Merge pull request 'Refactored forced https redirection' (#15) from notifications into master

Reviewed-on: #15

ShopAdmin/Components/Layout/MainLayout.razor

@@ -1,5 +1,6 @@
 @inherits LayoutComponentBase
 @using Blazored.Toast
+@using Microsoft.AspNetCore.Components.Authorization
 
 <header class="top-bar">
     <a href="/" class="brand">
@@ -9,21 +10,38 @@
             <circle cx="75" cy="80" r="5" fill="#4dabff" opacity="0.6" />
             <circle cx="75" cy="20" r="5" fill="#4dabff" opacity="0.6" />
         </svg>
-            
+
         <div class="text-column">
             <span class="brand-main">Lite<span class="brand-accent">Charms</span></span>
             <span class="payoff-line">Shop Administration &amp; Monitoring</span>
         </div>
     </a>
+
+    <TopBarAuthstateView />
 </header>
 
-<NavShelf IsOpen="isShelfExpanded" IsOpenChanged="OnShelfStateChanged" @rendermode="InteractiveServer" />
+<CascadingAuthenticationState>
+    <AuthorizeView>
+        <Authorized>
+            <NavShelf IsOpen="isShelfExpanded" IsOpenChanged="OnShelfStateChanged" @rendermode="InteractiveServer" />
+        </Authorized>
+    </AuthorizeView>
+</CascadingAuthenticationState>
 
-<div class="page-wrapper @(isShelfExpanded ? "shifted-canvas" : "")">
-    <main>
-        @Body
-    </main>
-</div>
+<CascadingAuthenticationState>
+    <div class="page-wrapper @(isShelfExpanded ? "shifted-canvas" : "")">
+        <AuthorizeView>
+            <Authorized>
+                <main class="content-body">
+                    @Body
+                </main>
+            </Authorized>
+            <NotAuthorized>
+                <Login />
+            </NotAuthorized>
+        </AuthorizeView>
+    </div>
+</CascadingAuthenticationState>
 
 <BlazoredToasts />
 

ShopAdmin/Components/Pages/Login.razor

@@ -0,0 +1,84 @@
+@page "/login"
+@using Microsoft.AspNetCore.Components.Authorization
+@inject NavigationManager Navigation
+@rendermode InteractiveServer
+
+<div class="auth-workspace-canvas">
+    <div class="tech-background-matrix">
+        <svg class="bg-vector-mesh" viewBox="0 0 800 500" xmlns="http://www.w3.org/2000/svg">
+            <defs>
+                <pattern id="cyber-grid" width="40" height="40" patternUnits="userSpaceOnUse">
+                    <path d="M 40 0 L 0 0 0 40" fill="none" stroke="#102a35" stroke-width="0.75" />
+                    <circle cx="40" cy="40" r="1" fill="#173b4a" />
+                </pattern>
+
+                <filter id="core-blue-glow" x="-20%" y="-20%" width="140%" height="140%">
+                    <feGaussianBlur stdDeviation="6" result="blur" />
+                    <feComposite in="SourceGraphic" in2="blur" operator="over" />
+                </filter>
+            </defs>
+
+            <rect width="100%" height="100%" fill="url(#cyber-grid)" opacity="0.6" />
+
+            <g class="tech-circuit-left" stroke="#0091ff" stroke-width="1.25" fill="none" opacity="0.35">
+                <path d="M -50,250 L 120,250 L 180,190 L 250,190" />
+                <path d="M 40,100 L 100,160 L 100,340 L 160,400" />
+                <polyline points="220,160 240,190 220,220" />
+                <circle cx="250" cy="190" r="3" fill="#0091ff" />
+                <polygon points="30,200 60,170 90,170 60,200" stroke="#00bfff" stroke-width="1" opacity="0.5" />
+                <polygon points="110,300 130,280 160,280 140,300" stroke="#00bfff" stroke-width="1" opacity="0.3" />
+            </g>
+
+            <g class="tech-circuit-right" stroke="#00bfff" stroke-width="1.25" fill="none" opacity="0.35">
+                <path d="M 850,250 L 680,250 L 620,310 L 550,310" />
+                <path d="M 760,400 L 700,340 L 700,160 L 640,100" />
+                <polyline points="580,340 560,310 580,280" />
+                <circle cx="550" cy="310" r="3" fill="#00bfff" />
+                <polygon points="770,300 740,330 710,330 740,300" stroke="#0091ff" stroke-width="1" opacity="0.5" />
+                <polygon points="690,200 670,220 640,220 660,200" stroke="#0091ff" stroke-width="1" opacity="0.3" />
+            </g>
+
+            <g class="center-target" stroke="#0091ff" fill="none" opacity="0.15">
+                <circle cx="400" cy="250" r="90" stroke-dasharray="8 6" />
+                <circle cx="400" cy="250" r="130" />
+                <line x1="400" y1="80" x2="400" y2="420" stroke-dasharray="4 4" />
+                <line x1="220" y1="250" x2="580" y2="250" stroke-dasharray="4 4" />
+            </g>
+        </svg>
+    </div>
+
+    <div class="login-action-container">
+        <header class="login-header">
+            <span class="security-status-tag">SYSTEM_LOCKOUT_ACTIVE</span>
+            <h1 class="login-title">Console Authentication Required</h1>
+            <p class="login-subtitle">Initialize terminal authorization pipeline to access core application monitors.</p>
+        </header>
+
+        <button class="login-cta-button" @onclick="HandleLogin">
+            <span class="btn-glow-layer"></span>
+            <span class="btn-text-content">INITIALIZE SECURE ACCESS</span>
+            <svg class="btn-arrow-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5">
+                <line x1="5" y1="12" x2="19" y2="12"></line>
+                <polyline points="12 5 19 12 12 19"></polyline>
+            </svg>
+        </button>
+    </div>
+</div>
+
+@code {
+    [CascadingParameter]
+    private Task<AuthenticationState>? AuthState { get; set; }
+
+    protected override async Task OnInitializedAsync()
+    {
+        if (AuthState is not null)
+        {
+            var state = await AuthState;
+
+            if (state.User.Identity?.IsAuthenticated ?? false) 
+                Navigation.NavigateTo("/", replace: true);
+        }
+    }
+
+    private void HandleLogin() => Navigation.NavigateTo("/auth/login", forceLoad: true);
+}

ShopAdmin/Components/Pages/Login.razor.css

@@ -0,0 +1,143 @@
+/* Login.razor.css */
+
+.auth-workspace-canvas {
+    position: relative;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 100%;
+    height: 100%;
+    min-height: calc(100vh - var(--header-height, 92px));
+    background-color: #010405; /* Matches your core console background depth */
+    overflow: hidden;
+    box-sizing: border-box;
+    padding: 24px;
+}
+
+/* BOUNDLESS TECH BACKGROUND ANIMATION & MAPPING */
+.tech-background-matrix {
+    position: absolute;
+    top: 50%;
+    left: 50%;
+    width: 140%;
+    height: 140%;
+    transform: translate(-50%, -50%);
+    pointer-events: none;
+    z-index: 1;
+}
+
+.bg-vector-mesh {
+    width: 100%;
+    height: 100%;
+    object-fit: cover;
+}
+
+/* Subtle technological pulse across background circuit networks */
+.tech-circuit-left, .tech-circuit-right {
+    animation: background-circuit-glow 6s ease-in-out infinite alternate;
+}
+
+.tech-circuit-right {
+    animation-delay: 3s;
+}
+
+/* THE CONTAINER PAYLOAD */
+.login-action-container {
+    position: relative;
+    z-index: 2;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    text-align: center;
+    max-width: 520px;
+    padding: 40px;
+    box-sizing: border-box;
+}
+
+.login-header {
+    margin-bottom: 36px;
+}
+
+.security-status-tag {
+    font-family: monospace;
+    font-size: 11px;
+    font-weight: 700;
+    color: #ffd166; /* Matches your top bar warning lock indicator token */
+    background: rgba(255, 209, 102, 0.07);
+    border: 1px solid rgba(255, 209, 102, 0.25);
+    padding: 4px 10px;
+    border-radius: 2px;
+    letter-spacing: 1px;
+    text-transform: uppercase;
+}
+
+.login-title {
+    font-size: 26px;
+    font-weight: 700;
+    color: #ffffff;
+    margin: 20px 0 10px 0;
+    letter-spacing: -0.5px;
+}
+
+.login-subtitle {
+    font-size: 14px;
+    font-weight: 400;
+    color: #8fa3ad;
+    line-height: 1.5;
+}
+
+/* THE INVITING LARGE CALL TO ACTION BUTTON */
+.login-cta-button {
+    position: relative;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    gap: 12px;
+    width: 100%;
+    max-width: 320px;
+    height: 54px;
+    background: #0087f5; /* Core premium brand interaction blue */
+    color: #ffffff;
+    border: none;
+    border-radius: 4px;
+    font-size: 14px;
+    font-weight: 700;
+    letter-spacing: 0.5px;
+    cursor: pointer;
+    overflow: hidden;
+    box-shadow: 0 4px 20px rgba(0, 135, 245, 0.3);
+    transition: all 0.25s cubic-bezier(0.2, 0.8, 0.2, 1);
+}
+
+    .login-cta-button:hover {
+        background: #0091ff;
+        transform: translateY(-2px);
+        box-shadow: 0 0 24px rgba(0, 145, 255, 0.6);
+    }
+
+    .login-cta-button:active {
+        transform: translateY(0);
+    }
+
+.btn-arrow-icon {
+    width: 16px;
+    height: 16px;
+    transition: transform 0.25s ease;
+}
+
+.login-cta-button:hover .btn-arrow-icon {
+    transform: translateX(4px);
+}
+
+/* KEYFRAMES */
+@keyframes background-circuit-glow {
+    0% {
+        opacity: 0.25;
+        filter: drop-shadow(0 0 1px rgba(0, 145, 255, 0));
+    }
+
+    100% {
+        opacity: 0.55;
+        filter: drop-shadow(0 0 6px rgba(0, 191, 255, 0.4));
+    }
+}

ShopAdmin/Components/Pages/NavShelf.razor

@@ -60,22 +60,24 @@
             <span>Notifications</span>
         </NavLink>
 
-        <div class="shelf-divider"></div>
+        <div class="shelf-divider"></div>        
 
-        <NavLink class="shelf-link" href="settings" @onclick="CloseShelf">
-            <svg class="link-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="3"></circle><path d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 1 1-2.83 2.83l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-4 0v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 1 1-2.83-2.83l.06-.06a1.65 1.65 0 0 0 .33-1.82 1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1 0-4h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 1 1 2.83-2.83l.06.06a1.65 1.65 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 4 0v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 1 1 2.83 2.83l-.06.06a1.65 1.65 0 0 0-.33 1.82V9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 0 4h-.09a1.65 1.65 0 0 0-1.51 1z"></path></svg>
-            <span>Settings</span>
-        </NavLink>
-
-        <NavLink class="shelf-link" href="policies" @onclick="CloseShelf">
-            <svg class="link-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"></path></svg>
-            <span>Policies</span>
-        </NavLink>
-
-        <NavLink class="shelf-link" href="profile" @onclick="CloseShelf">
-            <svg class="link-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"></path><circle cx="12" cy="7" r="4"></circle></svg>
+        <NavLink class="shelf-link" href="@ProfileUrl" target="_blank" @onclick="CloseShelf">
+            <svg class="link-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                <path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"></path>
+                <circle cx="12" cy="7" r="4"></circle>
+            </svg>
             <span>Profile</span>
         </NavLink>
+
+        <NavLink class="shelf-link" href="auth/logout" ForceLoad="true" @onclick="CloseShelf">
+            <svg class="link-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                <path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4"></path>
+                <polyline points="16 17 21 12 16 7"></polyline>
+                <line x1="21" y1="12" x2="9" y2="12"></line>
+            </svg>
+            <span>Logout</span>
+        </NavLink>
     </nav>
 </aside>
 
@@ -83,6 +85,24 @@
     [Parameter] public bool IsOpen { get; set; } = false;
     [Parameter] public EventCallback<bool> IsOpenChanged { get; set; }
 
+    [Inject] private IConfiguration? Configuration { get; set; }
+
+    private string? ProfileUrl { get; set; }
+
+    protected override void OnInitialized()
+    {
+        if (Configuration is null) return;
+
+        var authority = Configuration["IdKongisa:Authority"];
+
+        if (!string.IsNullOrWhiteSpace(authority))
+        {
+            var uri = new Uri(authority);
+            
+            ProfileUrl = $"{uri.Scheme}://{uri.Host}/if/user/#/settings";
+        }
+    }
+
     private async Task ToggleShelf()
     {
         IsOpen = !IsOpen;

ShopAdmin/Components/Pages/NavShelf.razor.css

@@ -1,8 +1,8 @@
 /* --- 1. The Flyout Side Panel --- */
 .nav-shelf-panel {
     position: fixed;
-    top: var(--header-height); /* Drops clean below your top-bar */
-    right: -300px; /* Hidden by default */
+    top: var(--header-height);
+    right: -300px;
     width: 300px;
     height: calc(100vh - var(--header-height));
     background-color: var(--shelf-bg);
@@ -10,7 +10,8 @@
     z-index: 2000;
     display: flex;
     flex-direction: column;
-    padding: 2rem 1.5rem;
+    /* MODIFIED: Reduce padding-bottom so items don't clip raw against the bottom line window frame */
+    padding: 2rem 1.5rem 1rem 1.5rem;
     box-sizing: border-box;
     transition: right 0.35s cubic-bezier(0.16, 1, 0.3, 1);
     box-shadow: -15px 0 40px rgba(0, 0, 0, 0.6);
@@ -68,6 +69,7 @@
     margin-bottom: 2rem;
     padding-bottom: 1rem;
     border-bottom: 1px solid rgba(144, 224, 239, 0.1);
+    flex-shrink: 0; /* CRITICAL: Prevents the header text from squishing up on small screens */
 }
 
     .shelf-header h3 {
@@ -92,6 +94,14 @@
     display: flex;
     flex-direction: column;
     gap: 8px;
+    /* NEW RULES: Absorb all available viewport height and isolate scrolling bounds */
+    flex: 1;
+    overflow-y: auto;
+    overflow-x: hidden;
+    /* Optional: Adds smooth mobile elastic touch responses on iOS devices */
+    -webkit-overflow-scrolling: touch;
+    /* Clean up spacing so bottom-most links have breathing room when fully scrolled down */
+    padding-bottom: 2rem;
 }
 
 /* Deep selection matching Blazor's active class matching system */

ShopAdmin/Components/TopBarAuthstateView.razor

@@ -0,0 +1,67 @@
+@using Microsoft.AspNetCore.Components.Authorization
+<div class="auth-state-container">
+    <AuthorizeView>
+        <Authorized>
+            <div class="auth-indicator authenticated">
+                <div class="user-meta-stack">
+                    <span class="meta-row-primary">@Name</span>
+                    <span class="meta-row-secondary">@Email</span>
+                    <span class="meta-row-secondary">@LoginTime</span>
+                </div>
+            </div>
+        </Authorized>
+        <NotAuthorized>
+            <div class="auth-indicator unauthenticated">
+                <svg class="security-lock-vector" viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg">
+                    <defs>
+                        <filter id="amber-cyber-glow" x="-30%" y="-30%" width="160%" height="160%">
+                            <feGaussianBlur stdDeviation="3.5" result="blur" />
+                            <feComposite in="SourceGraphic" in2="blur" operator="over" />
+                        </filter>
+                    </defs>
+
+                    <g class="lock-chassis" filter="url(#amber-cyber-glow)">
+                        <path d="M 32,45 V 24 L 38,18 H 62 L 68,24 V 45" stroke="#ffd166" stroke-width="3.5" fill="none" stroke-linecap="square" stroke-linejoin="miter" />
+
+                        <rect x="20" y="45" width="60" height="32" fill="#03090b" stroke="#ffd166" stroke-width="3.5" stroke-linejoin="miter" />
+
+                        <polygon points="47,54 53,54 55,60 45,60" fill="#ffd166" />
+                        <rect x="48.5" y="60" width="3" height="10" fill="#ffd166" />
+                    </g>
+                </svg>
+            </div>
+        </NotAuthorized>
+    </AuthorizeView>
+</div>
+
+@code {
+    [CascadingParameter]
+    private Task<AuthenticationState>? AuthStateTask { get; set; }
+
+    private System.Security.Claims.ClaimsPrincipal? UserPrincipal;
+
+    private string? Name { get; set; }
+    private string? Email { get; set; }
+    private DateTime? LoginTime { get; set; }
+
+    protected override async Task OnInitializedAsync()
+    {
+        if (AuthStateTask != null)
+        {
+            var authState = await AuthStateTask;
+
+            UserPrincipal = authState.User;
+
+            Name = UserPrincipal?.Identity?.Name;
+            Email = UserPrincipal?.FindFirst(System.Security.Claims.ClaimTypes.Email)?.Value;
+
+            var authTimeClaim = UserPrincipal?.FindFirst("auth_time")?.Value;
+
+            if (!string.IsNullOrEmpty(authTimeClaim) && long.TryParse(authTimeClaim, out long unixSeconds))
+            {
+                var dateTimeOffset = DateTimeOffset.FromUnixTimeSeconds(unixSeconds);
+                LoginTime = dateTimeOffset.LocalDateTime;
+            }
+        }
+    }
+}

ShopAdmin/Components/TopBarAuthstateView.razor.css

@@ -0,0 +1,87 @@
+/* TopBarAuthstateView.razor.css */
+
+.auth-state-container {
+    display: flex;
+    align-items: center;
+    justify-content: flex-end;
+    /* REMOVED min-width: 160px; -> Let the box collapse to exactly the icon's width */
+    width: auto;
+    height: 100%;
+    /* Sliced down to a tight, crisp margin from the right browser edge */
+    padding-right: 6px;
+    box-sizing: border-box;
+    /* Keeps it anchored to the far right side of your header layout layout */
+    margin-left: auto;
+}
+
+.auth-indicator {
+    display: flex;
+    flex-direction: column;
+    align-items: flex-end;
+    justify-content: center;
+    height: 100%;
+    width: auto; /* Collapses container layout tight */
+}
+
+/* Pristine yellow security lock vector */
+.security-lock-vector {
+    width: auto;
+    height: 48px; /* Preserved your ideal visual size */
+    overflow: visible;
+}
+
+/* Subtle hardware-accelerated technological power-hum pulse */
+.unauthenticated .lock-chassis {
+    animation: clean-cyber-pulse 4s ease-in-out infinite;
+}
+
+/* PRE-STRUCTURED TEXT STACKS: Active right-aligned layout framework */
+.user-meta-stack {
+    display: flex;
+    flex-direction: column;
+    justify-content: center;
+    text-align: right;
+    font-family: inherit;
+    gap: 4px;
+}
+
+.meta-row-primary {
+    font-size: 14px;
+    font-weight: 700;
+    color: #ffffff;
+    letter-spacing: 0.5px;
+}
+
+.meta-row-secondary {
+    font-size: 11px;
+    font-weight: 400;
+    color: #4dabff;
+    opacity: 0.8;
+}
+
+/* Mixed weighting classes pre-staged for detailed user metadata strings */
+.meta-row-large-bold {
+    font-size: 15px;
+    font-weight: 700;
+    color: #ffffff;
+    line-height: 1.2;
+    letter-spacing: 0.25px;
+}
+
+.meta-row-small-regular {
+    font-size: 11px;
+    font-weight: 400;
+    color: #4dabff;
+    opacity: 0.85;
+    line-height: 1;
+}
+
+@keyframes clean-cyber-pulse {
+    0%, 100% {
+        filter: drop-shadow(0px 0px 4px rgba(255, 209, 102, 0.35));
+    }
+
+    50% {
+        filter: drop-shadow(0px 0px 14px rgba(255, 209, 102, 0.65));
+    }
+}

ShopAdmin/Program.cs

@@ -8,6 +8,8 @@ var builder = WebApplication.CreateBuilder(args);
 builder.Services.AddRazorComponents()
     .AddInteractiveServerComponents();
 
+builder.Services.AddCascadingAuthenticationState();
+
 builder.AddMonitoring();
 
 builder.Services.AddControllers();
@@ -33,6 +35,56 @@ builder.Services.AddPostgresHealtchCheck();
 builder.Services.AddQuartzHealtchCheck();
 builder.Services.AddHealthChecksSupport(builder.Configuration);
 
+builder.Services.AddAuthentication(options =>
+{
+    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
+    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
+})
+.AddCookie()
+.AddOpenIdConnect(options =>
+{
+    options.Authority = builder.Configuration.GetSection("IdKongisa:Authority").Value;
+    options.ClientId = builder.Configuration.GetSection("IdKongisa:ClientId").Value;
+    options.ClientSecret = builder.Configuration.GetSection("IdKongisa:ClientSecret").Value;
+
+    options.ResponseType = "code";
+    options.SaveTokens = true;
+
+    options.GetClaimsFromUserInfoEndpoint = true;
+
+    options.MetadataAddress = $"{options.Authority}/.well-known/openid-configuration";
+
+    options.Scope.Clear();
+    options.Scope.Add("openid");
+    options.Scope.Add("profile");
+    options.Scope.Add("email");
+
+    options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
+    {
+        NameClaimType = "name",
+        RoleClaimType = "groups"
+    };
+
+    options.Events = new OpenIdConnectEvents
+    {
+        OnRedirectToIdentityProvider = context =>
+        {
+            var fallbackUri = context.ProtocolMessage.RedirectUri;
+
+            if (fallbackUri.StartsWith("http://", StringComparison.OrdinalIgnoreCase))
+                context.ProtocolMessage.RedirectUri = fallbackUri.Replace("http://", "https://", StringComparison.OrdinalIgnoreCase);
+
+            return Task.CompletedTask;
+        }
+    };
+});
+
+builder.Services.Configure<ForwardedHeadersOptions>(options =>
+{
+    options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
+    options.KnownProxies.Clear();
+});
+
 var app = builder.Build();
 
 var schedulerFactory = app.Services.GetRequiredService<ISchedulerFactory>();
@@ -41,6 +93,8 @@ var scheduler = await schedulerFactory.GetScheduler(ShopSchedulerName);
 if (!scheduler!.IsStarted)
     await scheduler.Start();
 
+app.UseForwardedHeaders();
+
 if (!app.Environment.IsDevelopment())
 {
     app.UseExceptionHandler("/Error", createScopeForErrors: true);
@@ -53,11 +107,30 @@ app.UseHealthChecks("/health", new HealthCheckOptions
 });
 
 app.UseStatusCodePagesWithReExecute("/not-found", createScopeForStatusCodePages: true);
-app.UseHttpsRedirection();
 
+app.UseHttpsRedirection();
 app.UseAntiforgery();
 
+app.UseAuthentication();
+app.UseAuthorization();
+
 app.MapStaticAssets();
+
+app.MapGet("/auth/login", (string redirectUri = "/") =>
+    Results.Challenge(new AuthenticationProperties { RedirectUri = redirectUri }, [OpenIdConnectDefaults.AuthenticationScheme]));
+
+app.MapGet("/auth/logout", async (HttpContext context) =>
+{
+    await context.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
+
+    string currentBaseUrl = $"https://{context.Request.Host}{context.Request.PathBase}/";
+
+    await context.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme, new AuthenticationProperties
+    {
+        RedirectUri = currentBaseUrl
+    });
+});
+
 app.MapRazorComponents<App>()
     .AddInteractiveServerRenderMode();
 

ShopAdmin/ShopAdmin.csproj

@@ -20,6 +20,15 @@
     <PackageReference Include="Polly" Version="8.6.6" />
   </ItemGroup>
 
+  <!-- Authentication-->
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="10.0.8" />
+    
+    <!-- Global Usings -->
+    <Using Include="Microsoft.AspNetCore.Authentication.Cookies"/>
+    <Using Include="Microsoft.AspNetCore.Authentication.OpenIdConnect"/>
+  </ItemGroup>
+
   <!-- UI -->
   <ItemGroup>
     <PackageReference Include="ANM.Blazored.Toast" Version="0.1.1" />
@@ -48,6 +57,8 @@
 
   <!-- Shared Global Usings -->
   <ItemGroup>
+    <Using Include="Microsoft.AspNetCore.HttpOverrides" />
+    <Using Include="Microsoft.AspNetCore.Authentication" />
     <Using Include="Blazored.Toast" />
     <Using Include="Quartz" />
     <Using Include="Mediator" />

ShopAdmin/appsettings.json

@@ -1,4 +1,7 @@
 {
+  "IdKongisa": {
+    "Authority": "https://id.khongisa.co.za/application/o/litecharms-shopadmin"
+  },
   "Email": {
     "Credentials": {
       "Username": "shop@litecharms.co.za"

ShopAdmin/wwwroot/app.css

@@ -42,7 +42,7 @@ html, body {
     display: flex;
     align-items: center;
     justify-content: space-between;
-    padding: 0 4rem 0 1rem;
+    padding: 0 1.5rem; /* Balanced horizontal spacing for both sides */
     z-index: 1000;
     border-bottom: 1px solid rgba(144, 224, 239, 0.15);
 }
@@ -119,7 +119,7 @@ main {
 /* --- Responsive Logic --- */
 @media (max-width: 1200px) {
     .top-bar {
-        padding: 0 2rem;
+        padding: 0 1rem;
     }
 }
 

litecharms-shopadmin-uat.yml

@@ -14,6 +14,7 @@ data:
   ASPNETCORE_URLS: "http://0.0.0.0:8080"
   Monitoring__Address: "http://aspire-dashboard-service.aspire.svc.cluster.local:18889"
   Monitoring__ServiceName: "LiteCharms.ShopAdmin.Uat"
+  IdKongisa__Authority: "https://id.khongisa.co.za/application/o/litecharms-shopadmin"
 ---
 apiVersion: v1
 kind: Secret
@@ -25,6 +26,8 @@ data:
   connection-string: SG9zdD0xOTIuMTY4LjEuMTcwO0RhdGFiYXNlPXNob3AtZGV2O1VzZXJuYW1lPXNob3AtZGV2LXVzZXI7UGFzc3dvcmQ9a1ZWbW9XS0ozeHpnUVg7UGVyc2lzdCBTZWN1cml0eSBJbmZvPVRydWU=
   connection-string-quartz: SG9zdD0xOTIuMTY4LjEuMTcwO0RhdGFiYXNlPXNjaGVkdWxlci1kZXY7VXNlcm5hbWU9c2NoZWR1bGVyLWRldi11c2VyO1Bhc3N3b3JkPWtWVm1vV0tKM3h6Z1FYO1BlcnNpc3QgU2VjdXJpdHkgSW5mbz1UcnVl
   aspire-apikey: bWMzRzYzSzJqNVpPRXNpMEFqTW9qTFRYbTFLRVpGY3R6SUlqU3dEaVRHdXQ4cUdTa1B1V3d4R1AxUmJzY0pVbw==
+  auth-clientid: NUxldE5hSERsUlhOWXo1N3FkMVV1RWN4R01uUDNmT3FXc0RHcWdjUg==
+  auth-clientsecret: a3ZxN3k1anc0M0g4WDRjQW91eGRqRDhNNXdxVUhUQ2I4UjNSVjNVWjI4TUZjTk51NWxhM3g3V1ZZRzQ2QnJFMjVPMnhXRmhoeEk0VXNSaFlMTHRqSGRhWWVrUTBmdHpIQ3ZNczV5TXdRdERpcDBkM3QzTkNDa0RtN1JXeW1XSTg=
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -102,6 +105,16 @@ spec:
                 secretKeyRef:
                   name: shopadmin-secrets
                   key: aspire-apikey
+            - name: IdKongisa__ClientId
+              valueFrom:
+                secretKeyRef:
+                  name: shopadmin-secrets
+                  key: auth-clientid
+            - name: IdKongisa__ClientSecret
+              valueFrom:
+                secretKeyRef:
+                  name: shopadmin-secrets
+                  key: auth-clientsecret
           volumeMounts:
             - name: data
               mountPath: /app/wwwroot/content