Program.cs

using Microsoft.AspNetCore.Authentication;
using Microsoft.OpenApi.Models;
using System.Net.Http.Headers;
using System.Security.Claims;
using System.Text.Encodings.Web;
using Microsoft.Extensions.Options;
using K8sControlApi.Services;

var builder = WebApplication.CreateBuilder(args);

var enableAuth = Environment.GetEnvironmentVariable("ENABLE_BASIC_AUTH")?.ToLower() == "true";

builder.Services.AddControllers();
builder.Services.AddSingleton<K8sService>();  // ✅ Add K8sService to DI
builder.Services.AddEndpointsApiExplorer();

builder.Services.AddSwaggerGen(c =>
{
    if (enableAuth)
    {
        c.AddSecurityDefinition("basic", new OpenApiSecurityScheme
        {
            Name = "Authorization",
            Type = SecuritySchemeType.Http,
            Scheme = "basic", // ✅ Match this
            In = ParameterLocation.Header,
            Description = "Basic Authentication"
        });

        c.AddSecurityRequirement(new OpenApiSecurityRequirement
        {
            {
                new OpenApiSecurityScheme
                {
                    Reference = new OpenApiReference { Type = ReferenceType.SecurityScheme, Id = "basic" }
                },
                new string[] {}
            }
        });
    }
});

if (enableAuth)
{
    builder.Services.AddAuthentication("basic") // ✅ Match scheme name used in Swagger
        .AddScheme<AuthenticationSchemeOptions, BasicAuthHandler>("basic", null);
}

var app = builder.Build();

app.UseSwagger();
app.UseSwaggerUI();

if (enableAuth)
{
    app.UseAuthentication();
}

app.UseAuthorization();

app.MapControllers();

app.Run();

public class BasicAuthHandler : AuthenticationHandler<AuthenticationSchemeOptions>
{
    public BasicAuthHandler(
        IOptionsMonitor<AuthenticationSchemeOptions> options,
        ILoggerFactory logger,
        UrlEncoder encoder,
        ISystemClock clock)
        : base(options, logger, encoder, clock) { }

    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        if (!Request.Headers.ContainsKey("Authorization"))
            return Task.FromResult(AuthenticateResult.Fail("Missing Authorization Header"));

        try
        {
            var authHeader = AuthenticationHeaderValue.Parse(Request.Headers["Authorization"]);
            var credentials = System.Text.Encoding.UTF8
                .GetString(Convert.FromBase64String(authHeader.Parameter ?? ""))
                .Split(':', 2);

            var username = Environment.GetEnvironmentVariable("BASIC_AUTH_USER");
            var password = Environment.GetEnvironmentVariable("BASIC_AUTH_PASSWORD");

            if (credentials.Length == 2 &&
                credentials[0] == username &&
                credentials[1] == password)
            {
                var claims = new[] { new Claim(ClaimTypes.Name, credentials[0]) };
                var identity = new ClaimsIdentity(claims, Scheme.Name);
                var principal = new ClaimsPrincipal(identity);
                var ticket = new AuthenticationTicket(principal, Scheme.Name);
                return Task.FromResult(AuthenticateResult.Success(ticket));
            }

            return Task.FromResult(AuthenticateResult.Fail("Invalid Username or Password"));
        }
        catch
        {
            return Task.FromResult(AuthenticateResult.Fail("Invalid Authorization Header"));
        }
    }
}