SignalR Hubs

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.SignalR;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.Authority = builder.Configuration["Auth:Authority"];
        options.Audience = "orders-api";
        options.MapInboundClaims = false;
        options.TokenValidationParameters.NameClaimType = "sub";
        options.TokenValidationParameters.RoleClaimType = "role";
        options.Events = new JwtBearerEvents
        {
            OnMessageReceived = context =>
            {
                // Browsers cannot send headers on WebSocket or EventSource requests.
                var accessToken = context.Request.Query["access_token"];
                if (!string.IsNullOrEmpty(accessToken) && context.HttpContext.Request.Path.StartsWithSegments("/hubs"))
                {
                    context.Token = accessToken;
                }
                return Task.CompletedTask;
            }
        };
    });
builder.Services.AddAuthorization();
builder.Services.AddSignalR();
builder.Services.AddSingleton<IUserIdProvider, SubjectUserIdProvider>();
builder.Services.AddSingleton<IOrderOwnership, InMemoryOrderOwnership>();

var app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();
app.MapHub<CustomerOrdersHub>("/hubs/orders", options => options.CloseOnAuthenticationExpiration = true);
app.Run();

public sealed class SubjectUserIdProvider : IUserIdProvider
{
    public string? GetUserId(HubConnectionContext connection) => connection.User?.FindFirst("sub")?.Value;
}

public interface IOrderOwnership
{
    Task<bool> IsOwnerAsync(string customerId, int orderId, CancellationToken cancellationToken);
}

public sealed class InMemoryOrderOwnership : IOrderOwnership
{
    private readonly Dictionary<int, string> owners = new() { [2042] = "cust-17", [2043] = "cust-23" };

    public Task<bool> IsOwnerAsync(string customerId, int orderId, CancellationToken cancellationToken) =>
        Task.FromResult(owners.TryGetValue(orderId, out var owner) && owner == customerId);
}

[Authorize]
public sealed class CustomerOrdersHub(IOrderOwnership ownership) : Hub
{
    public async Task WatchOrder(int orderId)
    {
        var customerId = Context.UserIdentifier ?? throw new HubException("No user id in the token.");
        if (!await ownership.IsOwnerAsync(customerId, orderId, Context.ConnectionAborted))
        {
            // Same message for "not yours" and "does not exist", so ids cannot be probed.
            throw new HubException($"Order {orderId} was not found.");
        }
        await Groups.AddToGroupAsync(Context.ConnectionId, $"order-{orderId}");
    }

    [Authorize(Roles = "support")]
    public Task WatchAllOrders() => Groups.AddToGroupAsync(Context.ConnectionId, "orders-all");
}

using Microsoft.AspNetCore.SignalR.Client;

await using var connection = new HubConnectionBuilder()
    .WithUrl("https://orders.example.com/hubs/orders", options =>
    {
        options.AccessTokenProvider = () => Task.FromResult(Environment.GetEnvironmentVariable("ORDERS_API_TOKEN"));
    })
    .WithAutomaticReconnect()
    .Build();

connection.On<OrderStatusUpdate>("OrderStatusChanged", update =>
    Console.WriteLine($"Order {update.OrderId} is now {update.Status} ({update.ChangedAt:u})"));

// A reconnect is a new connection id with no groups, and anything sent meanwhile is gone.
connection.Reconnected += async connectionId =>
{
    await connection.InvokeAsync("WatchOrder", 2042);
    Console.WriteLine("Reconnected; re-fetch order 2042 over HTTP to catch up on missed updates.");
};

connection.Closed += error =>
{
    Console.WriteLine($"Connection closed for good: {error?.Message ?? "stopped"}");
    return Task.CompletedTask;
};

await connection.StartAsync();
await connection.InvokeAsync("WatchOrder", 2042);
await Task.Delay(TimeSpan.FromMinutes(5));

public sealed record OrderStatusUpdate(int OrderId, string Status, DateTimeOffset ChangedAt);

using System.Diagnostics;
using Microsoft.AspNetCore.SignalR;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddSingleton<HubTimingFilter>();
builder.Services.AddSignalR(options =>
{
    options.AddFilter<HubTimingFilter>();
    options.EnableDetailedErrors = builder.Environment.IsDevelopment();
});

var app = builder.Build();
app.MapHub<InvoicesHub>("/hubs/invoices");
app.Run();

public sealed class InvoicesHub : Hub
{
    public Task WatchInvoice(string invoiceNumber) =>
        Groups.AddToGroupAsync(Context.ConnectionId, $"invoice-{invoiceNumber}");
}

public sealed class HubTimingFilter(ILogger<HubTimingFilter> logger) : IHubFilter
{
    public async ValueTask<object?> InvokeMethodAsync(
        HubInvocationContext invocationContext, Func<HubInvocationContext, ValueTask<object?>> next)
    {
        var started = Stopwatch.GetTimestamp();
        try
        {
            return await next(invocationContext);
        }
        catch (Exception ex) when (ex is not HubException)
        {
            logger.LogError(ex, "Hub method {Method} failed for connection {ConnectionId}",
                invocationContext.HubMethodName, invocationContext.Context.ConnectionId);
            throw new HubException("The request could not be completed.");
        }
        finally
        {
            logger.LogInformation("Hub method {Method} took {ElapsedMs} ms",
                invocationContext.HubMethodName, Stopwatch.GetElapsedTime(started).TotalMilliseconds);
        }
    }
}