Minimal APIs — Missing Auth Middleware Exposes Endpoints

// Program.cs — a complete, runnable Minimal API
// Requires: dotnet new web -o ProductApi
// No controllers, no separate Startup.cs, no folder structure required.

var builder = WebApplication.CreateBuilder(args);

// Register services into the DI container BEFORE calling Build()
builder.Services.AddEndpointsApiExplorer(); // Enables OpenAPI endpoint discovery
builder.Services.AddSwaggerGen();           // Wires up Swagger UI

var app = builder.Build();

// Middleware runs in the order you register it — this matters!
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();    // Serves the OpenAPI JSON spec at /swagger/v1/swagger.json
    app.UseSwaggerUI(); // Serves the browser UI at /swagger
}

// MapGet registers a GET handler for the route "/"
// The lambda IS the handler — no controller needed
app.MapGet("/", () => "Product Catalogue API is running!");

// MapGet with a route parameter — {id} is captured and injected automatically
// ASP.NET Core infers the int type from the parameter name and type annotation
app.MapGet("/products/{id}", (int id) =>
{
    // In a real app this would call a service; here we prove the binding works
    return Results.Ok(new { ProductId = id, Name = $"Product #{id}", Price = 9.99m });
});

// MapPost accepts a JSON body — the [FromBody] attribute is inferred automatically
// The record type is deserialized from the request body using System.Text.Json
app.MapPost("/products", (CreateProductRequest request) =>
{
    // Results.Created sets HTTP 201 and the Location header — correct REST semantics
    return Results.Created($"/products/42", new { Id = 42, request.Name, request.Price });
});

app.Run();

// Define your request/response models — keep them close to where they're used
// Using records gives you immutability and value equality for free
public record CreateProductRequest(string Name, decimal Price);

// Demonstrates all parameter binding sources in a single handler
// This endpoint accepts both route and query parameters, a JSON body, and DI services

app.MapPost("/products/{categoryId:int}/check", async (
    int categoryId,                              // From route: /products/12/check
    string? filter,                              // From query: /products/12/check?filter=active
    CheckInventoryRequest request,               // From body as JSON
    [FromHeader(Name = "X-Tenant-Id")] string tenantId,  // From header using attribute
    IProductService productService,              // From DI container
    HttpContext httpContext,                      // Special framework service
    CancellationToken cancellationToken,         // Cancellation token from DI
    LinkGenerator linkGenerator) =>               // Another DI service
{\n    var result = await productService.CheckInventoryAsync(\n        categoryId, filter, request, tenantId, cancellationToken);\n\n    var location = linkGenerator.GetPathByName(httpContext, \"GetProductById\", new { id = result.Id });\n    return TypedResults.Created(location, result);\n});\n\n// Validation: If you send a non-integer categoryId, the framework returns 400 automatically\n// If you omit the body, it also returns 400 with validation details\n\npublic record CheckInventoryRequest(string Sku, int Quantity);",
        "output": "// Valid request:\n// POST /products/12/check?filter=active HTTP/1.1\n// Content-Type: application/json\n// X-Tenant-Id: acme-corp\n//\n// { \"sku\": \"WIDGET-001\", \"quantity\": 5 }\n//\n// HTTP 201 Created\n// Location: /products/42\n\n// Invalid route:\n// POST /products/abc/check ⇒ 400 Bad Request (cannot parse 'abc' as int)\n\n// Missing body:\n// POST /products/1/check ⇒ 400 with ProblemDetails (request body missing)"
      }

// ── ProductEndpoints.cs ──────────────────────────────────────────────────────
// Extension method that groups all /products endpoints in one place.
// Program.cs calls app.MapProductEndpoints() — keeping the entry file clean.

using Microsoft.AspNetCore.Http.HttpResults; // Typed Results — strongly-typed return types

public static class ProductEndpoints
{
    public static void MapProductEndpoints(this WebApplication app)
    {
        // RouteGroupBuilder applies the prefix AND any shared middleware to every endpoint below
        var group = app.MapGroup("/products")
                       .WithTags("Products")       // Groups endpoints in Swagger UI
                       .WithOpenApi();             // Generates OpenAPI metadata automatically

        group.MapGet("/",    GetAllProducts);
        group.MapGet("/{id:int}", GetProductById); // :int constrains the route — 404 on non-int
        group.MapPost("/",   CreateProduct);
        group.MapPut("/{id:int}",    UpdateProduct);
        group.MapDelete("/{id:int}", DeleteProduct);
    }

    // Handler methods are static — no allocations for a class instance per request
    // IProductService is resolved from DI; int id comes from the route segment
    static async Task<Ok<IEnumerable<Product>>> GetAllProducts(\n        IProductService productService)
    {
        var products = await productService.GetAllAsync();
        return TypedResults.Ok(products); // TypedResults gives compile-time HTTP status verification
    }

    static async Task<Results<Ok<Product>, NotFound>> GetProductById(\n        int id,\n        IProductService productService)
    {
        var product = await productService.GetByIdAsync(id);

        // Pattern match on null — returns 404 if not found, 200 with body if found
        return product is null
            ? TypedResults.NotFound()
            : TypedResults.Ok(product);
    }

    static async Task<Created<Product>> CreateProduct(
        CreateProductRequest request,       // Bound from JSON request body
        IProductService productService,
        LinkGenerator linkGenerator,        // Built-in service to generate URLs
        HttpContext httpContext)
    {\n        var created = await productService.CreateAsync(request);\n\n        // Generate the Location header pointing to the new resource — correct REST\n        var location = linkGenerator.GetPathByName(httpContext, \"GetProductById\",\n                                                   new { id = created.Id });\n        return TypedResults.Created(location, created);\n    }\n\n    static async Task<Results<NoContent, NotFound>> UpdateProduct(\n        int id,\n        UpdateProductRequest request,\n        IProductService productService)\n    {\n        var success = await productService.UpdateAsync(id, request);\n        return success ? TypedResults.NoContent() : TypedResults.NotFound();\n    }\n\n    static async Task<Results<NoContent, NotFound>> DeleteProduct(\n        int id,\n        IProductService productService)\n    {\n        var success = await productService.DeleteAsync(id);\n        return success ? TypedResults.NoContent() : TypedResults.NotFound();\n    }\n}\n\n// ── Program.cs (the clean version) ──────────────────────────────────────────\nvar builder = WebApplication.CreateBuilder(args);\n\nbuilder.Services.AddEndpointsApiExplorer();\nbuilder.Services.AddSwaggerGen();\n\n// Register your domain services — Minimal APIs use the SAME DI system as controllers\nbuilder.Services.AddScoped<IProductService, ProductService>();\n\nvar app = builder.Build();\n\nif (app.Environment.IsDevelopment())\n{\n    app.UseSwagger();\n    app.UseSwaggerUI();\n}\n\napp.UseHttpsRedirection();\n\n// One line per feature area — Program.cs stays readable at any scale\napp.MapProductEndpoints();\n\napp.Run();\n\n// ── Domain models (simplified for clarity) ───────────────────────────────────\npublic record Product(int Id, string Name, decimal Price, int StockCount);\npublic record CreateProductRequest(string Name, decimal Price, int StockCount);\npublic record UpdateProductRequest(string Name, decimal Price, int StockCount);\n\npublic interface IProductService\n{\n    Task<IEnumerable<Product>> GetAllAsync();\n    Task<Product?> GetByIdAsync(int id);\n    Task<Product>  CreateAsync(CreateProductRequest request);\n    Task<bool>     UpdateAsync(int id, UpdateProductRequest request);\n    Task<bool>     DeleteAsync(int id);\n}",
        "output": "// GET /products\nHTTP 200 OK\n[\n  { \"id\": 1, \"name\": \"Widget\", \"price\": 4.99, \"stockCount\": 100 },\n  { \"id\": 2, \"name\": \"Gadget\", \"price\": 19.99, \"stockCount\": 45 }\n]\n\n// GET /products/99 (non-existent)\nHTTP 404 Not Found\n\n// GET /products/abc (route constraint :int fails)\nHTTP 404 Not Found  ← route never matched, no handler runs\n\n// POST /products\nHTTP 201 Created\nLocation: /products/3\n{ \"id\": 3, \"name\": \"Sprocket\", \"price\": 2.49, \"stockCount\": 200 }"
      }

// ── Program.cs: Register JWT authentication and authorization policies ─────
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.Authority = "https://your-identity-server";
        options.Audience = "products-api";
    });

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("AdminOnly", policy =>
        policy.RequireClaim("role", "admin"));
    options.AddPolicy("ReadAccess", policy =>
        policy.RequireAuthenticatedUser()
              .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme));
});

var app = builder.Build();

// ★ Middleware must come before endpoints ★
app.UseAuthentication();
app.UseAuthorization();

// ── Apply auth to a route group ────────────────────────────────────────────
var adminGroup = app.MapGroup("/admin")
    .RequireAuthorization("AdminOnly");   // All /admin endpoints require Admin role

adminGroup.MapGet("/products", async (IProductService svc) =>
{
    var products = await svc.GetAllAsync();
    return TypedResults.Ok(products);
});

// ── Apply auth to a single endpoint ────────────────────────────────────────
var publicGroup = app.MapGroup("/products");

publicGroup.MapGet("/public", () => "This is public") // No auth
           .AllowAnonymous();

publicGroup.MapGet("/", async (IProductService svc) =>
    {
        var products = await svc.GetAllAsync();
        return TypedResults.Ok(products);
    })
    .RequireAuthorization("ReadAccess");

app.Run();

// ── Integration test example ───────────────────────────────────────────────
// To test authenticated endpoints, create a WebApplicationFactory with a test auth handler
// or generate a real JWT and include it in the HttpClient's DefaultRequestHeaders.

// ── ValidationFilter.cs ─────────────────────────────────────────────────────
// A generic endpoint filter that validates any request model using FluentValidation.
// Add NuGet: FluentValidation.AspNetCore

using FluentValidation;

public class ValidationFilter<TRequest> : IEndpointFilter
{
    private readonly IValidator<TRequest> _validator;

    public ValidationFilter(IValidator<TRequest> validator)
    {
        _validator = validator;
    }

    public async ValueTask<object?> InvokeAsync(
        EndpointFilterInvocationContext context,
        EndpointFilterDelegate next)
    {\n        // Find the argument that matches our request type in the handler's parameter list\n        var request = context.Arguments\n                             .OfType<TRequest>()\n                             .FirstOrDefault();\n\n        if (request is null)\n            return Results.BadRequest(\"Request body is missing.\");\n\n        var validationResult = await _validator.ValidateAsync(request);\n\n        if (!validationResult.IsValid)\n        {\n            // Return a structured 400 with all validation errors — client-friendly\n            var errors = validationResult.Errors\n                .GroupBy(e => e.PropertyName)\n                .ToDictionary(\n                    group => group.Key,\n                    group => group.Select(e => e.ErrorMessage).ToArray()\n                );\n\n            return Results.ValidationProblem(errors); // Returns RFC 7807 Problem Details\n        }\n\n        // Validation passed — call the next filter or the actual handler\n        return await next(context);\n    }\n}\n\n// ── CreateProductRequestValidator.cs ─────────────────────────────────────────\npublic class CreateProductRequestValidator : AbstractValidator<CreateProductRequest>\n{\n    public CreateProductRequestValidator()\n    {\n        RuleFor(r => r.Name)\n            .NotEmpty().WithMessage(\"Product name is required.\")\n            .MaximumLength(100).WithMessage(\"Name cannot exceed 100 characters.\");\n\n        RuleFor(r => r.Price)\n            .GreaterThan(0).WithMessage(\"Price must be greater than zero.\");\n\n        RuleFor(r => r.StockCount)\n            .GreaterThanOrEqualTo(0).WithMessage(\"Stock count cannot be negative.\");\n    }\n}\n\n// ── How to wire it up in ProductEndpoints.cs ─────────────────────────────────\n// Apply the filter to only the POST endpoint — surgical, not global\ngroup.MapPost(\"/\", CreateProduct)\n     .AddEndpointFilter<ValidationFilter<CreateProductRequest>>();\n     // That's it. The handler stays clean.\n\n// ── Program.cs additions for global error handling ───────────────────────────\nbuilder.Services.AddProblemDetails(); // Registers the RFC 7807 Problem Details formatter\n\n// Register all FluentValidation validators from the current assembly automatically\nbuilder.Services.AddValidatorsFromAssemblyContaining<CreateProductRequestValidator>();\n\n// ...\n\nvar app = builder.Build();\n\n// UseExceptionHandler MUST come before endpoint mapping\n// In .NET 8+, this one-liner handles all unhandled exceptions as Problem Details\napp.UseExceptionHandler();\napp.UseStatusCodePages(); // Turns empty 404/405 responses into Problem Details too\n\n// ── Testing the validation (curl example) ────────────────────────────────────\n// curl -X POST https://localhost:5001/products \\\n//      -H 'Content-Type: application/json' \\\n//      -d '{\"name\": \"\", \"price\": -5, \"stockCount\": -1}'",
        "output": "// POST /products with invalid body\nHTTP 400 Bad Request\nContent-Type: application/problem+json\n\n{\n  \"type\": \"https://tools.ietf.org/html/rfc9110#section-15.5.1\",\n  \"title\": \"One or more validation errors occurred.\",\n  \"status\": 400,\n  \"errors\": {\n    \"Name\": [\"Product name is required.\"],\n    \"Price\": [\"Price must be greater than zero.\"],\n    \"StockCount\": [\"Stock count cannot be negative.\"]\n  }\n}\n\n// Unhandled exception (e.g., DB connection dropped)\nHTTP 500 Internal Server Error\nContent-Type: application/problem+json\n\n{\n  \"type\": \"https://tools.ietf.org/html/rfc9110#section-15.6.1\",\n  \"title\": \"An error occurred while processing your request.\",\n  \"status\": 500\n}"
      }

// Demonstrating auth, rate limiting, and output caching on Minimal API endpoints
// These show Minimal APIs can handle production concerns — not just toy examples

// ── Program.cs service registrations ─────────────────────────────────────────
builder.Services.AddAuthentication().AddJwtBearer(); // JWT auth in one line
builder.Services.AddAuthorization();

builder.Services.AddOutputCache(options =>
{
    // Define a named cache policy — endpoints opt in by name
    options.AddPolicy("ProductCachePolicy", policyBuilder =>
        policyBuilder.Expire(TimeSpan.FromSeconds(30))
                     .Tag("products")); // Tag lets us invalidate by group later
});

builder.Services.AddRateLimiter(options =>
{
    // Fixed window: max 100 requests per minute per IP address
    options.AddFixedWindowLimiter("ApiRateLimit", limiterOptions =>
    {\n        limiterOptions.PermitLimit = 100;\n        limiterOptions.Window = TimeSpan.FromMinutes(1);\n        limiterOptions.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;\n        limiterOptions.QueueLimit = 5; // Buffer up to 5 excess requests, then 503\n    });

    options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
});

// ── app middleware — ORDER MATTERS ────────────────────────────────────────────
app.UseAuthentication(); // Must come before UseAuthorization
app.UseAuthorization();
app.UseOutputCache();
app.UseRateLimiter();

// ── Endpoint with all production concerns attached ───────────────────────────
var group = app.MapGroup("/products")
               .WithTags("Products")
               .RequireAuthorization()        // Every endpoint in this group needs a valid JWT
               .RequireRateLimiting("ApiRateLimit"); // Apply rate limit to the whole group

// This specific endpoint also uses output caching — expensive DB read cached for 30s
group.MapGet("/", async (IProductService productService) =>
    {
        var products = await productService.GetAllAsync();
        return TypedResults.Ok(products);
    })
    .CacheOutput("ProductCachePolicy"); // Only GET /products is cached, not the whole group

// Cache invalidation when a product is created
group.MapPost("/", async (\n    CreateProductRequest request,\n    IProductService productService,\n    IOutputCacheStore cacheStore,          // Inject the cache store directly\n    CancellationToken cancellationToken) =>
{
    var created = await productService.CreateAsync(request);

    // Invalidate all cached responses tagged "products" so GET / reflects the new item
    await cacheStore.EvictByTagAsync("products", cancellationToken);

    return TypedResults.Created($"/products/{created.Id}", created);
})
.AddEndpointFilter<ValidationFilter<CreateProductRequest>>();

// ── Unit test for GetAllProducts ─────────────────────────────────────────────
using Microsoft.AspNetCore.Http.HttpResults;

[Fact]
public async Task GetAllProducts_ReturnsOkWithList()
{
    // Arrange
    var mockService = new Mock<IProductService>();
    var expectedProducts = new List<Product>
    {
        new(1, "Widget", 4.99m, 100),
        new(2, "Gadget", 19.99m, 45)
    };
    mockService.Setup(s => s.GetAllAsync()).ReturnsAsync(expectedProducts);

    // Act — call the static handler directly
    var result = await ProductEndpoints.GetAllProducts(mockService.Object);

    // Assert — TypedResults gives us compile-time access to the status and value
    var okResult = Assert.IsType<Ok<IEnumerable<Product>>>(result);
    Assert.Equal(expectedProducts, okResult.Value); // Value equality on records
}

// ── Integration test using WebApplicationFactory ──────────────────────────────
// Requires: add <InternalsVisibleTo Include="YourTestProject" /> to .csproj
// or declare public partial class Program { } at end of Program.cs

public class ProductApiTests : IClassFixture<WebApplicationFactory<Program>>
{
    private readonly HttpClient _client;

    public ProductApiTests(WebApplicationFactory<Program> factory)
    {
        _client = factory.CreateClient();
    }

    [Fact]
    public async Task GetProducts_ReturnsSuccessWithJson()
    {
        var response = await _client.GetAsync("/products");
        response.EnsureSuccessStatusCode();
        var products = await response.Content.ReadFromJsonAsync<IEnumerable<Product>>();
        Assert.NotEmpty(products);
    }

    [Fact]
    public async Task CreateProduct_WithInvalidData_ReturnsValidationProblem()
    {
        var invalid = new { Name = "", Price = -5m, StockCount = -1 };
        var content = JsonContent.Create(invalid);
        var response = await _client.PostAsync("/products", content);
        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
        var problem = await response.Content.ReadFromJsonAsync<HttpValidationProblemDetails>();
        Assert.Contains("Name", problem.Errors.Keys);
    }
}

// Starter template for Exercise 1 — a basic task manager Minimal API

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();
builder.Services.AddSingleton<TaskStore>(); // In-memory store

var app = builder.Build();

if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

app.MapTaskEndpoints();  // You will implement this

app.Run();

// You'll need: TaskItem record, TaskStore class, TaskEndpoints static class, validation filter
public record TaskItem(int Id, string Title, bool IsComplete, DateTime CreatedAt);
public record CreateTaskRequest(string Title);
public record UpdateTaskRequest(string Title, bool IsComplete);

public class TaskStore
{\n    private readonly List<TaskItem> _tasks = new();\n    private int _nextId = 1;\n\n    public TaskItem Add(string title) { /* implement */ }
    public IEnumerable<TaskItem> GetAll() => _tasks;
    public TaskItem? GetById(int id) => _tasks.FirstOrDefault(t => t.Id == id);
    public bool Update(int id, UpdateTaskRequest req) { /* implement */ }
    public bool Delete(int id) { /* implement */ }
}