// ASP.NET Core 10 excerpts for a separately configured disposable project.
// Not a standalone compilation unit; no publisher compilation/execution claim.
// Required project context: web SDK, Microsoft.AspNetCore.OpenApi package;
// integration project: Microsoft.AspNetCore.Mvc.Testing, xUnit, accessible Program.
// 1. Before builder.Build(), with a real authentication scheme already configured:
builder.Services.AddProblemDetails();
builder.Services.AddOpenApi();
builder.Services.AddAuthorization(options => {
    options.AddPolicy("Orders.Read", p => p.RequireAuthenticatedUser()
        .RequireClaim("permission", "Orders.Read"));
    options.AddPolicy("Orders.Write", p => p.RequireAuthenticatedUser()
        .RequireClaim("permission", "Orders.Write"));
});
// 2. After app is built, before mapping endpoints:
app.UseExceptionHandler();
app.UseStatusCodePages();
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
if (app.Environment.IsDevelopment()) app.MapOpenApi();
// Handlers GetOrder/CreateOrder and registered dependencies belong to that project.
app.MapGet("/orders/{id:int}", GetOrder).RequireAuthorization("Orders.Read")
    .Produces<OrderResponse>(200).ProducesProblem(404);
app.MapPost("/orders", CreateOrder).RequireAuthorization("Orders.Write")
    .Produces<OrderResponse>(201).ProducesProblem(422).ProducesProblem(409);
// Metadata above is deliberately abbreviated, not the full status/security contract.
// Implement strict serializer/binding, domain checks, safe problem customization
// and the replay boundary; .ProducesProblem does not implement any of these.
// 3. Inside a domain-validation branch of CreateOrder:
return Results.Problem(statusCode: 422, title: "Order validation failed");
// The exercise's full type/instance/trace whitelist needs explicit configuration.
// 4. In an async integration test using a prepared WebApplicationFactory<Program>
// with an explicit test auth handler and disposable observable store:
using var client = factory.CreateClient(new WebApplicationFactoryClientOptions {
    AllowAutoRedirect = false
});
using var request = new HttpRequestMessage(HttpMethod.Post, "/orders");
request.Headers.Accept.ParseAdd("application/problem+json");
request.Headers.Add("Idempotency-Key", "test-01");
request.Content = JsonContent.Create(new { customerReference = "r-01", quantity = 2 });
using var response = await client.SendAsync(request);
Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
Assert.Contains(response.Headers.WwwAuthenticate, h => h.Scheme == "Bearer");
Assert.Equal(0, fixtureStore.Writes); // Same observable store registered by factory.
// Also assert media type, sanitized problem body, response/body status and trace.
// Do not enable client-controlled synthetic principals in a deployed application.
// Test-auth substitution does not validate the real issuer, cryptography or host.