Veilige Identity Management met het BFF Pattern

// Startup.cs
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.AspNetCore.DataProtection.Repositories;
using Microsoft.AspNetCore.HttpOverrides;
using Microsoft.EntityFrameworkCore;
using Microsoft.IdentityModel.Logging;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
using Microsoft.Net.Http.Headers;
using Microsoft.OpenApi.Models;
using Ocelot.DependencyInjection;
using Ocelot.Middleware;
using Serilog;
using System.Reflection;
using System.Security.Claims;

namespace Gateway;

public class Startup(IConfiguration configuration)
{
    public IConfiguration Configuration { get; } = configuration;

    public void ConfigureServices(IServiceCollection services)
    {
        // Monitoring en observability
        services.AddMonitoring(typeof(Program).Assembly.FullName?.Split(",")[0]);

        // Serilog configuratie
        Log.Logger = new LoggerConfiguration()
                            .WriteTo.Console()
                            .CreateLogger();

        // Azure Redis Cache voor token storage
        services.AddCaching(Configuration);

        // Active company validation voor multi-tenancy
        services.Configure<ActiveCompanyValidationOptions>(
            Configuration.GetSection(ActiveCompanyValidationOptions.SectionName));

        // Controllers voor BFF endpoints
        services.AddControllersWithViews();
        
        // Ocelot API Gateway met custom handlers
        services.AddOcelot(Configuration)
            .AddDelegatingHandler<DownstreamContentHeadersHandler>(true)
            .AddDelegatingHandler<JwtHandler>(true)         // JWT injection naar backend
            .AddDelegatingHandler<CorsHandler>(true);      // CORS handling

        // Health checks voor monitoring
        services.AddHealthChecks()
            .AddCheck<IdentityHealthCheck>("IdentityHealthCheck");
            
        // Forwarded headers voor load balancer support
        services.Configure<ForwardedHeadersOptions>(options =>
        {
            options.ForwardedHeaders =
                ForwardedHeaders.XForwardedFor |
                ForwardedHeaders.XForwardedHost |
                ForwardedHeaders.XForwardedProto;

            options.ForwardLimit = 2;  // Limit proxy hops voor security
            options.KnownNetworks.Clear();
            options.KnownProxies.Clear();
        });

        // Development tooling
        if (Configuration.IsSwaggerEnabled())
        {
            services.AddSwaggerForOcelot(Configuration, (o) =>
            {
                o.GenerateDocsForGatewayItSelf = false;
            });
        }
        
        // HTTPS redirection voor production
        if (!Configuration.DisableHttps())
        {
            services.AddHttpsRedirection(options =>
            {
                options.RedirectStatusCode = StatusCodes.Status308PermanentRedirect;
                options.HttpsPort = 443;
            });
        }

        // Identity model debugging (alleen development)
        IdentityModelEventSource.ShowPII = true;

        // Anti-forgery token configuratie voor CSRF protection
        services.AddAntiforgery(options =>
        {
            options.HeaderName = "X-XSRF-TOKEN";
            options.Cookie.Name = "__Host-X-XSRF-TOKEN";
            options.Cookie.SameSite = Microsoft.AspNetCore.Http.SameSiteMode.Strict;
            options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
        });

        services.AddHttpClient();
        services.AddOptions();

        // Data Protection setup voor cookie encryption
        services.SetupDataProtection("Gateway");

        // Authentication configuratie
        var openIdConnectSettings = Configuration.GetSection("OpenIDConnectSettings");
        var cookieDomain = Configuration["cookieDomain"];
        
        // Development vs Production cookie domain handling
        if (openIdConnectSettings["Authority"]?.Contains("localhost", StringComparison.InvariantCultureIgnoreCase) ?? false)
        {
            cookieDomain = "localhost";
        }

        services.AddAuthentication(options =>
        {
            options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
            options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        })
        .AddCookie(options =>
        {
            // Cookie configuratie voor maximum security
            options.Cookie.Name = AuthCookieName.CookieName;
            options.Cookie.MaxAge = TokenSettings.CookieLifeSpan;
            options.Cookie.HttpOnly = true;                              // XSS protection
            options.Cookie.Domain = cookieDomain;                        // Cross-subdomain support
            options.Cookie.IsEssential = true;                          // GDPR essentieel
            options.Cookie.SameSite = Microsoft.AspNetCore.Http.SameSiteMode.Strict;  // CSRF protection
            options.Cookie.SecurePolicy = CookieSecurePolicy.Always;     // HTTPS only
            options.SlidingExpiration = false;                          // Fixed expiration
            
            // Authentication flow paths
            options.AccessDeniedPath = "/forbidden";
            options.LoginPath = "/login";
            options.LogoutPath = "/logout";
        })

        .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>
        {
            // Basic OIDC configuratie
            options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.Authority = openIdConnectSettings["Authority"];
            options.ClientId = openIdConnectSettings["ClientId"];
            options.ClientSecret = openIdConnectSettings["ClientSecret"];
            options.RequireHttpsMetadata = false;                        // Development flexibiliteit
            options.ResponseType = OpenIdConnectResponseType.Code;       // Authorization Code flow
            options.ResponseMode = "form_post";                          // Security best practice
            options.UsePkce = true;                                      // PKCE voor extra security
            
            // Callback paths
            options.CallbackPath = "/signin-oidc";
            options.SignedOutCallbackPath = "/signout-callback-oidc";
            
            // Scopes configuratie
            options.Scope.Clear();
            options.Scope.Add("profile");
            options.Scope.Add("roles");
            options.Scope.Add("openid");
            options.Scope.Add("offline_access");                        // Voor refresh tokens
            
            // Token storage - KRITIEK: SaveTokens = true voor token extractie
            options.SaveTokens = true;

            // Event handlers voor token management
            options.Events.OnRedirectToIdentityProvider = context =>
            {
                // Consumer app parameter doorgeven voor multi-app support
                var consumerApp = context.Request.Query["consumer_app"].ToString();
                if (!string.IsNullOrEmpty(consumerApp))
                {
                    context.ProtocolMessage.RedirectUri += $"?consumer_app={consumerApp}";
                }
                return Task.CompletedTask;
            };
            
            options.Events.OnRedirectToIdentityProviderForSignOut = context =>
            {
                // Logout flow configuration
                context.ProtocolMessage.ClientId = openIdConnectSettings["ClientId"];

                var consumerApp = context.Request.Query["consumer_app"].ToString();
                if (!string.IsNullOrEmpty(consumerApp))
                {
                    context.ProtocolMessage.PostLogoutRedirectUri += $"?consumer_app={consumerApp}";
                    context.ProtocolMessage.RedirectUri += $"?consumer_app={consumerApp}";
                }
                return Task.CompletedTask;
            };
            
            // KRITIEKE EVENT: Token extraction en caching
            options.Events.OnTicketReceived = async context =>
            {
                var cache = context.HttpContext.RequestServices.GetRequiredService<ICacheProvider>();

                var identity = context!.Principal!.Identities.FirstOrDefault();
                if (identity == null || !identity.IsAuthenticated)
                {
                    context.Fail("Failed authentication");
                    return;
                }

                if (context.Properties != null)
                {
                    // Extract user ID en tokens
                    var userId = identity.Claims.FirstOrDefault(c => c.Type == ClaimTypes.NameIdentifier)?.Value;
                    var token = context.Properties.GetTokenValue("id_token");
                    var refreshToken = context.Properties.GetTokenValue("refresh_token");
                    
                    if (token == null)
                    {
                        return;
                    }
                    
                    // Clean previous token en store nieuwe
                    await cache.ClearAsync($"access_token_{userId}");
                    await cache.SetAsync($"access_token_{userId}", token, TokenSettings.TokenLifeSpan);
                    
                    // SECURITY: Clear tokens uit cookie properties
                    // Anders zouden ze in de cookie terecht kunnen komen
                    context.Properties.UpdateTokenValue("access_token", string.Empty);
                    context.Properties.UpdateTokenValue("id_token", string.Empty);
                    context.Properties.UpdateTokenValue("expires_at", string.Empty);
                    context.Properties.UpdateTokenValue("token_type", string.Empty);
                    context.Properties.UpdateTokenValue("refresh_token", string.Empty);

                    // Special handling voor mobile apps (GoNative/Median)
                    var userAgent = context.Request.Headers[HeaderNames.UserAgent].ToString();
                    
                    // Check voor GoNative of Median user agents
                    if (!string.IsNullOrEmpty(userAgent)
                        && (userAgent.Contains("median", StringComparison.InvariantCultureIgnoreCase) 
                            || userAgent.Contains("gonative", StringComparison.InvariantCultureIgnoreCase))
                        && refreshToken != null)
                    {
                        // Mobile apps hebben refresh tokens nodig voor offline scenarios
                        await cache.ClearAsync($"refresh_token_{userId}");
                        await cache.SetAsync($"refresh_token_{userId}", refreshToken, TokenSettings.RefreshTokenLifeSpan);
                    }
                }

                return;
            };
        });

        // Database context voor gateway-specifieke data
        services.AddDbContext<ApplicationDbContext>(options => 
            options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));

        // Real-time messaging met SignalR
        services.AddSignalR();
        
        // Message broker voor async communication
        services.AddRabbitMq(Configuration.GetConnectionString("RabbitMqConnection"), 
            new DefaultDeadLetterConfiguration());
        
        // Custom services
        services.AddSingleton<ISignalRMessageService, SignalRMessageService>();
        services.AddSingleton<ICorsHeaderService, CorsHeaderService>();
        services.AddHostedService<NotificationSubscriber>();

        // Data protection key storage in database
        services.AddScoped<IXmlRepository, SqlXmlRepository>();
    }

    // Configure method: HTTP request pipeline
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        // Health checks voor Kubernetes/monitoring
        app.UseHealthChecks("/health");
        
        // Structured logging met request enrichment
        app.UseSerilogRequestLogging(options =>
        {
            options.MessageTemplate = "HTTP {RequestMethod} {RequestPath} responded {StatusCode} in {Elapsed:0.0000} ms for {XForwardedFor}";
            options.EnrichDiagnosticContext = (diagnosticContext, httpContext) =>
            {
                diagnosticContext.Set("XForwardedFor", httpContext.Request.Headers["X-Forwarded-For"]);
            };
        });
        
        // Load balancer support
        app.UseForwardedHeaders();

        // Environment-specific middleware
        if (env.IsDevelopment() || env.EnvironmentName == "k8s-test")
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            if (!Configuration.DisableHttps())
            {
                app.UseHsts();  // HTTPS Strict Transport Security
            }
        }

        // KRITIEK: Security headers middleware
        app.UseMiddleware<SecurityHeadersMiddleware>();

        // Root path redirect naar index
        app.Use(async (context, next) =>
        {
            if (context.Request.Path.Value == "/")
            {
                context.Response.Redirect("/index");
                return;
            }
            await next.Invoke();
        });

        // CORS handling voor SignalR
        app.UseMiddleware<SignalRCorsMiddleware>();
        
        // Multi-tenancy middleware
        app.UseActiveCompanyValidation();

        // Standard ASP.NET Core pipeline
        app.UseRouting();
        app.UseAuthentication();
        app.UseAuthorization();

        // Endpoints mapping
        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
            endpoints.MapHub<SignalRService>("/notifications");
        });

        app.UseStaticFiles();

        // Development tooling
        if (Configuration.IsSwaggerEnabled())
        {
            app.UseSwagger();

            app.UseSwaggerForOcelotUI(opt =>
            {
                opt.PathToSwaggerGenerator = "/swagger/docs";
            }, uiOpt =>
            {
                uiOpt.DocumentTitle = "Gateway documentation";
                uiOpt.InjectStylesheet("/css/custom-swagger-ui.css");
                uiOpt.InjectJavascript("/js/custom-swagger-ui.js");
            });
        }

        // Ocelot configuration en middleware
        var configuration = new OcelotPipelineConfiguration();
        app.UseWebSockets();                           // WebSocket support voor real-time features
        app.UseOcelot(configuration).Wait();          // API Gateway functionality

        // Background services
        var scopedServiceProvider = app.ApplicationServices.CreateScope().ServiceProvider;
        Timer timer = new Timer(new TimerCallback(CallCms), scopedServiceProvider, 
            TimeSpan.Zero, TimeSpan.FromHours(4));     // CMS cache refresh elke 4 uur

        // Database migrations
        if (Assembly.GetEntryAssembly()?.GetName().Name != "dotnet-swagger")
        {
            RunMigration(scopedServiceProvider);
        }
    }

// Gateway/Handlers/JwtHandler.cs
public class JwtHandler : DelegatingHandler
{
    private readonly IServiceProvider _serviceProvider;
    private readonly ILogger<JwtHandler> _logger;

    public JwtHandler(IServiceProvider serviceProvider, ILogger<JwtHandler> logger)
    {
        _serviceProvider = serviceProvider;
        _logger = logger;
    }

    protected override async Task<HttpResponseMessage> SendAsync(
        HttpRequestMessage request, 
        CancellationToken cancellationToken)
    {
        using var scope = _serviceProvider.CreateScope();
        var httpContextAccessor = scope.ServiceProvider.GetService<IHttpContextAccessor>();
        var cache = scope.ServiceProvider.GetService<ICacheProvider>();

        if (httpContextAccessor?.HttpContext?.User?.Identity?.IsAuthenticated == true)
        {
            try
            {
                // Extract user ID van authenticated user
                var userId = httpContextAccessor.HttpContext.User
                    .FindFirst(ClaimTypes.NameIdentifier)?.Value;

                if (!string.IsNullOrEmpty(userId))
                {
                    // Haal JWT token uit Redis cache
                    var token = await cache.GetAsync<string>($"access_token_{userId}");
                    
                    if (!string.IsNullOrEmpty(token))
                    {
                        // Inject Bearer token in Authorization header
                        request.Headers.Authorization = 
                            new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
                            
                        _logger.LogDebug("Injected JWT token for user {UserId}", userId);
                    }
                    else
                    {
                        _logger.LogWarning("No cached token found for user {UserId}", userId);
                    }
                }
            }
            catch (Exception ex)
            {
                _logger.LogError(ex, "Failed to inject JWT token");
                // Continue zonder token - downstream service moet 401 returnen
            }
        }

        return await base.SendAsync(request, cancellationToken);
    }
}

// Mobile app detection in token caching
var userAgent = context.Request.Headers[HeaderNames.UserAgent].ToString();

// GoNative is het oude platform, Median is de nieuwe naam
if (!string.IsNullOrEmpty(userAgent)
    && (userAgent.Contains("median", StringComparison.InvariantCultureIgnoreCase) 
        || userAgent.Contains("gonative", StringComparison.InvariantCultureIgnoreCase))
    && refreshToken != null)
{
    // Mobile apps krijgen refresh tokens voor offline scenarios
    await cache.ClearAsync($"refresh_token_{userId}");
    await cache.SetAsync($"refresh_token_{userId}", refreshToken, TokenSettings.RefreshTokenLifeSpan);
}

// TokenSettings configuratie voor verschillende client types
public static class TokenSettings
{
    // Standard web app lifespans
    public static readonly TimeSpan TokenLifeSpan = TimeSpan.FromHours(1);
    public static readonly TimeSpan CookieLifeSpan = TimeSpan.FromHours(8);
    
    // Extended lifespans voor mobile apps
    public static readonly TimeSpan RefreshTokenLifeSpan = TimeSpan.FromDays(30);  // Mobile refresh
    
    // Security settings
    public static readonly TimeSpan MaxInactivityTime = TimeSpan.FromHours(2);
    public static readonly TimeSpan AbsoluteTimeout = TimeSpan.FromHours(12);
}

// Mobile refresh token endpoint
[HttpPost("api/auth/mobile/refresh")]
[Authorize]
public async Task<IActionResult> RefreshMobileToken()
{
    var userId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
    if (string.IsNullOrEmpty(userId))
    {
        return Unauthorized();
    }

    var userAgent = Request.Headers[HeaderNames.UserAgent].ToString();
    var isMobileApp = !string.IsNullOrEmpty(userAgent) &&
                     (userAgent.Contains("median", StringComparison.InvariantCultureIgnoreCase) ||
                      userAgent.Contains("gonative", StringComparison.InvariantCultureIgnoreCase));

    if (!isMobileApp)
    {
        return BadRequest("Only mobile apps can use this endpoint");
    }

    try
    {
        var refreshToken = await _cache.GetAsync<string>($"refresh_token_{userId}");
        if (string.IsNullOrEmpty(refreshToken))
        {
            return Unauthorized("No refresh token available");
        }

        // Call OpenIdDict token endpoint
        var tokenResponse = await RefreshTokenWithIdentityProvider(refreshToken);
        
        if (tokenResponse != null)
        {
            // Update cached tokens
            await _cache.SetAsync($"access_token_{userId}", tokenResponse.AccessToken, 
                TokenSettings.TokenLifeSpan);
            
            if (!string.IsNullOrEmpty(tokenResponse.RefreshToken))
            {
                await _cache.SetAsync($"refresh_token_{userId}", tokenResponse.RefreshToken, 
                    TokenSettings.RefreshTokenLifeSpan);
            }

            return Ok(new { success = true, expiresIn = tokenResponse.ExpiresIn });
        }

        return Unauthorized("Token refresh failed");
    }
    catch (Exception ex)
    {
        _logger.LogError(ex, "Mobile token refresh failed for user {UserId}", userId);
        return StatusCode(500, "Token refresh failed");
    }
}

// Background cleanup job voor expired tokens
public class TokenCleanupService : IHostedService
{
    private readonly IServiceProvider _serviceProvider;
    private readonly ILogger<TokenCleanupService> _logger;
    private Timer? _timer;

    public async Task StartAsync(CancellationToken cancellationToken)
    {
        _timer = new Timer(CleanupExpiredTokens, null, 
            TimeSpan.Zero,                    // Start immediately
            TimeSpan.FromHours(1));           // Run every hour
    }

    private async void CleanupExpiredTokens(object? state)
    {
        using var scope = _serviceProvider.CreateScope();
        var cache = scope.ServiceProvider.GetService<ICacheProvider>();
        
        try
        {
            // Redis SCAN voor alle access_token keys
            var expiredKeys = await cache.ScanKeysAsync("access_token_*");
            var deletedCount = 0;

            foreach (var key in expiredKeys)
            {
                var exists = await cache.ExistsAsync(key);
                if (!exists)
                {
                    deletedCount++;
                }
            }

            _logger.LogInformation("Token cleanup completed: {DeletedCount} expired tokens removed", 
                deletedCount);
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Token cleanup failed");
        }
    }
}

// Monitoring en alerting
public class AuthenticationMetrics
{
    private readonly ILogger<AuthenticationMetrics> _logger;

    public void LogAuthenticationSuccess(string userId, string userAgent)
    {
        _logger.LogInformation("Authentication successful for user {UserId} with agent {UserAgent}", 
            userId, userAgent);
    }

    public void LogAuthenticationFailure(string reason, string? userId = null)
    {
        _logger.LogWarning("Authentication failed: {Reason} for user {UserId}", 
            reason, userId ?? "unknown");
    }

    public void LogTokenCacheHit(string userId)
    {
        _logger.LogDebug("Token cache hit for user {UserId}", userId);
    }

    public void LogTokenCacheMiss(string userId)
    {
        _logger.LogWarning("Token cache miss for user {UserId} - token may be expired", userId);
    }
}