Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Extend an ASP.NET Core API to production-shaped quality. Add AUTHENTICATION (JWT bearer or ASP.NET Core Identity) and AUTHORIZATION (protect endpoints with [Authorize] plus a role- or policy-based rule), with UseAuthentication before UseAuthorization. Move settings into the layered configuration with the strongly-typed options pattern (IOptions<T>), keeping secrets in user-secrets/env (not source control). Add centralized exception handling returning ProblemDetails and structured logging (ILogger/Serilog). Write unit tests (xUnit + a mock) AND integration tests with WebApplicationFactory that exercise the real pipeline, including an auth-protected route.
Authentication (JWT/Identity) and authorization ([Authorize] + roles/policies) correct and distinct; middleware order right; protected routes enforced.
Options pattern for typed config; secrets kept out of source; centralized exception handling -> ProblemDetails; structured logging.
Unit tests with mocks + integration tests via WebApplicationFactory exercising the pipeline (incl. an auth-protected endpoint); tests pass.
Idiomatic, async, no captive-dependency mistakes; clean structure.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A secured, tested API with auth and config ## Goal Extend an ASP.NET Core API to production-shaped quality. Add AUTHENTICATION (JWT bearer or ASP.NET Core Identity) and AUTHORIZATION (protect endpoints with [Authorize] plus a role- or policy-based rule), with UseAuthentication before UseAuthorization. Move settings into the layered configuration with the strongly-typed options pattern (IOptions<T>), keeping secrets in user-secrets/env (not source control). Add centralized exception handling returning ProblemDetails and structured logging (ILogger/Serilog). Write unit tests (xUnit + a mock) AND integration tests with WebApplicationFactory that exercise the real pipeline, including an auth-protected route. ## Acceptance criteria - [ ] AuthN + AuthZ: Authentication (JWT/Identity) and authorization ([Authorize] + roles/policies) correct and distinct; middleware order right; protected routes enforced. - [ ] Config & errors: Options pattern for typed config; secrets kept out of source; centralized exception handling -> ProblemDetails; structured logging. - [ ] Testing: Unit tests with mocks + integration tests via WebApplicationFactory exercising the pipeline (incl. an auth-protected endpoint); tests pass. - [ ] Quality: Idiomatic, async, no captive-dependency mistakes; clean structure. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.