[AllowAnonymous]

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthentication().AddJwtBearer();
builder.Services.AddAuthorization();
builder.Services.AddHealthChecks();

var app = builder.Build();

var api = app.MapGroup("/api").RequireAuthorization();

api.MapGet("/orders", () => TypedResults.Ok(Array.Empty<object>()));

// Only this endpoint is public; the group stays protected.
api.MapGet("/products", () => TypedResults.Ok(new[] { new { sku = "MUG-WHITE", price = 12.50m } }))
   .AllowAnonymous();

// Probes from the orchestrator carry no token.
app.MapHealthChecks("/health").AllowAnonymous();

app.Run();

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc.Testing;
using Microsoft.AspNetCore.Routing;
using Xunit;

public class AnonymousEndpointTests(WebApplicationFactory<Program> factory) : IClassFixture<WebApplicationFactory<Program>>
{
    private static readonly string[] Approved = ["api/catalog/products", "health", "auth/token"];

    [Fact]
    public void Only_approved_endpoints_allow_anonymous_access()
    {
        var anonymous = factory.Services.GetRequiredService<EndpointDataSource>().Endpoints
            .OfType<RouteEndpoint>()
            .Where(e => e.Metadata.GetMetadata<IAllowAnonymous>() is not null)
            .Select(e => e.RoutePattern.RawText!.TrimStart('/'))
            .Order()
            .ToArray();

        Assert.Equal(Approved.Order(), anonymous);
    }
}

// Stand-in so this file compiles alone. In a real test project delete it: the API's
// Program.cs ends with "public partial class Program;" in the global namespace, this
// project references the API project, and WebApplicationFactory<Program> then boots
// the real API. Declared here inside a namespace, it would be a different, empty class.
public partial class Program;

using System.Collections.Concurrent;
using System.Security.Cryptography;
using System.Text;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthorization();
var app = builder.Build();

// Processed event ids; use a shared store with a TTL when running several replicas.
var processed = new ConcurrentDictionary<string, DateTimeOffset>();

app.MapPost("/webhooks/payments", [AllowAnonymous] [RequestSizeLimit(64 * 1024)] async (HttpRequest request, IConfiguration config) =>
{
    // Freshness: the provider signs "timestamp.body"; old deliveries are replays.
    if (!long.TryParse(request.Headers["X-Timestamp"], out var unixSeconds)
        || Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - unixSeconds) > 300)
    {
        return Results.Unauthorized();
    }

    using var reader = new StreamReader(request.Body);
    var payload = await reader.ReadToEndAsync(request.HttpContext.RequestAborted);
    var secret = Encoding.UTF8.GetBytes(config["Payments:WebhookSecret"]!);
    var signed = Encoding.UTF8.GetBytes($"{unixSeconds}.{payload}");
    var expected = Convert.ToHexStringLower(HMACSHA256.HashData(secret, signed));
    var received = request.Headers["X-Signature"].ToString();

    if (!CryptographicOperations.FixedTimeEquals(Encoding.ASCII.GetBytes(expected), Encoding.ASCII.GetBytes(received)))
    {
        return Results.Unauthorized();
    }

    // De-duplication: a verified delivery with a known event id is acknowledged, not reprocessed.
    var eventId = request.Headers["X-Event-Id"].ToString();
    if (eventId.Length == 0) return Results.BadRequest();
    if (!processed.TryAdd(eventId, DateTimeOffset.UtcNow)) return Results.Ok();

    // Process the payment event once here.
    return Results.Ok();
});

app.Run();