Program.cs

using System.IdentityModel.Tokens.Jwt;
using System.Text.Json;
using API.Client.Models;
using API.Client.Services;
using Azure.Identity;
using Azure.Security.KeyVault.Keys.Cryptography;

namespace API.Client;

class Program
{
    static async Task<int> Main(string[] args)
    {
        Console.WriteLine("=== OAuth 2.0 Private Key JWT Client ===\n");

        // Parse CLI args. No args => existing client_credentials flow (unchanged).
        // --gateway --api-client <id> [--api-client <id> ...] => gateway mode.
        bool gatewayMode = false;
        var apiClientIds = new List<string>();
        string? standaloneClientId = null;
        var configPath = "config.json";
        for (int i = 0; i < args.Length; i++)
        {
            switch (args[i])
            {
                case "--gateway":
                    gatewayMode = true;
                    break;
                case "--api-client":
                    if (i + 1 >= args.Length)
                    {
                        Console.WriteLine("Error: --api-client requires a value");
                        PrintUsage();
                        return 2;
                    }
                    apiClientIds.Add(args[++i]);
                    break;
                case "--client":
                    if (i + 1 >= args.Length)
                    {
                        Console.WriteLine("Error: --client requires a value");
                        PrintUsage();
                        return 2;
                    }
                    standaloneClientId = args[++i];
                    break;
                case "--config":
                    if (i + 1 >= args.Length)
                    {
                        Console.WriteLine("Error: --config requires a value");
                        PrintUsage();
                        return 2;
                    }
                    configPath = args[++i];
                    break;
                case "--help":
                case "-h":
                    PrintUsage();
                    return 0;
                default:
                    Console.WriteLine($"Error: Unknown argument '{args[i]}'");
                    PrintUsage();
                    return 2;
            }
        }

        if (gatewayMode && apiClientIds.Count == 0)
        {
            Console.WriteLine("Error: --gateway requires at least one --api-client <id>");
            PrintUsage();
            return 2;
        }
        if (!gatewayMode && apiClientIds.Count > 0)
        {
            Console.WriteLine("Error: --api-client requires --gateway");
            PrintUsage();
            return 2;
        }
        if (gatewayMode && standaloneClientId != null)
        {
            Console.WriteLine("Error: --client cannot be combined with --gateway (use --api-client instead)");
            PrintUsage();
            return 2;
        }

        try
        {
            // Load configuration (path overridable via --config; defaults to config.json)
            if (!File.Exists(configPath))
            {
                Console.WriteLine($"Error: Configuration file '{configPath}' not found.");
                Console.WriteLine("Please create a config.json file based on config.json.template");
                return 1;
            }

            Console.WriteLine($"Loading configuration from {configPath}...");
            var configJson = await File.ReadAllTextAsync(configPath);
            var config = JsonSerializer.Deserialize<OAuthConfig>(configJson);

            if (config == null)
            {
                Console.WriteLine("Error: Failed to parse configuration file.");
                return 1;
            }

            // tokenEndpoint is shared between both flows; everything else is mode-specific.
            if (string.IsNullOrWhiteSpace(config.TokenEndpoint))
            {
                Console.WriteLine("Configuration Error: tokenEndpoint is required");
                return 1;
            }

            // effectiveConfig is what JwtService + OAuthClient run against. In gateway mode it
            // is built from the 'gateway' section; in standalone mode it is the top-level config.
            OAuthConfig effectiveConfig;
            List<(string Id, ApiClientConfig Config)> resolvedApiClients = new();

            if (gatewayMode)
            {
                if (config.Gateway == null)
                {
                    Console.WriteLine("Error: --gateway mode requires a 'gateway' section in config.json");
                    return 1;
                }
                Console.WriteLine("Validating gateway configuration...");
                config.Gateway.Validate();

                if (config.Gateway.ApiClients == null || config.Gateway.ApiClients.Count == 0)
                {
                    Console.WriteLine("Error: 'gateway.apiClients' section is required when using --gateway");
                    return 1;
                }
                foreach (var id in apiClientIds)
                {
                    if (!config.Gateway.ApiClients.TryGetValue(id, out var apiClient))
                    {
                        Console.WriteLine($"Error: API client '{id}' not found in config.json 'gateway.apiClients'");
                        Console.WriteLine($"  Available: {string.Join(", ", config.Gateway.ApiClients.Keys)}");
                        return 1;
                    }
                    apiClient.Validate(id);
                    resolvedApiClients.Add((id, apiClient));
                }

                effectiveConfig = config.Gateway.ToOAuthConfig(config.TokenEndpoint);
                Console.WriteLine("Configuration is valid.\n");
            }
            else
            {
                Console.WriteLine("Validating configuration...");
                effectiveConfig = standaloneClientId != null
                    ? config.ForStandaloneClient(standaloneClientId)
                    : config;
                effectiveConfig.Validate();
                Console.WriteLine("Configuration is valid.\n");
            }

            // Display configuration (without sensitive data)
            Console.WriteLine("Configuration:");
            Console.WriteLine($"  Token Endpoint: {effectiveConfig.TokenEndpoint}");
            Console.WriteLine($"  Client ID: {effectiveConfig.ClientId}");
            Console.WriteLine($"  Audience: {effectiveConfig.Audience}");
            Console.WriteLine($"  Issuer: {effectiveConfig.Issuer}");
            Console.WriteLine($"  Scopes: {(string.IsNullOrEmpty(effectiveConfig.Scopes) ? "(none)" : effectiveConfig.Scopes)}");
            if (effectiveConfig.UseKeyVault)
            {
                Console.WriteLine($"  Key Vault URL: {effectiveConfig.KeyVaultUrl}");
                Console.WriteLine($"  Key Vault Key: {effectiveConfig.KeyVaultKeyName}");
                if (!string.IsNullOrEmpty(effectiveConfig.KeyVaultKeyVersion))
                    Console.WriteLine($"  Key Vault Key Version: {effectiveConfig.KeyVaultKeyVersion}");
            }
            else
            {
                Console.WriteLine($"  Private Key Path: {effectiveConfig.PrivateKeyPath}");
            }
            if (!string.IsNullOrEmpty(effectiveConfig.KeyId))
            {
                Console.WriteLine($"  Key ID: {effectiveConfig.KeyId}");
            }
            if (gatewayMode)
            {
                Console.WriteLine($"  Mode: GATEWAY (token-exchange)");
                Console.WriteLine($"  API clients: {string.Join(", ", resolvedApiClients.Select(b => b.Id))}");
            }

            // Create services
            CryptographyClient? cryptoClient = null;
            if (effectiveConfig.UseKeyVault)
            {
                var keyVersion = string.IsNullOrEmpty(effectiveConfig.KeyVaultKeyVersion) ? "" : $"/{effectiveConfig.KeyVaultKeyVersion}";
                var keyId = new Uri($"{effectiveConfig.KeyVaultUrl!.TrimEnd('/')}/keys/{effectiveConfig.KeyVaultKeyName}{keyVersion}");
                cryptoClient = new CryptographyClient(keyId, new DefaultAzureCredential());
                Console.WriteLine("\nKey Vault authentication via DefaultAzureCredential (Azure CLI / Managed Identity / environment).");
            }

            var jwtService = new JwtService(effectiveConfig, cryptoClient);
            using var oauthClient = new OAuthClient(effectiveConfig, jwtService);

            // Step 1: authenticate (gateway or standalone — same client_credentials call)
            var stepLabel = gatewayMode ? "STEP 1: Gateway Authentication" : "Requesting Access Token...";
            Console.WriteLine("\n" + new string('=', 60));
            Console.WriteLine(stepLabel);
            Console.WriteLine(new string('=', 60));

            var tokenResponse = await oauthClient.RequestAccessTokenAsync();

            Console.WriteLine("\n" + new string('=', 60));
            Console.WriteLine(gatewayMode ? "SUCCESS - Gateway Access Token Received" : "SUCCESS - Access Token Received");
            Console.WriteLine(new string('=', 60) + "\n");

            // Use the explicit authority when configured; otherwise derive it from the token endpoint.
            var realmUrl = string.IsNullOrWhiteSpace(effectiveConfig.Authority)
                ? effectiveConfig.TokenEndpoint.Replace("/protocol/openid-connect/token", "")
                : effectiveConfig.Authority!;
            PrintTokenSection(tokenResponse, realmUrl, effectiveConfig.ExpectedAudience, effectiveConfig.ClockSkewMinutes);

            if (!gatewayMode)
            {
                return 0;
            }

            // Step 2: token exchange for each API client
            int failures = 0;
            for (int idx = 0; idx < resolvedApiClients.Count; idx++)
            {
                var (apiClientId, apiClient) = resolvedApiClients[idx];
                Console.WriteLine("\n" + new string('=', 60));
                Console.WriteLine($"STEP 2.{idx + 1}: Token Exchange - {apiClientId}");
                Console.WriteLine(new string('=', 60));

                try
                {
                    var exchanged = await oauthClient.ExchangeTokenAsync(tokenResponse.AccessToken, apiClientId, apiClient);

                    Console.WriteLine("\n" + new string('=', 60));
                    Console.WriteLine($"SUCCESS - API Client Access Token Received ({apiClientId})");
                    Console.WriteLine(new string('=', 60) + "\n");

                    var expectedAud = apiClient.ExpectedAudience ?? apiClient.Audience;
                    PrintTokenSection(exchanged, realmUrl, expectedAud, effectiveConfig.ClockSkewMinutes);
                }
                catch (Exception ex)
                {
                    failures++;
                    Console.WriteLine($"\nFAILED to exchange token for '{apiClientId}': {ex.Message}");
                    if (ex.InnerException != null)
                    {
                        Console.WriteLine($"  Inner Error: {ex.InnerException.Message}");
                    }
                    // Continue with the remaining API clients.
                }
            }

            if (failures > 0)
            {
                Console.WriteLine($"\n{failures} of {resolvedApiClients.Count} API client exchange(s) failed.");
                return 1;
            }

            return 0;
        }
        catch (ArgumentException ex)
        {
            Console.WriteLine($"\nConfiguration Error: {ex.Message}");
            return 1;
        }
        catch (FileNotFoundException ex)
        {
            Console.WriteLine($"\nFile Error: {ex.Message}");
            return 1;
        }
        catch (InvalidOperationException ex)
        {
            Console.WriteLine($"\nOperation Error: {ex.Message}");
            return 1;
        }
        catch (Exception ex)
        {
            Console.WriteLine($"\nError: {ex.Message}");
            if (ex.InnerException != null)
            {
                Console.WriteLine($"Inner Error: {ex.InnerException.Message}");
            }
            return 1;
        }
    }

    static void PrintTokenSection(TokenResponse tokenResponse, string realmUrl, string? expectedAudience, int? clockSkewMinutes = null)
    {
        Console.WriteLine("--- TOKEN VALIDATION ---");
        var validationService = new TokenValidationService(realmUrl, expectedAudience, clockSkewMinutes);
        var validationResult = validationService.ValidateTokenAsync(tokenResponse.AccessToken).GetAwaiter().GetResult();

        if (validationResult.IsValid)
        {
            Console.WriteLine($"  {validationResult.Message}");
            Console.WriteLine("  - Signature: Valid");
            Console.WriteLine($"  - Issuer: Verified (Keycloak)");
            var tokenAudience = validationResult.ValidatedToken?.Audiences.FirstOrDefault();
            Console.WriteLine($"  - Audience: Verified ({tokenAudience})");
            Console.WriteLine("  - Expiration: Valid");
        }
        else
        {
            Console.WriteLine($"  {validationResult.Message}");
            Console.WriteLine("\nWARNING: Token validation failed! This token may be invalid or tampered with.");
        }
        Console.WriteLine();

        Console.WriteLine("Token Type: " + (tokenResponse.TokenType ?? "Bearer"));
        if (tokenResponse.ExpiresIn.HasValue)
        {
            Console.WriteLine($"Expires In: {tokenResponse.ExpiresIn.Value} seconds");
        }
        if (!string.IsNullOrEmpty(tokenResponse.Scope))
        {
            Console.WriteLine($"Scope: {tokenResponse.Scope}");
        }

        Console.WriteLine("\n--- ACCESS TOKEN JWT ---");
        Console.WriteLine(tokenResponse.AccessToken);
        Console.WriteLine("--- END ACCESS TOKEN JWT ---\n");

        try
        {
            var handler = new JwtSecurityTokenHandler();
            var jwtToken = handler.ReadJwtToken(tokenResponse.AccessToken);

            Console.WriteLine("--- DECODED TOKEN CLAIMS ---");
            foreach (var claim in jwtToken.Claims)
            {
                Console.WriteLine($"  {claim.Type}: {claim.Value}");
            }

            Console.WriteLine("\n--- TOKEN HEADER ---");
            Console.WriteLine($"  Algorithm: {jwtToken.Header.Alg}");
            Console.WriteLine($"  Type: {jwtToken.Header.Typ}");
            if (!string.IsNullOrEmpty(jwtToken.Header.Kid))
            {
                Console.WriteLine($"  Key ID: {jwtToken.Header.Kid}");
            }

            Console.WriteLine("\n--- TOKEN VALIDITY ---");
            Console.WriteLine($"  Issued At: {jwtToken.ValidFrom:yyyy-MM-dd HH:mm:ss} UTC");
            Console.WriteLine($"  Expires: {jwtToken.ValidTo:yyyy-MM-dd HH:mm:ss} UTC");
            var remaining = jwtToken.ValidTo - DateTime.UtcNow;
            Console.WriteLine($"  Time Remaining: {remaining.TotalMinutes:F2} minutes");
        }
        catch (Exception ex)
        {
            Console.WriteLine($"Note: Could not decode token (it may not be a JWT): {ex.Message}");
        }
    }

    static void PrintUsage()
    {
        Console.WriteLine();
        Console.WriteLine("Usage:");
        Console.WriteLine("  API.client                                                 Run client_credentials flow (default)");
        Console.WriteLine("  API.client --client <id>                                   Standalone flow, but running as one of");
        Console.WriteLine("                                                             the named identities in config.json's");
        Console.WriteLine("                                                             'standaloneClients' map instead of the");
        Console.WriteLine("                                                             top-level clientId");
        Console.WriteLine("  API.client --gateway --api-client <id> [--api-client <id> ...]");
        Console.WriteLine("                                                             Gateway mode: authenticate using the");
        Console.WriteLine("                                                             'gateway' section of config.json, then");
        Console.WriteLine("                                                             token-exchange (RFC 8693) for each API client");
        Console.WriteLine("  API.client --config <path>                                 Use an alternate configuration file (default: config.json)");
        Console.WriteLine("  API.client --help                                          Show this help");
        Console.WriteLine();
        Console.WriteLine("Standalone mode uses the top-level config.json fields (optionally overridden per-client via 'standaloneClients').");
        Console.WriteLine("Gateway mode uses the 'gateway' section (its own clientId/key/audience + 'apiClients' map).");
    }
}