hamkadr/src/JobsMedical.Web/Program.cs

using System.Text.Encodings.Web;
using System.Text.Unicode;
using JobsMedical.Web.Data;
using JobsMedical.Web.Models;
using JobsMedical.Web.Services;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.HttpOverrides;
using Microsoft.EntityFrameworkCore;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.
builder.Services.AddRazorPages();

// Interest tracking + recommendation engine.
builder.Services.AddHttpContextAccessor();
builder.Services.AddMemoryCache();
builder.Services.AddScoped<VisitorContext>();
builder.Services.AddScoped<InterestService>();
builder.Services.AddScoped<RecommendationService>();
builder.Services.AddHttpClient("sms");
builder.Services.AddSingleton<ISmsSender, KavenegarSmsSender>();
builder.Services.AddScoped<OtpService>();
builder.Services.AddSingleton<CaptchaService>();
builder.Services.AddScoped<SubmissionGuard>();
// Listing parser: heuristic now; swap for an LLM-backed IListingParser later.
builder.Services.AddSingleton<IListingParser, HeuristicListingParser>();

// Scrape/ingestion engine: pluggable sources → dedupe → parse → validate → (AI audit) → publish/queue.
builder.Services.AddHttpClient("scrape", c =>
{
    c.Timeout = TimeSpan.FromSeconds(20);
    c.DefaultRequestHeaders.UserAgent.ParseAdd("Mozilla/5.0 (compatible; HamkadrBot/1.0)");
});
builder.Services.AddHttpClient("ai");
builder.Services.AddSingleton<JobsMedical.Web.Services.Scraping.ListingValidator>();
builder.Services.AddSingleton<JobsMedical.Web.Services.Scraping.IAiAuditor,
    JobsMedical.Web.Services.Scraping.OpenAiCompatibleAuditor>();
builder.Services.AddScoped<JobsMedical.Web.Services.Scraping.SettingsService>();
builder.Services.AddSingleton<JobsMedical.Web.Services.Scraping.IListingSource,
    JobsMedical.Web.Services.Scraping.SampleListingSource>();
builder.Services.AddSingleton<JobsMedical.Web.Services.Scraping.IListingSource,
    JobsMedical.Web.Services.Scraping.TelegramListingSource>();
builder.Services.AddSingleton<JobsMedical.Web.Services.Scraping.IListingSource,
    JobsMedical.Web.Services.Scraping.BaleListingSource>();
builder.Services.AddSingleton<JobsMedical.Web.Services.Scraping.IListingSource,
    JobsMedical.Web.Services.Scraping.DivarListingSource>();
builder.Services.AddSingleton<JobsMedical.Web.Services.Scraping.IListingSource,
    JobsMedical.Web.Services.Scraping.MedjobsListingSource>();
builder.Services.AddScoped<JobsMedical.Web.Services.Scraping.ListingArchiver>();
builder.Services.AddScoped<JobsMedical.Web.Services.Scraping.IngestionService>();
builder.Services.AddHostedService<JobsMedical.Web.Services.Scraping.IngestionWorker>();

// Phone-OTP cookie auth.
builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(o =>
    {
        o.LoginPath = "/Account/Login";
        o.AccessDeniedPath = "/Account/Login";
        o.ExpireTimeSpan = TimeSpan.FromDays(30);
        o.SlidingExpiration = true;
    });

// Emit Persian/Arabic characters directly in HTML instead of \u-style entities.
builder.Services.AddSingleton(HtmlEncoder.Create(
    UnicodeRanges.BasicLatin, UnicodeRanges.Arabic, UnicodeRanges.ArabicSupplement,
    UnicodeRanges.ArabicExtendedA, UnicodeRanges.GeneralPunctuation));

builder.Services.AddDbContext<AppDbContext>(opt =>
    opt.UseNpgsql(builder.Configuration.GetConnectionString("Default")));

var app = builder.Build();

// Apply migrations + seed on startup (fine for MVP single-instance deploy).
using (var scope = app.Services.CreateScope())
{
    var db = scope.ServiceProvider.GetRequiredService<AppDbContext>();
    db.Database.Migrate();
    // Production seeds reference data only (no demo facilities/shifts); dev seeds the full board.
    await SeedData.EnsureSeededAsync(db, app.Environment.IsDevelopment());
    // Archive any listings that went stale while the app was down.
    await scope.ServiceProvider
        .GetRequiredService<JobsMedical.Web.Services.Scraping.ListingArchiver>()
        .ArchiveStaleAsync();
}

// Configure the HTTP request pipeline.
if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Error");
    // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
    app.UseHsts();
}

// Behind nginx (TLS terminated upstream): trust X-Forwarded-Proto/For so the app knows it's
// HTTPS — required for correct secure cookies and to avoid HTTPS-redirect loops.
var forwardedOptions = new ForwardedHeadersOptions
{
    ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
};
forwardedOptions.KnownIPNetworks.Clear();   // only nginx can reach the container's bound port
forwardedOptions.KnownProxies.Clear();
app.UseForwardedHeaders(forwardedOptions);

app.UseHttpsRedirection();

app.UseRouting();

// Assign every visitor a stable cookie id so we can track interest from the first visit.
app.UseMiddleware<VisitorCookieMiddleware>();

app.UseAuthentication();
app.UseAuthorization();

app.MapStaticAssets();
app.MapRazorPages()
   .WithStaticAssets();

// Lightweight liveness probe for the deploy health-wait loop (and uptime checks).
app.MapGet("/healthz", () => Results.Text("ok"));

// ---- SEO: robots.txt + dynamic sitemap.xml (so Google indexes every live shift/job page) ----
app.MapGet("/robots.txt", (HttpContext ctx) =>
{
    var b = $"{ctx.Request.Scheme}://{ctx.Request.Host}";
    return Results.Text($"User-agent: *\nAllow: /\nDisallow: /Admin\nDisallow: /Employer\nSitemap: {b}/sitemap.xml\n", "text/plain");
});

app.MapGet("/sitemap.xml", async (HttpContext ctx, AppDbContext db) =>
{
    var b = $"{ctx.Request.Scheme}://{ctx.Request.Host}";
    var today = DateOnly.FromDateTime(DateTime.UtcNow);
    var jobCutoff = JobsMedical.Web.Services.Scraping.ListingPolicy.JobCutoffUtc;

    var sb = new System.Text.StringBuilder();
    sb.Append("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
    sb.Append("<urlset xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\">\n");
    void Url(string loc, DateTime? mod = null, string freq = "daily")
    {
        sb.Append("  <url><loc>").Append(System.Security.SecurityElement.Escape(loc)).Append("</loc>");
        if (mod is not null) sb.Append("<lastmod>").Append(mod.Value.ToString("yyyy-MM-dd")).Append("</lastmod>");
        sb.Append("<changefreq>").Append(freq).Append("</changefreq></url>\n");
    }

    foreach (var p in new[] { "", "/Shifts", "/Jobs", "/Calendar", "/Facilities" })
        Url($"{b}{p}", DateTime.UtcNow, p == "" ? "daily" : "hourly");

    foreach (var s in await db.Shifts.Where(s => s.Status == ShiftStatus.Open && s.Date >= today)
                 .Select(s => new { s.Id, s.CreatedAt }).ToListAsync())
        Url($"{b}/Shifts/Details/{s.Id}", s.CreatedAt, "daily");

    foreach (var j in await db.JobOpenings.Where(j => j.Status == ShiftStatus.Open && j.CreatedAt >= jobCutoff)
                 .Select(j => new { j.Id, j.CreatedAt }).ToListAsync())
        Url($"{b}/Jobs/Details/{j.Id}", j.CreatedAt, "weekly");

    sb.Append("</urlset>");
    return Results.Content(sb.ToString(), "application/xml");
});

app.Run();