[Authorize]

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Authorization;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.Authority = builder.Configuration["Auth:Authority"];
        options.Audience = "orders-api";
        options.MapInboundClaims = false;                  // keep claim names as issued
        options.TokenValidationParameters.RoleClaimType = "roles";
        options.TokenValidationParameters.NameClaimType = "sub";
    });
builder.Services.AddAuthorization();

var app = builder.Build();

app.MapDelete("/orders/{id:int}", [Authorize(Roles = "orders.admin")] (int id) => TypedResults.NoContent());

app.Run();

using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddControllers();
builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie()
    .AddJwtBearer(o => o.Authority = builder.Configuration["Auth:Authority"]);
builder.Services.AddAuthorization();

var app = builder.Build();
app.MapControllers();
app.Run();

[ApiController]
[Route("api/integrations")]
[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
public class IntegrationsController : ControllerBase
{
    // Machine clients only: a browser cookie is not accepted here.
    [HttpPost("orders")]
    public IActionResult Import() => Accepted();
}

using Microsoft.AspNetCore.Authorization;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthentication().AddJwtBearer(o => o.MapInboundClaims = false);
// Scopes arrive as one space-separated claim, so split it instead of using RequireClaim.
builder.Services.AddAuthorizationBuilder()
    .AddPolicy("InventoryWrite", p => p.RequireAssertion(context =>
        context.User.FindAll(c => c.Type is "scope" or "scp")
            .Any(c => c.Value.Split(' ', StringSplitOptions.RemoveEmptyEntries).Contains("inventory:write"))));

var app = builder.Build();

var inventory = app.MapGroup("/inventory").RequireAuthorization();   // every endpoint: authenticated

inventory.MapGet("/{sku}", (string sku) => TypedResults.Ok(new { sku, quantity = 12 }));

// Group requirement AND this policy.
inventory.MapPut("/{sku}", [Authorize(Policy = "InventoryWrite")] (string sku, int quantity) =>
    TypedResults.NoContent());

// Same effect with the fluent API instead of the attribute.
inventory.MapDelete("/{sku}", (string sku) => TypedResults.NoContent())
    .RequireAuthorization("InventoryWrite");

app.Run();