Authentication Flow

1. Request Logging Middleware
   ↓
2. Exception Handler Middleware
   ↓
3. CORS Middleware
   ↓
4. Authentication Middleware ← JWT validation happens here
   ↓
5. Authorization Middleware ← [Authorize] attribute enforced
   ↓
6. Controller Endpoint

string authHeader = context.Request.Headers["Authorization"];
if (!authHeader.StartsWith("Bearer "))
    return 401 Unauthorized;

string token = authHeader.Substring(7); // Remove "Bearer " prefix

var tokenHandler = new JwtSecurityTokenHandler();
var validationParameters = new TokenValidationParameters {
    ValidateIssuerSigningKey = true,
    IssuerSigningKey = new SymmetricSecurityKey(
        Encoding.UTF8.GetBytes(Configuration["JWT_SECRET"])
    ),
    ValidateIssuer = true,
    ValidIssuer = $"{Configuration["SUPABASE_URL"]}/auth/v1",
    ValidateAudience = true,
    ValidAudience = "authenticated",
    ValidateLifetime = true,
    ClockSkew = TimeSpan.Zero
};

ClaimsPrincipal principal = tokenHandler.ValidateToken(
    token, 
    validationParameters, 
    out SecurityToken validatedToken
);

var userId = principal.FindFirst("sub")?.Value;
var email = principal.FindFirst("email")?.Value;
var fullName = principal.FindFirst("full_name")?.Value;

if (string.IsNullOrEmpty(userId))
    return 401 Unauthorized;

context.User = principal;
context.Items["UserId"] = userId;
context.Items["Email"] = email;

var userId = User.FindFirst("sub")?.Value;
var email = User.FindFirst("email")?.Value;

[Authorize]
public async Task<IActionResult> Chat([FromBody] ChatRequest request)
{
    var userId = User.FindFirst("sub")?.Value;
    var email = User.FindFirst("email")?.Value;
    var fullName = User.FindFirst("full_name")?.Value;
    
    // User sync happens here (every request)
    await _userSyncService.EnsureUserExistsAsync(userId, email, fullName);
    
    // ... rest of logic
}

public async Task EnsureUserExistsAsync(string userId, string email, string fullName)
{
    try {
        var user = new User {
            UserId = Guid.Parse(userId),
            Email = email ?? $"user_{userId}@placeholder.com",
            FullName = fullName ?? email?.Split('@')[0] ?? "User",
            Role = "user"
        };
        
        await _supabaseClient
            .From<User>()
            .Upsert(user);
            
    } catch (Exception ex) {
        _logger.LogWarning($"User sync failed for {userId}: {ex.Message}");
        // Don't throw - user sync failure shouldn't block request
    }
}

INSERT INTO users (user_id, email, full_name, role, created_at)
VALUES ($1, $2, $3, 'user', NOW())
ON CONFLICT (user_id) DO UPDATE
SET email = EXCLUDED.email,
    full_name = EXCLUDED.full_name,
    updated_at = NOW();

iss: "https://<PROJECT_REF>.supabase.co/auth/v1"

ValidIssuer = $"{Configuration["SUPABASE_URL"]}/auth/v1"

SUPABASE_URL=https://abcdefgh.supabase.co

const supabase = createClient(
  SUPABASE_URL,
  SUPABASE_ANON_KEY  // Limited permissions, RLS enforced
);

var supabase = new SupabaseClient(
  Configuration["SUPABASE_URL"],
  Configuration["SUPABASE_SERVICE_ROLE_KEY"]  // Full access, bypasses RLS
);

var thread = await _threadsService.GetByIdAsync(threadId);
var userId = User.FindFirst("sub")?.Value;

if (thread.UserId != userId)
    return Forbid(); // 403 Forbidden

[Authorize]  // Requires authentication but not specific authorization
public async Task<IActionResult> GetThread(string id)
{
    var thread = await _threadsService.GetByIdAsync(id);
    
    // Custom authorization check
    if (thread.Visibility == "private") {
        var userId = User.FindFirst("sub")?.Value;
        if (thread.UserId != userId)
            return Forbid();
    }
    
    return Ok(thread);
}

[AllowAnonymous]  // No JWT required
public IActionResult Health()
{
    return Ok(new { status = "healthy" });
}

const { data } = await supabase.auth.signInWithPassword({
  email: 'user@example.com',
  password: 'password'
});

const jwt = data.session.access_token;        // 1-hour expiry
const refreshToken = data.session.refresh_token; // 30-day expiry

fetch('/api/arena/chat', {
  headers: {
    'Authorization': `Bearer ${jwt}`
  }
});

const payload = JSON.parse(atob(jwt.split('.')[1]));
if (payload.exp * 1000 < Date.now()) {
  // Token expired
}

const { data, error } = await supabase.auth.refreshSession({
  refresh_token: refreshToken
});

if (!error) {
  const newJwt = data.session.access_token;
  // Use newJwt for subsequent requests
}

JWT_SECRET=your_supabase_jwt_secret_here

// Decode JWT to inspect claims (don't validate signature)
const payload = JSON.parse(atob(jwt.split('.')[1]));
console.log(payload);