Program.cs

using PlanApi;
using PlanApi.Indexing;
using PlanApi.Messaging;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Scalar.AspNetCore;
using StackExchange.Redis;
using System.Text.Json.Nodes;
using Json.Schema;
using System.Linq;
using System.Text.Json;

// Top-level statements: this file IS the program (no Main method needed).
var builder = WebApplication.CreateBuilder(args);

// builder.Services is the DI container. Frozen after Build().
builder.Services.AddOpenApi();

builder.Services.AddSingleton<IConnectionMultiplexer>(_ =>
    ConnectionMultiplexer.Connect(
        builder.Configuration.GetConnectionString("Redis")
        ?? throw new InvalidOperationException("ConnectionStrings:Redis is not configured")));

builder.Services.AddSingleton(JsonSchema.FromFile(
    Path.Combine(builder.Environment.ContentRootPath, "schema.json")));

builder.Services.AddSingleton<IPlanRepository, RedisRepository>();

// One RabbitMQ connection for the process, not one per request. Registered three ways so that
// the interface and the startup hook resolve to the *same* instance rather than two publishers.
builder.Services.AddSingleton<RabbitPublisher>();
builder.Services.AddSingleton<IPlanPublisher>(sp => sp.GetRequiredService<RabbitPublisher>());
builder.Services.AddHostedService(sp => sp.GetRequiredService<RabbitPublisher>());

// The consumer side: reads the queue and writes the derived documents into Elasticsearch.
builder.Services.AddSingleton<IPlanIndexer, PlanIndexer>();
builder.Services.AddHostedService<IndexerService>();

// Resource-server auth: validate Google-issued ID tokens, never mint them.
// Authority triggers OIDC discovery + JWKS fetch, so signing keys auto-rotate.
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.Authority = "https://accounts.google.com";
        options.Audience = builder.Configuration["Google:ClientId"]
            ?? throw new InvalidOperationException("Google:ClientId is not configured");
    });
builder.Services.AddAuthorization();

var app = builder.Build();

_ = app.Services.GetRequiredService<IConnectionMultiplexer>();

if (app.Environment.IsDevelopment())
{
    app.MapOpenApi();
    app.MapScalarApiReference();
}

app.UseAuthentication();
app.UseAuthorization();

// All plan endpoints require a valid Bearer token; unauthenticated -> 401.
var plan = app.MapGroup("/v1/plan").RequireAuthorization();

plan.MapPost("", async (JsonNode body, IPlanRepository repo, JsonSchema schema, IPlanPublisher publisher, HttpResponse response) =>
{
    var result = schema.Evaluate(body.Deserialize<JsonElement>(), new EvaluationOptions { OutputFormat = OutputFormat.List });
    if (!result.IsValid)
    {
        var errors = result.Details
            .Where(d => d.Errors is not null && d.Errors.Count > 0)
            .SelectMany(d => d.Errors!.Select(e => new
            {
                path = d.InstanceLocation.ToString(),
                keyword = e.Key,
                message = e.Value
            }))
            .ToList();
        return Results.BadRequest(new { errors });
    }

    var objectId = body["objectId"]!.GetValue<string>();

    if (await repo.ExistsAsync(objectId))
        return Results.Conflict(new { error = $"plan '{objectId}' already exists" });

    await repo.SaveFlattenedAsync(PlanFlattener.Decompose(body));

    // Hook: Redis has committed, so tell the indexer. Never throws — see RabbitPublisher.
    await publisher.PublishAsync(PlanMessage.Create(objectId, body.AsObject()));

    response.Headers.ETag = ETag.Compute(body);
    return Results.Created($"/v1/plan/{objectId}", null);
});

plan.MapGet("/{objectId}", async (string objectId, IPlanRepository repo, HttpRequest request, HttpResponse response) =>
{
    var plan = await repo.GetAsync(objectId);
    if (plan is null) return Results.NotFound();

    var etag = ETag.Compute(plan);
    response.Headers.ETag = etag;

    if (request.Headers.IfNoneMatch.Contains(etag))
        return Results.StatusCode(StatusCodes.Status304NotModified);

    return Results.Ok(plan);
});

plan.MapDelete("/{objectId}", async (string objectId, IPlanRepository repo, IPlanPublisher publisher) =>
{
    // Read the tree BEFORE deleting it: the descendant ids only exist inside it, and
    // repo.DeleteAsync is about to remove every key we would need to discover them.
    var tree = await repo.GetAsync(objectId);

    var deleted = await repo.DeleteAsync(objectId);
    if (!deleted) return Results.NotFound();

    if (tree is not null)
        await publisher.PublishAsync(PlanMessage.Delete(objectId, EsFlattener.CollectIds(tree)));

    return Results.NoContent();
});

plan.MapPatch("/{objectId}", async (string objectId, JsonNode body, IPlanRepository repo, JsonSchema schema, IPlanPublisher publisher, HttpRequest request, HttpResponse response) =>
{
    // objectId is the resource identity: reject any attempt to change it via the body.
    if (body["objectId"] is JsonNode bodyId && bodyId.ToString() != objectId)
        return Results.BadRequest(new { error = "objectId is immutable and cannot be changed via PATCH" });

    var stored = await repo.GetAsync(objectId);
    if (stored is null) return Results.NotFound();

    // Conditional write: If-Match is mandatory ("update if not changed").
    var ifMatch = request.Headers.IfMatch;
    if (ifMatch.Count == 0)
        return Results.StatusCode(StatusCodes.Status428PreconditionRequired);

    var currentETag = ETag.Compute(stored);
    if (!ifMatch.Contains("*") && !ifMatch.Contains(currentETag))
        return Results.StatusCode(StatusCodes.Status412PreconditionFailed);

    // Merge the partial body, then validate the *result* (the body itself is partial).
    var merged = PlanMerger.Merge(stored, body.AsObject());

    var result = schema.Evaluate(merged.Deserialize<JsonElement>(), new EvaluationOptions { OutputFormat = OutputFormat.List });
    if (!result.IsValid)
    {
        var errors = result.Details
            .Where(d => d.Errors is not null && d.Errors.Count > 0)
            .SelectMany(d => d.Errors!.Select(e => new
            {
                path = d.InstanceLocation.ToString(),
                keyword = e.Key,
                message = e.Value
            }))
            .ToList();
        return Results.BadRequest(new { errors });
    }

    await repo.SaveFlattenedAsync(PlanFlattener.Decompose(merged));

    // Hook: publish the *merged* plan, not the partial patch body. The consumer re-flattens
    // the whole tree and upserts every document by id, so the index cannot drift from Redis.
    await publisher.PublishAsync(PlanMessage.Update(objectId, merged));

    response.Headers.ETag = ETag.Compute(merged);
    return Results.Ok(merged);
});


app.UseHttpsRedirection();

app.Run();