builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerDocument(settings =>
{
    settings.AddSecurity(
        "bearer",
        [],
        new OpenApiSecurityScheme
        {
            Type = OpenApiSecuritySchemeType.OAuth2,
            Description = "Azure AD",
            Flow = OpenApiOAuth2Flow.Implicit,
            Flows = new OpenApiOAuthFlows
            {
                Implicit = new OpenApiOAuthFlow
                {
                    Scopes = new Dictionary<string, string>
                    {
                        {
                            $"api://{builder.Configuration["AzureAd:ClientId"]}/Api.Access",
                            "Access to the API. Some endpoints may additionally require group permissions."
                        },
                    },
                    AuthorizationUrl =
                        $"https://login.microsoftonline.com/{builder.Configuration["AzureAd:TenantId"]}/oauth2/v2.0/authorize",
                    TokenUrl =
                        $"https://login.microsoftonline.com/{builder.Configuration["AzureAd:TenantId"]}/oauth2/v2.0/token",
                },
            },
        }
    );
});

app.UseOpenApi(options =>
{
    options.Path = "/openapi/{documentName}.json";
});
app.MapScalarApiReference(options =>
        options
            .AddPreferredSecuritySchemes("bearer")
            .AddImplicitFlow(
                "bearer",
                oauth =>
                {
                    oauth.ClientId = builder.Configuration["AzureAd:ClientId"];
                    oauth.SelectedScopes = [$"api://{builder.Configuration["AzureAd:ClientId"]}/"];
                }
            )
            .SortTagsAlphabetically()
            .SortOperationsByMethod()
    )
    .AllowAnonymous();