Stable user endpoints

Removed security deadlock

PostFundManagement.Api/Program.cs

@@ -38,6 +38,54 @@ builder.Services.AddHealthChecks()
     .AddCheck<PostgresHealthCheck>("PostgresDatabase")
     .AddCheck("Self", () => HealthCheckResult.Healthy());
 
+IEnumerable<string> identityScopes = ["openid", "profile", "roles", "email", "address"];
+
+builder.Services.AddOpenApi(options =>
+{
+    options.AddDocumentTransformer((document, context, cancellationToken) =>
+    {
+        document.Components ??= new OpenApiComponents();
+        document.Components?.SecuritySchemes!["OAuth2"] = new OpenApiSecurityScheme
+        {
+            Type = SecuritySchemeType.OAuth2,
+            Description = "Interactive OAuth2 flow for authentication and authorization",
+            Flows = new OpenApiOAuthFlows
+            {
+                AuthorizationCode = new OpenApiOAuthFlow
+                {
+                    AuthorizationUrl = new Uri($"{builder.Configuration["SecuritySettings:Authority"]}/connect/authorize"),
+                    TokenUrl = new Uri($"{builder.Configuration["SecuritySettings:Authority"]}/connect/token"),
+                    Scopes = new Dictionary<string, string>
+                    {
+                        { "openid", "OpenID Connect" },
+                        { "profile", "User Profile" },
+                        { "roles", "User Roles" },
+                        { "email", "User Email" },
+                        { "address", "User Address" },
+                        { builder.Configuration["SecuritySettings:Audience"]!, "PFM API Scope" }
+                    }
+                }
+            }
+        };
+
+        return Task.CompletedTask;
+    });
+
+    options.AddOperationTransformer((operation, context, cancellationToken) =>
+    {
+        operation.Security ??= [];
+
+        var schemeReference = new OpenApiSecuritySchemeReference("OAuth2");
+
+        operation.Security.Add(new OpenApiSecurityRequirement
+        {
+            [schemeReference] = [.. identityScopes, builder.Configuration["SecuritySettings:Audience"]!]
+        });
+
+        return Task.CompletedTask;
+    });
+});
+
 var app = builder.Build();
 
 var schedulerFactory = app.Services.GetRequiredService<ISchedulerFactory>();
@@ -63,7 +111,7 @@ var versionGroups = new Dictionary<int, RouteGroupBuilder>
 {
     { 
         1, app.MapGroup("v{version:apiVersion}").WithApiVersionSet(versionSet)
-            .RequireAuthorization().AddEndpointFilter<ActiveUserFilter>() 
+            .RequireAuthorization("ApiScope").AddEndpointFilter<ActiveUserFilter>() 
     }
 };
 
@@ -86,14 +134,25 @@ var apiVersions = app.DescribeApiVersions()
     .ToList();
 
 foreach (var description in app.DescribeApiVersions().OrderByDescending(o => o.ApiVersion.MajorVersion))
+{
     app.MapScalarApiReference($"/openapi/{description.GroupName}", (options, context) =>
     {
         options.AddServer(new ScalarServer($"https://{context.Request.Host}"));
         options.WithOpenApiRoutePattern($"/openapi/{description.GroupName}.json");        
         options.WithTheme(ScalarTheme.DeepSpace);
         options.Agent = new ScalarAgentOptions { Disabled = true };
-        options.Authentication = new ScalarAuthenticationOptions { PreferredSecuritySchemes = ["Bearer"] };
+        options.AddPreferredSecuritySchemes("OAuth2")
+               .AddOAuth2Flows("OAuth2", flow =>
+               {
+                   flow.AuthorizationCode = new AuthorizationCodeFlow
+                   {
+                       ClientId = builder.Configuration["SecuritySettings:ClientId"]!,
+                       Pkce = Pkce.Sha256,
+                       SelectedScopes = [.. identityScopes, builder.Configuration["SecuritySettings:Audience"]!]
+                   };
+               });
     });
+}
 
 var latestVersionGroup = apiVersions.FirstOrDefault()?.GroupName ?? "v1";