Run a standalone identity server

using Microsoft.EntityFrameworkCore;
using SqlOS.Extensions;
 
var builder = WebApplication.CreateBuilder(args);
 
builder.Services.AddDbContext<ExampleAppDbContext>(options =>
    options.UseSqlServer(
        builder.Configuration.GetConnectionString("DefaultConnection")));
 
builder.AddSqlOS<ExampleAppDbContext>(options =>
{
    options.DashboardBasePath = "/sqlos";
 
    var auth = options.AuthServer;
    auth.Issuer = "https://auth.example.com/sqlos/auth";
    auth.PublicOrigin = "https://auth.example.com";
    auth.DefaultAudience = "https://api.example.com";
});
 
var app = builder.Build();
app.MapSqlOS();
app.Run();

builder.AddSqlOS<ExampleAppDbContext>(options =>
{
    var auth = options.AuthServer;
 
    auth.SeedBrowserClient(
        "customer-portal",
        "Customer Portal",
        "https://app.example.com/auth/callback");
 
    auth.SeedBrowserClient(
        "admin-console",
        "Admin Console",
        "https://admin.example.com/auth/callback");
 
    auth.SeedBrowserClient(
        "mobile-app",
        "Mobile App",
        "sqlos-mobile://auth-callback");
 
    auth.SeedCliClient(
        "support-cli",
        "Support CLI",
        "https://api.example.com",
        "openid",
        "profile",
        "email",
        "offline_access");
});

auth.UseHeadlessAuthPage(headless =>
{
    headless.BuildUiUrl = ctx =>
        QueryHelpers.AddQueryString(
            "https://app.example.com/auth/authorize",
            new Dictionary<string, string?>
            {
                ["request"] = ctx.RequestId,
                ["view"] = ctx.View,
                ["email"] = ctx.Email,
                ["pendingToken"] = ctx.PendingToken,
                ["mfaToken"] = ctx.MfaToken,
                ["ui_context"] = ctx.UiContext?.ToJsonString()
            });
});

auth.SeedClient(client =>
{
    client.ClientId = "admin-console";
    client.Name = "Admin Console";
    client.RedirectUris = ["https://admin.example.com/auth/callback"];
    client.AccessMode = SqlOSApplicationAccessModes.SelectedUsersGroupsRoles;
    client.AssignRole("tenant-admins", "org_123", "admin");
});

curl -X POST https://auth.example.com/sqlos/admin/auth/api/applications/admin-console/access-mode \
  -b "$SQLOS_DASHBOARD_COOKIE_JAR" \
  -H "Content-Type: application/json" \
  -d '{ "accessMode": "selected_users_groups_roles" }'

curl -X POST https://auth.example.com/sqlos/admin/auth/api/applications/admin-console/assignments \
  -b "$SQLOS_DASHBOARD_COOKIE_JAR" \
  -H "Content-Type: application/json" \
  -d '{
    "principalType": "role",
    "organizationId": "org_123",
    "roleKey": "admin",
    "access": "allowed",
    "reason": "Tenant admins may use Admin Console"
  }'

curl -b "$SQLOS_DASHBOARD_COOKIE_JAR" \
  "https://auth.example.com/sqlos/admin/auth/api/applications/admin-console/access/check?organizationId=org_123&userId=usr_123"

app.UseSqlOSAccessTokenValidation(options =>
{
    options.ExpectedAudience = "https://api.example.com";
});