Run a standalone identity server

using Microsoft.EntityFrameworkCore;
using SqlOS;
using SqlOS.Configuration;
using SqlOS.Extensions;
 
var builder = WebApplication.CreateBuilder(args);
var connectionString = builder.Configuration.GetConnectionString("DefaultConnection")
    ?? throw new InvalidOperationException("Configure ConnectionStrings:DefaultConnection.");
var dashboardPassword = builder.Configuration["SqlOS:Dashboard:Password"]
    ?? throw new InvalidOperationException("Configure SqlOS:Dashboard:Password.");
const string identityOrigin = "https://auth.example.com";
const string apiAudience = "https://api.example.com";
 
builder.AddSqlOS<ExampleAppDbContext>(db => db.UseSqlServer(connectionString), options =>
{
    options.ConfigureApplication("Acme Identity", application =>
    {
        application.Origin = identityOrigin;
        application.Brand(page => page.PrimaryColor = "#0f172a");
    });
    options.Dashboard.AuthMode = SqlOSDashboardAuthMode.Password;
    options.Dashboard.Password = dashboardPassword;
 
    var auth = options.AuthServer;
    auth.PublicOrigin = identityOrigin;
    auth.Issuer = identityOrigin + "/sqlos/auth";
    auth.DefaultAudience = apiAudience;
 
    foreach (var (id, name, redirect) in new[]
    {
        ("customer-portal", "Customer Portal", "https://app.example.com/auth/callback"),
        ("admin-console", "Admin Console", "https://admin.example.com/auth/callback"),
        ("mobile-app", "Mobile App", "sqlos-mobile://auth-callback")
    })
    {
        auth.SeedClient(client =>
        {
            client.ClientId = id;
            client.Name = name;
            client.RedirectUris = [redirect];
            client.Audience = apiAudience;
            client.AllowedScopes = ["openid", "profile", "email", "offline_access"];
            client.ClientType = "public_pkce";
            client.RequirePkce = true;
            client.IsFirstParty = true;
        });
    }
    auth.SeedCliClient("support-cli", "Support CLI", apiAudience,
        "openid", "profile", "email", "offline_access");
});
 
var app = builder.Build();
app.Run();
 
public sealed class ExampleAppDbContext(DbContextOptions<ExampleAppDbContext> options)
    : SqlOSDbContext<ExampleAppDbContext>(options);

application.Headless(headless =>
{
    headless.BuildUiUrl = ctx =>
        QueryHelpers.AddQueryString(
            "https://app.example.com/auth/authorize",
            new Dictionary<string, string?>
            {
                ["request"] = ctx.RequestId,
                ["view"] = ctx.View,
                ["email"] = ctx.Email,
                ["pendingToken"] = ctx.PendingToken,
                ["mfaToken"] = ctx.MfaToken,
                ["ui_context"] = ctx.UiContext?.ToJsonString()
            });
});

auth.SeedClient(client =>
{
    client.ClientId = "admin-console";
    client.Name = "Admin Console";
    client.RedirectUris = ["https://admin.example.com/auth/callback"];
    client.AccessMode = SqlOSApplicationAccessModes.SelectedUsersGroupsRoles;
    client.AssignRole("tenant-admins", "org_123", "admin");
});

curl -X POST https://auth.example.com/sqlos/admin/auth/api/applications/admin-console/access-mode \
  -b "$SQLOS_DASHBOARD_COOKIE_JAR" \
  -H "Content-Type: application/json" \
  -d '{ "accessMode": "selected_users_groups_roles" }'

curl -X POST https://auth.example.com/sqlos/admin/auth/api/applications/admin-console/assignments \
  -b "$SQLOS_DASHBOARD_COOKIE_JAR" \
  -H "Content-Type: application/json" \
  -d '{
    "principalType": "role",
    "organizationId": "org_123",
    "roleKey": "admin",
    "access": "allowed",
    "reason": "Tenant admins may use Admin Console"
  }'

curl -b "$SQLOS_DASHBOARD_COOKIE_JAR" \
  "https://auth.example.com/sqlos/admin/auth/api/applications/admin-console/access/check?organizationId=org_123&userId=usr_123"

builder.Services.AddAuthentication("Bearer").AddJwtBearer("Bearer", options =>
{
    options.Authority = "https://auth.example.com/sqlos/auth";
    options.Audience = "https://api.example.com";
    options.MapInboundClaims = false;
});
builder.Services.AddAuthorization();
 
var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();
app.MapGet("/me", (HttpContext http) => new { userId = http.User.FindFirst("sub")?.Value })
    .RequireAuthorization();
app.Run();