Identity

services.AddIdentityServer()
                .AddInMemoryIdentityResources(Config.GetIdentityResources())
                .AddInMemoryApiResources(Config.GetApis())
                .AddInMemoryClients(Config.GetClients())
                .AddTestUsers(Config.GetUsers())
                .AddDeveloperSigningCredential();


app.UseIdentityServer();

 public static class Config
    {
        public static List<TestUser> GetUsers()
        {
            return new List<TestUser>
            {
                new TestUser
                {
                    SubjectId = "1",
                    Username = "alice",
                    Password = "password"
                },
                new TestUser
                {
                    SubjectId = "2",
                    Username = "bob",
                    Password = "password"
                }
            };
        }

        public static IEnumerable<IdentityResource> GetIdentityResources()
        {
            return new IdentityResource[]
            {
                new IdentityResources.OpenId()
            };
        }

        public static IEnumerable<ApiResource> GetApis()
        {
            return new List<ApiResource>
            {
                new ApiResource("api1", "My API")
            };
        }

        public static IEnumerable<Client> GetClients()
        {
            return new List<Client>
            {
                new Client
                {
                    ClientId = "client",

                    // no interactive user, use the clientid/secret for authentication
                    AllowedGrantTypes = GrantTypes.ClientCredentials,

                    // secret for authentication
                    ClientSecrets =
                    {
                        new Secret("secret".Sha256())
                    },

                    // scopes that client has access to
                    AllowedScopes = {  IdentityServerConstants.StandardScopes.OpenId, "api1" }
                },
                // resource owner password grant client
                new Client
                {
                    ClientId = "ro.client",
                    AllowedGrantTypes = GrantTypes.ResourceOwnerPassword,

                    ClientSecrets =
                    {
                        new Secret("secret".Sha256())
                    },
                    AllowedScopes = { "api1" }
                }
            };
        }
    }

 public class BaseUrlMiddleWare
    {
        private readonly RequestDelegate _next;

        public BaseUrlMiddleWare(RequestDelegate next)
        {
            _next = next;
        }

        public async Task Invoke(HttpContext context)
        {
            var realBaseUrl = context.Request.Headers["X-real-base-url"];
            var url = realBaseUrl.FirstOrDefault();

            if (url != null)
            {
                Uri uriAddress = new Uri(url, UriKind.Absolute);

                context.Request.Scheme = uriAddress.Scheme;
                context.Request.PathBase = new PathString(uriAddress.LocalPath);
                context.Request.Host = new HostString(uriAddress.Host, uriAddress.Port);
                context.SetIdentityServerBasePath(uriAddress.LocalPath);
            }

            await _next(context);
        }
    }

 services.AddSwaggerGen(c =>
            {
                c.SwaggerDoc("v1", new Info { Title = "My API", Version = "v1" });

                c.AddSecurityDefinition("oauth2", new OAuth2Scheme
                {
                    Type = "oauth2",
                    Flow = "password",
                    TokenUrl = "http://docker:80/auth/connect/token",
                    Scopes = new Dictionary<string, string>{}
                });
                c.AddSecurityRequirement(new Dictionary<string, IEnumerable<string>>
                {
                    { "oauth2", new string[] { } }
                });
            });

 var baseUrl = "/api/app";

            app.UseSwagger(c=>c.PreSerializeFilters.Add((doc, req) =>
            {
                doc.BasePath = baseUrl;
            }));
         
            // Enable middleware to serve swagger-ui (HTML, JS, CSS, etc.), 
            // specifying the Swagger JSON endpoint.
            app.UseSwaggerUI(c =>
            {
                c.SwaggerEndpoint($"{baseUrl}/swagger/v1/swagger.json", "My API V1");
                c.OAuthClientId("client");
                c.OAuthClientSecret("secret");
                c.OAuthRealm("test-realm");
                c.OAuthAppName("test-app");
                c.OAuthScopeSeparator(" ");
                c.OAuthUseBasicAuthenticationWithAccessCodeGrant();
            });

public class ApplicationUser: IdentityUser<Guid>
    {
    }
    
  public class ApplicationRole: IdentityRole<Guid>
    {
    }
    
public class ApplicationDbContext: IdentityDbContext<ApplicationUser, ApplicationRole, Guid>
    {
        private readonly Connections _connections;

        public ApplicationDbContext(Connections connections)
        {
            _connections = connections;
        }

        protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
            => optionsBuilder.UseNpgsql(_connections.DBConnectionString, options=>options.MigrationsHistoryTable("__EFMigrationsHistory", "auth"));

        protected override void OnModelCreating(ModelBuilder builder)
        {
            builder.HasDefaultSchema("auth");
            base.OnModelCreating(builder);
        }
    }

  services.AddIdentity<ApplicationUser, ApplicationRole>()
                .AddEntityFrameworkStores<ApplicationDbContext>()
                .AddDefaultTokenProviders();
  services.AddDbContext<ApplicationDbContext>();

[Route("account")]
    public class AccountController: BaseController
    {
        private readonly UserManager<ApplicationUser> _userManager;

        public AccountController(UserManager<ApplicationUser> userManager)
        {
            _userManager = userManager;
        }

            [HttpGet("do-something")]
            public async Task<IActionResult> DoSomething(string email, string password)
            {
                var user = new ApplicationUser()
                {
                    Email = email,
                    UserName = email
                };

                var result = await _userManager.CreateAsync(user, password);

                return Result(new Success<bool>(result.Succeeded));
            }
    }

  .AddAspNetIdentity<ApplicationUser>()

await  _userManager.AddClaimAsync(user, new Claim("Admin", "true"));

 public static Client AdministrationClient(int lifetime) => new Client
        {
            ClientName = "administration_client",
            ClientId = "administration_client",
            ClientSecrets =
            {
                new Secret("administration_client-secret".Sha256())
            },

            AllowedGrantTypes = { GrantType.ResourceOwnerPassword },
            AccessTokenType = AccessTokenType.Jwt,

            AllowOfflineAccess = true,
            AccessTokenLifetime = lifetime,
            AllowAccessTokensViaBrowser = true,
            RequireConsent = false,
            AllowedCorsOrigins = Origins.Urls,

            RefreshTokenExpiration = TokenExpiration.Absolute,
            RefreshTokenUsage = TokenUsage.OneTimeOnly,

            AllowedScopes = new List<string>
            {
                IdentityServerConstants.StandardScopes.OpenId,
                IdentityServerConstants.StandardScopes.Email,
                IdentityServerConstants.StandardScopes.OfflineAccess,
                "administration"
            }
        };

public static IEnumerable<ApiResource> GetApiResources()
        {
            return new List<ApiResource>
            {
                new ApiResource()
                {
                    Name = "administration_api",
                    ApiSecrets = { new Secret("administration_api_secret".Sha256()) },
                    UserClaims = {
                       "IsAdmin"
                    },
                    Description = "Administration API",
                    DisplayName = "Administration API",
                    Enabled = true,
                    Scopes = { new Scope("administration") }
                }
            };
        }

 public async Task IsActiveAsync(IsActiveContext context)
        {
            var sub = context.Subject.GetSubjectId();
            var user = await _userManager.FindByIdAsync(sub);
            context.IsActive = user != null;
        }

   public async Task GetProfileDataAsync(ProfileDataRequestContext context)
        {
            var sub = context.Subject.GetSubjectId();
            var user = await _userManager.FindByIdAsync(sub);
            var principal = await _claimsFactory.CreateAsync(user);

            var claims = principal.Claims
                                  .Where(claim => context.RequestedClaimTypes.Contains(claim.Type))
                                  .ToList();

            claims.Add(new Claim(IdentityServerConstants.StandardScopes.Email, user.Email.ToLower()));

            context.IssuedClaims = claims;
        }