Authentication and authorization architecture.

// Program.cs — Backend
services.AddCoreAuth(options =>
{
    options.Jwt.SigningKey = builder.Configuration["Auth:SigningKey"]!;
    options.Jwt.Issuer = "my-app";
    options.Jwt.Audience = "my-api";
    options.Jwt.AccessTokenExpiryMinutes = 60;
    options.Jwt.RefreshTokenExpiryDays = 7;

    options.Sessions.MaxSessionsPerUser = 10;

    options.Identity.RequireConfirmedEmail = true;
    options.Identity.Password.RequiredLength = 8;
    options.Identity.Password.RequireUppercase = true;
    options.Identity.Password.RequireDigit = true;
    options.Identity.Lockout.MaxFailedAccessAttempts = 5;
    options.Identity.Lockout.DefaultLockoutMinutes = 15;
});

// Register custom claim providers (optional)
services.AddScoped<IClaimDefinitionProvider, MyAppClaimProvider>();
services.AddCoreAuthPoliciesFromProviders();

// Program.cs — Endpoint mapping
app.MapCoreAuthEndpoints(options =>
{
    options.BasePath = "/api/v1";
    options.AdminReadPolicy = "identity.read";
    options.AdminWritePolicy = "identity.update";
    options.AdminUsersCreatePolicy = "identity.users.create";
    options.ProfileReadPolicy = "auth.profile.read";
    options.ProfileUpdatePolicy = "auth.profile.update";
});

// Program.cs — Database
services.AddDbContext<CoreAuthDbContext>(options =>
    options.UseNpgsql(
        builder.Configuration.GetConnectionString("auth")));

// 1. Client sends credentials
POST /auth/login  { "email": "...", "password": "..." }

// 2. Server validates, returns tokens + creates session
{ "accessToken": "eyJ...", "refreshToken": "abc123..." }

// 3. Client stores tokens, sends Bearer on every request
GET /me  → Authorization: Bearer eyJ...

// 4. Token expires → client uses refresh token
POST /auth/refresh  { "refreshToken": "abc123..." }

// 5. Server rotates session, returns new token pair
{ "accessToken": "eyJ...(new)", "refreshToken": "def456..." }

// Define custom claims for your application
public class MyAppClaimProvider : IClaimDefinitionProvider
{
    public IEnumerable<ClaimDefinition> GetDefinitions() =>
    [
        new("orders.read",   "Orders",  "Read orders"),
        new("orders.create", "Orders",  "Create orders"),
        new("reports.view",  "Reports", "View reports"),
    ];
}

// Registration in Program.cs
services.AddScoped<IClaimDefinitionProvider, MyAppClaimProvider>();
services.AddCoreAuthPoliciesFromProviders();

// Now usable as authorization policies:
// [Authorize(Policy = "orders.read")]
// or in Minimal API: .RequireAuthorization("orders.read")

// Program.cs — Blazor frontend
services.AddCoreAuthComponents(options =>
{
    options.ApiBaseUrl = "https://api.example.com/api/v1";
});

builder.Services.AddCascadingAuthenticationState();

<!-- Razor component — show/hide based on auth state -->
<AuthorizeView>
    <Authorized>
        <Typo>Welcome, @context.User.Identity?.Name</Typo>
        <Button Text="Logout" OnClick="Logout" />
    </Authorized>
    <NotAuthorized>
        <Button Text="Login" Href="/login" />
    </NotAuthorized>
</AuthorizeView>

<!-- Policy-based authorization -->
<AuthorizeView Policy="orders.read">
    <Authorized>
        <OrderList />
    </Authorized>
</AuthorizeView>