Program.cs

using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
using ContextIQMvcWebApi.Data;
using Microsoft.AspNetCore.Authentication.Cookies;
using Pomelo.EntityFrameworkCore.MySql.Infrastructure;
using Microsoft.Extensions.AI;
using Azure.AI.OpenAI;
using Azure;
using Azure.Identity;
using Microsoft.AspNetCore.Identity.UI.Services;
using ContextIQMvcWebApi.Services;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container

// Forgot password email sender service
builder.Services.AddTransient<IEmailSender, EmailSender>();
// Bind SendGrid settings to AuthMessageSenderOptions from the "SendGrid" section
builder.Services.Configure<AuthMessageSenderOptions>(
    builder.Configuration.GetSection("SendGrid")
);

// Chat Client Configuration/MCP Configuration
var endpoint = builder.Configuration["MCP:Endpoint"];
var apiKey = builder.Configuration["MCP:ApiKey"];
var model = builder.Configuration["MCP:ModelName"];

builder.Services.AddChatClient(services =>
  new ChatClientBuilder(
    (
      !string.IsNullOrEmpty(apiKey)
        ? new AzureOpenAIClient(new Uri(endpoint!), new AzureKeyCredential(apiKey))
        : new AzureOpenAIClient(new Uri(endpoint!), new DefaultAzureCredential())
    ).GetChatClient(model).AsIChatClient()
  )
  .UseFunctionInvocation()
  .Build());

// Swagger for API testing and documentation
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

// Configure JSON serialization for minimal APIs
builder.Services.ConfigureHttpJsonOptions(options =>
{
    options.SerializerOptions.PropertyNamingPolicy = System.Text.Json.JsonNamingPolicy.CamelCase;
    options.SerializerOptions.WriteIndented = true;
});

// Database Configuration
var connectionString = builder.Configuration.GetConnectionString("DefaultConnection") 
                    ?? builder.Configuration.GetConnectionString("AZURE_MYSQL_CONNECTIONSTRING");

if (string.IsNullOrEmpty(connectionString))
{
    // Fallback for development or if connection string is not set
    connectionString = "Server=localhost;Port=3306;Database=ChatApp;User=root;Password=;";
    builder.Logging.AddConsole().SetMinimumLevel(LogLevel.Warning);
    Console.WriteLine("Warning: Using default connection string. Configure connection string in Azure.");
}

builder.Services.AddDbContext<ApplicationDbContext>(options =>
{
    // Use a specific MySQL version instead of AutoDetect to avoid startup connection issues
    options.UseMySql(connectionString, new MySqlServerVersion(new Version(8, 0, 21)));
});

// Catch EF Core database errors in development
builder.Services.AddDatabaseDeveloperPageExceptionFilter();

// Identity + Authentication + Authorization Configuration

// Configure authentication (Cookies for UI + Bearer tokens for API endpoints)
builder.Services.AddAuthentication(options =>
{
    // Default everything to Bearer for APIs and SignalR
    options.DefaultAuthenticateScheme = IdentityConstants.BearerScheme;
    options.DefaultChallengeScheme = IdentityConstants.BearerScheme;
})
.AddCookie(options =>
{
    options.Cookie.Name = "AIChatAuth";
    options.Cookie.HttpOnly = true;
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always; // require HTTPS
    options.Cookie.SameSite = SameSiteMode.Lax; // or Strict depending on SPA cross-site needs
    options.ExpireTimeSpan = TimeSpan.FromHours(8); // session duration
    options.SlidingExpiration = true;
    options.LoginPath = "/account/login"; // optional
    options.LogoutPath = "/account/logout";
})
.AddBearerToken(IdentityConstants.BearerScheme);

// Configure ASP.NET Core Identity with roles and API endpoints
builder.Services.AddIdentity<IdentityUser, IdentityRole>(options =>
{
    options.Stores.MaxLengthForKeys = 128; // Maximum length for key strings

    // Password settings
    // options.Password.RequireDigit = true;             // Must include at least one number
    // options.Password.RequireLowercase = true;         // Must include at least one lowercase letter
    // options.Password.RequireUppercase = true;         // Must include at least one uppercase letter
    // options.Password.RequireNonAlphanumeric = true;   // Must include at least one special character
    // options.Password.RequiredLength = 8;              // Minimum length
    // options.Password.RequiredUniqueChars = 1;         // At least one unique character
    options.Password.RequireDigit = false;             // Must include at least one number
    options.Password.RequireLowercase = false;        // Must include at least one lowercase letter
    options.Password.RequireUppercase = false;         // Must include at least one uppercase letter
    options.Password.RequireNonAlphanumeric = false;   // Must include at least one special character
    options.Password.RequiredLength = 3;              // Minimum length
    options.Password.RequiredUniqueChars = 1;         // At least one unique character
})
.AddEntityFrameworkStores<ApplicationDbContext>()     // Use EF Core for storage
.AddRoles<IdentityRole>()                             // Enable role-based access
.AddDefaultUI()                                       // Enable default Razor UI (login, register)
.AddDefaultTokenProviders()                           // Enable password reset and email confirmation tokens
.AddApiEndpoints();                                   // Adds /login, /register, /logout, etc.

// Add custom authorization policy for API endpoints
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("ApiPolicy", policy =>
        policy.RequireAuthenticatedUser()
              .AddAuthenticationSchemes(IdentityConstants.BearerScheme));
});

// MVC, Razor Pages, and Email Services

builder.Services.AddControllersWithViews();
builder.Services.AddRazorPages();

// CORS Configuration - MUST specify exact origins when using AllowCredentials
// Azure App Service CORS settings should be DISABLED in the Azure portal
// to avoid conflicts with this policy
builder.Services.AddCors(options =>
{
    options.AddPolicy("AllowFrontend", policy =>
    {
        policy.WithOrigins(
                  "https://aichatapp-61vl.onrender.com",  // Render frontend
                  "https://chatapptermproject-ah-fcbufpg5dsc8b4g3.canadacentral-01.azurewebsites.net",  // Backend itself
                  "http://localhost:3000",
                  "http://localhost:5173",
                  "http://localhost:5157"
              )
              .AllowAnyHeader()
              .AllowAnyMethod()
              .AllowCredentials()  // Required for SignalR with auth
              .WithExposedHeaders("X-Usage-Warning"); // Expose custom header to frontend
    });
});
// SignalR Configuration
builder.Services.AddSignalR();

// Build the application
var app = builder.Build();

// Configure the HTTP request pipeline
if (app.Environment.IsDevelopment())
{
    app.UseMigrationsEndPoint();
    app.UseSwagger();
    app.UseSwaggerUI(options => {
        options.SwaggerEndpoint("/swagger/v1/swagger.json", "ISATermProjectBackend");
        options.RoutePrefix = "";
    });
}
else
{
    app.UseExceptionHandler("/Home/Error");
    app.UseHsts(); // Enable HSTS for production
}

app.UseHttpsRedirection();
app.UseRouting();

app.UseCors("AllowFrontend"); // Allow requests from specified frontend

app.UseAuthentication(); // Enable authentication middleware
app.UseAuthorization();  // Enable authorization middleware

// Add request counting middleware (must come after authentication)
app.UseMiddleware<ContextIQMvcWebApi.Middleware.RequestCountingMiddleware>();

app.MapStaticAssets();

// Route Mapping

// Default controller route
app.MapControllerRoute(
    name: "default",
    pattern: "{controller=Home}/{action=Index}/{id?}")
    .WithStaticAssets();

// Map Razor Pages (for Identity UI)
app.MapRazorPages()
   .WithStaticAssets();

// Map Identity API endpoints (/login, /register, etc.)
app.MapIdentityApi<IdentityUser>();

// Map SignalR hubs
app.MapHub<ContextIQMvcWebApi.Services.ChatHub>("/chathub");

// Add a simple health check endpoint
app.MapGet("/health", () => "Healthy - App is running!");

// Database seeding (creates admin role and default users)
try 
{
    using (var scope = app.Services.CreateScope())
    {
        var services = scope.ServiceProvider;
        var logger = services.GetRequiredService<ILogger<Program>>();
        
        logger.LogInformation("Starting database migration and seeding...");

        var context = services.GetRequiredService<ApplicationDbContext>();
        context.Database.Migrate();
        
        logger.LogInformation("Database migration completed successfully.");

        var userMgr = services.GetRequiredService<UserManager<IdentityUser>>();
        var roleMgr = services.GetRequiredService<RoleManager<IdentityRole>>();
        var configuration = services.GetRequiredService<IConfiguration>();

        // Initialize Identity seed data (creates admin@admin.com and roles)
        IdentitySeedData.Initialize(context, userMgr, roleMgr, configuration).Wait();
        
        logger.LogInformation("Database seeding completed successfully.");
    }
}
catch (Exception ex)
{
    var logger = app.Services.GetRequiredService<ILogger<Program>>();
    logger.LogError(ex, "An error occurred during database migration or seeding. App will continue startup.");
    // Don't let database issues prevent app startup
}

// Temporary test - remove after verifying
// await ContextIQMvcWebApi.Services.SendGridExample.SendTestEmailAsync(
//     apiKeyEnvVar: "SENDGRID_API_KEY",
//     fromEmail: "burnermax247@gmail.com",
//     fromName: "Your Name",
//     toEmail: "burnermax247@gmail.com",
//     toName: "You");

// Run the application
app.Run();