DEV Community: Vinícius Estevam

Testing Services on .NET8 with NUnit and Moq

Vinícius Estevam — Sun, 31 Aug 2025 19:16:27 +0000

Introduction

Testing is a important part of building and maintainable applications, in this tutorial we will use some powerful tools that make writing and managing tests much easier. We will explore how to create and run unit tests in .NET 8 using NUnit and Moq for mocking dependencies.

Requirements

C#
.NET8
Docker
NUnit

What are we going to test? ?

A service responsible for creating orders in a pizza app, following the folder organization:

Create order interface

using PizzApp.Domain.Entities;

namespace PizzApp.Application.Features.OrderFeatures.Create
{
    public interface ICreateOrderService
    {
        Task<Result> Execute(CreateOrderRequest request, CancellationToken cancellation);
    }
}

Create order service

using PizzApp.Domain.Entities;
using PizzApp.Domain.Interfaces;

namespace PizzApp.Application.Features.OrderFeatures.Create
{
    public class CreateOrderService : ICreateOrderService
    {
        protected readonly IOrderRepository _orderRepository;
        protected readonly ICustomerRepository _customerRepository;
        protected readonly IProductRepository _productRepository;
        protected readonly IUnitOfWork _unitOfWork;

        public CreateOrderService(
            ICustomerRepository customerRepository, 
            IProductRepository productRepository, 
            IOrderRepository orderRepository, 
            IUnitOfWork unitOfWork)
        {
            _customerRepository = customerRepository;
            _productRepository = productRepository;
            _orderRepository = orderRepository;
            _unitOfWork = unitOfWork;
        }

        public string CustomerErrorMessage = "Customer not registered in the system";
        public string InvalidItemQuantityError = "The item quantity must be greater than zero";
        public string OrderCreatedMessage = "Customer Order created with sucessful";

        public async Task<Result> Execute(CreateOrderRequest request, CancellationToken cancellationToken)
        {
            var result = new Result();

            bool hasItemWithInvalidQuantity = request.Items.Any(x => x.Quantity <= 0);

            if (hasItemWithInvalidQuantity)
            {
                result.Error(InvalidItemQuantityError);
                return result;
            }

            Customer? customer = await _customerRepository.GetCustomerById(request.CustomerId, cancellationToken);

            if (customer == null)
            {
                result.Error(CustomerErrorMessage);
                return result;
            }

            var order = new Order(request.CustomerId, new List<OrderItem>());
            result = await AddOrderItems(request, result, order, cancellationToken);

            if (result.IsSuccess)
            {
                await _orderRepository.Create(order);
                await _unitOfWork.Commit(cancellationToken);
                result.Success(OrderCreatedMessage, order.Id);
            }

            return result;
        }

        private async Task<Result> AddOrderItems(CreateOrderRequest request, Result result, Order order, CancellationToken cancellationToken)
        {
            foreach (var item in request.Items)
            {
                var product = await _productRepository.GetProductById(item.ProductId, cancellationToken);

                if (product == null)
                {
                    result.Error($"Item with ID {item.ProductId} does not exist on database");
                    return result;
                }

                order.AddItem(new OrderItem(product.Id, item.Quantity, product.Price));
            }

            return result;
        }
    }
}

In this tutorial, we will focus on one error case and one successful case, the other test cases will be implemented in the project and avaliable on github.

Within the same solution add a new NUnit test project, in this project we will also use the Moq librarie to mock the interfaces required by CreateOrderService.

Test Project Structure

1. Set Mock on interfaces

[TestFixture]
public class CreateOrderServiceTests
{
    protected Mock<IOrderRepository> _orderRepositoryMock = null!;
    protected Mock<ICustomerRepository> _customerRepositoryMock = null!;
    protected Mock<IProductRepository> _productRepositoryMock = null!;
    protected Mock<IUnitOfWork> _unitOfWorkMock = null!;
    protected CreateOrderService _service = null!;

    [SetUp]
    public void SetUp()
    {
        _orderRepositoryMock = new Mock<IOrderRepository>();
        _customerRepositoryMock = new Mock<ICustomerRepository>();
        _productRepositoryMock = new Mock<IProductRepository>();
        _unitOfWorkMock = new Mock<IUnitOfWork>();

        _service = new CreateOrderService(
            _customerRepositoryMock.Object, 
            _productRepositoryMock.Object, 
            _orderRepositoryMock.Object, 
            _unitOfWorkMock.Object);
    }
    // ...
}

First Scenario: Create Order Should be Successful

2. Arrange the objects

[Test]
public async Task CreateOrder_ShouldReturn_Success()
{
    // Arrange
    var customer = new Customer("Walter White", "walterwhite@email.com", "99338844");

    var product1 = new Product("Margherita Pizza", "Classic pizza with tomatoes, mozzarella, and basil", 29.90m, ProductCategoryEnum.PIZZA);
    var product2 = new Product("Coca-Cola 350ml", "Refreshing soda can", 5.90m, ProductCategoryEnum.DRINK);
    var product3 = new Product("Tiramisu", "Classic Italian dessert with mascarpone and coffee", 17.90m, ProductCategoryEnum.DESSERT);

    var orderItems = new List<CreateOrderItemRequest>
    {
        new CreateOrderItemRequest(product1.Id, 1),
        new CreateOrderItemRequest(product2.Id, 2),
        new CreateOrderItemRequest(product3.Id, 2)
    };

    var command = new CreateOrderRequest(customer.Id, orderItems);
   // ...
}

3. Setup the interfaces method

[Test]
public async Task CreateOrder_ShouldReturn_Success()
{
    // Arrange
    _customerRepositoryMock
        .Setup(x => x.GetCustomerById(customer.Id, new CancellationToken()))
        .ReturnsAsync(customer);

    _productRepositoryMock
        .Setup(x => x.GetProductById(orderItems[0].ProductId, new CancellationToken()))
        .ReturnsAsync(product1);

    _productRepositoryMock
        .Setup(x => x.GetProductById(orderItems[1].ProductId, new CancellationToken()))
        .ReturnsAsync(product2);

    _productRepositoryMock
        .Setup(x => x.GetProductById(orderItems[2].ProductId, new CancellationToken()))
        .ReturnsAsync(product3);
    // ...
}

Setup the input/output method used by service on required interfaces.

4. Execute the service

[Test]
public async Task CreateOrder_ShouldReturn_Success()
{
    // Act
    var result = await _service.Execute(command, new CancellationToken());
}

5. Check if result returned is what expected

[Test]
public async Task CreateOrder_ShouldReturn_Success()
{
    // Assert
    Assert.IsTrue(result.IsSuccess);
    Assert.That(_service.OrderCreatedMessage.Equals(result.Message));
    _customerRepositoryMock.Verify(x => x.GetCustomerById(It.IsAny<Guid>(), It.IsAny<CancellationToken>()), Times.Once);
    _productRepositoryMock.Verify(x => x.GetProductById(It.IsAny<Guid>(), It.IsAny<CancellationToken>()), Times.Exactly(3));
}

Verify that the result is successful.
Ensure the returned message matches the expected value.
Confirm that the mocked interface methods are executed the expected number of times.

6. Running the test

Open the terminal an run the following code:

dotnet test

If not working try to reference the soluction in the command:

dotnet test PizzApp.sln

After tests running on can check in the results in console:

You can use the option provided by your IDE to execute the tests.

Second Scenario: Create Order Should return Invalid Item Quantity

In the CreateOrderService, the first parameter validation checks the order item quantity. If the value is less than or equal to zero an error message should be returned.

public async Task<Result> Execute(CreateOrderRequest request, CancellationToken cancellationToken)
{
    var result = new Result();

    bool hasItemWithInvalidQuantity = request.Items.Any(x => x.Quantity <= 0);

    if (hasItemWithInvalidQuantity)
    {
        result.Error(InvalidItemQuantityError);
        return result;
    }

To test this scenario we will follow the same step of previous one: Arrange, Act and Assert. However this time we will only set up the resources that are necessary.

[Test]
[TestCase(0)]
[TestCase(-2)]
public async Task CreateOrder_ShouldReturn_InvalidItemQuantityError(int quantity)
{           
    var orderItems = new List<CreateOrderItemRequest>
    {
        new CreateOrderItemRequest(new Guid(), quantity)
    };

    var command = new CreateOrderRequest(new Guid(), orderItems);

    // Act
    var result = await _service.Execute(command, new CancellationToken());

    // Assert
    Assert.IsTrue(!result.IsSuccess);
    Assert.That(_service.InvalidItemQuantityError.Equals(result.Message));
    _customerRepositoryMock.Verify(x => x.GetCustomerById(It.IsAny<Guid>(), It.IsAny<CancellationToken>()), Times.Never);
    _productRepositoryMock.Verify(x => x.GetProductById(It.IsAny<Guid>(), It.IsAny<CancellationToken>()), Times.Never);
}

The TestCase attribute is a parameterized way to cover multiple values in the same scenario. In this case we use zero and a value below zero to verify if our implementation behaves correctly.

You can check the result of the each test on the Test Explorer, based on parameter provided in the TestCase:

Links:

You can access the full project in the following link

ASP.NET 8 - Cookie Authentication

Vinícius Estevam — Sun, 08 Jun 2025 21:34:06 +0000

What is Cookie ?

In web context Cookies are objects that store user information to help identify, track, and personalize the user experience based on their actions on a website.

How it's works ?

When you login in a website the server that process your request, if the login is successfuly, creates a cookie with an ID, user data and some informations such as the cookie type, expiration time, refresh policy and so on. Once the brownser receive the cookie it becomes responsible to storing and send the cookie in every request to the server which will check the cookies properties on each request.

How to implement in .NET8 ?

For this tutorial you will need to create a ASPNET CORE Web API and install the following packages:

<PackageReference Include="Microsoft.AspNetCore.Authentication.Cookies" Version="2.3.0" />
<PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="8.0.16" />

I made a simple entity to represent User with Name, Email, Password, and Roles. You can check it in this link.

For the table mapping, use this configuration:

public class UserConfiguration : IEntityTypeConfiguration<User>
{
    public void Configure(EntityTypeBuilder<User> builder)
    {
        builder.HasKey(x => x.Id);
        builder.HasIndex(x => x.Email).IsUnique();

        builder.Property(x => x.Name).HasMaxLength(100).IsRequired();
        builder.Property(x => x.Email).HasMaxLength(100).IsRequired();
        builder.Property(x => x.Password).HasMaxLength(250).IsRequired();
    }
}

I set the Email property as an index and marked it as unique to ensure that different users cannot register with the same email address. This also allows it to be used efficiently as a filter parameter during login.

In your DbContext, make sure to configure the UserRoles relationship like this:

public class AppDbContext : DbContext
{
    public DbSet<User> Users { get; set; }
    public DbSet<Role> Roles { get; set; }

    public AppDbContext(DbContextOptions<AppDbContext> options) : base(options)
    {
    }

    protected override void OnModelCreating(ModelBuilder modelBuilder)
    {
        base.OnModelCreating(modelBuilder);

        modelBuilder.Entity<User>()
            .HasMany(u => u.Roles)
            .WithMany(r => r.Users)
            .UsingEntity<Dictionary<string, object>>(
                "UserRoles",
                j => j.HasOne<Role>().WithMany().HasForeignKey("RoleId"),
                j => j.HasOne<User>().WithMany().HasForeignKey("UserId"),
                j =>
                {
                    j.HasKey("UserId", "RoleId");
                    j.ToTable("UserRoles");
                });
    }
}

On the respository we only need to search user by his email:

public class UserRepository : IUserRespository
{
    private readonly AppDbContext _context;
    private readonly DbSet<User> _users;

    public UserRepository(AppDbContext context)
    {
        _context = context;
        _users = _context.Set<User>();
    }

    public async Task<User?> GetByEmail(string email)
    {
        return await _users
            .Where(x => x.Email == email)
            .Include(x => x.Roles)
            .FirstOrDefaultAsync();
    }
}

Now we can focus on the login service, which is pretty simple: it just receives the user input, searches for the user by email in the database, validates the password, and returns the user. Here's the implementation:

public class LoginService : ILoginService
{
    protected readonly IUserRespository _respository;

    public LoginService(IUserRespository respository)
    {
        _respository = respository;
    }

    public async Task<TResult<User>> Login(LoginDto dto)
    {
        var result = new TResult<User>();
        var user = await _respository.GetByEmail(dto.Email);

        if (user == null)
        {
            result.AddError($"User {dto.Email} not found!");
            return result;
        }

        if (!user.IsPasswordMatch(dto.Password))
        {
            result.AddError($"Password Incorrect!");
            return result;
        }

        result.Success(user);
        return result;
    }
}

Time to configure the Cookie Authentication, move on to the Program.cs and add this configuration:

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        options.Cookie.Name = "CookieAuthSystem";
        options.Cookie.HttpOnly = true;
        options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
        options.Cookie.SameSite = SameSiteMode.Strict;
        options.ExpireTimeSpan = TimeSpan.FromMinutes(5);
        options.SlidingExpiration = true;
        options.LoginPath = "/auth/login";
        options.AccessDeniedPath = "/auth/access-denied";
        // Hanlder the unauthorized access
        options.Events.OnRedirectToLogin = context =>
        {
            context.Response.StatusCode = 401;
            return Task.CompletedTask;
        };
    })

Some configuration explained:

Cookie.HttpOnly = true >> Ensures that the authentication cookie cannot be accessed by client-side JavaScript, helping to prevent XSS (Cross-Site Scripting) attacks.

Cookie.SecurePolicy = CookieSecurePolicy.Always >> Cookie will only send by HTTPS request.

Cookie.SameSite = SameSiteMode.Strict >> Prevent the cookies from being sent with cross-origin requests, helping to prevent CSRF (Cross-Site Request Forgery) attacks.

ExpireTimeSpan = TimeSpan.FromMinutes(5) >> Set the Cookie lifetime for 5 minutes.

SlidingExpiration = true >> Requests a new cookie if a request is made when the current cookie is halfway to expiration. This improves the user experience by preventing repeated logins during continuous site usage.

Once we configure the Cookie Authentication, let's implements the the service to generate cookie:

public class CookieService : ICookieService
{

    public CookieDto GenerateCookie(User user)
    {
        var claims = new List<Claim>
        {
            new Claim(ClaimTypes.Name, user.Name),
            new Claim(ClaimTypes.Email, user.Email),
        };

        foreach (var role in user.Roles)
        {
            claims.Add(new Claim(ClaimTypes.Role, role.Name));
        }

        var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);

        var authProperties = new AuthenticationProperties
        {
            IsPersistent = true,
            AllowRefresh = true,
            ExpiresUtc = DateTimeOffset.UtcNow.AddMinutes(5),
        };

        return new CookieDto(claimsIdentity, authProperties);
    }

In Claims Identity we provide the user name, email and his roles and define the authentication type which is cookie-based authentication.

In Cookie propertites we set has the persistent, allow request new cookie and define the time expiration.

Now lets move on to the auth controller:

[ApiController]
[Route("auth")]
public class AuthController : Controller
{
    protected readonly ILoginService _loginService;
    protected readonly ICookieService _cookieService;

    public AuthController(ILoginService loginService, ICookieService cookieService)
    {
        _loginService = loginService;
        _cookieService = cookieService;
    }

    [HttpPost("login")]
    public async Task<IActionResult> Login([FromBody] LoginDto request)
    {
        var userResult = await _loginService.Login(request);

        // Check if login is successful
        if (!userResult.IsSuccess || userResult.Value == null)
        {
            return BadRequest(userResult.ErrorMessage);
        }

        var cookie = _cookieService.GenerateCookie(userResult.Value);

        await HttpContext.SignInAsync(
            CookieAuthenticationDefaults.AuthenticationScheme,
            new ClaimsPrincipal(cookie.Claims),
            cookie.Properties);

        return LocalRedirect("/auth/logged");
    }

    [HttpPost("logout")]
    public async Task<IActionResult> Logout()
    {
        await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
        return Ok("User Logout Successful");
    }

    [HttpGet("access-denied")]
    public IActionResult NotAllowed()
    {
        return Unauthorized("You not allowed to access this resource");
    }

    [Authorize]
    [HttpGet("logged")]
    public IActionResult Logged()
    {
        var userName = User.FindFirst(ClaimTypes.Name)?.Value;

        return Ok($"Hello {userName}");
    }
}

Login: Creates a cookie with user information and redirect the user to the /logged page which contains the cookie stored in the brownser.

Logout: Turns the Cookie into invalid and clear from the brownser.

Access Denied: Every time someone try to access a resource which is not allowed, they are redirected to this path.

Protected Endpoints:

[ApiController]
[Route("api")]
public class ApiController : Controller
{

    [Authorize(Roles = "User")]
    [HttpGet("user")]
    public ActionResult UserController()
    {
        return Ok("Hello User");
    }

    [Authorize(Roles = "Manager")]
    [HttpGet("manager")]
    public ActionResult ManagerController()
    {
        return Ok("Hello Manager");
    }

    [Authorize(Roles = "Admin")]
    [HttpGet("admin")]
    public ActionResult AdminController()
    {
        return Ok("Hello Admin");
    }
}

Running the Project

On swagger when you login successful, the user will receive this:

You can check the cookie in the browser, open the browser inspect, goes to application and then cookies, you will able to see something like this:

But if you try to access the cookie using javascript in the browser console with the following:

document.cookie

You probably will receive a empty string, because the cookie configuration we made in the program.cs, Cookie.HttpOnly = true

If the user try to access a resource which who is not allowed them will be redirect to this path:

In this tutorial you noticited we configure cookie to works in https environment, but i run in http, it because browsers treat localhost as a special case.

Github Link

Publish Private Nuget Packages on Github

Vinícius Estevam — Wed, 15 Jan 2025 11:12:54 +0000

Introduction

If you are already working with microservices you have probably noticed that some services shared certain files with specific functionalities or abstractions.
Refactoring these files manually can be a nightmare when they are not a part of a package as it demands repeating the changes across all services.
Working this way is not recommended and it is a bad practice too.

To simplify this process this commons files can be turned into a package, centralizing them in one location to simplify the refactoring process.
In the end we just need to release the fixes or updates, making them available to every service that depends on the package.

First Step: Create Project

For this tutorial I used a Class Library project to develop my package who will provide some commons files as base entity, dto, repository, service and controller, you can check this project in this link

Second Step: Upload your project in Github

This is the easiest step, you just need to create a github repository, link with your local repository and commit your project.

Third Step: Configure your csproject file

Locate your csproject in your IDE or Github, after that you can add a some details about your project such as version, description, author, company, tags which will help other users find your package, below I’ve provided a template from Microsoft documentation as an example:

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <!-- General project information -->
    <TargetFramework>net8.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>

    <!-- NuGet package details -->
    <PackageId>**YOUR_PROJECT_NAME**</PackageId>
    <Version>**VERSION**</Version>
    <Authors>**YOUR_NAME**</Authors>
    <Company>**COMPANY_NAME**</Company>
    <PackageTags>**TAG_NAME;TAG_NAME,TAG_NAME**</PackageTags>
    <Description>**PACKAGE_DESCRIPTION**</Description>  
    <RepositoryUrl>**https://github.com/...**</RepositoryUrl>
  </PropertyGroup>

 <!-- Dependencies -->
  <ItemGroup>
    <PackageReference/>
  </ItemGroup>

</Project>

PackageId: The unique identifier for your package on NuGet.
Version: Version of the package (e.g., 1.0.0).
Authors: Name(s) of the author(s).
Company: Name of yout company (if the package belongs to one company).
Description: Detailed information about your package.
PackageTags: Keywords to help users find your package.
RepositoryUrl: Link to your project's repository.

Check the Microsoft documentation in order to know more about optional or additional fields.

Fourth Step: Github Token & Repository Secret

To publish your package, you'll need to generate a GitHub token, follow these steps:

Log in to your GitHub account.
Navigate to Settings and select Developer settings.
Click on Personal access tokens and then choose the Token (classic) option.
Generate a new token with the following permissions:

Copy your token immediately, as it won’t be shown again.
Navigate to your project repository on GitHub.
Click on Settings (gear icon) for the repository.
Go to Actions > Secrets and variables, and choose the Secrets option.
Click on New repository secret.
Paste your token and assign a name to it (e.g., GITHUB_TOKEN).

Fifth Step: NuGet.Config

Create in your root folder a NuGet.config file and paste the following code:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
    <add key="Github" value="https://nuget.pkg.github.com/GITHUB_USERNAME/index.json" />
  </packageSources>
  <packageSourceCredentials>
    <github>
        <add key="Username" value="GITHUB_USERNAME" />
        <add key="ClearTextPassword" value="GITHUB_TOKEN" />
    </github>
</packageSourceCredentials>
</configuration>

Replace the GITHUB_USERNAME with your GitHub username. You can find it in your profile or in a GitHub URL (e.g., https://github.com/username). Also, replace the GITHUB_TOKEN with your generated token.

This file allows users to download the package with the following command:

dotnet add package <PackageName>

You will need this setup when using the package in a real project to authenticate to the package source.

Why are there two package sources in this file?

When you need to use this package in a project, I set this file in the project root folder so that your project can recognize both the official NuGet packages and your/organization's custom packages.

For your custom packages, you need to provide the package source and credentials to consume the package.

You can define this file in the project root or configure it in the global NuGet file located at:
C:\Users\username\AppData\Roaming\NuGet\NuGet.Config.

Sixth Step: Github Actions

1. Create the .github Directory:

In the root of your GitHub project repository, create a folder named .github.

2. Create the workflows Folder:

Inside the .github folder, create another folder named workflows.

3. Add a YAML File for the Workflow:

name: Publish NuGet Package

on:
  push:
    branches:
      - main

jobs:
  publish:
    runs-on: ubuntu-latest

    steps:
      # Step 1: Checkout the repository
      - name: Checkout code
        uses: actions/checkout@v3

      # Step 2: Setup .NET environment
      - name: Setup .NET
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: '8.0' # Adjust based on your project

      # Step 3: Restore dependencies
      - name: Restore dependencies
        run: dotnet restore [path].Project.csproj

      # Step 4: Build the project
      - name: Build
        run: dotnet build [path].Project.csproj --configuration Release --no-restore

       # Step 5: Pack the project
      - name: Pack
        run: dotnet pack [path].Project.csproj --configuration Release --no-build -o ./packages

      # Step 6: Publish package to GitHub Packages
      - name: Publish to GitHub Packages
        run: dotnet nuget push ./packages/*.nupkg --api-key ${{ secrets.GITHUB_TOKEN }} --source "github"

Every time you commit or merge into the main branch, this will trigger the GitHub Action to publish updates to your package.

Remember to:

Replace [path]/Project.csproj with the path to your .csproj file.
Replace GITHUB_TOKEN with the name of your token as configured in the repository secrets.

After setting this up, you will see the job running under the Actions tab in your GitHub repository. You can review each step in the workflow log to debug any issues in case of a crash.

Seventh Step: Link the project repository to the package

Search for the Packages option at the top of your GitHub Profile page and click on it.
You will see somethind like this:
You can then link your package to your project repository..

Eighth Step: Use the package

Open any project where you want to use the package. In the solution folder, add the NuGet.Config file you created in the sixth step. Replace <username> and <token> with your GitHub username and token.
Open the NuGet Package Manager and click on the Settings (gear icon).
Add a new package source by providing a name and the Github link from the NuGet.Config file.
After setting the new package source, you can select the source you need and search for your package.

Conclusion

Now, it is easier to maintain the packages from your organization that are used across various microservices. To improve your daily workflow, you can set the GITHUB_TOKEN as a computer environment variable and link it in the NuGet.Config file.

Important: Please do not expose your GitHub token by hardcoding it in the NuGet.Config file. Instead, use environment variables for better security.

I hope this tutorial helps you!

Package Repository

BDD Testing in .NET8

Vinícius Estevam — Thu, 06 Jun 2024 19:52:40 +0000

Introduction

In this tutorial you will understand what is Behavior-Driven Development (BDD) and your benefits.

Behavior-Driven Development (BDD)

Behavior-Driven Development (BDD) is an agile methodology that enhances collaboration among all project participants, regardless of technical knowledge. It builds on Test-Driven Development (TDD) by using natural language to describe test scenarios, making them easy to understand for everyone. BDD aims to improve communication, reduce misunderstandings, and ensure the software meets real user needs.

Benefits Of BDD

Clear overview of the project.
Improves understanding of the parties involved.
Allows automation of tests and documents.
Contributes to efficient development.

How BDD Works ?

Scenario definition (features files):
The team must define through natural language how the system should behave in each scenario, which can be understood as the CRUD operation for a system entity. Cases of success and error must be taken into account, as well as what the system should return to the user in each action.

BDD syntax uses 3 keywords:
Given: Describes the initial context of the scenario.
When: Describes the action that triggers the scenario.
Then: Describes the expected result of the action.

Scenario automation (steps files):
After defining the scenarios, tests can be automated based on feature documents, these tests serve to validate the scenarios created and are run continuously throughout the project's development, to identify bugs quickly.

Tools

C#
.NET8
Visual Studio 2022

Configuration

To implement the BDD test in .NET8 we will use the Xunit.Gherkin.Quick library available on link

Within your api's solution, right-click and select the Add new Project option and select the xUnit Test Project type project. At the end you should see a project in this structure:

To install Xunit.Gherkin.Quick you can run this commands in cmd or add packages in Nuget Mangement via Visual Studio.



dotnet add package Xunit.Gherkin.Quick
dotnet add package Microsoft.AspNetCore.Mvc.Testing
dotnet add package Newtonsoft.Json

Then create two folders within this project named as Features and Steps.

Test Implementation

Let's start making the feature file for the member entity, create a file called MemberFeatures.feature inside the feature folder, then let's set the scene, in this tutorial we will cover an error and a success case for registration and editing.



Feature: Member CRUD

Background: 
    Given I have access to the member API

Scenario Outline: Create a new member
    When I send a POST request to /Member with the following member details: "<Name>", "<Email>", "<Identifier>", "<BrazilianDocument>", "<BrazilianZipCode>", "<Phone>"
    Then the API response should be: "<StatusCode>"
Examples: 
    | Name       | Email                  | Identifier    | BrazilianDocument   | BrazilianZipCode    | Phone         | StatusCode   |
    | ""         | john.doe@example.com   | 0000bsi0000   | 12345678900         | 12345678            | 27900000000   | 400          |
    | John Doe   | john.doe@example.com   | 0000bsi0000   | 12345678900         | 12345678            | 27900000000   | 200          |

Scenario Outline: Update a new member
    When I send a PUT request to /Member/"<MemberId>" with the following member details: "<Name>", "<Email>", "<Identifier>", "<BrazilianDocument>", "<BrazilianZipCode>", "<Phone>"
    Then the API response should be: "<StatusCode>"
Examples: 
    | MemberId                             | Name             | Email                 | Identifier  | BrazilianDocument | BrazilianZipCode | Phone       | StatusCode |
    | 8db060d9-ca6f-4320-a972-c687d75accce | ""               | john.doe@example.com  | 0000bsi0000 | 12345678900       | 12345678         | 27900000000 | 400        |
    | 8db060d9-ca6f-4320-a972-c687d75accce | John Doe Updated | john.doe2@example.com | 1111bsi1111 | 12345678911       | 12345679         | 27912341234 | 200        |

Scenario Outline: Retrieve an existing member
    When I send a GET request to /Member/"<MemberId>"
    Then the API response should be: "<StatusCode>"
Examples: 
    | MemberId                             | StatusCode |
    | 28368835-8f04-4357-81b5-31d666314020 | 200        |

Scenario Outline: Delete an existing member
    When I send a DELETE request to /Member/"<MemberId>"
    Then the API response should be: "<StatusCode>"
Examples: 
    | MemberId                             | StatusCode |
    | 52ee8b49-9758-499a-b35e-93b61e10827a | 200        |

Now let's implement the steps test based on the resource file we just created in the previous step, to create a file called MemberSteps.cs inside the Step folder.



using Gherkin.Ast;
using Application.DTOs.Request;
using Application.DTOs.Response;
using Test.Shared;
using System.Net;
using System.Text;
using System.Text.Json;
using Xunit.Gherkin.Quick;

namespace SlaveOneBack.Test.Steps
{
    [FeatureFile("../../../Features/MemberFeature.feature")]
    public class MemberSteps : Xunit.Gherkin.Quick.Feature
    {
        private const string BASE_URL = "https://localhost:3000/api/Member/";
        private readonly HttpClient _client;
        private HttpResponseMessage _response;
        private ApiDataProvider _provider;

        public MemberSteps()
        {
            _client = new HttpClient();
            _provider = new ApiDataProvider();
        }

        #region Check if API is running
        [Given("I have access to the member API")]
        public async Task IHaveAccessAPI()
        {
            var response = await _client.GetAsync(BASE_URL);
            Assert.Equal(HttpStatusCode.OK, response.StatusCode);
        }
        #endregion

        #region Post Request
        [When(@"I send a POST request to /Member with the following member details: ""(.+)"", ""(.+)"", ""(.+)"", ""(.+)"", ""(.+)"", ""(.+)""")]
        public async Task WhenISendAPostRequest(string name, string email, string identifier, string document, string zipCode, string phone)
        {
            var member = new MemberRequestDTO();

            member.Name = name;
            member.Email = email;
            member.Identifier = identifier;
            member.BrazilianDocument = document;
            member.BrazilianZipCode = zipCode;
            member.Phone = phone;

            var content = new StringContent(JsonSerializer.Serialize(member), Encoding.UTF8, "application/json");
            var response = await _client.PostAsync(BASE_URL, content);
            _response = response;
        }
        #endregion

        #region Put Request
        [When(@"I send a PUT request to /Member/""(.+)"" with the following member details: ""(.+)"", ""(.+)"", ""(.+)"", ""(.+)"", ""(.+)"", ""(.+)""")]
        public async Task WhenISendAPutRequest(string memberId, string name, string email, string identifier, string document, string zipCode, string phone)
        {
            MemberResponseDTO member = await _provider.GetEntityById<MemberResponseDTO>("Member", memberId);

            member.Name = name;
            member.Email = email;
            member.Identifier = identifier;
            member.BrazilianDocument = document;
            member.BrazilianZipCode = zipCode;
            member.Phone = phone;

            var content = new StringContent(JsonSerializer.Serialize(member), Encoding.UTF8, "application/json");
            var response = await _client.PutAsync(BASE_URL + memberId, content);
            _response = response;
        }
        #endregion

        #region Retrieve Request
        [When(@"I send a GET request to /Member/""(.+)""")]
        public async Task WhenISendAGetRequest(string memberId)
        {
            var response = await _client.GetAsync(BASE_URL + memberId);
            _response = response;
        }
        #endregion

        #region Delete Request
        [When(@"I send a DELETE request to /Member/""(.+)""")]
        public async Task WhenISendADeleteRequest(string memberId)
        {
            var response = await _client.DeleteAsync(BASE_URL + memberId);
            _response = response;
        }
        #endregion

        #region Check API Response
        [Then(@"the API response should be: ""(.+)""")]
        public async Task ThenApiResponse(string statusCode)
        {
            Assert.Equal(Convert.ToInt32(statusCode), (int)_response.StatusCode);
        }
        #endregion
    }

}

So how this file works ?

Feature File Association
The MemberSteps class is associated with the MemberFeature.feature file using the [FeatureFile] attribute:



[FeatureFile("../../../Features/MemberFeature.feature")]
public class MemberSteps : Xunit.Gherkin.Quick.Feature
{

Fields and Constructor
The class has fields to hold an HttpClient instance, a base URL for the API, an ApiDataProvider instance and a response instance to store api response to each request:



private const string BASE_URL = "https://localhost:3000/api/Member/";
        private readonly HttpClient _client;
        private HttpResponseMessage _response;
        private ApiDataProvider _provider;

        public MemberSteps()
        {
            _client = new HttpClient();
            _provider = new ApiDataProvider();
        }

Verifying API Availability
This step ensures the API is available:



[Given("I have access to the member API")]
        public async Task IHaveAccessAPI()
        {
            var response = await _client.GetAsync(BASE_URL);
            Assert.Equal(HttpStatusCode.OK, response.StatusCode);
        }

Verifying API Response Codes
This step checks that the API response codes match expected values:



[Then(@"the API response should be: ""(.+)""")]
        public async Task ThenApiResponse(string statusCode)
        {
            Assert.Equal(Convert.ToInt32(statusCode), (int)_response.StatusCode);
        }

Creating a New Member
This step sends a POST request to create a new member and records the response status codes:



[When(@"I send a POST request to /Member with the following member details: ""(.+)"", ""(.+)"", ""(.+)"", ""(.+)"", ""(.+)"", ""(.+)""")]
        public async Task WhenISendAPostRequest(string name, string email, string identifier, string document, string zipCode, string phone)
        {
            var member = new MemberRequestDTO();

            member.Name = name;
            member.Email = email;
            member.Identifier = identifier;
            member.BrazilianDocument = document;
            member.BrazilianZipCode = zipCode;
            member.Phone = phone;

            var content = new StringContent(JsonSerializer.Serialize(member), Encoding.UTF8, "application/json");
            var response = await _client.PostAsync(BASE_URL, content);
            _response = response;
        }

Retrieving an Existing Member
This step sends a GET request to retrieve a member by ID and records the response status code:



[When("I send a GET request to '/Member/28368835-8f04-4357-81b5-31d666314020'")]
public async Task GetByIdRequest()
{
    listOfStatusCode.Clear();
    var response = await _client.GetAsync(BASE_URL + MemberID);
    listOfStatusCode.Add((int)response.StatusCode);
}

Updating an Existing Member
This step sends a PUT request to update a member's details and records the response status codes:



[When(@"I send a PUT request to /Member/""(.+)"" with the following member details: ""(.+)"", ""(.+)"", ""(.+)"", ""(.+)"", ""(.+)"", ""(.+)""")]
        public async Task WhenISendAPutRequest(string memberId, string name, string email, string identifier, string document, string zipCode, string phone)
        {
            MemberResponseDTO member = await _provider.GetEntityById<MemberResponseDTO>("Member", memberId);

            member.Name = name;
            member.Email = email;
            member.Identifier = identifier;
            member.BrazilianDocument = document;
            member.BrazilianZipCode = zipCode;
            member.Phone = phone;

            var content = new StringContent(JsonSerializer.Serialize(member), Encoding.UTF8, "application/json");
            var response = await _client.PutAsync(BASE_URL + memberId, content);
            _response = response;
        }

Deleting a Member
This step sends a DELETE request to delete a member by ID and records the response status code:



[When(@"I send a DELETE request to /Member/""(.+)""")]
        public async Task WhenISendADeleteRequest(string memberId)
        {
            var response = await _client.DeleteAsync(BASE_URL + memberId);
            _response = response;
        }

Run Test

You can run the test in Visual Studio IDE or cmd.



dotnet test

I choose to run via IDE then i got this following report from our test, if you choose run by terminal you will receive the report on terminal:

Conclusion

Working with BDD (Behavior-Driven Development) at LEDS has been an has been an incredible experience, writing test scenarios right after requirements documentation helps reduce uncertainty and decrease the error rate during a development phase. Furthermore, test automation allows, with each new change or implementation of new functionalities, it is possible to validate these changes efficiently. This ensures greater security and confidence in continuous development.

Another significant benefit is that everyone involved in the project, regardless of their area of expertise, is fully aware of what to expect from each new version of the project. The BDD is read in natural language, which makes communication clear and accessible to everyone, making it easier to understand what is being developed and tested. This approach promotes more integrated and effective collaboration between teams, resulting in a higher quality final product.

ASP.NET 8 - Authentication and Authorization in 7 steps.

Vinícius Estevam — Sun, 05 May 2024 18:50:21 +0000

Introduction

In this tutorial, you will learn how to develop an API for user permission-based authentication and authorization. In addition, the Clean Architecture, Unit of Work, and Mediator patterns will be used.

Tools

C#
.NET8
Visual Studio 2022
Docker
Azure Data Studio

Patterns

Mediator

This pattern aims to improve the way different parts of your application communicate with each other. Different parts of your application (components) don't talk directly to each other. Instead, they send requests to the mediator which is as a central point of communication in your application.

Unit of Work

Is a design pattern used to manage a series of database operations as a single unit. The Unit of Work pattern groups database operations (Create, Delete, and Update) into a single transaction. This ensures that all operations are reflected in the database (commit). In case of an error, the pattern performs a rollback.

Clean Architecture

Clean Architecture is a software design pattern that promotes maintainability, testability, and reusability by separating different concerns within the application into distinct layers. It's often visualized as an onion, with the core business logic (domain) at the center, surrounded by outward layers that handle progressively more external concerns.

The layers in Clean Architecture:

Domain

Represents the core business logic of your application.
Contains entities, value objects and interfaces.

Application

Implements the use cases of your application.
Defines application services that manipulate domain entities.

Infrastructure

Contains concrete implementations for technical details.
Provides interfaces for persistence (databases), external APIs, email services, etc.

Presentation

User access layer who can make requests to the application.
Contains controllers, extensions and configurions.

First Step: Create Project

With Visual Studio open, create a new project and select Blank Solution name it as follows Project, inside the solution create four Solution Folder, with the following names: Domain, Application, Infrastructure and Presentation.

Open the Domain folder and add a new project and select Class Libary, name it as follows Project.Domain, do the same with the layers Application (Project.Application) and Infrastructure(Project.Infrastructure).

In sequence in the folder Presentation, Add a new project and this time select the option ASP.NET Core Web API name it as follows Project.WebApi

Select the box Enable Docker and select the OS Linux

In the end you should have this folder structure:

Second Step: Layer references

Now let's configure the references for each layer, in projects like Class Library and delete the Class.cs files.

To add a reference, select the Dependencies folder and right-click and select Add Project Reference.. as in the image below:

Start at the Project.Application layer, add reference to the Project.Domain project.

In the Project.Infrastructure layer add the following references:

Finally, in the last section Project.Presentation add the following references:

Third Step: Install Packages

Now let's install the packages, to do this in the Visual Studio menu click on Tools, select NuGet Package Manager and finally click on Manager NuGet Packages For Solution..

Project.Application

AutoMapper: Simplifies mapping between different object structures, often used for converting domain models to DTOs (Data Transfer Objects) for API responses.
BCrypt.Net-Next: Provides a secure password hashing library for secure user password storage and verification.
FluentValidation.DependencyInjection: Integrates FluentValidation, a popular library for building validation rules for your application models.
MediatR: Facilitates communication within your application using the Mediator pattern, promoting loose coupling and testability.

Project.WebApi

Microsoft.AspNet.WebApi.Cors: Enables Cross-Origin Resource Sharing (CORS) for your Web API, allowing requests from different origins (domains, ports, protocols).
Microsoft.AspNetCore.Authentication.JwtBearer: Enables implementing JWT (JSON Web Token) based authentication for your Web API, ensuring secure access control.
Microsoft.EntityFrameworkCore: Provides core functionalities and a SQL Server provider for interacting with your database from the Web API layer. (Note: Only needed if using SQL Server)
Microsoft.EntityFrameworkCore.Design: Assists with database migrations and design-time tools.
Microsoft.EntityFrameworkCore.Tools: Provides command-line tools for interacting with your database schema and migrations.
Microsoft.VisualStudio.Azure.Containers.Tools.Target (Optional): Might be required for deploying your Web API to Azure containers.
Swashbuckle.AspNetCore & Swashbuckle.AspNetCore.SwaggerUI: This combination generates OpenAPI (Swagger) documentation for your Web API, allowing developers to explore API endpoints and functionalities.

Project.Infrastructure

Microsoft.EntityFrameworkCore
Microsoft.EntityFrameworkCore.Design
Microsoft.EntityFrameworkCore.Tools
Microsoft.EntityFrameworkCore.SqlServer: provides the Entity Framework Core (EF Core) database provider for Microsoft SQL Server.

Fourth Step: Implementation of layers

Domain Layer

Create a folder with name Entities and add the following Class files:

We need a entity base Id and the timestamp to Create, Update and Delete operations:

using System.ComponentModel.DataAnnotations;

namespace Project.Domain.Entities
{
    public class EntityBase
    {
        [Key]
        public Guid Id { get; set; }
        public DateTimeOffset DateCreated { get; set; }
        public DateTimeOffset? DateUpdated { get; set; }
        public DateTimeOffset? DateDeleted { get; set; }

        protected EntityBase() => Id = Guid.NewGuid();
    }
}

User class:

namespace Project.Domain.Entities
{
    public class User : EntityBase
    {
        public string Email { get; set; }
        public string Password { get; set; }
        public List<Role> Roles { get; set; } = new();
        public Guid RefreshToken { get; set; } = Guid.NewGuid();

        public User(string email, string password)
        {
            Email = email;
            Password = password;
        }

        public void UpdateUser(User newUser)
        {
            Email = newUser.Email;
            Password = newUser.Password;
            Roles = newUser.Roles;
        }

        public void GenerateRefreshToken()
        {
            RefreshToken = Guid.NewGuid();
        }

        public void addRole(Role role)
        {
            Roles.Add(role);
        }
    }
}

Role class:

namespace Project.Domain.Entities
{
    public class Role : EntityBase
    {
        public string Name { get; set; }
        public List<User> Users { get; set; } = new();

        public Role(string name)
        {
            Name = name;
        }
    }
}

Let's create the Domain Interfaces for Repositories

Base Interface Repository with the CRUD basic operations.

using Project.Domain.Entities;

namespace Project.Domain.Interfaces
{
    public interface IBaseRepository<T> where T : EntityBase
    {
        void Create(T entity);
        void Update(T entity);
        void Delete(T entity);
        T GetById(Guid id);
        List<T> GetAll();
    }
}

In Role Interface Repository we need a functions that brings all roles by a list of ids passed

using Project.Domain.Entities;

namespace Project.Domain.Interfaces
{
    public interface IRoleRepository : IBaseRepository<Role>
    {
        Task<List<Role>> GetRoles(List<Guid> ids);
    }
}

In User Interface Repository we need more three methods GetUserByEmailAsync, GetUserByRefreshCode and AnyAsync.

using Project.Domain.Entities;

namespace Project.Domain.Interfaces
{
    public interface IUserRepository : IBaseRepository<User>
    {
        Task<User?> GetUserByEmailAsync(string email, CancellationToken cancellationToken);
        public Task<User?> GetUserByRefreshCode(Guid refreshToken, CancellationToken cancellationToken);
        Task<bool> AnyAsync(string email, CancellationToken cancelationToken);
    }
}

Now let's create the Unit of Work interface to commit the transactions in database:

namespace Project.Domain.Interfaces
{
    public interface IUnitOfWork
    {
        Task Commit(CancellationToken cancellationToken);
    }
}

Now we need a class to receive the environment variables that we can manipulate in code.

Configuration class:

namespace Project.Domain.Security
{
    public static class Configuration
    {
        public static SecretsConfiguration Secrets { get; set; } = new();
        public class SecretsConfiguration
        {
            public string ApiKey { get; set; } = string.Empty;
            public string JwtPrivateKey { get; set; } = string.Empty;
            public string PasswordSaltKey { get; set; } = string.Empty;
        }
    }
}

Application Layer

First, let's start with DTOs and Handler Response, following this structure of folder and class:

User Response DTO:

namespace Project.Application.DTOs
{
    public class UserResponseDTO
    {
        public Guid Id { get; set; }
        public string Email { get; set; }
        public List<RoleResponseDTO> Roles { get; set; }
        public string? Token { get; set; }
        public Guid? RefreshToken { get; set; }
    }
}

Role Response DTO:

namespace Project.Application.DTOs
{
    public class RoleResponseDTO
    {
        public Guid Id { get; set; }
        public string Name { get; set; }
    }
}

In Handler Response folder, create a class named has Response, we gonna use this class to patronize all handlers response.

using Project.Application.DTOs;

namespace Project.Application.HandlerResponse
{
    public class Response
    {
        public string Message { get; set; }
        public int Status { get; set; }
        public UserResponseDTO? Data { get; set; }

        public Response(string message, int status)
        {
            Message = message;
            Status = status;
        }

        public Response(string message, int status, UserResponseDTO? data)
        {
            Message = message;
            Status = status;
            Data = data;
        }
    }
}

Now we need to create Mappers to transform entities to his respective DTOs

User Mapper:

using AutoMapper;
using Project.Application.DTOs;
using Project.Domain.Entities;

namespace Project.Application.Mappers
{
    public class UserMapper : Profile
    {
        public UserMapper()
        {
            CreateMap<User, UserResponseDTO>().ReverseMap();
        }
    }
}

Role Mapper:

using AutoMapper;
using Project.Application.DTOs;
using Project.Domain.Entities;

namespace Project.Application.Mappers
{
    public class RoleMapper : Profile
    {
        public RoleMapper()
        {
            CreateMap<Role, RoleResponseDTO>().ReverseMap();
        }
    }
}

We will be using Fluent Validation to validate some inputs. However, before we proceed, we need to configure it.

Validation Behavior class:

using FluentValidation;
using MediatR;

namespace Project.Application.Shared
{
    public sealed class ValidationBehavior<TRequest, TResponse> :
                  IPipelineBehavior<TRequest, TResponse>
                  where TRequest : IRequest<TResponse>
    {
        private readonly IEnumerable<IValidator<TRequest>> _validators;

        public ValidationBehavior(IEnumerable<IValidator<TRequest>> validators)
        {
            _validators = validators;
        }

        public async Task<TResponse> Handle(TRequest request,
                                     RequestHandlerDelegate<TResponse> next,
                                     CancellationToken cancellationToken)
        {
            if (!_validators.Any()) return await next();

            var context = new ValidationContext<TRequest>(request);

            if (_validators.Any())
            {
                context = new ValidationContext<TRequest>(request);

                var validationResults = await Task.WhenAll(_validators.Select(v => v.ValidateAsync(context, cancellationToken)));

                var failures = validationResults.SelectMany(r => r.Errors).Where(f => f != null).ToList();

                if (failures.Count != 0)
                    throw new FluentValidation.ValidationException(failures);
            }

            return await next();
        }
    }
}

In sequence let's create one interface and implement the service to Hash Password for store User password in database:

Password Hashing Service Interface:

HashPassword function to hash the string password then return a hash and the VerifyHashedPassword to compare if a string password match with the hash stored in database to allow user to login.

namespace Project.Application.Interfaces
{
    public interface IPasswordHashingService
    {
        string HashPassword(string password);
        bool VerifyHashedPassword(string hashedPassword, string providedPassword);
    }
}

Service Implementation:
I chose to use the BCrypt library to hash and verify passwords conveniently.

using Project.Application.Interfaces;

namespace Project.Application.Services
{
    public class PasswordHashingService : IPasswordHashingService
    {
        public string HashPassword(string password)
        {
            if (password == null)
            {
                throw new ArgumentNullException(nameof(password));
            }

            return BCrypt.Net.BCrypt.HashPassword(password);
        }

        public bool VerifyHashedPassword(string hashedPassword, string providedPassword)
        {
            if (hashedPassword == null) throw new ArgumentNullException(nameof(hashedPassword));
            if (providedPassword == null) throw new ArgumentNullException(nameof(providedPassword));

            return BCrypt.Net.BCrypt.Verify(providedPassword, hashedPassword);
        }
    }

}

Now we need to configure services for the Application layer.

This file configures essential services for the application layer:

AutoMapper for data mapping
MediatR for handling requests using the Mediator pattern
FluentValidation for model validation
Custom ValidationBehavior integrated with MediatR for request validation
PasswordHashingService implementation for secure password hashing

using FluentValidation;
using MediatR;
using Microsoft.Extensions.DependencyInjection;
using Project.Application.Interfaces;
using Project.Application.Services;
using Project.Application.Shared;
using System.Reflection;

namespace Project.Application.Configuration
{
    public static class ServiceExtensions
    {
        public static void ConfigureApplicationApp(this IServiceCollection services)
        {
            services.AddAutoMapper(Assembly.GetExecutingAssembly());
            services.AddMediatR(cfg => cfg.RegisterServicesFromAssembly(Assembly.GetExecutingAssembly()));
            services.AddValidatorsFromAssembly(Assembly.GetExecutingAssembly());

            services.AddTransient(typeof(IPipelineBehavior<,>), typeof(ValidationBehavior<,>));
            services.AddScoped<IPasswordHashingService, PasswordHashingService>();
        }
    }
}

After configuration, we need to implement the
business rule for Create User, Authentication and Refresh token, we gonna follow the structure of Request refers to an object representing a specific action or operation the application needs to perform, Validator is a component responsible for checking the validity of data contained within a request object and Handler responsible for processing a specific type of request.

Following this folder and file structure:

Use Case: Create User

Create Request:

using MediatR;
using Project.Application.HandlerResponse;

namespace Project.Application.UseCases.Create
{
    public record CreateUserRequest(
        string Email,
        string Password,
        List<Guid> RoleIds
    ) : IRequest<Response>;
}

Create User Validator:

using FluentValidation;

namespace Project.Application.UseCases.Create
{
    public class CreateUserValidator : AbstractValidator<CreateUserRequest>
    {
        public CreateUserValidator()
        {
            RuleFor(x => x.RoleIds).NotEmpty().NotNull();
            RuleFor(x => x.Email).NotEmpty().MinimumLength(3).MaximumLength(100);
            RuleFor(x => x.Password).NotEmpty().MinimumLength(3).MaximumLength(100);
        }
    }
}

Create User Handler:

This handler search if email passed is already in use, then search all roles passed to associate to the user, create the user object with password hashed by the method HashPassword and finally save users in database.

using MediatR;
using Project.Application.HandlerResponse;
using Project.Application.Interfaces;
using Project.Domain.Entities;
using Project.Domain.Interfaces;

namespace Project.Application.UseCases.Create
{
    public class CreateUserHandler : IRequestHandler<CreateUserRequest, Response>
    {
        private readonly IUserRepository _userRepository;
        private readonly IRoleRepository _roleRepository;
        private readonly IUnitOfWork _unitOfWork;
        private readonly IPasswordHashingService _service;

        public CreateUserHandler(IUserRepository userRepository, IRoleRepository roleRepository, IUnitOfWork unitOfWork, IPasswordHashingService service)
        {
            _userRepository = userRepository;
            _roleRepository = roleRepository;
            _unitOfWork = unitOfWork;
            _service = service;
        }

        public async Task<Response> Handle(CreateUserRequest request, CancellationToken cancellationToken)
        {

            // Get roles
            List<Role> roles = [];

            try
            {
                roles = await _roleRepository.GetRoles(request.RoleIds);
            }
            catch
            {
                return new Response("Internal Server Error", 500);
            }

            try
            {
                // Check if email is avaliable
                bool isAvaliable = await _userRepository.AnyAsync(request.Email, cancellationToken);
                if (isAvaliable)
                {
                    return new Response("Email already in use", 404);
                }
            }
            catch
            {
                return new Response("Internal Server Error", 500);
            }

            // Generate User object
            User user = new User(request.Email, _service.HashPassword(request.Password));
            user.Roles = roles;

            try
            {
                // Save user in database
                _userRepository.Create(user);
                // Commit the chages in database
                await _unitOfWork.Commit(cancellationToken);
            }
            catch
            {
                return new Response("Internal Server Error", 500);
            }

            return new Response("User created", 201);
        }
    }
}

Use Case: Authentication

Authentication Request:

using MediatR;
using Project.Application.HandlerResponse;

namespace Project.Application.UseCases.Authentication
{
    public record AuthenticationRequest
    (
        string Email,
        string Password
    ) : IRequest<Response>;
}

Authentication Validator:

For purpose of this tutorial i chose to do a simple validate, but you can check the email format with some external library for regex.

using FluentValidation;

namespace Project.Application.UseCases.Authentication
{
    public class AuthenticationValidator : AbstractValidator<AuthenticationRequest>
    {
        public AuthenticationValidator()
        {
            RuleFor(x => x.Email).NotEmpty().MinimumLength(3).MaximumLength(100);
            RuleFor(x => x.Password).NotEmpty().MinimumLength(3).MaximumLength(100);
        }
    }
}

Authentication Handler:

This files search user in database, check if password passed match to password hashed in database and return the user object.

using AutoMapper;
using MediatR;
using Project.Application.DTOs;
using Project.Application.HandlerResponse;
using Project.Application.Interfaces;
using Project.Domain.Entities;
using Project.Domain.Interfaces;

namespace Project.Application.UseCases.Authentication
{
    public class AuthenticationHandler : IRequestHandler<AuthenticationRequest, Response>
    {
        private readonly IUserRepository _repository;
        private readonly IUnitOfWork _unitOfWork;
        private readonly IMapper _mapper;
        private readonly IPasswordHashingService _service;

        public AuthenticationHandler(IUserRepository repository, IUnitOfWork unitOfWork, IMapper mapper, IPasswordHashingService service)
        {
            _repository = repository;
            _unitOfWork = unitOfWork;
            _mapper = mapper;
            _service = service;
        }

        public async Task<Response> Handle(AuthenticationRequest request, CancellationToken cancellationToken)
        {
            User? user;
            try
            {
                // Search user in database
                user = await _repository.GetUserByEmailAsync(request.Email, cancellationToken);
                if (user is null)
                    return new Response("User not found", 404);
            }
            catch
            {
                return new Response("Internal Server Error", 500);
            }

            // Validate user password
            bool isVerified = _service.VerifyHashedPassword(user.Password, request.Password);
            if (!isVerified)
            {
                return new Response("Password dont match", 404);
            }

            try
            {
                // Commit the chages in database
                await _unitOfWork.Commit(cancellationToken);
            }
            catch
            {
                return new Response("Internal Server Error", 500);
            }

            // Mapper user to DTO
            UserResponseDTO userDTO = _mapper.Map<UserResponseDTO>(user);
            return new Response("User authenticated", 200, userDTO);
        }
    }
}

Use Case: Refresh Token

Refresh Token Request

using MediatR;
using Project.Application.HandlerResponse;

namespace Project.Application.UseCases.RefreshToken
{
    public record RefreshTokenRequest(
        Guid RefreshToken
    ) : IRequest<Response>;
}

Refresh Token Validator

using FluentValidation;

namespace Project.Application.UseCases.RefreshToken
{
    public class RefreshTokenValidator : AbstractValidator<RefreshTokenRequest>
    {
        public RefreshTokenValidator()
        {
            RuleFor(x => x.RefreshToken).NotEmpty().NotNull();
        }
    }
}

Refresh Token Hander

This handler search user to his refresh code, generate a new refresh token then update in database.

using AutoMapper;
using MediatR;
using Project.Application.DTOs;
using Project.Application.HandlerResponse;
using Project.Domain.Entities;
using Project.Domain.Interfaces;

namespace Project.Application.UseCases.RefreshToken
{
    public class RefreshTokenHandler : IRequestHandler<RefreshTokenRequest, Response>
    {
        private readonly IUserRepository _userRepository;
        private readonly IUnitOfWork _unitOfWork;
        private readonly IMapper _mapper;

        public RefreshTokenHandler(IUserRepository userRepository, IUnitOfWork unitOfWork, IMapper mapper)
        {
            _userRepository = userRepository;
            _unitOfWork = unitOfWork;
            _mapper = mapper;
        }

        public async Task<Response> Handle(RefreshTokenRequest request, CancellationToken cancellationToken)
        {
            // Search user
            User? user;
            try
            {
                // Search user role
                user = await _userRepository.GetUserByRefreshCode(request.RefreshToken, cancellationToken);
                if (user is null)
                {
                    return new Response("User not found", 404);
                }
            }
            catch
            {
                return new Response("Internal Server Error", 500);
            }

            // Update Refresh token
            user.GenerateRefreshToken();

            try
            {
                // Commit the chages in database
                await _unitOfWork.Commit(cancellationToken);
            }
            catch
            {
                return new Response("Internal Server Error", 500);
            }

            // Mapper user to dto
            UserResponseDTO userDTO = _mapper.Map<UserResponseDTO>(user);

            return new Response("Token Refreshed", 200, userDTO);
        }
    }
}

Infraestruture Layer

Here we start in Repositories.

Base Repository:

using Project.Domain.Entities;
using Project.Domain.Interfaces;
using Project.Infrastructure.Context;

namespace Project.Infrastructure.Repositories
{
    public class BaseRepository<T> : IBaseRepository<T> where T : EntityBase
    {
        private readonly AppDbContext _context;

        public BaseRepository(AppDbContext context)
        {
            _context = context;
        }

        public void Create(T entity)
        {
            entity.DateCreated = DateTimeOffset.UtcNow;
            _context.Add(entity);
        }

        public void Delete(T entity)
        {
            entity.DateDeleted = DateTimeOffset.UtcNow;
            _context.Remove(entity);
        }

        public List<T> GetAll()
        {
            return _context.Set<T>().ToList();
        }

        public T GetById(Guid id)
        {
            return _context.Set<T>().FirstOrDefault(x => x.Id == id);
        }

        public void Update(T entity)
        {
            entity.DateUpdated = DateTimeOffset.UtcNow;
            _context.Update(entity);
        }
    }
}

Role Repository:

using Microsoft.EntityFrameworkCore;
using Project.Domain.Entities;
using Project.Domain.Interfaces;
using Project.Infrastructure.Context;

namespace Project.Infrastructure.Repositories
{
    public class RoleRepository : BaseRepository<Role>, IRoleRepository
    {
        private readonly AppDbContext _context;
        public RoleRepository(AppDbContext context) : base(context)
        {
            _context = context;
        }

        public async Task<List<Role>> GetRoles(List<Guid> ids)
        {
            return await _context.Roles.Where(x => ids.Contains(x.Id)).ToListAsync();
        }
    }
}

User Repository:

using Microsoft.EntityFrameworkCore;
using Project.Domain.Entities;
using Project.Domain.Interfaces;
using Project.Infrastructure.Context;

namespace Project.Infrastructure.Repositories
{
    public class UserRepository : BaseRepository<User>, IUserRepository
    {
        private readonly AppDbContext _context;

        public UserRepository(AppDbContext context) : base(context)
        {
            _context = context;
        }

        public Task<bool> AnyAsync(string email, CancellationToken cancelationToken)
        {
            return _context.Users
                        .AnyAsync(x => x.Email == email, cancelationToken);
        }

        public Task<User?> GetUserByEmailAsync(string email, CancellationToken cancellationToken)
        {
            return _context.Users
                        .Include(x => x.Roles)
                        .FirstOrDefaultAsync(x => x.Email == email, cancellationToken);
        }

        public Task<User?> GetUserByRefreshCode(Guid refreshToken, CancellationToken cancellationToken)
        {
            return _context.Users
                        .Include(x => x.Roles)
                        .FirstOrDefaultAsync(x => x.RefreshToken == refreshToken, cancellationToken: cancellationToken);
        }
    }
}

Unit of Work:

using Project.Domain.Interfaces;
using Project.Infrastructure.Context;

namespace Project.Infrastructure.Repositories
{
    public class UnitOfWork : IUnitOfWork
    {
        private readonly AppDbContext _context;

        public UnitOfWork(AppDbContext context)
        {
            _context = context;
        }

        public async Task Commit(CancellationToken cancellationToken)
        {
            await _context.SaveChangesAsync();
        }
    }
}

Now move on to the folder Entities Configuration

Role Configuration:

Here is important to highlight the insert the roles "Admin" and "User", this inserts will be executed in momennrt to run migrations in database.

using Microsoft.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore.Metadata.Builders;
using Project.Domain.Entities;

namespace Project.Infrastructure.EntitiesConfiguration
{
    public class RoleConfiguration : IEntityTypeConfiguration<Role>
    {
        public void Configure(EntityTypeBuilder<Role> builder)
        {
            builder.HasKey(x => x.Id);
            builder.Property(x => x.Name)
                .HasColumnName("Name")
                .HasColumnType("NVARCHAR")
                .HasMaxLength(50)
                .IsRequired(true);

            builder.HasData(new Role("ADMIN"), new Role("USER"));
        }
    }
}

User Configuration:

using Microsoft.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore.Metadata.Builders;
using Project.Domain.Entities;

namespace Project.Infrastructure.EntitiesConfiguration
{
    public class UserConfiguration : IEntityTypeConfiguration<User>
    {
        public void Configure(EntityTypeBuilder<User> builder)
        {
            builder.HasKey(x => x.Id);

            builder.Property(x => x.Email)
                .HasColumnName("Name")
                .HasColumnType("NVARCHAR")
                .HasMaxLength(100)
                .IsRequired();

            builder.Property(x => x.Password)
                .HasColumnName("Password")
                .IsRequired();

            builder.Property(x => x.RefreshToken)
                .HasColumnName("RefreshToken");

            builder
                .HasMany(x => x.Roles)
                .WithMany(x => x.Users)
                .UsingEntity<Dictionary<string, object>>(
                    "UserRole",
                    role => role
                        .HasOne<Role>()
                        .WithMany()
                        .HasForeignKey("RoleId")
                        .OnDelete(DeleteBehavior.Cascade),
                    user => user
                        .HasOne<User>()
                        .WithMany()
                        .HasForeignKey("UserId")
                        .OnDelete(DeleteBehavior.Cascade));
        }
    }
}

Now let's configure the context of the database

App Db Context:

using Microsoft.EntityFrameworkCore;
using Project.Domain.Entities;

namespace Project.Infrastructure.Context
{
    public class AppDbContext : DbContext
    {
        public AppDbContext(DbContextOptions<AppDbContext> options) : base(options) { }

        protected override void OnModelCreating(ModelBuilder modelBuilder)
        {
            modelBuilder.ApplyConfigurationsFromAssembly(GetType().Assembly);
        }

        public DbSet<User> Users { get; set; }
        public DbSet<Role> Roles { get; set; }
    }
}

For last we need to add some configurations, then create a file with name Service Extensions inside in the layer.

This files is reponsible for:

Registers the AppDbContext with EF Core for database interactions.
Defines repository implementations for data access using the context.
Uses AddScoped for services that should exist within a single request scope.

using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Project.Domain.Interfaces;
using Project.Infrastructure.Context;
using Project.Infrastructure.Repositories;

namespace Project.Infrastructure
{
    public static class ServiceExtensions
    {
        public static void ConfigurePersistenceApp(this IServiceCollection services, IConfiguration configuration)
        {
            var connectionString = configuration.GetConnectionString("SqlServer");
            IServiceCollection serviceCollection = services.AddDbContext<AppDbContext>(opt => opt.UseSqlServer(connectionString, x => x.MigrationsAssembly("Project.Infrastructure")), ServiceLifetime.Scoped);

            services.AddScoped<IUnitOfWork, UnitOfWork>();
            services.AddScoped<IUserRepository, UserRepository>();
            services.AddScoped<IRoleRepository, RoleRepository>();
        }
    }
}

Presentation Layer

Inside in this layer click in appsettings.json and paste the following code that contains database string connection and some secrets for JWT service.

{
  "ConnectionStrings": {
    "SqlServer": "Server=sqlserver,1433;Database=project;User ID=sa;Password=0tI52#fa@vkz;Trusted_Connection=False;TrustServerCertificate=True;"
  },
  "Secrets": {
    "ApiKey": "da088158b6bebabd07de25d02ec2dd8e",
    "JwtPrivateKey": "ce8a25b97b7ad21fdb76c70f163f1e43",
    "PasswordSaltKey": "af07d7ea0910e49903c69ede15d987a7"
  },
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*"
}

Remember that environment variables should not be disposable in public access, if you need to protect this, use dotnet-secrets to store your variables.

The create a folter with name Extensions:

CORS configuration:
For purpose of this tutorial i chose to set CORS acessible to any client, but you need to specify the clients that are allowed to request your api.

namespace Project.WebApi.Extensions
{
    public static class CorsPolicyExtensions
    {
        public static void ConfigureCorsPolicy(this IServiceCollection services)
        {
            services.AddCors(opt =>
            {
                opt.AddDefaultPolicy(builder => builder
                    .AllowAnyOrigin()
                    .AllowAnyMethod()
                    .AllowAnyHeader());
            });
        }
    }
}

Builder Extension:

In method AddConfiguration we are retrieve the enviroment variables from appsettings to use along in the code. The method AddJwtAuthentication enables the JWT authentication.

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using Project.Domain.Security;
using System.Text;

namespace Project.WebApi.Extensions
{
    public static class BuilderExtension
    {
        public static void AddConfiguration(this WebApplicationBuilder builder)
        {
            Configuration.Secrets.ApiKey = builder.Configuration.GetSection("Secrets").GetValue<string>("ApiKey") ?? string.Empty;
            Configuration.Secrets.JwtPrivateKey = builder.Configuration.GetSection("Secrets").GetValue<string>("JwtPrivateKey") ?? string.Empty;
            Configuration.Secrets.PasswordSaltKey = builder.Configuration.GetSection("Secrets").GetValue<string>("PasswordSaltKey") ?? string.Empty;
        }

        public static void AddJwtAuthentication(this WebApplicationBuilder builder)
        {
            builder.Services
                .AddAuthentication(x =>
                {
                    x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                    x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
                }).AddJwtBearer(x =>
                {
                    x.RequireHttpsMetadata = false;
                    x.SaveToken = true;
                    x.TokenValidationParameters = new TokenValidationParameters
                    {
                        IssuerSigningKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(Configuration.Secrets.JwtPrivateKey)),
                        ValidateIssuer = false,
                        ValidateAudience = false
                    };
                });
            builder.Services.AddAuthorization();
        }
    }
}

JwtExtension:

This file provides a way to generate JWT tokens to our Web API and the JWT token is valid for 2 hours, then the client need to request a new token with refresh token.

using Microsoft.IdentityModel.Tokens;
using Project.Application.DTOs;
using Project.Domain.Security;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;

namespace Project.WebApi.Extensions
{
    public static class JwtExtension
    {
        public static string Generate(UserResponseDTO data)
        {
            var handler = new JwtSecurityTokenHandler();
            var key = Encoding.ASCII.GetBytes(Configuration.Secrets.JwtPrivateKey);
            var credentials = new SigningCredentials(
                new SymmetricSecurityKey(key),
                SecurityAlgorithms.HmacSha256Signature);

            var tokenDescriptor = new SecurityTokenDescriptor
            {
                Subject = GenerateClaims(data),
                Expires = DateTime.UtcNow.AddHours(2),
                SigningCredentials = credentials,
            };
            var token = handler.CreateToken(tokenDescriptor);
            return handler.WriteToken(token);
        }

        private static ClaimsIdentity GenerateClaims(UserResponseDTO user)
        {
            var ci = new ClaimsIdentity();
            ci.AddClaim(new Claim("Id", user.Id.ToString()));
            ci.AddClaim(new Claim(ClaimTypes.Name, user.Email));
            foreach (var role in user.Roles)
                ci.AddClaim(new Claim(ClaimTypes.Role, role.Name));

            return ci;
        }
    }
}

Move on to the controllers:

Auth Controller:

This controller is responsible to create, authentication and refresh the token requests.

using MediatR;
using Microsoft.AspNetCore.Mvc;
using Project.Application.UseCases.Authentication;
using Project.Application.UseCases.Create;
using Project.Application.UseCases.RefreshToken;
using Project.WebApi.Extensions;

namespace Project.WebApi.Controllers
{
    [ApiController]
    [Route("auth")]
    public class AuthController : ControllerBase
    {
        private readonly IMediator _mediator;
        public AuthController(IMediator mediadtor)
        {
            _mediator = mediadtor;
        }

        [HttpPost("authentication")]
        public async Task<IActionResult> Authentication([FromBody] AuthenticationRequest request, CancellationToken cancellation)
        {
            var response = await _mediator.Send(request, cancellation);

            if (response is null) return BadRequest();

            response.Data.Token = JwtExtension.Generate(response.Data);
            return Ok(response);
        }

        [HttpPost("refresh")]
        public async Task<IActionResult> RefreshToken([FromBody] RefreshTokenRequest request, CancellationToken cancellation)
        {
            var response = await _mediator.Send(request, cancellation);

            if (response is null) return BadRequest();

            response.Data.Token = JwtExtension.Generate(response.Data);
            return Ok(response);
        }

        [HttpPost("register")]
        public async Task<IActionResult> Create([FromBody] CreateUserRequest request, CancellationToken cancellation)
        {
            var response = await _mediator.Send(request, cancellation);

            if (response is null) return BadRequest();

            return Ok(response);
        }
    }
}

And the Project Controller has just two endpoints to user and admin which is needed permission to access.

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace Project.WebApi.Controllers
{
    [ApiController]
    [Route("project")]
    public class ProjectController : ControllerBase
    {
        [HttpGet("user")]
        [Authorize(Roles = "USER")]
        public ActionResult User()
        {
            return Ok("Hello User");
        }

        [HttpGet("admin")]
        [Authorize(Roles = "ADMIN")]
        public ActionResult Admin()
        {
            return Ok("Hello Admin");
        }
    }
}

Now let's configure the Program.cs in this layer.

This file is responsible to configurations for building
ASP.NET Web API with features like database access, JWT authentication, Swagger documentation, CORS, Migrations, Application Services, etc.

using Microsoft.OpenApi.Models;
using Project.Application.Configuration;
using Project.Infrastructure;
using Project.Infrastructure.Context;
using Project.WebApi.Extensions;
using System.Text.Json.Serialization;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.
builder.Services.AddControllers();
// Insert this to migrations run
builder.Services.ConfigurePersistenceApp(builder.Configuration);
// Mediator
builder.Services.ConfigureApplicationApp();
builder.Services.AddMvc()
                .AddJsonOptions(x => x.JsonSerializerOptions.ReferenceHandler = ReferenceHandler.IgnoreCycles);

// Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
builder.Services.AddEndpointsApiExplorer();

// Request JWT token in Swagger
builder.Services.AddSwaggerGen(options =>
{
    options.SwaggerDoc("v1", new OpenApiInfo { Title = "Demo API", Version = "v1" });
    options.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
    {
        In = ParameterLocation.Header,
        Description = "Please enter a valid token",
        Name = "Authorization",
        Type = SecuritySchemeType.Http,
        BearerFormat = "JWT",
        Scheme = "Bearer"
    });
    options.AddSecurityRequirement(new OpenApiSecurityRequirement
    {
        {
            new OpenApiSecurityScheme
            {
                Reference = new OpenApiReference
                {
                    Type=ReferenceType.SecurityScheme,
                    Id="Bearer"
                }
            },
            new string[]{}
        }
    });

    options.CustomSchemaIds(type => type.ToString());
});

// Add CORS extension
builder.Services.ConfigureCorsPolicy();

// Add extensions (Mine)
builder.AddConfiguration();
builder.AddJwtAuthentication();

var app = builder.Build();
CreateDatabase(app);

// Allow CORS POLICY
app.UseCors();

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

app.UseHttpsRedirection();

app.UseAuthorization();

app.MapControllers();

app.Run();

static void CreateDatabase(WebApplication app)
{
    var serviceScope = app.Services.CreateScope();
    var dataContext = serviceScope.ServiceProvider.GetService<AppDbContext>();
    dataContext?.Database.EnsureCreated();
}

Inside the Dockerfile in Presentation layer, paste this following configurations:

FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS base
USER app
WORKDIR /app
EXPOSE 8080
EXPOSE 8081

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
ARG BUILD_CONFIGURATION=Release
WORKDIR /src
COPY ["Project.WebApi/Project.WebApi.csproj", "Project.WebApi/"]
COPY ["Project.Domain/Project.Domain.csproj", "Project.Domain/"]
COPY ["Project.Application/Project.Application.csproj", "Project.Application/"]
COPY ["Project.Infrastructure/Project.Infrastructure.csproj", "Infrastructure.WebApi/"]
RUN dotnet restore "./Project.WebApi/Project.WebApi.csproj"
COPY . .
WORKDIR "/src/Project.WebApi"
RUN dotnet build "./Project.WebApi.csproj" -c $BUILD_CONFIGURATION -o /app/build

FROM buildbase as migrations
RUN dotnet tool install --version 8.0.2 --global dotnet-ef
ENV PATH="$PATH:/root/.dotnet/tools"
#ENTRYPOINT dotnet ef database update -s src/SlaveOneBack.WebAPI
ENTRYPOINT dotnet-ef database update --project src/Project.Infrastructure/ --startup-project src/Project.WebApi

FROM build AS publish
ARG BUILD_CONFIGURATION=Release
RUN dotnet publish "./Project.WebApi.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "Project.WebApi.dll"]

This configuration guarantees copying all files from this project to the docker environment and running the update database with migrations and API execution.

Fifth step: Execute Migrations

Let's execute the migrations, open the terminal and access the Project.Infraestructura layer and execute the following command:

dotnet ef migrations add -s ..\Project.Presentation v1

If migration is successful you should see in the

Checking whether a folder with the name Migrations was created in the Project.Infrastructure layer.

Sixth step: Docker Compose

In Presentation Layer, click with with the right button in mouse over Project.WebApi, Add and select Container Orchestrator Container.

In the popup, select docker and then linux.

You should see that docker is be executed and a new folder called docker-compose will be generated.

Open this folder and click in file docker-compose.yml, then paste this configuration.

version: '3.4'

services:
  project.webapi:
    image: ${DOCKER_REGISTRY-}projectwebapi
    build:
      context: .
      dockerfile: Project.WebApi/Dockerfile
    ports:
      - "3001:8080"
      - "3000:8081"

  migrations:
    container_name: service-migrations
    image: service-migrations
    build:
      context: .
      dockerfile: Project.WebApi/Dockerfile
      target: migrations
    depends_on:
        - sqlserver

  sqlserver:
    image: mcr.microsoft.com/mssql/server
    container_name: sqlserver
    ports:
      - "1433:1433"
    environment:
      ACCEPT_EULA: "Y"
      MSSQL_SA_PASSWORD: "0tI52#fa@vkz"
    restart: unless-stopped

This configurations will set the Web Api, Migration and SQL Server database.

With mouse right-click over docker-compose then set as startup project.

At top of the Visual Studio you should see:

Now is just click in this button and let's test our api.

In docker desktop you can check the container:

Seventh step: Testing

Ao executar o projeto a interface do Swagger deve abrir, ao tentar requisitar qualquer rota do endpoint project receberemos um erro com código 401 de não autorizado.

Creating a user:

To access the roles we must open the database, for this I will use Azure Data Studio with the database credentials that we defined in docker-compose.yml.

After connecting an interface to the bank you can follow the following path:

Select Roles and you should see:

Let's register a user

{
  "email": "user@email.com",
  "password": "#user123",
  "roleIds": [
    "db2b5b99-396c-4a53-b3f9-3522995befdd"
  ]
}

After registering, we must authenticate with email and password using the auth/authentication router.

The return will be this:

Copy the token and add it to swagger's authorize

And click on authorize, with this Swagger will pass the token on requests.

Once the user is logged in, we will request your project/user route to access the content.

If we try to request from the project/admin route, we will get the following response.

the auth/refresh route brings a new jwt token valid for another 2 hours. By passing the refresh token in the request, the login will be prolonged

Now let's create a user of type admin and user:

{
  "email": "admin@email.com",
  "password": "#admin",
  "roleIds": [
    "db2b5b99-396c-4a53-b3f9-3522995befdd", 
    "1b81a69d-c95f-43bd-b1e2-a51b73b48198"
  ]
}

When logging in with this new user, we can notice that he has both existing permissions in the system:

Changing the token in swagger's Authorize we can access both routes.

Conclusion

Implementing user authentication and authorization in a system is always a major challenge in the IT world. In this tutorial, in addition to implementing this API together, we briefly cover the benefits of Clean Architecture, Mediator and Unit of Work for a robust, secure and easily scalable system foundation.

github project repository