Intermediate

open Microsoft.AspNetCore.Builder
open Microsoft.Extensions.DependencyInjection
open Giraffe

// >=>: HttpHandler -> HttpHandler -> HttpHandler
// => (>=>) h1 h2 = fun next ctx -> task { return! h1 (h2 next) ctx }
// => Equivalent to: h1 calls h2 as "next"
// => If h1 short-circuits (returns None), h2 never runs

// Building complex handlers by composition
let requiresHttps : HttpHandler =
    fun next ctx ->
        task {
            if ctx.Request.IsHttps then
                return! next ctx            // => HTTPS: continue
            else
                return! (setStatusCode 400 >=> text "HTTPS required") next ctx
                // => HTTP: short-circuit with error
        }

let requiresJsonContent : HttpHandler =
    fun next ctx ->
        task {
            let ct = ctx.Request.ContentType |> Option.ofObj |> Option.defaultValue ""
            if ct.Contains("application/json") then
                return! next ctx            // => JSON content: continue
            else
                return! (setStatusCode 415 >=> text "application/json required") next ctx
                // => 415 Unsupported Media Type
        }

let rateLimitHandler : HttpHandler =
    fun next ctx ->
        task {
            // Simplified rate check (real: use IMemoryCache or Redis)
            let ip = ctx.Connection.RemoteIpAddress.ToString()
            let allowed = ip <> "192.168.1.99"   // => Block specific IP for demo
            if allowed then
                return! next ctx
            else
                return! (setStatusCode 429 >=> text "Too many requests") next ctx
                // => 429 Too Many Requests
        }

// Compose a guard chain: each guard must pass before reaching the terminal handler
let secureApiHandler : HttpHandler =
    requiresHttps        >=>    // => 1st: must be HTTPS
    requiresJsonContent  >=>    // => 2nd: must send JSON
    rateLimitHandler     >=>    // => 3rd: must not be rate-limited
    text "API response"         // => Terminal: write response
// => All three guards run in order; any failure short-circuits

let webApp : HttpHandler =
    POST >=> route "/api/secure" >=> secureApiHandler

let builder = WebApplication.CreateBuilder()
builder.Services.AddGiraffe() |> ignore
let app = builder.Build()
app.UseGiraffe(webApp)
// => POST /api/secure (HTTP, not HTTPS)          => 400 "HTTPS required"
// => POST /api/secure (HTTPS, text/plain body)   => 415 "application/json required"
// => POST /api/secure (HTTPS, JSON, rate-limited) => 429 "Too many requests"
// => POST /api/secure (HTTPS, JSON, allowed)     => "API response" (200)
app.Run()

open Microsoft.AspNetCore.Builder
open Microsoft.Extensions.DependencyInjection
open Microsoft.Extensions.Logging
open Giraffe

// Reusable timing middleware
// => Measures and logs the duration of every request it wraps
let withTiming (logger : ILogger) : HttpHandler -> HttpHandler =
    // => Returns a middleware factory: HttpHandler -> HttpHandler
    // => Takes the next handler as input, returns a wrapped handler
    fun (next : HttpHandler) ->
        fun (nextFunc : HttpFunc) (ctx : HttpContext) ->
            task {
                let sw = System.Diagnostics.Stopwatch.StartNew()
                // => StartNew: creates and starts a stopwatch

                let! result = next nextFunc ctx
                // => Await the wrapped handler pipeline
                // => next receives nextFunc as its continuation

                sw.Stop()
                logger.LogInformation(
                    "Request {Method} {Path} completed in {ElapsedMs}ms",
                    ctx.Request.Method, ctx.Request.Path, sw.ElapsedMilliseconds
                )
                // => Log timing after handler completes
                return result
            }

// Reusable correlation ID middleware
// => Reads or generates X-Correlation-ID header and adds to response
let withCorrelationId : HttpHandler =
    fun next ctx ->
        task {
            let correlationId =
                match ctx.Request.Headers["X-Correlation-ID"].ToString() with
                | "" -> System.Guid.NewGuid().ToString()
                // => No header: generate new GUID
                | id -> id
                // => Header present: propagate it

            ctx.Response.Headers["X-Correlation-ID"] <- correlationId
            // => Add correlation ID to response headers

            ctx.Items["CorrelationId"] <- correlationId :> obj
            // => Store in Items dict for downstream handlers to read
            // => ctx.Items: Dictionary<obj, obj> for per-request data

            return! next ctx
        }

// Compose middleware into application
let builder = WebApplication.CreateBuilder()
builder.Services.AddGiraffe() |> ignore

let app = builder.Build()
let logger = app.Services.GetRequiredService<ILogger<obj>>()

let webApp : HttpHandler =
    withCorrelationId >=>
    withTiming logger (           // => withTiming returns HttpHandler->HttpHandler
        choose [                  // => choose is the HttpHandler passed to withTiming
            GET >=> route "/items" >=> text "items"
        ]
    )
// => Request: withCorrelationId -> withTiming -> choose -> text

app.UseGiraffe(webApp)
app.Run()

open Microsoft.AspNetCore.Builder
open Microsoft.AspNetCore.Authentication.JwtBearer   // => JWT Bearer NuGet package
open Microsoft.Extensions.DependencyInjection
open Microsoft.IdentityModel.Tokens                  // => TokenValidationParameters
open System.Text
open Giraffe

// Protected handler: only reachable with valid JWT
let meHandler : HttpHandler =
    requiresAuthentication (setStatusCode 401 >=> text "Unauthorized") >=>
    // => requiresAuthentication: HttpHandler -> HttpHandler
    // => First arg: handler to run if NOT authenticated
    // => If ctx.User.Identity.IsAuthenticated = false, runs the error handler
    // => If authenticated, passes to the next handler (>=> chain continues)
    fun next ctx ->
        task {
            // ctx.User is populated by JWT Bearer middleware
            let username =
                ctx.User.FindFirst(System.Security.Claims.ClaimTypes.Name)
                |> Option.ofObj
                |> Option.map (fun c -> c.Value)
                |> Option.defaultValue "unknown"
            // => ClaimTypes.Name extracts the "name" claim from the JWT
            // => Option.ofObj handles null Claim reference

            let email =
                ctx.User.FindFirst(System.Security.Claims.ClaimTypes.Email)
                |> Option.ofObj
                |> Option.map (fun c -> c.Value)
                |> Option.defaultValue ""

            return! json {| Username = username; Email = email |} next ctx
        }

let builder = WebApplication.CreateBuilder()

let jwtKey = "super-secret-key-at-least-32-characters-long"
// => In production, read from environment variable or key vault
// => Never hardcode secrets in source code

builder.Services
    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    // => Sets JWT Bearer as the default auth scheme
    .AddJwtBearer(fun options ->
        options.TokenValidationParameters <- TokenValidationParameters(
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtKey)),
            // => Validates the signature using the shared secret
            ValidateIssuer   = false,   // => Set to true in production with ValidIssuer
            ValidateAudience = false    // => Set to true in production with ValidAudience
        )
    ) |> ignore

builder.Services.AddGiraffe() |> ignore
let app = builder.Build()

app.UseAuthentication() |> ignore    // => Must be before UseAuthorization and UseGiraffe
app.UseAuthorization()  |> ignore

app.UseGiraffe(
    choose [
        GET >=> route "/me" >=> meHandler
        GET >=> route "/public" >=> text "No auth required"
    ]
)
app.Run()
// => GET /me (Authorization: Bearer <valid-jwt>) => {"username":"alice","email":"..."}
// => GET /me (no Authorization header)            => 401 "Unauthorized"
// => GET /public                                  => "No auth required" (200)

open Microsoft.AspNetCore.Builder
open Microsoft.AspNetCore.Authentication
open Microsoft.AspNetCore.Authentication.Cookies  // => Cookie auth package (built-in)
open Microsoft.Extensions.DependencyInjection
open System.Security.Claims
open Giraffe

// Sign in handler: creates the auth cookie
let signInHandler : HttpHandler =
    fun next ctx ->
        task {
            let! form = ctx.BindFormAsync<{| Username: string; Password: string |}>()
            // => Bind form data to anonymous record
            // => Anonymous records work with BindFormAsync

            if form.Username = "admin" && form.Password = "secret" then
                // => Real app: hash password, query database
                let claims = [
                    Claim(ClaimTypes.Name,  form.Username)     // => "name" claim
                    Claim(ClaimTypes.Role,  "Administrator")   // => "role" claim
                    Claim(ClaimTypes.Email, "admin@example.com") // => "email" claim
                ]
                // => Claims are name/value pairs embedded in the auth cookie

                let claimsIdentity =
                    ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme)
                // => Identity with cookie auth scheme

                let claimsPrincipal = ClaimsPrincipal(claimsIdentity)
                // => Principal wraps one or more identities

                do! ctx.SignInAsync(
                    CookieAuthenticationDefaults.AuthenticationScheme,
                    claimsPrincipal
                )
                // => Creates and sets the auth cookie in the response
                // => Cookie is encrypted and signed by ASP.NET Core's data protection

                return! redirectTo false "/dashboard" next ctx
                // => Redirect to protected area after login
            else
                return! (setStatusCode 401 >=> text "Invalid credentials") next ctx
        }

// Sign out handler: clears the auth cookie
let signOutHandler : HttpHandler =
    fun next ctx ->
        task {
            do! ctx.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme)
            // => Deletes the auth cookie from client
            // => Also invalidates server-side session if using ITicketStore
            return! redirectTo false "/login" next ctx
        }

// Protected dashboard
let dashboardHandler : HttpHandler =
    requiresAuthentication (redirectTo false "/login") >=>
    // => Unauthenticated: redirect to login page (not 401 - better UX for web apps)
    fun next ctx ->
        task {
            let username = ctx.User.Identity.Name |> Option.ofObj |> Option.defaultValue ""
            return! text $"Welcome, {username}!" next ctx
        }

let builder = WebApplication.CreateBuilder()
builder.Services
    .AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(fun options ->
        options.LoginPath  <- "/login"        // => Redirect unauthenticated to /login
        options.LogoutPath <- "/logout"       // => Logout endpoint
        options.ExpireTimeSpan <- System.TimeSpan.FromHours(1.0)
        // => Cookie expires after 1 hour of inactivity
        options.SlidingExpiration <- true
        // => Reset expiry on each authenticated request
    ) |> ignore
builder.Services.AddGiraffe() |> ignore
let app = builder.Build()
app.UseAuthentication() |> ignore
app.UseAuthorization()  |> ignore
app.UseGiraffe(choose [
    GET  >=> route "/login"     >=> text "Login form here"
    POST >=> route "/login"     >=> signInHandler
    POST >=> route "/logout"    >=> signOutHandler
    GET  >=> route "/dashboard" >=> dashboardHandler
])
app.Run()

open Microsoft.AspNetCore.Builder
open Microsoft.Extensions.DependencyInjection
open Giraffe

// requiresRole: string -> HttpHandler -> HttpHandler
// => First arg: required role name
// => Second arg: error handler (runs if user lacks the role)
// => Checks ctx.User.IsInRole(role)

let adminOnlyHandler : HttpHandler =
    requiresRole "Administrator" (setStatusCode 403 >=> text "Forbidden: requires Administrator role") >=>
    // => If ctx.User.IsInRole("Administrator") = false => 403
    // => If user has role => continues to next handler
    json {| Message = "Admin dashboard data"; AdminOnly = true |}

// requiresClaim: string -> string -> HttpHandler -> HttpHandler
// => First arg: claim type
// => Second arg: required claim value
// => Third arg: error handler
let premiumOnlyHandler : HttpHandler =
    requiresClaim "subscription" "premium" (setStatusCode 403 >=> text "Premium subscription required") >=>
    // => Checks if user has a claim of type "subscription" with value "premium"
    // => JWT payload: { "subscription": "premium", ... }
    json {| Message = "Premium feature data" |}

// Combining multiple authorization checks
let superAdminHandler : HttpHandler =
    requiresAuthentication (setStatusCode 401 >=> text "Login required")    >=>
    // => Check 1: must be authenticated
    requiresRole "Administrator" (setStatusCode 403 >=> text "Admin required") >=>
    // => Check 2: must be in Administrator role
    requiresClaim "mfa_verified" "true" (setStatusCode 403 >=> text "MFA required") >=>
    // => Check 3: must have MFA-verified claim
    text "Super admin area"
// => All three checks must pass in sequence

// Custom policy handler using pure F# logic
let ownerOrAdminHandler (resourceOwnerId : int) : HttpHandler =
    fun next ctx ->
        task {
            let userId =
                ctx.User.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)
                |> Option.ofObj |> Option.map (fun c -> int c.Value) |> Option.defaultValue 0
            // => Extract user ID from "sub" or NameIdentifier claim
            let isAdmin  = ctx.User.IsInRole("Administrator")
            let isOwner  = userId = resourceOwnerId
            if isAdmin || isOwner then
                return! next ctx       // => Authorized: admin or owner
            else
                return! (setStatusCode 403 >=> text "Not authorized") next ctx
        }

let webApp : HttpHandler =
    choose [
        GET >=> route "/admin"   >=> requiresAuthentication (setStatusCode 401 >=> text "Login") >=> adminOnlyHandler
        GET >=> route "/premium" >=> requiresAuthentication (setStatusCode 401 >=> text "Login") >=> premiumOnlyHandler
        GET >=> routef "/items/%i" (fun id ->
            requiresAuthentication (setStatusCode 401 >=> text "Login") >=>
            ownerOrAdminHandler id >=>
            text $"Item {id} data"
        )
    ]

let builder = WebApplication.CreateBuilder()
builder.Services.AddGiraffe() |> ignore
let app = builder.Build()
app.UseAuthentication() |> ignore
app.UseAuthorization()  |> ignore
app.UseGiraffe(webApp)
app.Run()

open Microsoft.AspNetCore.Builder
open Microsoft.Extensions.DependencyInjection
open Giraffe

// Define a service interface (F# can use abstract types or interfaces)
type IUserRepository =
    abstract member GetById: int -> Async<{| Id: int; Name: string; Email: string |} option>
    abstract member GetAll: unit -> Async<{| Id: int; Name: string |} list>
// => F# interface with abstract members
// => Async<'T> wraps asynchronous operations

// Concrete implementation
type InMemoryUserRepository() =
    let users = [
        {| Id = 1; Name = "Alice"; Email = "alice@example.com" |}
        {| Id = 2; Name = "Bob";   Email = "bob@example.com"   |}
    ]
    // => In-memory list simulates a database

    interface IUserRepository with
        member _.GetById(id) = async {
            return users |> List.tryFind (fun u -> u.Id = id)
            // => List.tryFind returns 'T option (Some if found, None if not)
        }
        member _.GetAll() = async {
            return users |> List.map (fun u -> {| Id = u.Id; Name = u.Name |})
            // => Return summary records (no email - less data over wire)
        }
// => InMemoryUserRepository implements IUserRepository

// Handler that uses the injected service
let getUsersHandler : HttpHandler =
    fun next ctx ->
        task {
            let repo = ctx.GetService<IUserRepository>()
            // => Resolves IUserRepository from DI container
            // => Will use InMemoryUserRepository (registered below)

            let! users = repo.GetAll() |> Async.StartAsTask
            // => GetAll returns Async<_>; StartAsTask converts to Task<_>
            // => let! in task {} awaits the Task
            return! json users next ctx
        }

let getUserByIdHandler (id : int) : HttpHandler =
    fun next ctx ->
        task {
            let repo = ctx.GetService<IUserRepository>()
            let! user = repo.GetById(id) |> Async.StartAsTask
            match user with
            | Some u -> return! json u next ctx            // => 200 with user
            | None   -> return! setStatusCode 404 >=> text $"User {id} not found" <| next <| ctx
                        // => 404 when not found
        }

let builder = WebApplication.CreateBuilder()

// Register implementation with the DI container
builder.Services.AddSingleton<IUserRepository, InMemoryUserRepository>() |> ignore
// => AddSingleton: one instance for the lifetime of the app
// => AddScoped: one instance per request
// => AddTransient: new instance every time resolved

builder.Services.AddGiraffe() |> ignore
let app = builder.Build()
app.UseGiraffe(choose [
    GET >=> route  "/users"     >=> getUsersHandler
    GET >=> routef "/users/%i" getUserByIdHandler
])
app.Run()
// => GET /users    => [{"id":1,"name":"Alice"},{"id":2,"name":"Bob"}]
// => GET /users/1  => {"id":1,"name":"Alice","email":"alice@example.com"}
// => GET /users/99 => 404 "User 99 not found"

open Microsoft.AspNetCore.Builder
open Microsoft.AspNetCore.Http                       // => IHttpContextAccessor
open Microsoft.Extensions.DependencyInjection
open Giraffe

// Service that needs the current user context
type ICurrentUserService =
    abstract member UserId   : int option
    abstract member Username : string option
    abstract member IsAdmin  : bool

type CurrentUserService(httpContextAccessor : IHttpContextAccessor) =
    // => Constructor injection: ASP.NET Core injects IHttpContextAccessor
    let user = httpContextAccessor.HttpContext.User
    // => Access the current request's user through IHttpContextAccessor
    // => IHttpContextAccessor wraps the HttpContext for injection

    interface ICurrentUserService with
        member _.UserId =
            user.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)
            |> Option.ofObj
            |> Option.map (fun c -> int c.Value)
        // => Returns None if not authenticated or no NameIdentifier claim

        member _.Username =
            user.FindFirst(System.Security.Claims.ClaimTypes.Name)
            |> Option.ofObj
            |> Option.map (fun c -> c.Value)

        member _.IsAdmin = user.IsInRole("Administrator")
// => CurrentUserService exposes current user info without HttpContext coupling

// Handler using injected current user service
let profileHandler : HttpHandler =
    fun next ctx ->
        task {
            let currentUser = ctx.GetService<ICurrentUserService>()
            // => Resolves the scoped CurrentUserService for this request

            return! json {|
                UserId   = currentUser.UserId
                Username = currentUser.Username
                IsAdmin  = currentUser.IsAdmin
            |} next ctx
        }

let builder = WebApplication.CreateBuilder()

// Register IHttpContextAccessor (required for per-request context access in services)
builder.Services.AddHttpContextAccessor() |> ignore
// => Enables injection of IHttpContextAccessor into services

// Register as Scoped (new instance per request, not singleton)
builder.Services.AddScoped<ICurrentUserService, CurrentUserService>() |> ignore
// => Scoped: one instance per HTTP request
// => Reuses the same CurrentUserService instance within one request

builder.Services.AddGiraffe() |> ignore
let app = builder.Build()
app.UseAuthentication() |> ignore
app.UseGiraffe(GET >=> route "/profile" >=> profileHandler)
app.Run()

open Microsoft.AspNetCore.Builder
open Microsoft.Extensions.DependencyInjection
open Microsoft.Extensions.Configuration
open Dapper                                          // => Dapper NuGet package
open System.Data.SqlClient                           // => Or Npgsql for PostgreSQL

// F# record for Dapper result mapping
// Column names in SQL must match record field names (case-insensitive by default)
[<CLIMutable>]                                       // => Required for Dapper's reflection
type ProductRow = {
    Id          : int
    Name        : string
    Price       : decimal
    CategoryId  : int
    CreatedAt   : System.DateTime
}
// => Dapper maps: id -> Id, name -> Name, price -> Price, etc.
// => [<CLIMutable>] adds a default constructor needed by Dapper

// Repository using Dapper
type ProductRepository(connectionString : string) =
    // => Constructor injection of connection string

    member _.GetAll() =
        task {
            use conn = new SqlConnection(connectionString)
            // => use: disposes conn when block exits (IDisposable)
            // => SqlConnection manages the database connection

            let! products =
                conn.QueryAsync<ProductRow>(
                    "SELECT id, name, price, category_id AS CategoryId, created_at AS CreatedAt FROM products"
                )
            // => QueryAsync<'T>: executes SQL and maps rows to 'T list
            // => AS aliases align SQL column names to F# record field names
            // => Returns IEnumerable<ProductRow>

            return products |> Seq.toList
            // => Convert IEnumerable to F# list
        }

    member _.GetById(id : int) =
        task {
            use conn = new SqlConnection(connectionString)
            let! product =
                conn.QueryFirstOrDefaultAsync<ProductRow>(
                    "SELECT id, name, price, category_id AS CategoryId, created_at AS CreatedAt FROM products WHERE id = @Id",
                    {| Id = id |}
                    // => Anonymous record as parameter object
                    // => @Id in SQL maps to Id field in anonymous record
                )
            // => QueryFirstOrDefaultAsync: returns first row or default(T)
            // => Default for record is null (reference type in .NET)
            return product |> Option.ofObj
            // => Convert null to None, value to Some
        }

// Handler using Dapper repository
let productsHandler (repo : ProductRepository) : HttpHandler =
    fun next ctx ->
        task {
            let! products = repo.GetAll()
            return! json products next ctx
        }

let builder = WebApplication.CreateBuilder()
builder.Services.AddGiraffe() |> ignore

let connStr = builder.Configuration.GetConnectionString("Default")
// => Reads from appsettings.json: { "ConnectionStrings": { "Default": "..." } }
let repo = ProductRepository(connStr)

let app = builder.Build()
app.UseGiraffe(GET >=> route "/products" >=> productsHandler repo)
app.Run()
// => GET /products => JSON array of ProductRow records from database

open Microsoft.AspNetCore.Builder
open Microsoft.EntityFrameworkCore                   // => EF Core NuGet package
open Microsoft.Extensions.DependencyInjection
open Giraffe

// EF Core entity (table model)
[<CLIMutable>]
type Todo = {
    mutable Id      : int       // => mutable required: EF Core sets Id after INSERT
    mutable Title   : string
    mutable Done    : bool
    mutable Created : System.DateTime
}
// => mutable fields allow EF Core's change tracker to modify values
// => Without mutable, EF Core cannot update properties after materialization

// DbContext for EF Core
type AppDbContext(options : DbContextOptions<AppDbContext>) =
    inherit DbContext(options)
    // => Inherit DbContext with options (connection string, provider, etc.)

    [<DefaultValue>]
    val mutable Todos : DbSet<Todo>
    // => DbSet<T> represents the todos table
    // => [<DefaultValue>] initializes mutable val to null (EF Core injects it)

    override this.OnModelCreating(builder : ModelBuilder) =
        builder.Entity<Todo>().HasKey(fun t -> t.Id :> obj) |> ignore
        // => Define primary key for Todo entity
        // => Real app: configure indexes, constraints, relationships

// Giraffe handler using EF Core
let getTodosHandler : HttpHandler =
    fun next ctx ->
        task {
            let db = ctx.GetService<AppDbContext>()
            // => Resolve AppDbContext from DI (registered as scoped)

            let! todos =
                db.Todos
                    .AsNoTracking()
                    // => AsNoTracking: don't track changes (read-only query)
                    // => Better performance for queries that don't update
                    .ToListAsync()
            // => ToListAsync: async materialization of the query

            return! json todos next ctx
        }

let createTodoHandler : HttpHandler =
    fun next ctx ->
        task {
            let! newTodo = ctx.BindJsonAsync<{| Title: string |}>()
            // => Bind JSON body to anonymous record
            let db = ctx.GetService<AppDbContext>()

            let todo = { Id = 0; Title = newTodo.Title; Done = false; Created = System.DateTime.UtcNow }
            // => Id = 0: EF Core replaces with generated ID after INSERT

            db.Todos.Add(todo) |> ignore    // => Add to change tracker
            let! _ = db.SaveChangesAsync()  // => Persist to database
            // => SaveChangesAsync: generates and executes INSERT SQL

            return! (setStatusCode 201 >=> json todo) next ctx
            // => Return created todo with generated Id
        }

let builder = WebApplication.CreateBuilder()
builder.Services.AddDbContext<AppDbContext>(fun opts ->
    opts.UseSqlite("Data Source=app.db") |> ignore
    // => UseSqlite: SQLite provider (for testing/development)
    // => Production: UseNpgsql/UseSqlServer with connection string
) |> ignore
builder.Services.AddGiraffe() |> ignore
let app = builder.Build()

// Apply migrations on startup (development only)
using (app.Services.CreateScope()) (fun scope ->
    let db = scope.ServiceProvider.GetRequiredService<AppDbContext>()
    db.Database.EnsureCreated() |> ignore
    // => EnsureCreated: creates database schema if not exists
    // => Production: use db.Database.Migrate() for proper migrations
)

app.UseGiraffe(choose [
    GET  >=> route "/todos" >=> getTodosHandler
    POST >=> route "/todos" >=> createTodoHandler
])
app.Run()

open Microsoft.AspNetCore.Builder
open Microsoft.AspNetCore.Http                      // => IFormFile
open Microsoft.Extensions.DependencyInjection
open System.IO
open Giraffe

// File upload handler
let uploadHandler : HttpHandler =
    fun next ctx ->
        task {
            // Validate content type is multipart/form-data
            if not (ctx.Request.HasFormContentType) then
                return! (setStatusCode 400 >=> text "Expected multipart/form-data") next ctx
            else
                // Access uploaded files from the form
                let files = ctx.Request.Form.Files
                // => IFormFileCollection: all uploaded files in this request
                // => Indexed by name attribute of the HTML <input type="file">

                if files.Count = 0 then
                    return! (setStatusCode 400 >=> text "No files uploaded") next ctx
                else
                    let file = files.[0]
                    // => IFormFile: first uploaded file
                    // => file.FileName: original filename from client
                    // => file.Length: file size in bytes
                    // => file.ContentType: MIME type reported by client

                    // Validate file size (10MB limit)
                    let maxSize = 10L * 1024L * 1024L   // => 10 MB in bytes
                    if file.Length > maxSize then
                        return! (setStatusCode 413 >=> text "File too large (max 10MB)") next ctx
                    // => 413 Payload Too Large

                    // Validate file type by extension (real app: check magic bytes)
                    let allowedExtensions = [".jpg"; ".jpeg"; ".png"; ".gif"; ".pdf"]
                    let ext = Path.GetExtension(file.FileName).ToLowerInvariant()
                    // => GetExtension: ".jpg" from "photo.jpg"
                    if not (List.contains ext allowedExtensions) then
                        return! (setStatusCode 400 >=> text $"File type {ext} not allowed") next ctx
                    else
                        // Generate safe filename to prevent path traversal
                        let safeFileName = $"{System.Guid.NewGuid()}{ext}"
                        // => New GUID prevents collisions and path traversal attacks
                        // => Never use file.FileName directly on disk

                        let uploadPath = Path.Combine("uploads", safeFileName)
                        Directory.CreateDirectory("uploads") |> ignore
                        // => Create uploads directory if not exists

                        use stream = new FileStream(uploadPath, FileMode.Create)
                        do! file.CopyToAsync(stream)
                        // => CopyToAsync: streams file from request to disk
                        // => Avoids loading entire file into memory

                        return! json {|
                            FileName    = safeFileName
                            OriginalName = file.FileName
                            Size        = file.Length
                            ContentType = file.ContentType
                        |} next ctx
        }

let builder = WebApplication.CreateBuilder()
builder.Services.AddGiraffe() |> ignore
let app = builder.Build()
app.UseGiraffe(POST >=> route "/upload" >=> uploadHandler)
app.Run()
// => POST /upload (multipart/form-data, valid image) => 200 JSON with file info
// => POST /upload (file > 10MB)                      => 413 "File too large"
// => POST /upload (file.exe)                         => 400 "File type .exe not allowed"

open Microsoft.AspNetCore.Builder
open Microsoft.AspNetCore.WebSockets               // => WebSocket support
open Microsoft.Extensions.DependencyInjection
open System.Net.WebSockets                         // => WebSocket, WebSocketReceiveResult
open System.Text
open Giraffe

// WebSocket echo handler: receives messages and sends them back
let webSocketHandler : HttpHandler =
    fun next ctx ->
        task {
            if ctx.WebSockets.IsWebSocketRequest then
                // => IsWebSocketRequest: true if client sent Upgrade: websocket header
                let! ws = ctx.WebSockets.AcceptWebSocketAsync()
                // => Upgrades the HTTP connection to WebSocket protocol
                // => Returns WebSocket object for send/receive

                let buffer = Array.zeroCreate<byte> 4096
                // => Buffer for incoming messages (4KB per read)

                let mutable keepRunning = true
                while keepRunning do
                    // Receive a message from the client
                    let! result = ws.ReceiveAsync(
                        System.ArraySegment<byte>(buffer), ctx.RequestAborted
                    )
                    // => ReceiveAsync: waits for next message from client
                    // => ctx.RequestAborted: CancellationToken for graceful shutdown
                    // => result: WebSocketReceiveResult (message type, count, close status)

                    match result.MessageType with
                    | WebSocketMessageType.Text ->
                        // => Client sent a text message
                        let message = Encoding.UTF8.GetString(buffer, 0, result.Count)
                        // => Decode bytes to string (UTF-8)
                        printfn $"Received: {message}"

                        // Echo back the message with a prefix
                        let response = Encoding.UTF8.GetBytes($"Echo: {message}")
                        do! ws.SendAsync(
                            System.ArraySegment<byte>(response),
                            WebSocketMessageType.Text,
                            endOfMessage = true,          // => true: complete message
                            cancellationToken = ctx.RequestAborted
                        )
                        // => SendAsync: sends bytes to client

                    | WebSocketMessageType.Close ->
                        // => Client initiated close handshake
                        do! ws.CloseAsync(WebSocketCloseStatus.NormalClosure, "Bye", ctx.RequestAborted)
                        // => Complete the close handshake
                        keepRunning <- false              // => Exit the receive loop
                    | _ ->
                        keepRunning <- false              // => Binary or unexpected: close

                return Some ctx                          // => Return Some to complete handler
            else
                // Non-WebSocket request to this endpoint
                return! (setStatusCode 400 >=> text "WebSocket connections only") next ctx
        }

let builder = WebApplication.CreateBuilder()
builder.Services.AddGiraffe() |> ignore
let app = builder.Build()

// UseWebSockets MUST be called before UseGiraffe
app.UseWebSockets() |> ignore
// => Enables WebSocket upgrade handling in the pipeline

app.UseGiraffe(GET >=> route "/ws" >=> webSocketHandler)
app.Run()
// => WS connect to /ws => upgrade to WebSocket
// => Send "hello" => receive "Echo: hello"
// => Send close => graceful close handshake

// Tests project: add packages Microsoft.AspNetCore.TestHost, xunit, FsUnit.Xunit

open Xunit                                          // => xUnit test framework
open System.Net                                     // => HttpStatusCode
open System.Net.Http                                // => HttpClient, StringContent
open Microsoft.AspNetCore.TestHost                  // => TestServer, WebHostBuilder
open Microsoft.AspNetCore.Builder
open Microsoft.Extensions.DependencyInjection
open Giraffe

// ===== Application under test =====
let createApp () =
    let webApp : HttpHandler =
        choose [
            GET  >=> route "/api/ping"   >=> text "pong"
            POST >=> route "/api/echo"   >=> fun next ctx ->
                task {
                    let! body = ctx.ReadBodyFromRequestAsync()
                    return! text $"Echo: {body}" next ctx
                }
        ]

    let builder = WebApplication.CreateBuilder()
    builder.Services.AddGiraffe() |> ignore
    let app = builder.Build()
    app.UseGiraffe(webApp)
    app
// => Creates the WebApplication but does NOT call app.Run()
// => TestHost uses this without starting a real server

// ===== Test class =====
type GiraffeIntegrationTests() =
    // Create TestServer from the application
    let server =
        new TestServer(
            Microsoft.AspNetCore.WebHost
                .CreateDefaultBuilder()
                .Configure(fun app ->
                    let webApp : HttpHandler =
                        choose [
                            GET  >=> route "/api/ping" >=> text "pong"
                            POST >=> route "/api/echo" >=> fun next ctx ->
                                task {
                                    let! body = ctx.ReadBodyFromRequestAsync()
                                    return! text $"Echo: {body}" next ctx
                                }
                        ]
                    app.UseGiraffe(webApp)
                )
                .ConfigureServices(fun services ->
                    services.AddGiraffe() |> ignore
                )
        )
    // => TestServer builds and hosts app in memory

    let client = server.CreateClient()
    // => HttpClient wired to the TestServer (no real network)

    [<Fact>]
    member _.``GET /api/ping returns pong``() =
        task {
            // Arrange
            let request = new HttpRequestMessage(HttpMethod.Get, "/api/ping")
            // => Create HTTP GET request

            // Act
            let! response = client.SendAsync(request)
            // => Sends request through in-process pipeline

            // Assert
            Assert.Equal(HttpStatusCode.OK, response.StatusCode)
            // => Verify 200 status code
            let! body = response.Content.ReadAsStringAsync()
            Assert.Equal("pong", body)
            // => Verify response body
        }

    [<Fact>]
    member _.``POST /api/echo returns echoed body``() =
        task {
            let content = new StringContent("hello world", System.Text.Encoding.UTF8, "text/plain")
            let! response = client.PostAsync("/api/echo", content)
            // => POST with body "hello world"

            Assert.Equal(HttpStatusCode.OK, response.StatusCode)
            let! body = response.Content.ReadAsStringAsync()
            Assert.Equal("Echo: hello world", body)
        }

    interface System.IDisposable with
        member _.Dispose() = server.Dispose()
        // => Clean up TestServer after all tests

open Xunit
open System.IO
open Microsoft.AspNetCore.Http                     // => DefaultHttpContext

// The handler to test
open Giraffe

let greetHandler (name : string) : HttpHandler =
    fun next ctx ->
        task {
            if name.Length < 2 then
                return! (setStatusCode 400 >=> text "Name too short") next ctx
            else
                return! text $"Hello, {name}!" next ctx
        }
// => Pure function: behavior depends only on name and ctx

// Helper: create a minimal HttpContext for testing
let createTestContext () =
    let ctx = DefaultHttpContext()
    // => DefaultHttpContext: in-memory HttpContext with no real network
    ctx.Response.Body <- new MemoryStream()
    // => Replace response body with MemoryStream (readable after handler runs)
    ctx

// Helper: read response body from test context
let readBody (ctx : HttpContext) =
    ctx.Response.Body.Seek(0L, SeekOrigin.Begin) |> ignore
    // => Seek to start of MemoryStream
    use reader = new StreamReader(ctx.Response.Body)
    reader.ReadToEnd()
    // => Read entire response body as string

// Terminal HttpFunc: does nothing, just returns the context
let terminalNext : HttpFunc =
    fun ctx -> task { return Some ctx }
// => Represents "end of pipeline" for testing

type HandlerTests() =
    [<Fact>]
    member _.``greetHandler returns greeting for valid name``() =
        task {
            let ctx = createTestContext()
            let! result = greetHandler "Alice" terminalNext ctx
            // => Call handler directly with test context

            Assert.True(result.IsSome)             // => Handler returned Some (not None)
            let body = readBody ctx
            Assert.Equal("Hello, Alice!", body)    // => Verify response body
            Assert.Equal(200, ctx.Response.StatusCode) // => Default 200
        }

    [<Fact>]
    member _.``greetHandler returns 400 for short name``() =
        task {
            let ctx = createTestContext()
            let! _ = greetHandler "X" terminalNext ctx
            // => Handler short-circuits to 400

            Assert.Equal(400, ctx.Response.StatusCode) // => Verify 400 status
            let body = readBody ctx
            Assert.Equal("Name too short", body)   // => Verify error message
        }

open Microsoft.AspNetCore.Builder
open Microsoft.Extensions.DependencyInjection
open System.IO
open Giraffe

// Stream a large file from disk
let downloadHandler (filePath : string) : HttpHandler =
    fun next ctx ->
        task {
            if not (File.Exists(filePath)) then
                return! (setStatusCode 404 >=> text "File not found") next ctx
            else
                let info = FileInfo(filePath)
                // => FileInfo: metadata about the file

                ctx.Response.ContentType   <- "application/octet-stream"
                // => Generic binary content type
                ctx.Response.ContentLength <- Nullable(info.Length)
                // => Set Content-Length for progress indicators
                ctx.SetHttpHeader("Content-Disposition", $"attachment; filename={info.Name}") |> ignore
                // => Forces browser to download rather than display

                use fileStream = File.OpenRead(filePath)
                // => OpenRead: opens file for reading
                do! fileStream.CopyToAsync(ctx.Response.Body)
                // => Stream file content directly to response
                // => Avoids loading entire file into memory
                // => Buffer size defaults to 81920 bytes (~80KB)

                return! next ctx   // => Pass to next handler
        }

// Server-Sent Events (SSE) for real-time updates without WebSocket
let sseHandler : HttpHandler =
    fun next ctx ->
        task {
            ctx.Response.ContentType <- "text/event-stream"
            // => SSE MIME type
            ctx.Response.Headers["Cache-Control"] <- "no-cache"
            // => Prevent caching of event stream
            ctx.Response.Headers["Connection"] <- "keep-alive"
            // => Keep connection open for streaming

            let writer = ctx.Response.BodyWriter
            // => PipeWriter for efficient buffered writing

            // Send 5 events with 1 second interval
            for i in 1..5 do
                let data = $"data: {{\"count\":{i},\"time\":\"{System.DateTime.UtcNow:u}\"}}\n\n"
                // => SSE format: "data: ...\n\n" (double newline ends event)
                let bytes = System.Text.Encoding.UTF8.GetBytes(data)
                do! writer.WriteAsync(System.ReadOnlyMemory<byte>(bytes))
                // => Write event to response buffer
                do! ctx.Response.Body.FlushAsync()
                // => Flush buffer to client immediately (do not accumulate)

                do! System.Threading.Tasks.Task.Delay(1000, ctx.RequestAborted)
                // => Wait 1 second between events
                // => ctx.RequestAborted: cancel if client disconnects

            return! next ctx
        }

let builder = WebApplication.CreateBuilder()
builder.Services.AddGiraffe() |> ignore
let app = builder.Build()
app.UseGiraffe(choose [
    GET >=> routef "/download/%s" (fun name -> downloadHandler $"files/{name}")
    GET >=> route  "/events"      >=> sseHandler
])
app.Run()
// => GET /download/report.pdf => streams file as download
// => GET /events              => SSE stream of 5 events, 1 per second

open Microsoft.AspNetCore.Builder
open Microsoft.AspNetCore.Cors.Infrastructure         // => CorsOptions, CorsPolicyBuilder
open Microsoft.Extensions.DependencyInjection
open Giraffe

// CORS policies define which origins, methods, and headers are allowed
let builder = WebApplication.CreateBuilder()

builder.Services.AddCors(fun options ->
    // Define a named policy for your frontend
    options.AddPolicy("FrontendPolicy", fun policy ->
        policy
            .WithOrigins("https://myapp.com", "https://www.myapp.com")
            // => Allow requests from these specific origins
            // => WithOrigins checks the Origin header against this whitelist
            .WithMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
            // => Allow these HTTP methods
            .WithHeaders("Content-Type", "Authorization", "X-Correlation-ID")
            // => Allow these request headers
            .AllowCredentials()
            // => Allow cookies and Authorization headers (cannot be used with AllowAnyOrigin)
        |> ignore
    )

    // Define a more permissive policy for development
    options.AddPolicy("DevelopmentPolicy", fun policy ->
        policy
            .AllowAnyOrigin()       // => Allow any origin (NEVER in production with credentials)
            .AllowAnyMethod()       // => Allow any HTTP method
            .AllowAnyHeader()       // => Allow any request header
        |> ignore
    )
) |> ignore

builder.Services.AddGiraffe() |> ignore
let app = builder.Build()

// Apply CORS middleware BEFORE routing and Giraffe
let corsPolicy =
    if app.Environment.IsDevelopment() then "DevelopmentPolicy"
    else "FrontendPolicy"

app.UseCors(corsPolicy) |> ignore
// => UseCors processes preflight OPTIONS requests and adds CORS headers
// => Must be BEFORE UseGiraffe so CORS headers appear on all responses

app.UseGiraffe(choose [
    GET  >=> route "/api/data" >=> json {| Data = "Hello from API" |}
    POST >=> route "/api/data" >=> text "Data received"
])
app.Run()
// => Browser (from myapp.com): OPTIONS /api/data => 204 with CORS headers
// => Browser: GET /api/data => 200 with Access-Control-Allow-Origin header
// => Browser from other.com: GET /api/data => 403 CORS blocked by browser

open Microsoft.AspNetCore.Builder
open Microsoft.Extensions.DependencyInjection
open System.Text.Json                               // => JsonSerializerOptions
open System.Text.Json.Serialization                 // => JsonConverter, JsonStringEnumConverter
open Giraffe
open Giraffe.Serialization.Json                     // => NewtonsoftJson (if using Newtonsoft)

// Custom serialization options
let serializerOptions = JsonSerializerOptions()
serializerOptions.PropertyNamingPolicy    <- JsonNamingPolicy.CamelCase
// => camelCase field names: Id -> id, FirstName -> firstName
serializerOptions.DefaultIgnoreCondition  <- JsonIgnoreCondition.WhenWritingNull
// => Omit null fields from JSON output (reduces payload size)
serializerOptions.WriteIndented           <- false
// => Compact output (no whitespace); set to true for debugging
serializerOptions.Converters.Add(JsonStringEnumConverter())
// => Serialize DU/enum as string: Active | Inactive => "Active" | "Inactive"
// => Without this: enums serialize as integers (0, 1, ...)

// Discriminated union for order status
type OrderStatus = Active | Completed | Cancelled | OnHold
// => DU with JsonStringEnumConverter: serializes as "Active", "Completed", etc.

type Order = {
    Id          : int
    Status      : OrderStatus        // => "Active" in JSON
    Description : string option      // => null in JSON if None (with WhenWritingNull)
    CreatedAt   : System.DateTime    // => ISO 8601 date string
}

let sampleOrder = {
    Id          = 42
    Status      = Active
    Description = None               // => Will be omitted in JSON output
    CreatedAt   = System.DateTime.UtcNow
}

let builder = WebApplication.CreateBuilder()

// Register custom JSON serializer with Giraffe
builder.Services
    .AddSingleton<Json.ISerializer>(SystemTextJson.Serializer(serializerOptions))
    |> ignore
// => Replaces default Giraffe serializer with configured instance
// => All calls to `json value` use these options

builder.Services.AddGiraffe() |> ignore
let app = builder.Build()
app.UseGiraffe(GET >=> route "/order" >=> json sampleOrder)
app.Run()
// => GET /order => {"id":42,"status":"Active","createdAt":"2026-03-19T..."}
// => description is omitted (WhenWritingNull)
// => status is "Active" not 0 (JsonStringEnumConverter)

open Microsoft.AspNetCore.Builder
open Microsoft.Extensions.DependencyInjection
open Giraffe

// task {} computation expression keywords:
// let!  => await Task<'T>, bind result to name
// do!   => await Task (no return value)
// return! => tail-call into another Task
// use!  => await Task<IDisposable>, auto-dispose when block exits
// return => wrap value in completed Task

// Parallel async operations using Task.WhenAll
let parallelHandler : HttpHandler =
    fun next ctx ->
        task {
            // Start multiple async operations concurrently
            let task1 = System.Threading.Tasks.Task.Delay(100) |> Async.AwaitTask
            // => Simulates a 100ms async operation (e.g., DB query)
            let task2 = System.Threading.Tasks.Task.Delay(100) |> Async.AwaitTask
            // => Another 100ms operation running in parallel

            do! Async.Parallel [task1; task2] |> Async.Ignore
            // => Async.Parallel: run both concurrently
            // => Total time: ~100ms instead of ~200ms sequential
            // => For Task<'T>: Task.WhenAll([task1Result; task2Result]) works too

            return! json {| Parallel = true; Note = "Both tasks ran concurrently" |} next ctx
        }

// Sequential async with Result chaining
let validateAndSaveHandler : HttpHandler =
    fun next ctx ->
        task {
            let! body = ctx.BindJsonAsync<{| Name: string; Value: int |}>()
            // => let!: await BindJsonAsync, bind result to body

            // Validate asynchronously (e.g., check DB for uniqueness)
            let! isUnique =
                System.Threading.Tasks.Task.FromResult(body.Name <> "duplicate")
                // => Simulates async uniqueness check
                // => Real app: query database

            if not isUnique then
                return! (setStatusCode 409 >=> text "Name already exists") next ctx
                // => return!: tail-call into the error response handler
                // => Exits the task {} block immediately
            elif body.Value < 0 then
                return! (setStatusCode 400 >=> text "Value must be non-negative") next ctx
            else
                // Simulate saving to database
                do! System.Threading.Tasks.Task.Delay(10)
                // => do!: await without binding result

                return! (setStatusCode 201 >=> json {| Name = body.Name; Value = body.Value; Saved = true |}) next ctx
        }

// use! for IAsyncDisposable resources
let transactionalHandler : HttpHandler =
    fun next ctx ->
        task {
            // In real code: open a database connection/transaction
            // use! conn = openConnectionAsync() -- auto-closes on exit
            // let! result = executeQueryAsync conn "SELECT..."
            // return! json result next ctx

            // Simulating with a plain async value for demonstration
            let! result = System.Threading.Tasks.Task.FromResult {| Data = "Transactional result" |}
            return! json result next ctx
        }

let builder = WebApplication.CreateBuilder()
builder.Services.AddGiraffe() |> ignore
let app = builder.Build()
app.UseGiraffe(choose [
    GET  >=> route "/parallel" >=> parallelHandler
    POST >=> route "/save"     >=> validateAndSaveHandler
])
app.Run()