From 73676d3d016b920e8d6e1d2225557f3f0669449f Mon Sep 17 00:00:00 2001
From: EugeneTes <meelstorm@gmail.com>
Date: Sat, 15 Aug 2026 11:32:16 +0000
Subject: [PATCH] Configure JWT bearer auth against Supabase JWKS via OpenID
 metadata

---
 backend/Program.cs     | 28 ++++++++++++++++++++++++++--
 backend/backend.csproj |  1 +
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/backend/Program.cs b/backend/Program.cs
index a4f6724..f2974c1 100644
--- a/backend/Program.cs
+++ b/backend/Program.cs
@@ -1,5 +1,7 @@
 using Backend.Data;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.IdentityModel.Tokens;
 
 var builder = WebApplication.CreateBuilder(args);
 
@@ -8,7 +10,28 @@ builder.Services.AddDbContext<AppDbContext>(options =>
 
 // MARKER: CORS SERVICES
 
-// MARKER: AUTH SERVICES
+builder.Services
+    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+    .AddJwtBearer(options =>
+    {
+        options.MetadataAddress = builder.Configuration["Supabase:MetadataAddress"]
+            ?? throw new InvalidOperationException("Supabase:MetadataAddress not configured");
+        options.RequireHttpsMetadata = true;
+        options.MapInboundClaims = false;
+        options.TokenValidationParameters = new TokenValidationParameters
+        {
+            ValidateIssuer = true,
+            ValidIssuer = builder.Configuration["Supabase:Issuer"],
+            ValidateAudience = true,
+            ValidAudience = builder.Configuration["Supabase:Audience"],
+            ValidateIssuerSigningKey = true,
+            ValidateLifetime = true,
+            ClockSkew = TimeSpan.FromSeconds(30),
+            NameClaimType = "sub"
+        };
+    });
+
+builder.Services.AddAuthorization();
 
 builder.Services.AddControllers();
 
@@ -16,7 +39,8 @@ var app = builder.Build();
 
 // MARKER: CORS MIDDLEWARE
 
-// MARKER: AUTH MIDDLEWARE
+app.UseAuthentication();
+app.UseAuthorization();
 
 app.MapControllers();
 
diff --git a/backend/backend.csproj b/backend/backend.csproj
index 4bd1142..6c72db5 100644
--- a/backend/backend.csproj
+++ b/backend/backend.csproj
@@ -7,6 +7,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="9.*" />
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="9.0.19" />
     <PackageReference Include="Microsoft.EntityFrameworkCore" Version="9.0.19" />
     <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="9.0.4" />