shoc-backend/Api.SeaHavenIndustries/Infrastructure/JwtAuthenticationRegistration.cs

using System.Text;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;

namespace Api.SeaHavenIndustries.Infrastructure
{
    public static class JwtAuthenticationRegistration
    {
        /// <summary>
        /// Registers bearer-token authentication as the default scheme. Program.cs and the
        /// behavior tests both compose authentication through this method so the token
        /// rules under test are the rules that run.
        /// </summary>
        public static IServiceCollection AddSeaHavenJwtAuthentication(this IServiceCollection services, IConfiguration configuration)
        {
            services.AddAuthentication(options =>
            {
                options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
                options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
            })
            .AddJwtBearer(options =>
            {
                options.SaveToken = true;
                options.RequireHttpsMetadata = false;
                options.TokenValidationParameters = new TokenValidationParameters()
                {
                    ValidateIssuer = true,
                    ValidateAudience = true,
                    ValidAudience = configuration["JWT:ValidAudience"],
                    ValidIssuer = configuration["JWT:ValidIssuer"],
                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(
                        configuration["JWT:Secret"]
                        ?? throw new InvalidOperationException("JWT:Secret configuration is required")))
                };
            });

            return services;
        }
    }
}