refactor: surface Duende.IdentityModel import in token-refresh step 1

The refresh step uses Duende.IdentityModel types, but the `using`
lived outside any @snippet tag so the Quickstart UI never showed it.
Include the imports (and rename step 1's description) so readers see
the required package.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ksroda-sa

samples/dotnet/token-refresh/src/Program.cs

@@ -1,12 +1,13 @@
+// @snippet:step1:start
+// @description Import the ASP.NET Core OIDC/cookie middleware plus Duende.IdentityModel (used later for the refresh-token grant) and DotNetEnv for `.env` loading
 using System.Security.Claims;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Authentication.OpenIdConnect;
 using Duende.IdentityModel.Client;
 using DotNetEnv;
 
-// @snippet:step1:start
-// @description Load environment variables from .env (searches parent dirs so `dotnet run --project src` finds the .env at the sample root). Existing env vars win.
+// Searches parent dirs so `dotnet run --project src` finds the .env at the sample root. Existing env vars win.
 Env.TraversePath().NoClobber().Load();
 // @snippet:step1:end
 

snippets.json

@@ -322,43 +322,43 @@
       "steps": [
         {
           "step": 1,
-          "description": "Load environment variables from .env (searches parent dirs so `dotnet run --project src` finds the .env at the sample root). Existing env vars win.",
-          "code": "Env.TraversePath().NoClobber().Load();",
+          "description": "Import the ASP.NET Core OIDC/cookie middleware plus Duende.IdentityModel (used later for the refresh-token grant) and DotNetEnv for `.env` loading",
+          "code": "using System.Security.Claims;\nusing Microsoft.AspNetCore.Authentication;\nusing Microsoft.AspNetCore.Authentication.Cookies;\nusing Microsoft.AspNetCore.Authentication.OpenIdConnect;\nusing Duende.IdentityModel.Client;\nusing DotNetEnv;\n\n// Searches parent dirs so `dotnet run --project src` finds the .env at the sample root. Existing env vars win.\nEnv.TraversePath().NoClobber().Load();",
           "file": "src/Program.cs",
           "lang": "csharp",
-          "lines": "8-10"
+          "lines": "1-11"
         },
         {
           "step": 2,
           "description": "Configure cookie auth + OpenID Connect; wire OnValidatePrincipal so every authenticated request can auto-refresh the access token",
           "code": "builder.Services.AddAuthentication(options =>\n    {\n        options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;\n        options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;\n    })\n    .AddCookie(options =>\n    {\n        options.Events.OnValidatePrincipal = ValidatePrincipalWithRefresh;\n    })\n    .AddOpenIdConnect(options =>\n    {\n        options.Authority = \"{{ISSUER_URL}}\";\n        options.ClientId = \"{{CLIENT_ID}}\";\n        options.ClientSecret = \"{{CLIENT_SECRET}}\";\n        options.ResponseType = \"code\";\n        options.UsePkce = true;\n        options.SaveTokens = true;\n        options.GetClaimsFromUserInfoEndpoint = true;\n        // Keep OIDC claim names (given_name, family_name, email) as-is — the default\n        // middleware remaps them to long xmlsoap URIs, which makes FindFirst(\"given_name\")\n        // return null in user code.\n        options.MapInboundClaims = false;\n        options.CallbackPath = \"/callback\";\n        options.Scope.Clear();\n        foreach (var scope in \"{{SCOPES}}\".Split(' ', StringSplitOptions.RemoveEmptyEntries))\n            options.Scope.Add(scope);\n    });\n\nbuilder.Services.AddAuthorization();",
           "file": "src/Program.cs",
           "lang": "csharp",
-          "lines": "17-47"
+          "lines": "18-48"
         },
         {
           "step": 3,
           "description": "Swap a refresh token for a fresh access token via the OIDC token endpoint",
           "code": "static async Task<TokenResponse> RefreshTokensAsync(\n    IHttpClientFactory httpFactory,\n    string refreshToken)\n{\n    var http = httpFactory.CreateClient();\n    var disco = await http.GetDiscoveryDocumentAsync(\"{{ISSUER_URL}}\");\n    if (disco.IsError)\n        throw new InvalidOperationException($\"Discovery failed: {disco.Error}\");\n\n    return await http.RequestRefreshTokenAsync(new RefreshTokenRequest\n    {\n        Address = disco.TokenEndpoint,\n        ClientId = \"{{CLIENT_ID}}\",\n        ClientSecret = \"{{CLIENT_SECRET}}\",\n        RefreshToken = refreshToken,\n        ClientCredentialStyle = ClientCredentialStyle.PostBody,\n    });\n}",
           "file": "src/Program.cs",
           "lang": "csharp",
-          "lines": "54-73"
+          "lines": "55-74"
         },
         {
           "step": 4,
           "description": "Routes: user display, sign-in, manual refresh (POST /refresh), sign-out",
           "code": "app.MapGet(\"/\", async (HttpContext ctx) =>\n{\n    if (ctx.User.Identity?.IsAuthenticated != true)\n        return Results.Content(Views.RenderSignedOutPage(), \"text/html\");\n\n    var expiresAtRaw = await ctx.GetTokenAsync(\"expires_at\");\n    var expiresAtDisplay = DateTimeOffset.TryParse(expiresAtRaw, out var dt)\n        ? dt.ToLocalTime().ToString(\"h:mm:ss tt\")\n        : \"unknown\";\n    return Results.Content(Views.RenderSignedInPage(ctx.User, expiresAtDisplay), \"text/html\");\n});\n\napp.MapGet(\"/login\", () => Results.Challenge(\n    new AuthenticationProperties { RedirectUri = \"/\" },\n    [OpenIdConnectDefaults.AuthenticationScheme]));\n\napp.MapPost(\"/refresh\", async (HttpContext ctx, IHttpClientFactory httpFactory) =>\n{\n    var authResult = await ctx.AuthenticateAsync();\n    if (!authResult.Succeeded || authResult.Properties is null)\n        return Results.Redirect(\"/\");\n\n    var refreshToken = authResult.Properties.GetTokenValue(\"refresh_token\");\n    if (refreshToken is null) return Results.Redirect(\"/\");\n\n    try\n    {\n        var tokens = await RefreshTokensAsync(httpFactory, refreshToken);\n        if (tokens.IsError)\n            return Results.Content(\n                Views.RenderErrorPage(tokens.Error ?? \"refresh failed\"),\n                \"text/html\");\n\n        UpdateAuthProperties(authResult.Properties, tokens);\n        await ctx.SignInAsync(\n            CookieAuthenticationDefaults.AuthenticationScheme,\n            authResult.Principal!,\n            authResult.Properties);\n        return Results.Redirect(\"/\");\n    }\n    catch (Exception ex)\n    {\n        return Results.Content(Views.RenderErrorPage(ex.Message), \"text/html\");\n    }\n});\n\napp.MapGet(\"/logout\", () => Results.SignOut(\n    new AuthenticationProperties { RedirectUri = \"/\" },\n    [CookieAuthenticationDefaults.AuthenticationScheme, OpenIdConnectDefaults.AuthenticationScheme]));\n\nstatic void UpdateAuthProperties(AuthenticationProperties props, TokenResponse tokens)\n{\n    if (tokens.AccessToken is not null)\n        props.UpdateTokenValue(\"access_token\", tokens.AccessToken);\n    if (tokens.RefreshToken is not null)\n        props.UpdateTokenValue(\"refresh_token\", tokens.RefreshToken);\n    if (tokens.IdentityToken is not null)\n        props.UpdateTokenValue(\"id_token\", tokens.IdentityToken);\n    if (tokens.ExpiresIn > 0)\n        props.UpdateTokenValue(\n            \"expires_at\",\n            DateTimeOffset.UtcNow.AddSeconds(tokens.ExpiresIn).ToString(\"o\"));\n}",
           "file": "src/Program.cs",
           "lang": "csharp",
-          "lines": "76-140"
+          "lines": "77-141"
         },
         {
           "step": 5,
           "description": "Auto-refresh via the cookie auth OnValidatePrincipal event — runs on every authenticated request",
           "code": "static async Task ValidatePrincipalWithRefresh(CookieValidatePrincipalContext ctx)\n{\n    var expiresAt = ctx.Properties.GetTokenValue(\"expires_at\");\n    if (expiresAt is null || !DateTimeOffset.TryParse(expiresAt, out var expiry)) return;\n    if (expiry - DateTimeOffset.UtcNow > TimeSpan.FromSeconds(60)) return;\n\n    var refreshToken = ctx.Properties.GetTokenValue(\"refresh_token\");\n    if (refreshToken is null)\n    {\n        ctx.RejectPrincipal();\n        return;\n    }\n\n    var httpFactory = ctx.HttpContext.RequestServices.GetRequiredService<IHttpClientFactory>();\n    try\n    {\n        var tokens = await RefreshTokensAsync(httpFactory, refreshToken);\n        if (tokens.IsError)\n        {\n            ctx.RejectPrincipal();\n            return;\n        }\n\n        UpdateAuthProperties(ctx.Properties, tokens);\n        ctx.ShouldRenew = true;\n    }\n    catch\n    {\n        ctx.RejectPrincipal();\n    }\n}",
           "file": "src/Program.cs",
           "lang": "csharp",
-          "lines": "143-175"
+          "lines": "144-176"
         }
       ],
       "framework": "dotnet",