"AzureAd": {
	"TenantId": "5698af84-5720-4ff0-bdc3-9d9195314244",
	"ClientId": "b9be5f88-f629-46b0-ac4c-c5a4354ac192",
	// "ClientSecret": "add secret to the user secrets"
	"MeetingOrganizer": "--your-email-for-sending--"
},

private GraphServiceClient GetGraphClient()
{
	string[] scopes = new[] { "https://graph.microsoft.com/.default" };
	var tenantId = _configuration["AzureAd:TenantId"];

	// Values from app registration
	var clientId = _configuration.GetValue<string>("AzureAd:ClientId");
	var clientSecret = _configuration.GetValue<string>("AzureAd:ClientSecret");

	var options = new TokenCredentialOptions
	{
		AuthorityHost = AzureAuthorityHosts.AzurePublicCloud
	};

	// https://docs.microsoft.com/dotnet/api/azure.identity.clientsecretcredential
	var clientSecretCredential = new ClientSecretCredential(
		tenantId, clientId, clientSecret, options);

	return new GraphServiceClient(clientSecretCredential, scopes);
}

public class ApiTokenInMemoryClient
{
	private readonly IHttpClientFactory _clientFactory;
	private readonly ILogger<ApiTokenInMemoryClient> _logger;

	private readonly IConfiguration _configuration;
	private readonly IConfidentialClientApplication _app;
	private readonly ConcurrentDictionary<string, AccessTokenItem> _accessTokens = new();

	private class AccessTokenItem
	{
		public string AccessToken { get; set; } = string.Empty;
		public DateTime ExpiresIn { get; set; }
	}

	public ApiTokenInMemoryClient(IHttpClientFactory clientFactory,
		IConfiguration configuration, ILoggerFactory loggerFactory)
	{
		_clientFactory = clientFactory;
		_configuration = configuration;
		_logger = loggerFactory.CreateLogger<ApiTokenInMemoryClient>();
		_app = InitConfidentialClientApplication();
	}

	public async Task<GraphServiceClient> GetGraphClient()
	{
		var result = await GetApiToken("default");

		var httpClient = _clientFactory.CreateClient();
		httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", result);
		httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

		var graphClient = new GraphServiceClient(httpClient)
		{
			AuthenticationProvider = new DelegateAuthenticationProvider(async (requestMessage) =>
			{
				requestMessage.Headers.Authorization = new AuthenticationHeaderValue("Bearer", result);
				await Task.FromResult<object>(null);
			})
		};

		return graphClient;
	}

	private async Task<string> GetApiToken(string api_name)
	{
		if (_accessTokens.ContainsKey(api_name))
		{
			var accessToken = _accessTokens.GetValueOrDefault(api_name);
			if (accessToken.ExpiresIn > DateTime.UtcNow)
			{
				return accessToken.AccessToken;
			}
			else
			{
				// remove
				_accessTokens.TryRemove(api_name, out _);
			}
		}

		_logger.LogDebug($"GetApiToken new from STS for {api_name}");

		// add
		var newAccessToken = await AcquireTokenSilent();
		_accessTokens.TryAdd(api_name, newAccessToken);

		return newAccessToken.AccessToken;
	}

	private async Task<AccessTokenItem> AcquireTokenSilent()
	{
		//var scopes = "User.read Mail.Send Mail.ReadWrite OnlineMeetings.ReadWrite.All";
		var authResult = await _app
			.AcquireTokenForClient(scopes: new[] { "https://graph.microsoft.com/.default" })
			.WithAuthority(AzureCloudInstance.AzurePublic, _configuration["AzureAd:TenantId"])
			.ExecuteAsync();

		return new AccessTokenItem
		{
			ExpiresIn = authResult.ExpiresOn.UtcDateTime,
			AccessToken = authResult.AccessToken
		};
	}

	private IConfidentialClientApplication InitConfidentialClientApplication()
	{
		return ConfidentialClientApplicationBuilder
			.Create(_configuration["AzureAd:ClientId"])
			.WithClientSecret(_configuration["AzureAd:ClientSecret"])
			.Build();
	}
}

using Microsoft.Graph;

namespace TeamsAdminUIObo.GraphServices;

public class AadGraphApiApplicationClient
{
    private readonly IConfiguration _configuration;
    private readonly GraphApplicationClientService _graphApplicationClientService;

    public AadGraphApiApplicationClient(IConfiguration configuration, 
        GraphApplicationClientService graphApplicationClientService)
    {
        _configuration = configuration;
        _graphApplicationClientService = graphApplicationClientService;
    }

    private async Task<string> GetUserIdAsync()
    {
        var meetingOrganizer = _configuration["AzureAd:MeetingOrganizer"];
        var filter = $"startswith(userPrincipalName,'{meetingOrganizer}')";
        var graphServiceClient = _graphApplicationClientService.GetGraphClientWithManagedIdentityOrDevClient();

        var users = await graphServiceClient.Users
            .Request()
            .Filter(filter)
            .GetAsync();

        return users.CurrentPage[0].Id;
    }

    public async Task SendEmailAsync(Message message)
    {
        var graphServiceClient = _graphApplicationClientService.GetGraphClientWithManagedIdentityOrDevClient();

        var saveToSentItems = true;

        var userId = await GetUserIdAsync();

        await graphServiceClient.Users[userId]
            .SendMail(message, saveToSentItems)
            .Request()
            .PostAsync();
    }

    public async Task<OnlineMeeting> CreateOnlineMeeting(OnlineMeeting onlineMeeting)
    {
        var graphServiceClient = _graphApplicationClientService.GetGraphClientWithManagedIdentityOrDevClient();

        var userId = await GetUserIdAsync();

        return await graphServiceClient.Users[userId]
            .OnlineMeetings
            .Request()
            .AddAsync(onlineMeeting);
    }

    public async Task<OnlineMeeting> UpdateOnlineMeeting(OnlineMeeting onlineMeeting)
    {
        var graphServiceClient = _graphApplicationClientService.GetGraphClientWithManagedIdentityOrDevClient();

        var userId = await GetUserIdAsync();

        return await graphServiceClient.Users[userId]
            .OnlineMeetings[onlineMeeting.Id]
            .Request()
            .UpdateAsync(onlineMeeting);
    }

    public async Task<OnlineMeeting> GetOnlineMeeting(string onlineMeetingId)
    {
        var graphServiceClient = _graphApplicationClientService.GetGraphClientWithManagedIdentityOrDevClient();

        var userId = await GetUserIdAsync();

        return await graphServiceClient.Users[userId]
            .OnlineMeetings[onlineMeetingId]
            .Request()
            .GetAsync();
    }
}

using Azure.Identity;
using Microsoft.Graph;

namespace TeamsAdminUIObo.GraphServices;

public class GraphApplicationClientService
{
    private readonly IConfiguration _configuration;
    private readonly IHostEnvironment _environment;
    private GraphServiceClient? _graphServiceClient;

    public GraphApplicationClientService(IConfiguration configuration, IHostEnvironment environment)
    {
        _configuration = configuration;
        _environment = environment;
    }

    /// <summary>
    /// gets a singleton instance of the GraphServiceClient
    /// </summary>
    /// <returns></returns>
    public GraphServiceClient GetGraphClientWithManagedIdentityOrDevClient()
    {
        if (_graphServiceClient != null)
            return _graphServiceClient;

        string[] scopes = new[] { "https://graph.microsoft.com/.default" };

        var chainedTokenCredential = GetChainedTokenCredentials();
        _graphServiceClient = new GraphServiceClient(chainedTokenCredential, scopes);

        return _graphServiceClient;
    }

    private ChainedTokenCredential GetChainedTokenCredentials()
    {
        if (!_environment.IsDevelopment())
        {
            return new ChainedTokenCredential(new ManagedIdentityCredential());
        }
        else // dev env
        {
            var tenantId = _configuration["AzureAd:TenantId"];
            var clientId = _configuration.GetValue<string>("AzureAd:ClientId");
            var clientSecret = _configuration.GetValue<string>("AzureAd:ClientSecret");

            var options = new TokenCredentialOptions
            {
                AuthorityHost = AzureAuthorityHosts.AzurePublicCloud
            };

            // https://docs.microsoft.com/dotnet/api/azure.identity.clientsecretcredential
            var devClientSecretCredential = new ClientSecretCredential(
                tenantId, clientId, clientSecret, options);

            var chainedTokenCredential = new ChainedTokenCredential(devClientSecretCredential);

            return chainedTokenCredential;
        }
    }
}

public void ConfigureServices(IServiceCollection services)
{
	services.AddScoped<AadGraphApiApplicationClient>();
	services.AddSingleton<GraphApplicationClientService>();
	services.AddScoped<EmailService>();
	services.AddScoped<TeamsService>();
	services.AddHttpClient();
	services.AddOptions();

	services.AddRazorPages();
}