using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;

namespace Tnsu.ApprovalRoute.Api.Auth;

public static class AuthSetup
{
    public static IServiceCollection AddApprovalRouteAuth(this IServiceCollection services, IConfiguration configuration)
    {
        var tenantId = configuration["Entra:TenantId"];
        var audience = configuration["Entra:Audience"];

        if (!string.IsNullOrWhiteSpace(tenantId) && !string.IsNullOrWhiteSpace(audience))
        {
            services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                .AddJwtBearer(options =>
                {
                    options.Authority = $"https://login.microsoftonline.com/{tenantId}/v2.0";
                    options.TokenValidationParameters = new TokenValidationParameters
                    {
                        ValidIssuers =
                        [
                            $"https://login.microsoftonline.com/{tenantId}/v2.0",
                            $"https://sts.windows.net/{tenantId}/"
                        ],
                        ValidAudiences = [audience, $"api://{audience}"]
                    };
                });
        }
        else
        {
            services.AddAuthentication(AuthSchemes.Dev)
                .AddScheme<AuthenticationSchemeOptions, DevAuthHandler>(AuthSchemes.Dev, _ => { });
        }

        services.AddAuthorization();

        return services;
    }
}