Program.cs

using System.IO.Compression;
using System.Reflection;
using System.Text;
using System.Threading.RateLimiting;
using FluentValidation;
using FluentValidation.AspNetCore;
using KutubxonaAPI.Common.Constants;
using KutubxonaAPI.Data;
using KutubxonaAPI.Middleware;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Diagnostics.HealthChecks;
using Microsoft.AspNetCore.RateLimiting;
using Microsoft.AspNetCore.ResponseCompression;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Diagnostics.HealthChecks;
using Microsoft.IdentityModel.Tokens;
using Scalar.AspNetCore;
using Serilog;

// PostgreSQL — DateTime'ni (Kind=Unspecified/Local bo'lsa ham) timestamp'ga
// yozishga ruxsat (DiscountEndsAt kabi mijozdan kelgan sanalar uchun).
AppContext.SetSwitch("Npgsql.EnableLegacyTimestampBehavior", true);

// ============================================
// SERILOG — Startup uchun bootstrap logger
// ============================================
Log.Logger = new LoggerConfiguration()
    .WriteTo.Console()
    .CreateBootstrapLogger();

try
{
    Log.Information("🚀 KutubxonaAPI ishga tushmoqda...");

    var builder = WebApplication.CreateBuilder(args);

    // Serilog'ni asosiy loggerga aylantirish
    builder.Host.UseSerilog((context, services, config) =>
    {
        config.ReadFrom.Configuration(context.Configuration)
              .ReadFrom.Services(services)
              .Enrich.FromLogContext();
    });

    // ============================================
    // SERVISLAR
    // ============================================

    // Controllers + OpenAPI (Scalar) — Enum'lar string sifatida
    builder.Services.AddControllers()
        .AddJsonOptions(options =>
        {
            options.JsonSerializerOptions.Converters.Add(
                new System.Text.Json.Serialization.JsonStringEnumConverter());
        });
    builder.Services.AddOpenApi();

    // ============================================
    // FLUENTVALIDATION
    // ============================================
    builder.Services.AddValidatorsFromAssembly(Assembly.GetExecutingAssembly());
    builder.Services.AddFluentValidationAutoValidation();
    builder.Services.AddFluentValidationClientsideAdapters();

    // ============================================
    // RESPONSE COMPRESSION (Gzip + Brotli)
    // ============================================
    builder.Services.AddResponseCompression(options =>
    {
        options.EnableForHttps = true;
        options.Providers.Add<BrotliCompressionProvider>();
        options.Providers.Add<GzipCompressionProvider>();
        options.MimeTypes = ResponseCompressionDefaults.MimeTypes.Concat(new[]
        {
            "application/json",
            "text/plain",
            "image/svg+xml"
        });
    });

    builder.Services.Configure<BrotliCompressionProviderOptions>(o => o.Level = CompressionLevel.Fastest);
    builder.Services.Configure<GzipCompressionProviderOptions>(o => o.Level = CompressionLevel.Fastest);

    // ============================================
    // IN-MEMORY CACHE + OUTPUT CACHE
    // ============================================
    builder.Services.AddMemoryCache();
    builder.Services.AddOutputCache(options =>
    {
        // Default: 60 sekund cache
        options.AddBasePolicy(builder => builder.Expire(TimeSpan.FromSeconds(60)));

        // Kategoriya kabi static data uchun — 5 daqiqa
        options.AddPolicy("static-5min", builder =>
            builder.Expire(TimeSpan.FromMinutes(5)));

        // Kitob ro'yxati — 30 sekund (barcha filtr parametrlari bo'yicha farqlanadi)
        options.AddPolicy("books-30sec", builder =>
            builder.Expire(TimeSpan.FromSeconds(30))
                   .SetVaryByQuery(
                        "includeInactive", "page", "pageSize",
                        "category", "search", "q", "count"));
    });

    // ============================================
    // EMAIL SENDER — SMTP sozlangan bo'lsa haqiqiy, aks holda log
    // ============================================
    if (!string.IsNullOrWhiteSpace(builder.Configuration["Email:Smtp:Host"]))
        builder.Services.AddScoped<KutubxonaAPI.Services.IEmailSender, KutubxonaAPI.Services.SmtpEmailSender>();
    else
        builder.Services.AddScoped<KutubxonaAPI.Services.IEmailSender, KutubxonaAPI.Services.LoggingEmailSender>();

    // Database
    var connectionString = builder.Configuration.GetConnectionString("DefaultConnection")
        ?? throw new InvalidOperationException("DefaultConnection topilmadi");

    builder.Services.AddDbContext<AppDbContext>(options =>
        options.UseNpgsql(connectionString));

    // Fon tozalash xizmati — eskirgan token/bildirishnomalarни o'chiradi
    builder.Services.AddHostedService<KutubxonaAPI.Services.CleanupHostedService>();

    // ============================================
    // HEALTH CHECKS
    // ============================================
    builder.Services.AddHealthChecks()
        .AddDbContextCheck<AppDbContext>(
            name: "database",
            failureStatus: HealthStatus.Unhealthy,
            tags: new[] { "db", "ready" })
        .AddNpgSql(
            connectionString: connectionString,
            name: "postgresql",
            failureStatus: HealthStatus.Degraded,
            tags: new[] { "db", "ready" });

    // JWT Authentication
    var jwtKey = builder.Configuration["Jwt:Key"]
        ?? throw new InvalidOperationException("JWT Key topilmadi!");
    var jwtIssuer = builder.Configuration["Jwt:Issuer"];
    var jwtAudience = builder.Configuration["Jwt:Audience"];

    builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddJwtBearer(options =>
        {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = true,
                ValidateAudience = true,
                ValidateLifetime = true,
                ValidateIssuerSigningKey = true,
                ValidIssuer = jwtIssuer,
                ValidAudience = jwtAudience,
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtKey)),
                ClockSkew = TimeSpan.Zero
            };
        });

    builder.Services.AddAuthorization();

    // ============================================
    // RATE LIMITING
    // ============================================
    builder.Services.AddRateLimiter(options =>
    {
        options.RejectionStatusCode = 429;

        // Auth endpoint'lar uchun qattiqroq (login/register/parol) — [EnableRateLimiting("auth")]
        options.AddFixedWindowLimiter(AuthConstants.AuthRateLimitPolicy, opt =>
        {
            opt.PermitLimit = AuthConstants.AuthRateLimitPerMinute;
            opt.Window = TimeSpan.FromMinutes(1);
            opt.QueueLimit = 0;
        });

        // GLOBAL limiter — har IP uchun 1 daqiqada N so'rov (barcha API'ga).
        // Statik fayllar pipeline'da RateLimiter'dan oldin uzatiladi, shuning uchun cheklanmaydi.
        options.GlobalLimiter = PartitionedRateLimiter.Create<HttpContext, string>(httpContext =>
            RateLimitPartition.GetFixedWindowLimiter(
                partitionKey: httpContext.Connection.RemoteIpAddress?.ToString() ?? "unknown",
                factory: _ => new FixedWindowRateLimiterOptions
                {
                    PermitLimit = AuthConstants.GeneralRateLimitPerMinute,
                    Window = TimeSpan.FromMinutes(1),
                    QueueLimit = 0
                }));
    });

    // ============================================
    // CORS
    // ============================================
    var allowedOrigins = builder.Configuration
        .GetSection("AllowedOrigins")
        .Get<string[]>() ?? new[] { "http://localhost:5000" };

    builder.Services.AddCors(options =>
    {
        options.AddPolicy(AuthConstants.DevelopmentCorsPolicy, policy =>
        {
            policy.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader();
        });

        options.AddPolicy(AuthConstants.ProductionCorsPolicy, policy =>
        {
            policy.WithOrigins(allowedOrigins)
                  .AllowAnyMethod()
                  .AllowAnyHeader()
                  .AllowCredentials();
        });
    });

    // ============================================
    // APP QURISH
    // ============================================
    var app = builder.Build();

    // Database migration — development'да avtomatik,
    // production'да faqat AutoMigrate=true bo'lsa (nazoratsiz migratsiya xavfi).
    var autoMigrate = app.Environment.IsDevelopment()
        || app.Configuration.GetValue<bool>("AutoMigrate");
    if (autoMigrate)
    {
        using var scope = app.Services.CreateScope();
        var dbContext = scope.ServiceProvider.GetRequiredService<AppDbContext>();
        dbContext.Database.Migrate();
        Log.Information("✅ Database migration bajarildi");

        // Eski kitoblarni ko'chirish — seed/salebooks.json bo'lsa va baza bo'sh bo'lsa
        var seedLogger = scope.ServiceProvider.GetRequiredService<ILogger<Program>>();
        await KutubxonaAPI.Data.BookJsonSeeder.SeedAsync(dbContext, app.Environment.ContentRootPath, seedLogger);
    }
    else
    {
        Log.Warning("⏭️ Avtomatik migratsiya o'chirilgan (production). Migratsiyalarni qo'lda qo'llang: dotnet ef database update");
    }

    // ============================================
    // MIDDLEWARE PIPELINE
    // ============================================

    // 1. Global Exception Handler
    app.UseMiddleware<GlobalExceptionMiddleware>();

    // Response compression — birinchi bo'lib pipeline'da
    app.UseResponseCompression();

    // 2. Serilog request logging — har HTTP so'rov loglanadi
    app.UseSerilogRequestLogging(options =>
    {
        options.MessageTemplate =
            "HTTP {RequestMethod} {RequestPath} → {StatusCode} in {Elapsed:0.00}ms";

        options.EnrichDiagnosticContext = (diagnosticContext, httpContext) =>
        {
            diagnosticContext.Set("UserAgent", httpContext.Request.Headers.UserAgent.ToString());
            diagnosticContext.Set("ClientIP", httpContext.Connection.RemoteIpAddress?.ToString() ?? "unknown");
            if (httpContext.User.Identity?.IsAuthenticated == true)
            {
                diagnosticContext.Set("UserId",
                    httpContext.User.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)?.Value ?? "anonymous");
            }
        };
    });

    // 3. Scalar
    if (app.Environment.IsDevelopment())
    {
        app.MapOpenApi();
        app.MapScalarApiReference(options =>
        {
            options.WithTitle("KutubxonaAPI")
                   .WithTheme(ScalarTheme.Purple)
                   .WithDefaultHttpClient(ScalarTarget.JavaScript, ScalarClient.Fetch);
        });
    }

    // 4. HTTPS + HSTS (production'da brauzerni faqat HTTPS'ga majburlaydi)
    if (!app.Environment.IsDevelopment())
        app.UseHsts();
    app.UseHttpsRedirection();

    // 5. Static files
    app.UseDefaultFiles();
    app.UseStaticFiles();

    // 6. CORS
    if (app.Environment.IsDevelopment())
        app.UseCors(AuthConstants.DevelopmentCorsPolicy);
    else
        app.UseCors(AuthConstants.ProductionCorsPolicy);

    // 7. Rate Limiter
    app.UseRateLimiter();

    // 8. Authentication + Authorization
    app.UseAuthentication();
    app.UseAuthorization();

    // Output cache
    app.UseOutputCache();

    // ============================================
    // HEALTH CHECK ENDPOINTS
    // ============================================
    // Umumiy: /health — server ishlayaptimi
    app.MapHealthChecks("/health", new Microsoft.AspNetCore.Diagnostics.HealthChecks.HealthCheckOptions
    {
        ResponseWriter = HealthChecks.UI.Client.UIResponseWriter.WriteHealthCheckUIResponse
    });

    // Readiness: /health/ready — DB va boshqa dependency'lar tayyormi
    app.MapHealthChecks("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/health/ready", new Microsoft.AspNetCore.Diagnostics.HealthChecks.HealthCheckOptions
    {
        Predicate = check => check.Tags.Contains("ready"),
        ResponseWriter = HealthChecks.UI.Client.UIResponseWriter.WriteHealthCheckUIResponse
    });

    // Liveness: /health/live — process tirikmi
    app.MapHealthChecks("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/health/live", new Microsoft.AspNetCore.Diagnostics.HealthChecks.HealthCheckOptions
    {
        Predicate = _ => false, // Hech qanday check emas, faqat process javob berayaptimi
        ResponseWriter = HealthChecks.UI.Client.UIResponseWriter.WriteHealthCheckUIResponse
    });

    // 9. Controllers
    app.MapControllers();

    Log.Information("✅ KutubxonaAPI tayyor — {Env} muhitida", app.Environment.EnvironmentName);

    app.Run();
}
// HostAbortedException — EF Core migratsiya asboblari (design-time) host'ni
// ataylab to'xtatganda tashlanadi. Bu XATO EMAS, shuning uchun loglamaymiz.
catch (Exception ex) when (ex.GetType().Name != "HostAbortedException")
{
    Log.Fatal(ex, "💥 KutubxonaAPI ishga tushmadi");
}
finally
{
    Log.CloseAndFlush();
}