Program.cs

using System.Text;
using Bastion.Data;
using Bastion.Interfaces;
using Bastion.Models;
using Bastion.Services;
using MaxMind.GeoIP2;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.EntityFrameworkCore;
using Microsoft.IdentityModel.Tokens;
using Serilog;

Log.Logger = new LoggerConfiguration()
    .WriteTo.Console()
    .WriteTo.File("logs/bastion_.log", rollingInterval: RollingInterval.Day)
    .CreateLogger();

try
{
    var builder = WebApplication.CreateBuilder(args);
    builder.Host.UseSerilog();

    var jwtKey = builder.Configuration["Jwt:Key"] ?? "SuperSecretKeyForBastion2024!DefaultKey";
    builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddJwtBearer(options =>
        {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = true,
                ValidateAudience = true,
                ValidateLifetime = true,
                ValidateIssuerSigningKey = true,
                ValidIssuer = "Bastion",
                ValidAudience = "Bastion",
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtKey))
            };
        });
    builder.Services.AddAuthorization();

    // SQL Server DbContext
    builder.Services.AddDbContext<AppDbContext>(options =>
        options.UseSqlServer(builder.Configuration.GetConnectionString("DefaultConnection")));

    // Repositories using SQL
    builder.Services.AddScoped<IRepository<User>, SqlRepository<User>>();
    builder.Services.AddScoped<IRepository<LoginAttempt>, SqlRepository<LoginAttempt>>();
    builder.Services.AddScoped<IAuthService, AuthService>();

    // Register MaxMind GeoIP2 reader
    var mmdbPath = Path.Combine(builder.Environment.ContentRootPath, "Data", "GeoLite2-City.mmdb");
    if (File.Exists(mmdbPath))
    {
        builder.Services.AddSingleton(new DatabaseReader(mmdbPath));
        Log.Information("GeoIP2 database loaded from {Path}", mmdbPath);
    }
    else
    {
        Log.Warning("GeoLite2-City.mmdb not found at {Path}. GeoIP lookups disabled.", mmdbPath);
    }

    builder.Services.AddControllers();

    var app = builder.Build();

    // Phase 7: Seed canary administrator account
    using (var scope = app.Services.CreateScope())
    {
        var userRepo = scope.ServiceProvider.GetRequiredService<IRepository<User>>();
        var admin = await userRepo.GetByUsername("administrator");
        if (admin == null)
        {
            var canary = new User
            {
                Username = "administrator",
                PasswordHash = BCrypt.Net.BCrypt.HashPassword(Guid.NewGuid().ToString()),
                Role = "Admin",
                CreatedAt = DateTime.UtcNow
            };
            await userRepo.Add(canary);
            Log.Information("Canary administrator account seeded.");
        }
    }

    app.UseStaticFiles();
    app.UseAuthentication();
    app.UseAuthorization();
    app.MapControllers();

    app.MapGet("/", () => "Bastion Security API is running.");

    app.Run();
}
catch (Exception ex)
{
    Log.Fatal(ex, "Application terminated unexpectedly");
}
finally
{
    Log.CloseAndFlush();
}