frontend fully integreated with the backend

Distribution/Program.cs

@@ -1,6 +1,6 @@
-using System.Security.Claims;
 using Distribution.Data;
 using Distribution.Features.Auth;
+using Distribution.Middleware;
 using Distribution.Features.Brand;
 using Distribution.Features.Category;
 using Distribution.Features.DeliveryRide;
@@ -34,10 +34,7 @@ using Distribution.Features.Stock;
 using Distribution.Features.Warehouse;
 using Distribution.Infra.Authorization;
 using Distribution.Infra.UoW;
-using Microsoft.AspNetCore.Authentication.JwtBearer;
-using Microsoft.AspNetCore.Authorization;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.IdentityModel.Tokens;
 
 var builder = WebApplication.CreateBuilder(args);
 
@@ -126,67 +123,26 @@ builder.Services.AddScoped<IPermissionRepository, PermissionRepository>();
 builder.Services.AddScoped<IScopeRepository, ScopeRepository>();
 builder.Services.AddScoped<IPermissionService, PermissionService>();
 builder.Services.AddScoped<IScopeAccessService, ScopeAccessService>();
-builder.Services.AddScoped<IAuthorizationHandler, PermissionAuthorizationHandler>();
-builder.Services.AddSingleton<IAuthorizationPolicyProvider, PermissionPolicyProvider>();
+// ── Auth Service connector ───────────────────────────────────────────────────
+builder.Services.Configure<AuthServiceOptions>(
+    builder.Configuration.GetSection(AuthServiceOptions.SectionName));
 
-var jwtSection = builder.Configuration.GetSection("Jwt");
-var jwtPublicKeyXml = jwtSection["PublicKey"] ?? throw new InvalidOperationException("Jwt:PublicKey is not configured.");
-var jwtSigningKey = new RsaSecurityKey(RsaXmlKeyReader.ReadPublicKey(jwtPublicKeyXml));
+var authServiceBaseUrl = builder.Configuration[$"{AuthServiceOptions.SectionName}:BaseUrl"];
 
-builder.Services.AddAuthentication(options =>
-    {
-        options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
-        options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
-    })
-    .AddJwtBearer(options =>
-    {
-        options.TokenValidationParameters = new TokenValidationParameters
-        {
-            ValidateIssuer = true,
-            ValidIssuer = jwtSection["Issuer"],
-            ValidateAudience = true,
-            ValidAudience = jwtSection["Audience"],
-            ValidateIssuerSigningKey = true,
-            IssuerSigningKey = jwtSigningKey,
-            ValidateLifetime = true,
-            ClockSkew = TimeSpan.FromMinutes(1)
-        };
+builder.Services.AddHttpClient<AuthServiceClient>(client =>
+{
+    if (!string.IsNullOrWhiteSpace(authServiceBaseUrl))
+        client.BaseAddress = new Uri(authServiceBaseUrl);
+});
 
-        // AuthHex issues the token and owns its claim shape; this app's authorization (permission
-        // policies, role-level checks) runs against the *local* Role/Permission tables, so every
-        // validated token is mapped back to a local User/Role once here, not duplicated per
-        // endpoint. A token for a user with no matching local User record is rejected outright —
-        // login via AuthHex does not implicitly provision a local user.
-        options.Events = new JwtBearerEvents
-        {
-            OnTokenValidated = async context =>
-            {
-                var subClaim = context.Principal?.FindFirst("sub")?.Value
-                    ?? context.Principal?.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+builder.Services.AddScoped<IAuthServiceClient, AuthServiceClient>();
 
-                if (!Guid.TryParse(subClaim, out var userId))
-                {
-                    context.Fail("Token is missing a valid user id claim.");
-                    return;
-                }
-
-                var userRepo = context.HttpContext.RequestServices.GetRequiredService<IUserRepository>();
-                var user = await userRepo.GetByIdAsync(userId);
-                if (user is null || !user.IsActive)
-                {
-                    context.Fail("User not found or inactive.");
-                    return;
-                }
-
-                var identity = (ClaimsIdentity)context.Principal!.Identity!;
-                identity.AddClaim(new Claim("username", user.Username));
-                identity.AddClaim(new Claim("role_id", user.FK_RoleId.ToString()));
-                identity.AddClaim(new Claim("role_level", (user.Role?.Level ?? 0).ToString()));
-            }
-        };
-    });
-
-builder.Services.AddAuthorization();
+var allowedOrigins = builder.Configuration.GetSection("Cors:AllowedOrigins").Get<string[]>() ?? [];
+builder.Services.AddCors(options =>
+    options.AddDefaultPolicy(policy =>
+        policy.WithOrigins(allowedOrigins)
+              .AllowAnyHeader()
+              .AllowAnyMethod()));
 
 builder.Services.AddControllers();
 builder.Services.AddEndpointsApiExplorer();
@@ -202,9 +158,9 @@ if (app.Environment.IsDevelopment())
     app.UseSwaggerUI();
 }
 
-app.UseHttpsRedirection();
-app.UseAuthentication();
-app.UseAuthorization();
+//app.UseHttpsRedirection();
+app.UseCors();
+app.UseMiddleware<AuthMiddleware>();
 app.MapControllers();
 
 app.Run();