public class KeycloakAuthenticationStateProvider : AuthenticationStateProvider
    {
        private readonly TokenService _tokenService;
        private readonly IConfiguration _configuration;

        private readonly SemaphoreSlim _authLock = new(1, 1);
        private AuthenticationState? _cachedAuthState;

        private readonly string _redirectUri;
        private readonly string _keycloakBaseUrl;
        private readonly string _keycloakAuthUrl;
        private readonly string _keycloakTokenUrl;
        

        public KeycloakAuthenticationStateProvider(IConfiguration configuration, TokenService tokenService)
        {
            _tokenService = tokenService;
            _configuration = configuration;

            _redirectUri = _configuration!["Keycloak:RedirectUri"]!;
            _keycloakBaseUrl = $"{_configuration["Keycloak:BaseUrl"]}/realms/{_configuration["Keycloak:Realm"]}/protocol/openid-connect";
            _keycloakAuthUrl = $"{_keycloakBaseUrl}/auth?client_id={_configuration["Keycloak:ClientId"]}&response_type=code&redirect_uri={_redirectUri}";
            _keycloakTokenUrl = $"{_keycloakBaseUrl}/token";

        }

        public override async Task<AuthenticationState> GetAuthenticationStateAsync()
        {
            if (_cachedAuthState != null)
            {
                return _cachedAuthState;
            }

            var authState = await RetrieveAuthenticationStateAsync(); // Extracted logic into a separate method
            _cachedAuthState = authState;
            return authState;
        }

        private async Task<AuthenticationState> RetrieveAuthenticationStateAsync()
        {
            string? token = await _tokenService.GetAccessTokenAsync();
            token = null;

            if (string.IsNullOrEmpty(token) || IsTokenExpired(token))
            {
                await _authLock.WaitAsync();
                try
                {
                    token = await _tokenService.GetAccessTokenAsync();
                    token = null;
                    if (string.IsNullOrEmpty(token) || IsTokenExpired(token))
                    {
                        token = await AuthenticateViaBrowser();
                    }
                }
                finally
                {
                    _authLock.Release();
                }
            }

            if (!string.IsNullOrEmpty(token))
            {
                var identity = new ClaimsIdentity(ParseClaimsFromJwt(token), "Keycloak");
                var user = new ClaimsPrincipal(identity);
                return new AuthenticationState(user);
            }

            return new AuthenticationState(new ClaimsPrincipal(new ClaimsIdentity())); // No user authenticated
        }

        private async Task<string> AuthenticateViaBrowser()
        {
            // Open system browser for authentication
            Process.Start(new ProcessStartInfo
            {
                FileName = _keycloakAuthUrl,
                UseShellExecute = true
            });

            // Start HTTP listener to capture redirect
            return await StartHttpListenerAsync();
        }

        private async Task<string> StartHttpListenerAsync()
        {
            var httpListener = new HttpListener();
            httpListener.Prefixes.Add(_redirectUri + "/"); // Ensure this matches your redirect URI

            httpListener.Start();
            Debug.WriteLine("Waiting for authentication response...");

            var context = await httpListener.GetContextAsync();
            var query = context.Request.Url.Query;

            // Extract authorization code
            string authCode = ExtractTokenFromQuery(query);
            if (string.IsNullOrEmpty(authCode))
            {
                Debug.WriteLine("Failed to retrieve authorization code.");
                return string.Empty;
            }

            // ✅ Exchange authorization code for access token
            string accessToken = await ExchangeCodeForTokenAsync(authCode);
            if (string.IsNullOrEmpty(accessToken))
            {
                Debug.WriteLine("Failed to retrieve access token.");
                return string.Empty;
            }

            // ✅ Save access token securely
            await _tokenService.SaveAccessTokenAsync(accessToken);

            // Send response back to browser
            var response = context.Response;
            string responseString = "<html><body>Login successful. You can close this window.</body></html>";
            byte[] buffer = System.Text.Encoding.UTF8.GetBytes(responseString);
            response.ContentLength64 = buffer.Length;
            await response.OutputStream.WriteAsync(buffer, 0, buffer.Length);
            response.OutputStream.Close();

            httpListener.Stop();
            return accessToken;
        }

        private string ExtractTokenFromQuery(string query)
        {
            var queryParams = System.Web.HttpUtility.ParseQueryString(query);
            return queryParams["code"] ?? string.Empty; // Extract authorization code
        }

        private async Task<string> ExchangeCodeForTokenAsync(string code)
        {
            using var client = new HttpClient();

            var content = new FormUrlEncodedContent(new Dictionary<string, string>
            {
                { "grant_type", "authorization_code" },
                { "client_id", _configuration["Keycloak:ClientId"]! },
                { "code", code },
                { "redirect_uri", _redirectUri }
            });

            var response = await client.PostAsync(_keycloakTokenUrl, content);
            var responseString = await response.Content.ReadAsStringAsync();

            if (!response.IsSuccessStatusCode)
            {
                Debug.WriteLine($"Error exchanging code for token: {responseString}");
                return string.Empty;
            }

            var tokenResponse = System.Text.Json.JsonSerializer.Deserialize<TokenResponse>(responseString);
            return tokenResponse?.AccessToken ?? string.Empty;
        }

        private class TokenResponse
        {
            [System.Text.Json.Serialization.JsonPropertyName("access_token")]
            public string AccessToken { get; set; } = string.Empty;
        }

        private IEnumerable<Claim> ParseClaimsFromJwt(string jwt)
        {
            var handler = new JwtSecurityTokenHandler();
            var token = handler.ReadJwtToken(jwt);

            return token.Claims;
        }

        private bool IsTokenExpired(string token)
        {
            var handler = new System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler();
            var jwtToken = handler.ReadJwtToken(token);

            // Get the expiration time (exp claim) and convert to DateTime
            var exp = jwtToken.Payload.Exp;
            if (exp == null) return true; // Assume expired if no exp claim

            var expirationTime = DateTimeOffset.FromUnixTimeSeconds(exp.Value);
            return expirationTime < DateTimeOffset.UtcNow;
        }
    }
    ```