Content Types and Negotiation

using Microsoft.AspNetCore.Mvc;

var builder = WebApplication.CreateBuilder(args);

builder.Services
    .AddControllers(options =>
    {
        options.ReturnHttpNotAcceptable = true;   // 406 instead of falling back to JSON
    })
    .AddXmlSerializerFormatters();

var app = builder.Build();
app.MapControllers();
app.Run();

public class InvoiceDto
{
    public int Id { get; set; }
    public string Number { get; set; } = "";
    public decimal Total { get; set; }
}

[ApiController]
[Route("api/invoices")]
public class InvoicesController : ControllerBase
{
    // Accept: application/xml -> XML; application/json or */* -> JSON; text/csv -> 406
    [HttpGet("{id:int}")]
    [Produces("application/json", "application/xml")]
    public ActionResult<InvoiceDto> Get(int id) =>
        new InvoiceDto { Id = id, Number = "INV-2026-0042", Total = 249.00m };
}

using System.Globalization;
using System.Runtime.CompilerServices;

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();

// CSV written row by row as it is read; memory stays flat whatever the size.
app.MapGet("/exports/orders.csv", (CancellationToken ct) =>
    TypedResults.Stream(async body =>
    {
        await using var writer = new StreamWriter(body);
        await writer.WriteLineAsync("id,customer_id,total,placed_at");
        await foreach (var o in OrderSource.ReadAllAsync(ct))
            await writer.WriteLineAsync(string.Create(CultureInfo.InvariantCulture,
                $"{o.Id},{o.CustomerId},{o.Total},{o.PlacedAt:O}"));
    }, contentType: "text/csv", fileDownloadName: "orders.csv"));

// IAsyncEnumerable<T> is written as a JSON array while items are still being produced.
app.MapGet("/exports/orders.json", (CancellationToken ct) => OrderSource.ReadAllAsync(ct));

app.Run();

public record OrderRow(int Id, int CustomerId, decimal Total, DateTimeOffset PlacedAt);

public static class OrderSource
{
    public static async IAsyncEnumerable<OrderRow> ReadAllAsync([EnumeratorCancellation] CancellationToken ct)
    {
        var start = new DateTimeOffset(2026, 1, 1, 0, 0, 0, TimeSpan.Zero);
        for (var i = 1; i <= 500_000; i++)
        {
            if (i % 10_000 == 0) await Task.Yield();
            ct.ThrowIfCancellationRequested();
            yield return new OrderRow(i, 1000 + i % 977, 19.99m + i % 300, start.AddMinutes(i));
        }
    }
}

using System.Security.Claims;
using Microsoft.AspNetCore.Http.HttpResults;
using Microsoft.Net.Http.Headers;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthentication().AddJwtBearer();
builder.Services.AddAuthorization();
builder.Services.AddSingleton<InvoiceOwnership>();

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();

var invoiceRoot = Path.TrimEndingDirectorySeparator(
    Path.GetFullPath(builder.Configuration["Invoices:Root"] ?? "/var/lib/shop/invoices"));

app.MapGet("/invoices/{number}/pdf", Results<PhysicalFileHttpResult, NotFound> (
    string number, ClaimsPrincipal user, InvoiceOwnership owners) =>
{
    // Invoice numbers are sequential and guessable: answer 404 unless this caller owns it.
    if (!owners.BelongsTo(number, user.FindFirstValue("customer_id")))
        return TypedResults.NotFound();

    // The route value is user input: never let it climb out of the invoice folder.
    var path = Path.GetFullPath(Path.Combine(invoiceRoot, $"{number}.pdf"));
    if (!path.StartsWith(invoiceRoot + Path.DirectorySeparatorChar, StringComparison.Ordinal) || !File.Exists(path))
        return TypedResults.NotFound();

    var info = new FileInfo(path);
    var etag = new EntityTagHeaderValue($"\"{info.Length:x}-{info.LastWriteTimeUtc.Ticks:x}\"");
    return TypedResults.PhysicalFile(path, "application/pdf", $"{number}.pdf",
        lastModified: info.LastWriteTimeUtc, entityTag: etag, enableRangeProcessing: true);
}).RequireAuthorization();

app.Run();

// Stand-in for the invoices table lookup: which customer an invoice number belongs to.
public sealed class InvoiceOwnership
{
    private readonly Dictionary<string, string> owners = new() { ["INV-2026-0042"] = "1001" };

    public bool BelongsTo(string number, string? customerId) =>
        customerId is not null && owners.TryGetValue(number, out var owner) && owner == customerId;
}