{
  "PushPasskey": {
    "ApiKey": "",
    "ApiBaseUrl": "https://auth.jintec.com",
    "TestMode": true,
    "TestUserKey": "test-user-001",
    "RequestTimeoutSeconds": 15
  },
  "AllowedHosts": "*"
}

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddControllersWithViews();
builder.Services.AddDistributedMemoryCache();
builder.Services.AddSession(options =>
{
    options.Cookie.Name = "pushpasskey_sample_session";
    options.Cookie.HttpOnly = true;
    options.Cookie.SameSite = SameSiteMode.Lax;
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
    options.IdleTimeout = TimeSpan.FromMinutes(30);
});
builder.Services.AddHttpClient("PushPasskey", client =>
{
    var baseUrl = builder.Configuration["PushPasskey:ApiBaseUrl"]
        ?? "https://auth.jintec.com";
    var timeout = builder.Configuration
        .GetValue("PushPasskey:RequestTimeoutSeconds", 15);

    client.BaseAddress = new Uri(baseUrl);
    client.Timeout = TimeSpan.FromSeconds(timeout);
    client.DefaultRequestHeaders.Accept.ParseAdd("application/json");
});

var app = builder.Build();

if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Home/Error");
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
app.UseSession();
app.UseAuthorization();
app.MapControllerRoute(
    name: "default",
    pattern: "{controller=Home}/{action=Index}/{id?}");
app.Run();

using System.Net;
using System.Net.Http.Json;
using System.Text.Json;
using Microsoft.AspNetCore.Mvc;

namespace PushPasskeySample.Controllers;

[ApiController]
[Route("pushpasskey")]
public sealed class PushPasskeyController : ControllerBase
{
    private static readonly HashSet<string> AllowedActions =
        new(StringComparer.Ordinal)
        {
            "regist_start",
            "auth_start",
            "regist_result",
            "auth_result"
        };

    private readonly IConfiguration configuration;
    private readonly IHttpClientFactory httpClientFactory;
    private readonly ILogger<PushPasskeyController> logger;

    public PushPasskeyController(
        IConfiguration configuration,
        IHttpClientFactory httpClientFactory,
        ILogger<PushPasskeyController> logger)
    {
        this.configuration = configuration;
        this.httpClientFactory = httpClientFactory;
        this.logger = logger;
    }

    [HttpPost("endpoint")]
    [Consumes("application/json")]
    [Produces("application/json")]
    public async Task<IActionResult> EndpointAsync(
        [FromBody] Dictionary<string, JsonElement> input,
        CancellationToken cancellationToken)
    {
        try
        {
            VerifySameOrigin();

            string action = GetString(input, "action");
            if (!AllowedActions.Contains(action))
            {
                return JsonError(400, "invalid_action",
                    "処理の指定が正しくありません。");
            }

            string apiKey =
                configuration["PushPasskey:ApiKey"]?.Trim() ?? "";
            if (apiKey == "")
            {
                throw new InvalidOperationException(
                    "PushPasskey:ApiKey is not configured.");
            }

            var apiBody = new Dictionary<string, object?>
            {
                ["api_key"] = apiKey
            };

            string apiPath;
            if (action == "regist_start")
            {
                string userKey = GetRegistrationUserKey();
                string returnPageUrl =
                    GetString(input, "return_page_url");

                apiPath = "/regist_url";
                apiBody["user_key"] = userKey;
                if (returnPageUrl != "")
                {
                    apiBody["return_page_url"] = returnPageUrl;
                }
            }
            else if (action == "auth_start")
            {
                string returnPageUrl =
                    GetString(input, "return_page_url");

                apiPath = "/auth_url";
                // 認証開始時はuser_keyを送信しない。
                if (returnPageUrl != "")
                {
                    apiBody["return_page_url"] = returnPageUrl;
                }
            }
            else
            {
                string requestId = GetString(input, "request_id");
                if (requestId == "")
                {
                    return JsonError(400, "request_id_required",
                        "request_idがありません。");
                }

                apiPath = action == "regist_result"
                    ? "/regist_result"
                    : "/auth_result";
                apiBody["request_id"] = requestId;
            }

            using HttpClient client =
                httpClientFactory.CreateClient("PushPasskey");
            using HttpResponseMessage apiResponse =
                await client.PostAsJsonAsync(
                    apiPath, apiBody, cancellationToken);

            string raw = await apiResponse.Content
                .ReadAsStringAsync(cancellationToken);

            JsonDocument json;
            try
            {
                json = JsonDocument.Parse(raw);
            }
            catch (JsonException ex)
            {
                logger.LogError(ex,
                    "Push! Passkey API returned non-JSON. HTTP {Status}",
                    (int)apiResponse.StatusCode);
                return JsonError(502, "api_invalid_json",
                    "Push! Passkey APIの応答がJSONではありません。");
            }

            using (json)
            {
                var result = JsonSerializer.Deserialize<Dictionary<string, object?>>(
                    json.RootElement.GetRawText()) ?? new();

                if (!apiResponse.IsSuccessStatusCode)
                {
                    return StatusCode((int)apiResponse.StatusCode, result);
                }

                if (action == "regist_result")
                {
                    AfterRegistrationSuccessIfNeeded(json.RootElement);
                }
                else if (action == "auth_result")
                {
                    await AfterAuthenticationSuccessIfNeededAsync(
                        json.RootElement, cancellationToken);
                }

                return Ok(result);
            }
        }
        catch (OperationCanceledException)
        {
            return JsonError(504, "api_timeout",
                "APIとの通信がタイムアウトしました。");
        }
        catch (Exception ex)
        {
            logger.LogError(ex, "Push! Passkey endpoint failed.");
            return JsonError(500, "internal_error",
                "サーバー処理中にエラーが発生しました。");
        }
    }

    private string GetRegistrationUserKey()
    {
        bool testMode =
            configuration.GetValue("PushPasskey:TestMode", true);

        if (testMode)
        {
            return configuration["PushPasskey:TestUserKey"]?.Trim()
                ?? "test-user-001";
        }

        // 本番では、既存ログインユーザーの外部連携用IDを返す。
        // 数値IDであっても必ず文字列へ変換する。
        int? userId = HttpContext.Session.GetInt32("user_id");
        if (userId is null)
        {
            throw new UnauthorizedAccessException(
                "ログイン後に登録してください。");
        }
        return userId.Value.ToString(
            System.Globalization.CultureInfo.InvariantCulture);
    }

    private void AfterRegistrationSuccessIfNeeded(JsonElement result)
    {
        if (!IsSuccess(result))
        {
            return;
        }

        // 必要に応じて、自社DBへ登録完了日時などを保存する。
    }

    private async Task AfterAuthenticationSuccessIfNeededAsync(
        JsonElement result,
        CancellationToken cancellationToken)
    {
        if (!IsSuccess(result))
        {
            return;
        }

        string userKey = GetJsonString(result, "user_key");
        if (userKey == "")
        {
            throw new InvalidOperationException(
                "Authentication result does not contain user_key.");
        }

        // 本番ではuser_keyで自社ユーザーを検索し、
        // 無効状態・権限などを確認する。
        // var user = await userRepository.FindByExternalKeyAsync(
        //     userKey, cancellationToken);

        HttpContext.Session.Clear();

        // 接続試験では、認証済みuser_keyをセッションへ保存する。
        // 本番では既存サイトのログイン確立処理へ置き換える。
        HttpContext.Session.SetString(
            "authenticated_user_key", userKey);
    }

    private void VerifySameOrigin()
    {
        string origin = Request.Headers.Origin.ToString();
        if (origin == "")
        {
            return;
        }

        string expected =
            $"{Request.Scheme}://{Request.Host}";
        if (!string.Equals(
            origin, expected, StringComparison.OrdinalIgnoreCase))
        {
            throw new UnauthorizedAccessException(
                "Origin is not allowed.");
        }
    }

    private static bool IsSuccess(JsonElement result) =>
        GetJsonString(result, "status") == "success";

    private static string GetString(
        Dictionary<string, JsonElement> input,
        string name) =>
        input.TryGetValue(name, out JsonElement value)
            ? value.ValueKind == JsonValueKind.String
                ? value.GetString()?.Trim() ?? ""
                : value.ToString().Trim()
            : "";

    private static string GetJsonString(
        JsonElement json, string name) =>
        json.TryGetProperty(name, out JsonElement value)
            ? value.ValueKind == JsonValueKind.String
                ? value.GetString()?.Trim() ?? ""
                : value.ToString().Trim()
            : "";

    private ObjectResult JsonError(
        int status, string errorCode, string message) =>
        StatusCode(status, new
        {
            ok = false,
            error_code = errorCode,
            message
        });
}

@{
    ViewData["Title"] = "Push! Passkey 接続テスト";
}

<h1>Push! Passkey 接続テスト</h1>
<p id="pushpasskey_result" aria-live="polite"></p>

<button
    type="button"
    data-pushpasskey="regist"
    data-endpoint="/pushpasskey/endpoint"
    data-success-url="/Home/PushPasskeyTest">
    パスキー登録
</button>

<button
    type="button"
    data-pushpasskey="auth"
    data-endpoint="/pushpasskey/endpoint"
    data-success-url="/">
    パスキー認証
</button>

<script src="https://auth.jintec.com/js/passkey.js"></script>