fix: use manual auth scheme fallback

Author: pandinocoder

Intersect.Server/Web/Net7/ApiService.cs

@@ -43,6 +43,7 @@ namespace Intersect.Server.Web;
 
 internal partial class ApiService : ApplicationService<ServerContext, IApiService, ApiService>, IApiService
 {
+    private const string BearerCookieFallbackAuthenticationScheme = "BearerCookieFallback";
     private WebApplication? _app;
     private static readonly Assembly Assembly = typeof(ApiService).Assembly;
 
@@ -153,14 +154,7 @@ internal partial class ApiService : ApplicationService<ServerContext, IApiServic
 
         builder.Services.AddSingleton<IntersectAuthenticationManager>();
 
-        builder.Services.AddAuthentication(
-                options =>
-                {
-                    options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
-                    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
-                    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
-                }
-            )
+        builder.Services.AddAuthentication(BearerCookieFallbackAuthenticationScheme)
             .AddCookie(
                 CookieAuthenticationDefaults.AuthenticationScheme,
                 options =>
@@ -288,6 +282,15 @@ internal partial class ApiService : ApplicationService<ServerContext, IApiServic
                     SymmetricSecurityKey issuerKey = new(tokenGenerationOptions.SecretData);
                     options.TokenValidationParameters.IssuerSigningKey = issuerKey;
                 }
+            ).AddPolicyScheme(
+                BearerCookieFallbackAuthenticationScheme,
+                "Bearer-to-Cookie Fallback",
+                pso =>
+                {
+                    pso.ForwardDefaultSelector = context => context.Request.Headers.Authorization.Count > 0
+                        ? JwtBearerDefaults.AuthenticationScheme
+                        : CookieAuthenticationDefaults.AuthenticationScheme;
+                }
             );
 
         builder.Services.AddOutputCache(o => o.AddPolicy(nameof(AvatarController), AvatarController.OutputCachePolicy));

Intersect.Server/Web/Net7/Middleware/AuthenticationDebugMiddleware.cs

@@ -28,7 +28,7 @@ public AuthenticationDebugMiddleware(RequestDelegate next, IAuthenticationScheme
     public async Task Invoke(HttpContext context)
     {
         var handlers = context.RequestServices.GetRequiredService<IAuthenticationHandlerProvider>();
-        var schemes = await Schemes.GetRequestHandlerSchemesAsync();
+        var schemes = (await Schemes.GetRequestHandlerSchemesAsync()).ToArray();
         foreach (var scheme in schemes)
         {
             if (await handlers.GetHandlerAsync(context, scheme.Name) is IAuthenticationRequestHandler handler &&