Unable to call UseSwagger() before MapGet() in minimal API

[Martinn2]

Describe the bug

I have issue with swaggerUI when having multiple versions combobox.
In all the examples, app.UseSwagger() and app.UseSwaggerUI() is called after MappingEndpoints. If I do UseSwagger() first, the version combox stops working (shows only v1). But in real application I need to execute app.UseSwagger() then app.UseAuthentication() then app.UseAuthorization() and then MappingEndpoints to preven swagger.index from getting 401 (I do not secure swagger endpoint).

Expected Behavior

I want to be able to call app.UseSwagger() and app.UseSwaggerUI() before MappingEndpoint (MapPost, MapGet etc.) and stil have version combobox working in swagger UI

[Martinn2]

Describe the bug

I have issue with swagger UI when having multiple version. In all the examples, app.UseSwagger() and app.UseSwaggerUI() is called after MappingEndpoints. If I do UseSwagger() first, the version combox stops working (shows only v1). But in real application I need to execute app.UseSwagger() then app.UseAuthentication() then app.UseAuthorization() and then MappingEndpoints to preven swagger.index from getting 401 (I do not secure swagger endpoint).

Expected Behavior

I want to be able to call app.UseSwagger() and app.UseSwaggerUI() before MappingEndpoint (MapPost, MapGet etc.) and stil have version combobox working in swagger UI

[commonsensesoftware]

This is a 🐔 and 🥚 problem.

When you call builder.Build(), what you get back is a WebApplication. This type also implements IEndpointRouteBuilder, which is how all Minimal APIs are registered. The quirk about this behavior and design is that the results is not available to DI services until you register the endpoints. The underlying APIs support reacting to changes in the available endpoints, which is why routing ultimately works. In order to collate the endpoints you've configured for Minimal APIs, the WebApplication instance itself must be inspected.

There is an ever-so-slightly different variance from previous versions, which is why you now see app.DescribeApiVersions(). This collates the endpoints from WebApplication that have yet to be realized as well as any controller endpoints if you happen to be mixing and matching. If you call app.UseSwaggerUI() first, you will miss all Minimal APIs when Swashbuckle is configured that way.

Defining endpoints does not affect the order of middleware. You can call UseSwagger() and UseSwaggerUI() in any order you so desire, but all Minimal API endpoints must have already been registered. That has nothing to do with authentication or authorization. You still have full control over the order of middleware. Honestly, I feel it makes a lot more logical sense to define the endpoints before you start configuring middleware, but in the case of Minimal APIs with OpenAPI, it is required that you configure them earlier in the pipeline. The order in which you call UseAuthentication() and UseAuthorization() is up to you. As a general rule, all endpoints should be defined before you begin configuring or customizing middleware.

[Martinn2]

Thanks for explanation. I was confused by all the official samples for minimal api, where UseAuthentication() a UseAuthorization() is called before MapGet(). I thought reversing it would lead to endpoints being unauthorized, but is not the case. The reason is that UseEndpoints() is called automatically at the end of middleware pipeline so after authorization applied.