Program.cs

using Microsoft.EntityFrameworkCore;
using ACRTS.Data;
using ACRTS.Services;
using ACRTS.Filters;

var builder = WebApplication.CreateBuilder(args);
DotNetEnv.Env.Load();

// 1. Database Configuration
var databaseUrl = Environment.GetEnvironmentVariable("DATABASE_URL");
if (!string.IsNullOrEmpty(databaseUrl))
{
    // Convert Railway PostgreSQL URL to Npgsql connection string
    var uri = new Uri(databaseUrl);
    var userInfo = uri.UserInfo.Split(':');
    var npgsqlConnection = $"Host={uri.Host};Port={uri.Port};Database={uri.AbsolutePath.TrimStart('/')};Username={userInfo[0]};Password={userInfo[1]};SSL Mode=Require;Trust Server Certificate=true";
    
    builder.Services.AddDbContext<ACRTSDbContext>(options =>
        options.UseNpgsql(npgsqlConnection));
}
else
{
    // SQLite for local development
    builder.Services.AddDbContext<ACRTSDbContext>(options =>
        options.UseSqlite("Data Source=Data/acrts.db"));
}

// 2. Session & Security Cookies
builder.Services.AddSession(options =>
{
    options.IdleTimeout = TimeSpan.FromMinutes(builder.Configuration.GetValue<int>("AdminSettings:SessionTimeoutMinutes"));
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
});

// 3. MVC Setup
builder.Services.AddControllersWithViews();
builder.Services.AddHttpContextAccessor();

// 4. Custom Service Registrations
// Scoped Services
builder.Services.AddScoped<TrackingIdService>();
builder.Services.AddScoped<PriorityDetectorService>();
builder.Services.AddScoped<EvidenceService>();
builder.Services.AddScoped<DuplicateDetectionService>();
builder.Services.AddScoped<AlertService>();
builder.Services.AddScoped<SampleDataService>();
builder.Services.AddScoped<AdminAuthFilter>();

// Singleton / State Services
builder.Services.AddSingleton<EncryptionService>();
builder.Services.AddSingleton<InputSanitizerService>();
builder.Services.AddSingleton<RateLimitService>();
builder.Services.AddSingleton<LoggerService>();

// CORS
builder.Services.AddCors(options => {
    options.AddPolicy("SameOrigin", policy => policy.WithOrigins("https://localhost:7084", "http://localhost:5084"));
});

var app = builder.Build();

// 5. Middleware Pipeline
if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Home/Error");
    app.UseStatusCodePagesWithReExecute("/Home/Error/{0}");
    app.UseHsts();
}
else
{
    app.UseDeveloperExceptionPage();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseRouting();
app.UseCors("SameOrigin");

app.UseSession();
app.UseAuthorization();

// Security Headers Middleware
app.Use(async (context, next) => {
    context.Response.Headers.Append("X-Content-Type-Options", "nosniff");
    context.Response.Headers.Append("X-Frame-Options", "DENY");
    context.Response.Headers.Append("X-XSS-Protection", "1; mode=block");
    await next();
});

app.UseMiddleware<ACRTS.Middleware.AnonymityMiddleware>();

// Default Route
app.MapControllerRoute(
    name: "default",
    pattern: "{controller=Home}/{action=Index}/{id?}");

// 6. DB Initialization & Seeding
using (var scope = app.Services.CreateScope())
{
    var context = scope.ServiceProvider.GetRequiredService<ACRTSDbContext>();
    
    // Ensure directories exist for Railway deployment
    var dataDir = Path.Combine(Directory.GetCurrentDirectory(), "Data");
    if (!Directory.Exists(dataDir))
        Directory.CreateDirectory(dataDir);

    var evidenceDir = Path.Combine(Directory.GetCurrentDirectory(), 
        "wwwroot", "uploads", "evidence");
    if (!Directory.Exists(evidenceDir))
        Directory.CreateDirectory(evidenceDir);
    
    // Ensure DB is created
    context.Database.EnsureCreated();
    
    if (app.Environment.IsDevelopment())
    {
        var seeder = scope.ServiceProvider.GetRequiredService<SampleDataService>();
        // Seed sample data if empty
        await seeder.SeedSampleData(context);
    }
}

var port = Environment.GetEnvironmentVariable("PORT") ?? "8080";
app.Urls.Add($"http://0.0.0.0:{port}");

app.Run();