var builder = WebApplication.CreateBuilder(args);

builder.Services.AddControllers();
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

builder.Services.AddSingleton<MyCertificateValidationService>();

builder.Services.AddAuthentication(CertificateAuthenticationDefaults.AuthenticationScheme)
    .AddCertificate(options =>
    {
        // https://docs.microsoft.com/en-us/aspnet/core/security/authentication/certauth
        options.AllowedCertificateTypes = CertificateTypes.SelfSigned;

        options.Events = new CertificateAuthenticationEvents
        {
            OnCertificateValidated = context =>
            {
                var validationService = context.HttpContext.RequestServices.GetService<MyCertificateValidationService>();

                if (validationService != null && validationService.ValidateCertificate(context.ClientCertificate))
                {
                    var claims = new[]
                    {
                        new Claim(ClaimTypes.NameIdentifier, context.ClientCertificate.Subject, ClaimValueTypes.String, context.Options.ClaimsIssuer),
                        new Claim(ClaimTypes.Name, context.ClientCertificate.Subject, ClaimValueTypes.String, context.Options.ClaimsIssuer)
                    };

                    context.Principal = new ClaimsPrincipal(new ClaimsIdentity(claims, context.Scheme.Name));
                    context.Success();
                }
                else
                {
                    context.Fail("invalid cert");
                }

                return Task.CompletedTask;
            }
        };
    });

builder.Host.UseSerilog((hostingContext, loggerConfiguration) => loggerConfiguration
    .ReadFrom.Configuration(hostingContext.Configuration)
    .Enrich.FromLogContext()
    .MinimumLevel.Debug()
    .WriteTo.Console()
    .WriteTo.File(
        //$@"../certauth.txt",
        $@"D:\home\LogFiles\Application\{Environment.UserDomainName}.txt",
        fileSizeLimitBytes: 1_000_000,
        rollOnFileSizeLimit: true,
        shared: true,
        flushToDiskInterval: TimeSpan.FromSeconds(1)));

var app = builder.Build();

if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

app.UseHttpsRedirection();

if (!app.Environment.IsDevelopment())
{
    app.UseAuthentication();
    app.UseAuthorization();
    app.MapControllers().RequireAuthorization();
}
else
{
    app.UseAuthorization();
    app.MapControllers();
}

app.Run();

public class MyCertificateValidationService 
{
	private readonly ILogger<MyCertificateValidationService> _logger;

	public MyCertificateValidationService(ILogger<MyCertificateValidationService> logger)
	{
		_logger = logger;
	}

	public bool ValidateCertificate(X509Certificate2 clientCertificate)
	{
		return CheckIfThumbprintIsValid(clientCertificate);
	}

	private bool CheckIfThumbprintIsValid(X509Certificate2 clientCertificate)
	{
		var listOfValidThumbprints = new List<string>
		{
			// add thumbprints of your allowed clients
			"15D118271F9AE7855778A2E6A00A575341D3D904"
		};

		if (listOfValidThumbprints.Contains(clientCertificate.Thumbprint))
		{
			_logger.LogInformation($"Custom auth-success for certificate  {clientCertificate.FriendlyName} {clientCertificate.Thumbprint}");

			return true;
		}

		_logger.LogWarning($"auth failed for certificate  {clientCertificate.FriendlyName} {clientCertificate.Thumbprint}");

		return false;
	}
}

class Program
{
	static CreateCertificates _cc;
	static void Main(string[] args)
	{
		var builder = new ConfigurationBuilder()
			.AddUserSecrets<Program>();
		var configuration = builder.Build();

		var sp = new ServiceCollection()
		   .AddCertificateManager()
		   .BuildServiceProvider();

		_cc = sp.GetService<CreateCertificates>();

		var rsaCert = CreateRsaCertificateSha512KeySize2048("localhost", 10);

		string password = configuration["certificateSecret"];
		var iec = sp.GetService<ImportExportCertificate>();

		var rsaCertPfxBytes = iec.ExportSelfSignedCertificatePfx(password, rsaCert);
		File.WriteAllBytes("cert_rsa512.pfx", rsaCertPfxBytes);

		Console.WriteLine("created");
	}

	public static X509Certificate2 CreateRsaCertificateSha512KeySize2048(string dnsName, int validityPeriodInYears)
	{
		var basicConstraints = new BasicConstraints
		{
			CertificateAuthority = false,
			HasPathLengthConstraint = false,
			PathLengthConstraint = 0,
			Critical = false
		};

		var subjectAlternativeName = new SubjectAlternativeName
		{
			DnsName = new List<string>
			{
				dnsName,
			}
		};

		var x509KeyUsageFlags = X509KeyUsageFlags.DigitalSignature;

		// only if certification authentication is used
		var enhancedKeyUsages = new OidCollection
		{
			OidLookup.ClientAuthentication,
			// OidLookup.ServerAuthentication 
			// OidLookup.CodeSigning,
			// OidLookup.SecureEmail,
			// OidLookup.TimeStamping  
		};

		var certificate = _cc.NewRsaSelfSignedCertificate(
			new DistinguishedName { CommonName = dnsName },
			basicConstraints,
			new ValidityPeriod
			{
				ValidFrom = DateTimeOffset.UtcNow,
				ValidTo = DateTimeOffset.UtcNow.AddYears(validityPeriodInYears)
			},
			subjectAlternativeName,
			enhancedKeyUsages,
			x509KeyUsageFlags,
			new RsaConfiguration
			{ 
				KeySize = 3072,
				HashAlgorithmName = HashAlgorithmName.SHA512
			});

		return certificate;
	}
}