Update webapp template to use top-level statements & minimal hosting API

[DamianEdwards]

Updated project templates to use top-level statements and minimal hosting APIs.

Here's what Program.cs ends up looking like with individual auth. (Note that most of the using statements will get removed when the implicit global usings SDK PR is merged):

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using Microsoft.Extensions.Logging;
using webapp.Data;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.
builder.Services.AddDbContext<ApplicationDbContext>(options =>
    options.UseSqlite(
        builder.Configuration.GetConnectionString("DefaultConnection")));
builder.Services.AddDatabaseDeveloperPageExceptionFilter();
builder.Services.AddDefaultIdentity<IdentityUser>(options => options.SignIn.RequireConfirmedAccount = true)
    .AddEntityFrameworkStores<ApplicationDbContext>();
builder.Services.AddRazorPages();

var app = builder.Build();

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseDeveloperExceptionPage();
    app.UseMigrationsEndPoint();
}
else
{
    app.UseExceptionHandler("/Error");
    // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseAuthentication();
app.UseAuthorization();

app.MapRazorPages();

app.Run();

Contributes to #33947 #33948 #33944 #32471 #33813

[bradygaster]

👍

[pranavkm]

@SteveSandersonMS / @javiercn in case you'd like to chime in on the formatting / shape of the code.

[LadyNaggaga]

LGTM 👍🏿

[pranavkm]

builder.Services.AddDbContext<ApplicationDbContext>(options =>
    options.UseSqlite(
        builder.Configuration.GetConnectionString("DefaultConnection")));

Is it more legible if the connection string is stored in a variable?

var connectionString = builder.Configuration.GetConnectionString("DefaultConnection");
builder.Services.AddDbContext<ApplicationDbContext>(options => options.UseSqlite(connectionString));

[DamianEdwards]

@pranavkm I'm happy to make that change. @davidfowl has some pretty strong opinions on this and did not like my original proposal that declared variables for services and configuration to avoid the builder.Services and builder.Configuration references everywhere.

[DamianEdwards]

Note that when the global implicit namespaces change lands the namespaces in this Program.cs will be reduced to:

using Microsoft.AspNetCore.Identity; // Needed for the IdentityUser type
using Microsoft.EntityFrameworkCore; // Needed for the UseSqlite extension method
using webapp.Data; // Needed for the ApplicationDbContext type

[pranavkm]

@davidfowl has some pretty strong opinions on this

I guess let's keep with this for now and we can always update it once @davidfowl's had a chance to weigh in on the change.

[DamianEdwards]

@JamesNK in case you'd like to chime in on the gRPC project template changes.

[JamesNK]

gRPC template 👍

[pranavkm]

As long as it works!

[davidfowl]

There's a super subtle difference to where UseRouting is called implicitly with the WebApplicationBuilder that we should make sure is ok. Routing will run before static files in a couple of these templates. Maybe we want to change that back so it's more explicit in those scenarios?

[DamianEdwards]

@davidfowl that's a good point but I must say I love the fact we can omit it. Is the difference big enough to warrant being explicit you think? Is the concern about performance, behavior, correctness, ease of diagnosing failure modes, etc.?

[davidfowl]

I guess to 2 differences are:

• Routes can win over static files. This might really only matter for implicit defaults (index.htm etc)
• Performance of static files as routing runs before it.

These can be worked around obviously by adding an explicit call but maybe we should measure.

[javiercn]

• Performance of static files as routing runs before it.

Doesn't routing run before static files today? Matching at least will.

[javiercn]

• Routes can win over static files. This might really only matter for implicit defaults (index.htm etc)

This is also the case today, isn't it? The MapFallback overloads have explicit constraints to avoid matching things that look like files, if you register a slug route explicitly, it will win over the files.

I believe the StaticFiles middleware avoids doing work if it detects there's an endpoint set on the request, so routes should already win?

[davidfowl]

Doesn't routing run before static files today? Matching at least will.

No it doesn't. For example here is the Razor pages template:

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }
    else
    {
        app.UseExceptionHandler("/Error");
        // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
        app.UseHsts();
    }

    app.UseHttpsRedirection();
    app.UseStaticFiles();

    app.UseRouting();

    app.UseAuthorization();

    app.UseEndpoints(endpoints =>
    {
        endpoints.MapRazorPages();
    });
}

Things that run before routing:

• DeveloperExceptionPage
• ExceptionHandler
• Hsts
• HttpsRedirection
• StaticFiles

I believe the StaticFiles middleware avoids doing work if it detects there's an endpoint set on the request, so routes should already win?

That's not the problem the "problem" is that it runs route matching first, which is a change from today. It may be irrelevant but we should be aware of the ordering differences here.

[davidfowl]

This is also the case today, isn't it? The MapFallback overloads have explicit constraints to avoid matching things that look like files, if you register a slug route explicitly, it will win over the files.

I'm not sure what you mean. If you explicitly call MapFallback? Sure but I'm not talking about that scenario.

[davidfowl]

@pranavkm @HaoK I thought we did this with middleware now. Why does this template still use the authorize filter?

[DamianEdwards]

Yeah that looks strange. Seems like a relic?

[davidfowl]

Not gonna lie these templates are impossible to review because of those ifs. You really want to look at the resulting content for each of them. Those could be baseline files checked into the repo or something.

[DamianEdwards]

@davidfowl certain baselines are generated in the scripts folder but purposely excluded as they're not part of the build today (i.e. they wouldn't get updated unless one manually runs the various Run-***-Locally.ps1 scripts). I can put the relevant baselines in a gist if it helps for review for now but any larger change to how template baselines are tracked is outside the scope of this work.

[DamianEdwards]

I've added calls to UseRouting() in all templates that have a call to UseExceptionHandler as not doing that causes issues today (see #34146).

@pranavkm @davidfowl I did the var connectionString ... change too.

Planning to merge once checks finish on this latest commit.