<Project Sdk="Microsoft.NET.Sdk.Web">

  <PropertyGroup>
    <TargetFramework>net6.0</TargetFramework>
  </PropertyGroup>

  <ItemGroup>
    <None Remove="usersdatabase.sqlite" />
  </ItemGroup>

  <ItemGroup>
    <Content Include="usersdatabase.sqlite">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </Content>
  </ItemGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="6.0.1" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="6.0.1">
      <PrivateAssets>all</PrivateAssets>
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    </PackageReference>
    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="6.0.1" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.Tools" Version="6.0.1">
      <PrivateAssets>all</PrivateAssets>
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    </PackageReference>
    <PackageReference Include="OpenIddict" Version="3.1.1" />
    <PackageReference Include="OpenIddict.AspNetCore" Version="3.1.1" />
    <PackageReference Include="OpenIddict.EntityFrameworkCore" Version="3.1.1" />
    <PackageReference Include="OpenIddict.Quartz" Version="3.1.1" />
    <PackageReference Include="OpenIddict.Server.AspNetCore" Version="3.1.1" />
    <PackageReference Include="Quartz.Extensions.Hosting" Version="3.3.3" />
	  <PackageReference Include="BuildBundlerMinifier" Version="3.2.449" />

    <PackageReference Include="Serilog.Settings.Configuration" Version="3.1.0" />
    <PackageReference Include="Serilog" Version="2.10.0" />
    <PackageReference Include="Serilog.AspNetCore" Version="4.1.0" />
    <PackageReference Include="Serilog.Settings.Configuration" Version="3.3.0" />
    <PackageReference Include="Serilog.Sinks.Console" Version="4.0.1" />
    <PackageReference Include="Serilog.Sinks.File" Version="5.0.0" />
  </ItemGroup>

   <Target Name="DebugEnsureNodeEnv" BeforeTargets="Build" Condition=" '$(Configuration)' == 'Debug' And !Exists('node_modules') ">
    <!-- Ensure Node.js is installed -->
    <Exec Command="node --version" ContinueOnError="true">
      <Output TaskParameter="ExitCode" PropertyName="ErrorCode" />
    </Exec>
    <Error Condition="'$(ErrorCode)' != '0'" Text="Node.js is required to build and run this project. To continue, please install Node.js from https://nodejs.org/, and then restart your command prompt or IDE." />
    <Message Importance="high" Text="Restoring dependencies using 'npm'. This may take several minutes..." />
    <Exec WorkingDirectory="" Command="npm install" />
  </Target>
   
</Project>

public void ConfigureServices(IServiceCollection services)
{
	services.AddControllersWithViews();

	services.AddDbContext<ApplicationDbContext>(options =>
	{
		// Configure the context to use Microsoft SQL Server.
		options.UseSqlite(Configuration.GetConnectionString("DefaultConnection"));

		// Register the entity sets needed by OpenIddict.
		// Note: use the generic overload if you need
		// to replace the default OpenIddict entities.
		options.UseOpenIddict();
	});

	// Register the Identity services.
	services.AddIdentity<ApplicationUser, IdentityRole>()
		.AddEntityFrameworkStores<ApplicationDbContext>()
		.AddDefaultTokenProviders();

	services.AddCors(options =>
	{
		options.AddPolicy("AllowAllOrigins",
			builder =>
			{
				builder
					.AllowCredentials()
					.WithOrigins(
						"https://localhost:4200")
					.SetIsOriginAllowedToAllowWildcardSubdomains()
					.AllowAnyHeader()
					.AllowAnyMethod();
			});
	});
	// Configure Identity to use the same JWT claims as OpenIddict instead
	// of the legacy WS-Federation claims it uses by default (ClaimTypes),
	// which saves you from doing the mapping in your authorization controller.
	services.Configure<IdentityOptions>(options =>
	{
		options.ClaimsIdentity.UserNameClaimType = Claims.Name;
		options.ClaimsIdentity.UserIdClaimType = Claims.Subject;
		options.ClaimsIdentity.RoleClaimType = Claims.Role;
	});

	// OpenIddict offers native integration with Quartz.NET to perform scheduled tasks
	// (like pruning orphaned authorizations/tokens from the database) at regular intervals.
	services.AddQuartz(options =>
	{
		options.UseMicrosoftDependencyInjectionJobFactory();
		options.UseSimpleTypeLoader();
		options.UseInMemoryStore();
	});

	// Register the Quartz.NET service and configure it to block shutdown until jobs are complete.
	services.AddQuartzHostedService(options => options.WaitForJobsToComplete = true);

	services.AddOpenIddict()

		// Register the OpenIddict core components.
		.AddCore(options =>
		{
			// Configure OpenIddict to use the Entity Framework Core stores and models.
			// Note: call ReplaceDefaultEntities() to replace the default OpenIddict entities.
			options.UseEntityFrameworkCore()
				   .UseDbContext<ApplicationDbContext>();

			// Developers who prefer using MongoDB can remove the previous lines
			// and configure OpenIddict to use the specified MongoDB database:
			// options.UseMongoDb()
			//        .UseDatabase(new MongoClient().GetDatabase("openiddict"));

			// Enable Quartz.NET integration.
			options.UseQuartz();
		})

		// Register the OpenIddict server components.
		.AddServer(options =>
		{
			// Enable the authorization, device, logout, token, userinfo and verification endpoints.
			options.SetAuthorizationEndpointUris("/connect/authorize")
				   .SetDeviceEndpointUris("/connect/device")
				   .SetLogoutEndpointUris("/connect/logout")
				   .SetIntrospectionEndpointUris("/connect/introspect")
				   .SetTokenEndpointUris("/connect/token")
				   .SetUserinfoEndpointUris("/connect/userinfo")
				   .SetVerificationEndpointUris("/connect/verify");

			// Note: this sample uses the code, device code, password and refresh token flows, but you
			// can enable the other flows if you need to support implicit or client credentials.
			options.AllowAuthorizationCodeFlow()
				   .AllowDeviceCodeFlow()
				   .AllowHybridFlow()
				   .AllowRefreshTokenFlow();

			// Mark the "email", "profile", "roles" and "dataEventRecords" scopes as supported scopes.
			options.RegisterScopes(Scopes.Email, Scopes.Profile, Scopes.Roles, "dataEventRecords");

			// Register the signing and encryption credentials.
			options.AddDevelopmentEncryptionCertificate()
				   .AddDevelopmentSigningCertificate();

			// Force client applications to use Proof Key for Code Exchange (PKCE).
			options.RequireProofKeyForCodeExchange();

			// Register the ASP.NET Core host and configure the ASP.NET Core-specific options.
			options.UseAspNetCore()
				   .EnableStatusCodePagesIntegration()
				   .EnableAuthorizationEndpointPassthrough()
				   .EnableLogoutEndpointPassthrough()
				   .EnableTokenEndpointPassthrough()
				   .EnableUserinfoEndpointPassthrough()
				   .EnableVerificationEndpointPassthrough()
				   .DisableTransportSecurityRequirement(); // During development, you can disable the HTTPS requirement.

			// Note: if you don't want to specify a client_id when sending
			// a token or revocation request, uncomment the following line:
			//
			// options.AcceptAnonymousClients();

			// Note: if you want to process authorization and token requests
			// that specify non-registered scopes, uncomment the following line:
			//
			// options.DisableScopeValidation();

			// Note: if you don't want to use permissions, you can disable
			// permission enforcement by uncommenting the following lines:
			//
			// options.IgnoreEndpointPermissions()
			//        .IgnoreGrantTypePermissions()
			//        .IgnoreResponseTypePermissions()
			//        .IgnoreScopePermissions();

			// Note: when issuing access tokens used by third-party APIs
			// you don't own, you can disable access token encryption:
			//
			// options.DisableAccessTokenEncryption();
		})

		// Register the OpenIddict validation components.
		.AddValidation(options =>
		{
			// Configure the audience accepted by this resource server.
			// The value MUST match the audience associated with the
			// "demo_api" scope, which is used by ResourceController.
			options.AddAudiences("rs_dataEventRecordsApi");

			// Import the configuration from the local OpenIddict server instance.
			options.UseLocalServer();

			// Register the ASP.NET Core host.
			options.UseAspNetCore();

			// For applications that need immediate access token or authorization
			// revocation, the database entry of the received tokens and their
			// associated authorizations can be validated for each API call.
			// Enabling these options may have a negative impact on performance.
			//
			// options.EnableAuthorizationEntryValidation();
			// options.EnableTokenEntryValidation();
		});

	services.AddTransient<IEmailSender, AuthMessageSender>();
	services.AddTransient<ISmsSender, AuthMessageSender>();

	// Register the worker responsible of seeding the database with the sample clients.
	// Note: in a real world application, this step should be part of a setup script.
	services.AddHostedService<Worker>();
}

public void Configure(IApplicationBuilder app)
{
	app.UseDeveloperExceptionPage();

	app.UseCors("AllowAllOrigins");

	app.UseStaticFiles();

	app.UseStatusCodePagesWithReExecute("/error");

	app.UseRouting();

	app.UseRequestLocalization(options =>
	{
		options.AddSupportedCultures("en-US", "fr-FR");
		options.AddSupportedUICultures("en-US", "fr-FR");
		options.SetDefaultCulture("en-US");
	});

	app.UseAuthentication();
	app.UseAuthorization();

	app.UseEndpoints(options => options.MapControllerRoute(
		name: "default",
		pattern: "{controller=Home}/{action=Index}/{id?}"));
}

dotnet ef migrations add test 
dotnet ef database update test

using System;
using System.Collections.Generic;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc;
using OpeniddictServer.Models;
using OpenIddict.Abstractions;
using OpenIddict.Server.AspNetCore;
using static OpenIddict.Abstractions.OpenIddictConstants;

namespace OpeniddictServer.Controllers
{
    public class UserinfoController : Controller
    {
        private readonly UserManager<ApplicationUser> _userManager;

        public UserinfoController(UserManager<ApplicationUser> userManager)
            => _userManager = userManager;

        [Authorize(AuthenticationSchemes = OpenIddictServerAspNetCoreDefaults.AuthenticationScheme)]
        [HttpGet("~/connect/userinfo"), HttpPost("~/connect/userinfo")]
        [IgnoreAntiforgeryToken, Produces("application/json")]
        public async Task<IActionResult> Userinfo()
        {
            var user = await _userManager.GetUserAsync(User);
            if (user is null)
            {
                return Challenge(
                    authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme,
                    properties: new AuthenticationProperties(new Dictionary<string, string>
                    {
                        [OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.InvalidToken,
                        [OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] =
                            "The specified access token is bound to an account that no longer exists."
                    }));
            }

            var claims = new Dictionary<string, object>(StringComparer.Ordinal)
            {
                // Note: the "sub" claim is a mandatory claim and must be included in the JSON response.
                [Claims.Subject] = await _userManager.GetUserIdAsync(user)
            };

            if (User.HasScope(Scopes.Email))
            {
                claims[Claims.Email] = await _userManager.GetEmailAsync(user);
                claims[Claims.EmailVerified] = await _userManager.IsEmailConfirmedAsync(user);
            }

            if (User.HasScope(Scopes.Phone))
            {
                claims[Claims.PhoneNumber] = await _userManager.GetPhoneNumberAsync(user);
                claims[Claims.PhoneNumberVerified] = await _userManager.IsPhoneNumberConfirmedAsync(user);
            }

            if (User.HasScope(Scopes.Roles))
            {
                claims[Claims.Role] = await _userManager.GetRolesAsync(user);
            }

            // Note: the complete list of standard claims supported by the OpenID Connect specification
            // can be found here: http://openid.net/specs/openid-connect-core-1_0.html#StandardClaims

            return Ok(claims);
        }
    }
}

private setHeaders(): any {
	this.headers = new HttpHeaders();
	this.headers = this.headers.set('Content-Type', 'application/json');
	this.headers = this.headers.set('Accept', 'application/json');

	const token = this.securityService.getAccessToken();
	if (token !== '') {
		const tokenValue = 'Bearer ' + token;
		this.headers = this.headers.append('Authorization', tokenValue);
	}
}

using ResourceServer.Model;
using ResourceServer.Repositories;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace ResourceServer.Controllers
{
    [Authorize("dataEventRecordsPolicy")]
    [Route("api/[controller]")]
    public class DataEventRecordsController : Controller
    {
        private readonly DataEventRecordRepository _dataEventRecordRepository;

        public DataEventRecordsController(DataEventRecordRepository dataEventRecordRepository)
        {
            _dataEventRecordRepository = dataEventRecordRepository;
        }

        [HttpGet]
        public IActionResult Get()
        {
            return Ok(_dataEventRecordRepository.GetAll());
        }

        [HttpGet("{id}")]
        public IActionResult Get(long id)
        {
            return Ok(_dataEventRecordRepository.Get(id));
        }

        [HttpPost]
        public void Post([FromBody]DataEventRecord value)
        {
            _dataEventRecordRepository.Post(value);
        }

        [HttpPut("{id}")]
        public void Put(long id, [FromBody]DataEventRecord value)
        {
            _dataEventRecordRepository.Put(id, value);
        }

        [HttpDelete("{id}")]
        public void Delete(long id)
        {
            _dataEventRecordRepository.Delete(id);
        }
    }
}

services.AddScoped<IAuthorizationHandler, RequireScopeHandler>();

services.AddAuthorization(options =>
{
	options.AddPolicy("dataEventRecordsPolicy", policyUser =>
	{
		policyUser.Requirements.Add(new RequireScope());
	});
});

services.AddAuthentication(options =>
{
	options.DefaultScheme = OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme;
});

// Register the OpenIddict validation components.
services.AddOpenIddict()
	.AddValidation(options =>
	{
		// Note: the validation handler uses OpenID Connect discovery
		// to retrieve the address of the introspection endpoint.
		options.SetIssuer("https://localhost:44395/");
		options.AddAudiences("rs_dataEventRecordsApi");

		// Configure the validation handler to use introspection and register the client
		// credentials used when communicating with the remote introspection endpoint.
		options.UseIntrospection()
			   .SetClientId("rs_dataEventRecordsApi")
			   .SetClientSecret("dataEventRecordsSecret");

		// Register the System.Net.Http integration.
		options.UseSystemNetHttp();

		// Register the ASP.NET Core host.
		options.UseAspNetCore();
	});