*
 * Step 1: Install the necessary NuGet package.
 * Execute this command in your project's NuGet Package Manager Console:
 * Install-Package Microsoft.AspNetCore.Authentication.JwtBearer
 *
 * Alternatively, add to your .csproj file:
 * <ItemGroup>
 *     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.0" />
 * </ItemGroup>
 */

// Step 2: Configure JWT settings in appsettings.json
// This centralizes our authentication parameters, making them easily manageable.
{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",
  "JwtSettings": {
    "Issuer": "https://yourdomain.com", // Replace with your actual issuer URL
    "Audience": "https://yourdomain.com", // Replace with your actual audience URL or client ID
    "Key": "YOUR_SUPER_SECRET_KEY_MUST_BE_LONG_AND_COMPLEX_FOR_PRODUCTION_ENVIRONMENTS"
  }
}

// Step 3: Integrate JWT Bearer Authentication into Program.cs
// This configures the ASP.NET Core authentication middleware to understand and validate JWTs.
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using System.Text;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.
builder.Services.AddControllers();
// Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

// --- JWT Configuration Starts Here ---
var jwtSettings = builder.Configuration.GetSection("JwtSettings");
var key = Encoding.ASCII.GetBytes(jwtSettings["Key"] ?? string.Empty);

builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
    options.RequireHttpsMetadata = false; // Set to true in production
    options.SaveToken = true;
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidateLifetime = true,
        ValidateIssuerSigningKey = true,
        ValidIssuer = jwtSettings["Issuer"],
        ValidAudience = jwtSettings["Audience"],
        IssuerSigningKey = new SymmetricSecurityKey(key)
    };
});
// --- JWT Configuration Ends Here ---

// Add Authorization services
builder.Services.AddAuthorization();

var app = builder.Build();

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

app.UseHttpsRedirection();

// --- Authentication and Authorization Middleware ---
app.UseAuthentication(); // Must be before UseAuthorization
app.UseAuthorization();
// --- End Middleware ---

app.MapControllers();

app.Run();

/*
 * Step 1: Define a simple model for login credentials.
 * Place this in a 'Models' folder or similar.
 */
namespace YourProjectName.Models
{
    public class LoginRequest
    {
        public string Username { get; set; } = string.Empty;
        public string Password { get; set; } = string.Empty;
    }
}

/*
 * Step 2: Create an Authentication Controller (e.g., AuthController).
 * This controller handles user login and token generation.
 * Ensure 'JwtSettings' are correctly loaded from IConfiguration.
 */
using Microsoft.AspNetCore.Mvc;
using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;

namespace YourProjectName.Controllers
{
    [Route("api/[controller]")]
    [ApiController]
    public class AuthController : ControllerBase
    {
        private readonly IConfiguration _configuration;

        public AuthController(IConfiguration configuration)
        {
            _configuration = configuration;
        }

        [HttpPost("login")]
        public IActionResult Login([FromBody] LoginRequest loginRequest)
        {
            // Step 3: Simulate user validation.
            // In a real application, validate against a database (e.g., using ASP.NET Core Identity).
            if (loginRequest.Username == "admin" && loginRequest.Password == "password")
            {
                var jwtSettings = _configuration.GetSection("JwtSettings");
                var key = Encoding.ASCII.GetBytes(jwtSettings["Key"] ?? string.Empty);

                // Step 4: Define claims for the JWT.
                // Claims carry user-specific data (e.g., User ID, Role).
                var claims = new[]
                {
                    new Claim(JwtRegisteredClaimNames.Sub, loginRequest.Username),
                    new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
                    new Claim(ClaimTypes.Role, "Administrator") // Example role claim
                };

                // Step 5: Create the JWT security token.
                var tokenDescriptor = new SecurityTokenDescriptor
                {
                    Subject = new ClaimsIdentity(claims),
                    Expires = DateTime.UtcNow.AddMinutes(30), // Token expires in 30 minutes
                    Issuer = jwtSettings["Issuer"],
                    Audience = jwtSettings["Audience"],
                    SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
                };

                var tokenHandler = new JwtSecurityTokenHandler();
                var token = tokenHandler.CreateToken(tokenDescriptor);
                var tokenString = tokenHandler.WriteToken(token);

                return Ok(new { Token = tokenString });
            }

            return Unauthorized(); // Invalid credentials
        }
    }
}

/*
 * Step 6: Protect API Endpoints with the [Authorize] attribute.
 * This attribute instructs the ASP.NET Core authorization middleware
 * to validate the JWT in the request header before allowing access.
 */
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace YourProjectName.Controllers
{
    [Route("api/[controller]")]
    [ApiController]
    [Authorize] // Apply this attribute to the controller or specific actions
    public class ProtectedController : ControllerBase
    {
        [HttpGet]
        public IActionResult GetSecretData()
        {
            // Access user claims from the authenticated context
            var username = User.Identity?.Name;
            var role = User.FindFirst(ClaimTypes.Role)?.Value;

            return Ok($"Hello {username}! You are a {role} and accessed secret data.");
        }

        [HttpGet("admin-only")]
        [Authorize(Roles = "Administrator")] // Role-based authorization
        public IActionResult GetAdminData()
        {
            return Ok("This data is for administrators only!");
        }
    }
}

/*
 * Client-side pseudocode for consuming a JWT.
 * This demonstrates how a client (e.g., JavaScript in a browser or a mobile app)
 * would store and send the token with subsequent requests.
 */

// 1. Upon successful login, the server returns a JWT.
const serverResponse = {
    token: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
};

// 2. Client stores the token securely.
//   - For web applications, localStorage or sessionStorage are common.
//   - Consider browser security implications (XSS risk).
//   - For mobile apps, secure storage mechanisms are preferred.
localStorage.setItem('jwtToken', serverResponse.token);

// 3. Client includes the token in subsequent API requests.
//    The 'Authorization' header is the standard way to send Bearer tokens.
function fetchProtectedData() {
    const token = localStorage.getItem('jwtToken');

    if (token) {
        fetch('https://yourdomain.com/api/protected', {
            method: 'GET',
            headers: {
                'Authorization': `Bearer ${token}`,
                'Content-Type': 'application/json'
            }
        })
        .then(response => {
            if (response.ok) {
                return response.json();
            } else if (response.status === 401) {
                console.error('Authentication failed: Token is invalid or expired.');
                // Redirect to login page or refresh token if applicable
            } else {
                console.error('API Error:', response.statusText);
            }
        })
        .then(data => {
            console.log('Protected data:', data);
        })
        .catch(error => {
            console.error('Network or other error:', error);
        });
    } else {
        console.warn('No JWT token found. User is not authenticated.');
        // Redirect to login page
    }
}

// Example usage:
// fetchProtectedData();

/*
 * Server-side considerations (already handled in Program.cs, but reiterating).
 * - Ensure 'RequireHttpsMetadata = true' in production for JwtBearerOptions.
 * - Implement refresh token strategy for better UX and security.
 * - Consider token revocation for critical scenarios (e.g., password change).
 */