Configure JWT bearer auth against Supabase JWKS via OpenID metadata

backend/Program.cs

@@ -1,5 +1,7 @@
 using Backend.Data;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.IdentityModel.Tokens;
 
 var builder = WebApplication.CreateBuilder(args);
 
@@ -8,7 +10,28 @@ builder.Services.AddDbContext<AppDbContext>(options =>
 
 // MARKER: CORS SERVICES
 
-// MARKER: AUTH SERVICES
+builder.Services
+    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+    .AddJwtBearer(options =>
+    {
+        options.MetadataAddress = builder.Configuration["Supabase:MetadataAddress"]
+            ?? throw new InvalidOperationException("Supabase:MetadataAddress not configured");
+        options.RequireHttpsMetadata = true;
+        options.MapInboundClaims = false;
+        options.TokenValidationParameters = new TokenValidationParameters
+        {
+            ValidateIssuer = true,
+            ValidIssuer = builder.Configuration["Supabase:Issuer"],
+            ValidateAudience = true,
+            ValidAudience = builder.Configuration["Supabase:Audience"],
+            ValidateIssuerSigningKey = true,
+            ValidateLifetime = true,
+            ClockSkew = TimeSpan.FromSeconds(30),
+            NameClaimType = "sub"
+        };
+    });
+
+builder.Services.AddAuthorization();
 
 builder.Services.AddControllers();
 
@@ -16,7 +39,8 @@ var app = builder.Build();
 
 // MARKER: CORS MIDDLEWARE
 
-// MARKER: AUTH MIDDLEWARE
+app.UseAuthentication();
+app.UseAuthorization();
 
 app.MapControllers();