Authentication¶

var keycloakAuthority = builder
    .AddParameter("keycloak-authority");

// Each API receives the authority URL as an environment variable
apiService
    .WithEnvironment("Keycloak__Authority", keycloakAuthority);

{
  "Parameters": {
    "keycloak-authority": "https://auth.bluebraces.online"
  }
}

// In Extensions.Infrastructure NuGet — AuthExtensions.cs
// Standard JWT Bearer with Keycloak as the authority
services
    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
    {
        options.Authority = keycloakOptions.AuthorityUrl;
        options.Audience = "account";
        options.RequireHttpsMetadata = keycloakOptions.RequireHttpsMetadata;
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = keycloakOptions.AuthorityUrl,
            ValidAudience = "account",
            RoleClaimType = ClaimTypes.Role,
        };
    });

// Claims transformation to map Keycloak roles to standard .NET role claims
services.AddTransient<IClaimsTransformation, KeycloakClaimsTransformation>();

// Authorization policies
services.AddAuthorizationBuilder()
    .AddPolicy("RequireAdmin", policy => policy.RequireRole(Roles.Admin))
    .AddPolicy("RequireModerator", policy => policy.RequireRole(Roles.Moderator))
    .AddPolicy("RequireAdminOrModerator", policy =>
        policy.RequireRole(Roles.Admin, Roles.Moderator));

public class KeycloakClaimsTransformation : IClaimsTransformation
{
    public Task<ClaimsPrincipal> TransformAsync(ClaimsPrincipal principal)
    {
        // Map Keycloak realm_access.roles to ClaimTypes.Role
        // Map sub to ClaimTypes.NameIdentifier
        // Map preferred_username to ClaimTypes.Name
    }
}

public interface ICurrentUserService
{
    Guid? UserId { get; }
    string? UserName { get; }
    IReadOnlyList<string> Roles { get; }
    bool IsInRole(string role);
}

// Implementation extracts from HttpContext.User claims
public class CurrentUserService(IHttpContextAccessor httpContextAccessor)
    : ICurrentUserService
{
    public Guid? UserId => Guid.TryParse(
        httpContextAccessor.HttpContext?.User
            .FindFirst(ClaimTypes.NameIdentifier)?.Value,
        out var id) ? id : null;

    public IReadOnlyList<string> Roles =>
        httpContextAccessor.HttpContext?.User
            .FindAll(ClaimTypes.Role)
            .Select(c => c.Value)
            .ToList() ?? [];
}

// Require any authenticated user
app.MapPost("/questions/propose", ...)
    .RequireAuthorization();

// Require specific role
app.MapPost("/questions/approve", ...)
    .RequireAuthorization(policy => policy.RequireRole(Roles.Moderator));

public sealed class ProposeQuestionHandler(
    ApplicationDbContext dbContext,
    ICurrentUserService userService)
{
    public async Task ExecuteAsync(ProposeQuestionCommand command, CancellationToken ct)
    {
        // For commands - require authentication
        var userId = userService.UserId
            ?? throw new UnauthorizedAccessException();

        // For queries - allow anonymous (use empty guid)
        var userId = userService.UserId ?? Guid.Empty;
    }
}

const userManager = new UserManager({
  authority: import.meta.env.VITE_AUTH_ISSUER,
  client_id: import.meta.env.VITE_AUTH_CLIENT_ID,
  redirect_uri: `${import.meta.env.VITE_AUTH_URL}/settings`,
  post_logout_redirect_uri: import.meta.env.VITE_AUTH_URL,
  userStore: new WebStorageStateStore({ store: sessionStorage }),
  automaticSilentRenew: true,
});

// Provider wraps the app
<AuthProvider>
  <App />
</AuthProvider>;

const auth = useAuth();

// All values are SolidJS accessors (call them to read)
auth.isAuthenticated(); // boolean
auth.isLoading(); // boolean
auth.user(); // User | null
auth.accessToken(); // string | undefined
auth.roles(); // string[]
auth.isAdmin(); // boolean
auth.isModerator(); // boolean
auth.isAdminOrModerator(); // boolean

// Methods
auth.signIn(); // redirect to Keycloak login
auth.signOut(); // redirect to Keycloak logout
auth.signInSilent(); // silent token renewal
auth.hasRole("admin"); // boolean
auth.hasAnyRole("admin", "moderator"); // boolean

interface RequireAuthProps {
  roles?: Role | Role[];
  fallback?: JSX.Element;
  children: JSX.Element;
}

// Usage in router
<RequireAuth roles={["user", "moderator", "admin"]}>
  <QuestionsPage />
</RequireAuth>;

function extractRoles(accessToken: string | undefined): string[] {
  // Decodes JWT base64 payload
  // Extracts realm_access.roles + resource_access.*.roles
  // Returns deduplicated array
}

// Exposed as reactive accessors via useAuth()
const roles = createMemo(() => extractRoles(accessToken()));
const isAdmin = createMemo(() =>
  roles().some((r) => r.toLowerCase() === "admin"),
);

// src/api/client.ts
const authMiddleware: Middleware = {
  async onRequest({ request }) {
    const token = await getAccessToken();
    if (token) {
      request.headers.set("Authorization", `Bearer ${token}`);
    }
    return request;
  },
};

export const organizerApi = createClient<OrganizerPaths>({
  baseUrl: `${baseUrl}/organizer`,
});
organizerApi.use(authMiddleware);

<Show
  when={auth.isAuthenticated()}
  fallback={<button onClick={() => auth.signIn()}>Login</button>}
>
  <button onClick={() => auth.signOut()}>
    Logout ({auth.user()?.profile?.preferred_username})
  </button>
</Show>