feature: RBAC + Clinical Audit Logging

VigilCareClinicalAPI/Program.cs

@@ -8,6 +8,10 @@ using FluentValidation;
 using FluentValidation.AspNetCore;
 using Microsoft.AspNetCore.Mvc;
 using System.Reflection;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.IdentityModel.Tokens;
+using Microsoft.AspNetCore.Authorization;
+using System.Text;
 
 Log.Logger = new LoggerConfiguration()
     .WriteTo.Console()
@@ -17,6 +21,35 @@ try
 {    
     var builder = WebApplication.CreateBuilder(args);
 
+    builder.Services.Configure<JwtOptions>(builder.Configuration.GetSection(JwtOptions.Section));
+
+    var jwtOptions = builder.Configuration.GetSection(JwtOptions.Section).Get<JwtOptions>()!;
+
+    builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+        .AddJwtBearer(options =>
+        {
+            options.TokenValidationParameters = new TokenValidationParameters
+            {
+                ValidateIssuer = true,
+                ValidateAudience = true,
+                ValidateLifetime = true,
+                ValidateIssuerSigningKey = true,
+                ValidIssuer = jwtOptions.Issuer,
+                ValidAudience = jwtOptions.Audience,
+                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtOptions.SigningKey))
+            };
+        });
+
+    builder.Services.AddSingleton<IAuthorizationPolicyProvider, PermissionPolicyProvider>();
+    builder.Services.AddSingleton<IAuthorizationHandler, PermissionAuthorizationHandler>();
+    builder.Services.AddAuthorization(options =>
+    {
+        options.FallbackPolicy = new AuthorizationPolicyBuilder()
+            .RequireAuthenticatedUser()
+            .Build();
+    });
+
+
     builder.Services.AddFluentValidationAutoValidation();
     builder.Services.AddValidatorsFromAssemblyContaining<Program>();
 
@@ -133,6 +166,10 @@ try
     builder.Services.AddScoped<MedicationAdministrationFhirMapper>();
     builder.Services.AddScoped<FhirBundleProcessor>();
     builder.Services.AddScoped<FhirExceptionFilter>();
+    builder.Services.AddHttpContextAccessor();
+    builder.Services.AddScoped<ICurrentUserService, CurrentUserService>();
+    builder.Services.AddScoped<IAuthService, AuthService>();
+    builder.Services.AddScoped<IAuditService, AuditService>();
     
     builder.Services.AddHostedService<ThresholdCacheLoader>();
     builder.Services.AddHostedService<KafkaTopicProvisioner>();
@@ -208,6 +245,7 @@ try
         var db = scope.ServiceProvider.GetRequiredService<AppDbContext>();
         var redis = scope.ServiceProvider.GetRequiredService<IConnectionMultiplexer>();
         await DataSeeder.SeedAsync(db, redis);
+        await UserSeeder.SeedAsync(db);
     }
 
     if (!app.Environment.IsEnvironment("Testing"))
@@ -220,11 +258,14 @@ try
     }
 
     app.UseMiddleware<CorrelationIdMiddleware>();
-    app.UseMiddleware<FhirApiKeyMiddleware>();
+    app.UseMiddleware<FhirApiKeyOrJwtMiddleware>();
     app.UseMiddleware<ExceptionHandlerMiddleware>();
 
     app.UseCors("Dashboard");
 
+    app.UseAuthentication();
+    app.UseAuthorization();
+
     // Configure the HTTP request pipeline.
     if (app.Environment.IsDevelopment())
     {