auth clean up

Distribution/Program.cs

@@ -91,7 +91,6 @@ builder.Services.AddScoped<OrderService>();
 builder.Services.AddScoped<SaleService>();
 builder.Services.AddScoped<UserService>();
 builder.Services.AddScoped<RoleService>();
-builder.Services.AddScoped<AuthService>();
 builder.Services.AddScoped<CategoryService>();
 builder.Services.AddScoped<BrandService>();
 builder.Services.AddScoped<UomService>();
@@ -117,7 +116,6 @@ builder.Services.AddScoped<PaymentService>();
 
 builder.Services.AddHttpContextAccessor();
 builder.Services.AddScoped<ICurrentUserService, CurrentUserService>();
-builder.Services.AddScoped<IJwtTokenService, JwtTokenService>();
 builder.Services.AddScoped<IPermissionRepository, PermissionRepository>();
 builder.Services.AddScoped<IScopeRepository, ScopeRepository>();
 builder.Services.AddScoped<IPermissionService, PermissionService>();
@@ -125,28 +123,57 @@ builder.Services.AddScoped<IScopeAccessService, ScopeAccessService>();
 builder.Services.AddScoped<IAuthorizationHandler, PermissionAuthorizationHandler>();
 builder.Services.AddSingleton<IAuthorizationPolicyProvider, PermissionPolicyProvider>();
 
-var jwtSection = builder.Configuration.GetSection("Jwt");
-var jwtKey = jwtSection["Key"] ?? throw new InvalidOperationException("Jwt:Key is not configured.");
+// ── Auth Service connector ───────────────────────────────────────────────────
+// TODO: replace placeholder BaseAddress with real Auth Service URL once decided.
+// The AuthServiceOptions:BaseUrl value in appsettings.json drives this.
+builder.Services.Configure<AuthServiceOptions>(
+    builder.Configuration.GetSection(AuthServiceOptions.SectionName));
 
-builder.Services.AddAuthentication(options =>
-    {
-        options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
-        options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
-    })
-    .AddJwtBearer(options =>
-    {
-        options.TokenValidationParameters = new TokenValidationParameters
+var authServiceBaseUrl = builder.Configuration[$"{AuthServiceOptions.SectionName}:BaseUrl"];
+
+builder.Services.AddHttpClient<AuthServiceClient>(client =>
+{
+    // TODO: set BaseAddress once Auth Service URL is known.
+    if (!string.IsNullOrWhiteSpace(authServiceBaseUrl))
+        client.BaseAddress = new Uri(authServiceBaseUrl);
+});
+
+builder.Services.AddScoped<IAuthServiceClient, AuthServiceClient>();
+
+// ── Authentication ───────────────────────────────────────────────────────────
+// TODO: replace this JWT configuration with the token validation strategy
+// dictated by the Auth Service (symmetric key, JWKS/OIDC, etc.) once decided.
+var jwtSection = builder.Configuration.GetSection("Jwt");
+var jwtKey = jwtSection["Key"];
+
+if (!string.IsNullOrWhiteSpace(jwtKey))
+{
+    builder.Services.AddAuthentication(options =>
         {
-            ValidateIssuer = true,
-            ValidIssuer = jwtSection["Issuer"],
-            ValidateAudience = true,
-            ValidAudience = jwtSection["Audience"],
-            ValidateIssuerSigningKey = true,
-            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtKey)),
-            ValidateLifetime = true,
-            ClockSkew = TimeSpan.FromMinutes(1)
-        };
-    });
+            options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
+            options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
+        })
+        .AddJwtBearer(options =>
+        {
+            options.TokenValidationParameters = new TokenValidationParameters
+            {
+                ValidateIssuer = true,
+                ValidIssuer = jwtSection["Issuer"],
+                ValidateAudience = true,
+                ValidAudience = jwtSection["Audience"],
+                ValidateIssuerSigningKey = true,
+                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtKey)),
+                ValidateLifetime = true,
+                ClockSkew = TimeSpan.FromMinutes(1)
+            };
+        });
+}
+else
+{
+    // Auth Service integration not yet configured — all [Authorize] checks will
+    // fail until the token validation strategy is wired up.
+    builder.Services.AddAuthentication();
+}
 
 builder.Services.AddAuthorization();