Tre middleware-anrop, ingen omskrivning

// Program.cs
builder.Services.AddDoconut(options =>
{
    options.LicensePath = "Doconut.Viewer.lic";
});
builder.Services.AddSession(); // document security rides on session state

var app = builder.Build();

app.UseSession();          // call UseSession() before UseDoconut()
app.UseDoconutResources(); // must be registered before UseDoconut()
app.UseDoconut();

// Open the document server-side, behind your own authorization
app.MapPost("/api/open", async (Viewer viewer, HttpContext ctx, string documentId) =>
{
    if (!await ctx.UserMayRead(documentId))
        return Results.Forbid();

    // The token is opaque — hand it to the widget, never log or persist it.
    string token = await viewer.OpenDocumentAsync(ResolvePath(documentId));
    return Results.Ok(new { token });
}).RequireAuthorization();