Skip to content

Conversation

@dariemcarlosdev
Copy link
Owner

@dariemcarlosdev dariemcarlosdev commented Nov 21, 2025

This pull request introduces significant improvements to the CI/CD pipeline for the BlueTreadApp project, including new workflows for Azure deployment and Docker publishing, as well as enhancements to the application's frontend and project configuration. The changes focus on automating builds, deployments, and security scans, while also improving the user experience and cleaning up the repository.

CI/CD and Deployment Automation

  • Added a comprehensive GitHub Actions workflow for building, testing, and deploying to Azure App Service, including environment configuration, health checks, and security scanning with Trivy.
  • Introduced a Docker build and publish workflow that builds multi-platform Docker images, pushes them to Docker Hub, scans for vulnerabilities, and updates Docker Hub descriptions.
  • Created a detailed .dockerignore file to optimize Docker build contexts by excluding unnecessary files, improving build speed, image size, and security.

Frontend and User Experience

  • Redesigned the Home.razor page with a welcoming card, clear description of the demo project, and a prominent link to Swagger UI for API exploration; added corresponding CSS for improved appearance. [1] [2]

Project Configuration and Cleanup

  • Removed unused or obsolete project files: BlueTreadApp.csproj and BlueTreadApp.slnx, streamlining the repository. [1] [2]

Other minor changes include small updates to error UI and style references in component files.

Summary by CodeRabbit

  • New Features

    • JWT login/logout, token blacklisting, token status & statistics endpoints.
    • API data integration with caching, refresh, and paginated responses.
    • Rate limiting, health checks, and a sample API with admin-only routes.
    • Docker support and CI/CD workflows for build, image publish, and Azure deploy.
    • Updated home/hero UI and Swagger discoverability.
  • Documentation

    • Expanded README and API contract examples with deployment and usage guidance.

✏️ Tip: You can customize this high-level summary in your review settings.

dariemcarlosdev and others added 20 commits November 18, 2025 09:34
- Rename solution file: BlueTreadApp.slnx -> SecureCleanApiWaf.slnx
- Rename project file: BlueTreadApp.csproj -> SecureCleanApiWaf.csproj
- Update .gitignore with new project name patterns
- Update Program.cs with project namespace and configuration
- Update launchSettings.json with new application profiles

This commit establishes the new project identity and configuration foundation.
**Entities (4):**
- BaseEntity: Abstract base with ID, audit fields, domain events
- User: User aggregate with Email value object and status
- Token: JWT token entity with blacklisting support
- ApiDataItem: Sample data entity with status tracking

**Value Objects (3):**
- Email: Validated email with domain rules
- Role: User role (User, Admin) with validation
- ValueObject: Base class for value object equality

**Enums (4):**
- UserStatus: Active, Inactive, Suspended, Deleted
- TokenStatus: Active, Revoked, Expired
- TokenType: Access, Refresh
- DataStatus: Active, Archived, Deleted

**Domain Events (4):**
- IDomainEvent: Event marker interface
- BaseDomainEvent: Base event with timestamp
- UserRegisteredEvent: User creation event
- TokenRevokedEvent: Token blacklisting event

**Common (2):**
- IAggregateRoot: Marker for aggregate roots
- DomainException: Domain-specific exceptions

This establishes the core domain model with rich business logic and invariants.
**Authentication Feature (6 components):**
Commands:
- LoginUserCommand + Handler: User authentication with JWT generation
- BlacklistTokenCommand + Handler: Secure logout with dual-cache

Queries:
- IsTokenBlacklistedQuery + Handler: Token validation with caching
- GetTokenBlacklistStatsQuery + Handler: Admin monitoring stats

**Sample Data Feature (6 components):**
Queries:
- GetApiDataQuery + Handler: Retrieve all data from external API
- GetApiDataByIdQuery + Handler: Retrieve single data item by ID
- GetApiDataWithMappingQuery + Handler: Data retrieval with AutoMapper

**Pipeline Behaviors (6):**
- ICacheable: Interface for cacheable queries
- CachingBehavior: Automatic caching via MediatR pipeline
- ILoggable: Interface for loggable requests
- LoggingBehavior: Automatic logging via MediatR pipeline
- IValidatable: Interface for validatable commands
- ValidationBehavior: Automatic validation via MediatR pipeline

**Common (2):**
- Result pattern: Result<T> for consistent error handling
- DTOs: SampleDataDto for API responses

This implements complete CQRS pattern with MediatR integration and cross-cutting concerns.
**Services (3):**
- ApiIntegrationService: External API integration with HttpClientFactory
- TokenBlacklistService: Dual-cache token management (Memory + Distributed)
- CacheService: Generic caching abstraction for IMemoryCache/IDistributedCache

**Repositories (3):**
- UserRepository: User data access with EF Core
- TokenRepository: Token persistence with EF Core
- ApiDataItemRepository: API data caching with EF Core

**Security (2):**
- JwtTokenGenerator: JWT token creation and configuration
- ApiKeyHandler: DelegatingHandler for external API authentication

**Middleware (1):**
- JwtBlacklistValidationMiddleware: Token validation in HTTP pipeline

**Data Layer (3):**
- ApplicationDbContext: EF Core DbContext configuration
- ApiDataItemConfiguration: Entity Framework entity configuration
- DatabaseSettings: Database connection configuration

**Caching (2):**
- CacheService: Generic caching implementation
- SampleCache: Sample caching patterns and usage

**Key Features:**
- HttpClientFactory with Polly resilience policies
- Dual-cache strategy for performance and scalability
- Repository pattern with EF Core
- JWT generation and validation
- Custom middleware for authentication pipeline

This establishes infrastructure for external integrations, data persistence, and cross-cutting concerns.
…or UI

**API Controllers (3):**
- AuthController: Login, logout, token management endpoints
- TokenBlacklistController: Admin monitoring and statistics
- SampleController: RESTful API v1 endpoints with caching

**Dependency Injection Extensions (3):**
- ApplicationServiceExtensions: Application layer DI configuration
- InfrastructureServiceExtensions: Infrastructure layer DI with Polly
- PresentationServiceExtensions: Presentation layer DI (Controllers, Swagger, JWT)

**HTTP Pipeline Extensions (1):**
- WebApplicationExtensions: Middleware pipeline configuration
  - Exception handling, HTTPS redirection, static files
  - Authentication, authorization, rate limiting
  - CORS, security headers, Swagger
  - Custom middleware (JWT blacklist validation)

**Blazor Components (6):**
- App.razor: Application root component
- Routes.razor: Routing configuration
- MainLayout.razor: Application layout
- Home.razor + Home.razor.css: Home page with styling
- Error.razor: Error page
- _Imports.razor: Global using directives

**Legacy Pages (1):**
- _Host.cshtml: Blazor Server host page

**Models (1):**
- SampleModel: Sample data model for demonstrations

**Static Files (1):**
- wwwroot/readme.txt: Static files directory documentation

**Key Features:**
- RESTful API v1 with versioning
- JWT authentication with role-based authorization
- Swagger/OpenAPI documentation
- Rate limiting (60/min, 1000/hr per IP)
- CORS configuration
- Security headers (XSS, Clickjacking, MIME-sniffing protection)
- Blazor Server UI with SignalR
- Dependency injection for all layers
- Polly resilience policies (Retry + Circuit Breaker)

This establishes the presentation layer with API endpoints, Blazor UI, and complete HTTP pipeline.
**Docker Configuration (4 files):**
- Dockerfile: Multi-stage build for production deployment
  - Stage 1: Build with .NET 8 SDK
  - Stage 2: Runtime with ASP.NET Core 8
  - Optimized for size and security
- Dockerfile.original: Reference implementation
- docker-compose.yml: Multi-container orchestration
  - App service with health checks
  - Redis for distributed caching (optional)
  - Environment variable configuration
- .dockerignore: Exclude unnecessary files from Docker context

**GitHub Actions CI/CD (2 workflows):**
- azure-webapps-dotnet-core.yml: Azure App Service deployment
  - Build, test, publish workflow
  - Automated deployment to Azure
  - Environment-specific configuration
- docker-publish.yml: Docker Hub publishing
  - Multi-platform builds (linux/amd64, linux/arm64)
  - Automated tagging and versioning
  - Push to Docker Hub registry

**Key Features:**
- Multi-stage Docker builds for optimization
- Health check endpoints for container orchestration
- Environment-based configuration
- Automated CI/CD pipelines
- Docker Compose for local development
- Azure App Service integration
- Docker Hub publishing automation

This enables containerized deployment and automated CI/CD workflows.
**Main Guides (5):**
- CLEAN-DDD_ARCH_README.md: Complete DDD & architecture documentation hub
- CLEAN_ARCHITECTURE_GUIDE.md: Comprehensive architecture principles and implementation
- MIGRATION_GUIDE.md: Step-by-step migration from single to multi-project
- ARCHITECTURE_PATTERNS_EXPLAINED.md: Detailed pattern explanations
- LAYER_INTEGRATION_GUIDE.md: How layers integrate and communicate

**Layer-Specific Guides (5):**
- 01-Domain-Layer.md: Entities, Value Objects, Events, Enums (85% complete)
- 02-Application-Layer.md: CQRS with MediatR, Commands, Queries, Handlers
- 03-Infrastructure-Layer.md: Services, Repositories, External integrations
- 04-Infrastructure-Azure-Layer.md: Azure Key Vault, App Service integration
- 05-Web-Presentation-Layer.md: Controllers, Extensions, Blazor components

**Pattern & Strategy Guides (1):**
- HYBRID-MAPPING-STRATEGY.md: AutoMapper + Custom Mapper decision matrix

**Key Topics Covered:**
- Clean Architecture principles and layers
- Dependency Inversion Principle (DIP)
- SOLID principles in practice
- Domain-Driven Design (DDD) patterns
- CQRS and MediatR integration
- Repository pattern with EF Core
- Value Objects and Aggregates
- Domain Events and invariants
- Single vs Multi-project approaches
- Interface abstractions (15+ interfaces)
- Layer boundaries and flow
- Testing strategies per layer
- Migration paths and best practices

This provides complete architectural documentation with real-world implementation examples.
**Documentation Hub (1):**
- API_README.md: Central hub for all API design documentation
  - Quick navigation to all guides
  - Overview of API capabilities
  - Links to specific topics

**API Design Guides (2):**
- API_DESIGN_GUIDE.md: Comprehensive API design principles
  - RESTful API design patterns
  - API versioning strategies (URL, Header, Query String)
  - Error handling with ProblemDetails
  - Security best practices (JWT, HTTPS, Rate Limiting)
  - Caching strategies (Cache-Aside, MediatR pipeline)
  - Performance optimization
  - API documentation with Swagger/OpenAPI
  - Testing strategies
  - CORS configuration
  - Content negotiation
  - Pagination and filtering

- API_CONTRACTS_EXAMPLES.md: Real-world API contract examples
  - Request/Response models
  - Authentication endpoints
  - Data retrieval endpoints
  - Error response formats
  - ProblemDetails examples
  - Swagger schema examples
  - Validation error responses

**Key Topics Covered:**
- RESTful resource naming conventions
- HTTP methods (GET, POST, PUT, DELETE, PATCH)
- Status codes (200, 201, 400, 401, 403, 404, 500)
- API versioning approaches
- Authentication and authorization patterns
- Rate limiting and throttling
- CORS policies
- Content negotiation (JSON, XML)
- Caching headers and strategies
- Error handling and ProblemDetails
- API documentation and testing
- Performance optimization techniques

This provides complete API design documentation with production-ready patterns.
**Documentation Hub (1):**
- AUTHENT-AUTHORIT_README.md: Central hub for all security documentation
  - Quick navigation to authentication, authorization, and security guides
  - Overview of security features
  - Links to CQRS implementation details

**Security Implementation Guides (4):**
- API-SECURITY-IMPLEMENTATION-GUIDE.md: Complete security architecture
  - JWT Bearer authentication configuration
  - Token blacklisting with dual-cache strategy
  - Custom middleware (JwtBlacklistValidationMiddleware)
  - Rate limiting setup (60/min, 1000/hr)
  - CORS configuration
  - Security headers (XSS, Clickjacking, MIME-sniffing)
  - Polly resilience policies (Retry + Circuit Breaker)
  - External API security (ApiKeyHandler)
  - Production deployment checklist

- JWT_AUTHENTICATION_CQRS_ARCHITECTURE.md: CQRS authentication architecture
  - Command pattern (LoginUserCommand, BlacklistTokenCommand)
  - Query pattern (IsTokenBlacklistedQuery, GetTokenBlacklistStatsQuery)
  - MediatR integration and pipeline behaviors
  - Automatic caching with CachingBehavior
  - Handler implementations
  - Request flow diagrams
  - Best practices and patterns

- CQRS_LOGIN_IMPLEMENTATION_SUMMARY.md: Login implementation details
  - LoginUserCommand and handler breakdown
  - JWT token generation process
  - Validation and error handling
  - Response structure and metadata

- CQRS_LOGOUT_IMPLEMENTATION_SUMMARY.md: Logout implementation details
  - BlacklistTokenCommand and handler breakdown
  - Dual-cache token blacklisting strategy
  - Token invalidation process
  - Cache expiration and cleanup

**Key Topics Covered:**
- JWT Bearer authentication and authorization
- Token-based authentication (stateless)
- Role-based access control (RBAC)
- Token blacklisting and revocation
- CQRS pattern for authentication
- MediatR integration
- Dual-cache strategy (Memory + Distributed)
- Custom middleware for token validation
- Rate limiting and throttling
- CORS policies
- Security headers configuration
- API key management
- Polly resilience patterns
- External API security
- Production security checklist

This provides complete security documentation with CQRS implementation examples.
**Deployment Hub (1):**
- DEPLOYMENT_README.md: Master deployment guide and hub
  - Quick start guides for all platforms
  - Platform comparison matrix
  - Prerequisites and configuration
  - Security best practices
  - Troubleshooting guide
  - Links to specific deployment guides

**Azure App Service Deployment (1):**
- AzureAppService/DEPLOYMENT_GUIDE.md: Complete Azure PaaS deployment
  - Azure resource setup (App Service, Key Vault)
  - Managed Identity configuration
  - GitHub Actions CI/CD pipeline
  - Application Insights integration
  - Environment variables and secrets
  - Complete deployment checklist
  - Troubleshooting and monitoring
  - Estimated time: 10-15 minutes

**Docker Deployment (6):**
- Docker/DOCKER_README.md: Docker documentation hub
- Docker/DOCKER_DEPLOYMENT.md: Full containerization guide (11 KB)
  - Building and running containers locally
  - Publishing to Docker Hub
  - Cloud deployment (Azure, AWS, GCP, Kubernetes)
  - Environment variables and configuration
  - Multi-stage builds
  - Estimated time: 5-10 minutes (local)
- Docker/DOCKER_QUICK_REFERENCE.md: Quick commands and troubleshooting
- Docker/DOCKER_SETUP_SUMMARY.md: Overview and checklist
- Docker/DOCKER_TROUBLESHOOTING.md: Common issues and solutions
- Docker/DOCKER_DNS_CONFIGURATION.md: DNS and networking setup

**Deployment Options Covered:**
- Docker Compose (Local): Low complexity, 5 min, for development
- Azure App Service: Low complexity, 15 min, managed PaaS
- Azure Container Apps: Medium complexity, 10 min, serverless containers
- Docker + Kubernetes: High complexity, 30+ min, enterprise orchestration
- CI/CD (GitHub Actions): Medium complexity, 20 min, automated deployments

**Key Topics Covered:**
- Azure App Service deployment
- Docker containerization
- Docker Compose orchestration
- Multi-stage Docker builds
- Environment-based configuration
- Secrets management (Azure Key Vault)
- Managed Identity for Azure resources
- GitHub Actions CI/CD pipelines
- Container health checks
- Multi-platform builds (linux/amd64, linux/arm64)
- Cloud platform deployment (Azure, AWS, GCP)
- Kubernetes deployment
- DNS configuration
- Troubleshooting and monitoring
- Security best practices
- Performance optimization

This provides complete deployment documentation for all major platforms.
**Testing Hub (1):**
- TEST_README.md: Central hub for all testing documentation
  - Quick navigation to all testing guides
  - Overview of testing strategies
  - Links to specific testing approaches

**Testing Strategy Guides (4):**
- CLEAN_ARCHITECTURE_TESTING_STRATEGY.md: Complete testing strategy
  - Unit testing per layer (Domain, Application, Infrastructure, Presentation)
  - Integration testing approaches
  - Architecture tests with NetArchTest
  - End-to-End testing strategies
  - Test organization and structure
  - Mocking strategies (Moq, NSubstitute)
  - Test data builders
  - xUnit, NUnit, MSTest examples
  - Code coverage targets (80%+ recommended)
  - CI/CD integration

- API_ENDPOINT_TESTING_GUIDE.md: How to test all API endpoints
  - Testing with Swagger UI
  - PowerShell testing scripts
  - Postman collection examples
  - curl commands for all endpoints
  - Authentication endpoint testing
  - Protected endpoint testing with JWT
  - Token blacklisting testing
  - Admin monitoring endpoint testing
  - Rate limiting verification
  - Error response testing

- TEST_AUTHENTICATION_GUIDE.md: Step-by-step authentication testing
  - Running the application
  - Getting JWT tokens via CQRS endpoints
  - Testing protected endpoints
  - Testing logout and token blacklisting
  - Testing authorization policies (User, Admin)
  - Testing rate limiting
  - Admin monitoring endpoints
  - Troubleshooting guide
  - Complete testing workflow (5 minutes)

**Key Topics Covered:**
- Unit testing strategies per layer
- Integration testing with WebApplicationFactory
- Architecture tests with NetArchTest
- API endpoint testing approaches
- Authentication and authorization testing
- JWT token testing workflows
- Token blacklisting verification
- Rate limiting testing
- CORS testing
- Error handling testing
- Swagger/OpenAPI testing
- PowerShell testing scripts
- Postman integration
- curl command examples
- Mock objects and test doubles
- Test data builders
- Code coverage reporting
- CI/CD test integration
- Test organization best practices

This provides complete testing documentation with practical examples for all layers.
Added comprehensive Clean Architecture documentation, including guides for Domain, Application, Infrastructure, Azure, and Presentation layers. Introduced a migration guide for transitioning to a multi-project structure and a quick reference for single-project setups. Updated `.gitignore` to exclude sensitive files and centralized logging configuration. Enhanced `README.md` with project overviews, dependency flow diagrams, and implementation checklists. Added detailed testing strategies covering unit, integration, and functional tests. Improved Azure integration documentation with examples for Key Vault, Blob Storage, and Service Bus. Simplified project organization for maintainability and scalability.

Enhance configs, docs, and Azure integration

- Improved `appsettings.Development.json` with detailed comments, verbose logging, JWT settings, CORS, rate-limiting, and database configurations for development.
- Updated `appsettings.json` with Azure Key Vault integration, production-ready logging, JWT placeholders, stricter CORS, and rate-limiting rules.
- Added certificates (`corporate-ca.crt` and `.cer`) for secure communication.
- Expanded `README.md` with project overview, architecture, security, and deployment details.
- Added `PROBLEMDETAILS-CUSTOMIZATION-GUIDE.md` and `PROBLEMDETAILS-EXAMPLES.md` for enriched API error responses.
- Introduced `AZURE_INTEGRATION_GUIDE.md` for App Service, Key Vault, and Managed Identity setup.
- Documented CI/CD pipeline in `CICD_PIPELINE_GUIDE.md` with GitHub Actions workflow for build, test, deploy, and security scans.
Enhanced readability and presentation by:
- Replacing ambiguous symbols with meaningful emojis.
- Fixing encoding issues for special characters.
- Standardizing formatting with consistent symbols (✅, ❌).
- Adding new badges for tools and technologies.
- Expanding the technology stack and implementation details.

Updated sections include:
- Inspiration, Table of Contents, Executive Summary.
- Core Technical Achievements, Metrics, Quick Reference.
- Documentation Hubs, Clean Architecture, Security Features.
- Added a "Contact" section and a personalized footer.

These changes aim to improve clarity, consistency, and user engagement.
Enhanced formatting with icons and emojis for better navigation.
Standardized terminology and fixed encoding issues across files.
Added detailed examples, diagrams, and step-by-step guides.
Expanded troubleshooting and support sections for user assistance.
Aligned all documentation with modern technical writing standards.
Improve README.md formatting and structure

Enhanced readability and presentation by:
- Replacing ambiguous symbols with meaningful emojis.
- Fixing encoding issues for special characters.
- Standardizing formatting with consistent symbols (✅, ❌).
- Adding new badges for tools and technologies.
- Expanding the technology stack and implementation details.

Updated sections include:
- Inspiration, Table of Contents, Executive Summary.
- Core Technical Achievements, Metrics, Quick Reference.
- Documentation Hubs, Clean Architecture, Security Features.
- Added a "Contact" section and a personalized footer.

These changes aim to improve clarity, consistency, and user engagement.
Updated section titles and headings for consistency, replacing ambiguous symbols with meaningful icons. Renamed "Contact & Contributions" to "Support & Contact" and enhanced the section with detailed instructions for help, bug reporting, and contributions.

Reorganized "Documentation Hubs" and added new hubs for Clean Architecture, Authentication & Authorization, and Testing. Updated links to ensure accuracy and consistency, including references to API design documentation.

Enhanced "Getting Started" and "Quick Reference" sections with actionable steps for new developers. Replaced outdated phrases with concise descriptions and improved the "Best Practices" and "Summary" sections.

Added a "License & Legal" section and updated "API Status" with a clear summary of implementation readiness. Improved formatting and tone throughout, ensuring better readability and navigation.
Merge branch 'Dev' of https://github.com/dariemcarlosdev/SecureCleanApiWaf into Dev
Added a new section under `services` in `docker-compose.yml`
to provide guidance for common issues. Included Q&A entries
for resolving problems like environment variables not being
applied and changes not reflecting after a rebuild. These
updates aim to improve developer experience and debugging.
@dariemcarlosdev dariemcarlosdev self-assigned this Nov 21, 2025
Copilot AI review requested due to automatic review settings November 21, 2025 16:04
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Nov 21, 2025

Caution

Review failed

The pull request is closed.

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

Walkthrough

Rebrands BlueTreadApp to SecureCleanApiWaf and introduces a full layered architecture: domain entities, value objects, repositories, services, MediatR CQRS handlers, caching and blacklist features, EF Core infrastructure, middleware, DI/pipeline extensions, CI/CD workflows, Docker artifacts, and comprehensive configuration and docs.

Changes

Cohort / File(s) Summary
Project & Build Files
\.dockerignore``, .gitignore, ``Dockerfile``, ``Dockerfile.original``, ``docker-compose.yml``, ``SecureCleanApiWaf.csproj``, ``SecureCleanApiWaf.slnx``, ``BlueTreadApp.csproj``, ``BlueTreadApp.slnx``
Added/updated project, Docker, and ignore files; removed old BlueTreadApp project; added SecureCleanApiWaf project and Docker multi-stage/runtime variants; docker-compose added.
CI/CD Workflows
.github/workflows/azure-deploy.yml, .github/workflows/docker-publish.yml
New GitHub Actions workflows for build/test/publish/deploy to Azure and Docker image build/push with security scanning.
Configuration & Launch
appsettings.json, appsettings.Development.json, Properties/launchSettings.json, Program.cs
Extensive configuration (JWT, DB, caching, Key Vault, rate limiting, CORS, logging), launch profiles updated, Program wired to layer DI extensions and Key Vault.
Presentation / Blazor & UI
Components/*, Pages/_Host.cshtml, Components/_Imports.razor, Models/SampleModel.cs
Cleaned BOMs, namespace/import updates, new Home hero UI and CSS, host page and sample DTO added.
Presentation / Controllers
Presentation/Controllers/v1/AuthController.cs, Presentation/Controllers/v1/SampleController.cs, Presentation/Controllers/v1/TokenBlacklistController.cs
New API controllers for auth (login/logout/token), sample data, and token blacklist endpoints using MediatR.
Presentation / DI & Pipeline
Presentation/Extensions/DependencyInjection/*.cs, Presentation/Extensions/HttpPipeline/WebApplicationExtensions.cs
Layered DI registration extension methods (Application, Infrastructure, Presentation), MediatR/AutoMapper registrations, and centralized HTTP pipeline configuration including security headers and middleware ordering.
Core Domain: Entities & ValueObjects
Core/Domain/Entities/*, Core/Domain/ValueObjects/*, Core/Domain/Enums/*, Core/Domain/Events/*, Core/Domain/Exceptions/*
New DDD model: BaseEntity, ApiDataItem, User, Token, value objects (Email, Role, ValueObject base), enums (UserStatus, TokenStatus, TokenType, DataStatus), domain events and exceptions.
Core Application: DTOs, Interfaces & Behaviors
Core/Application/Common/DTOs/*, Core/Application/Common/Interfaces/*, Core/Application/Common/Behaviors/*
New DTOs for API responses and statistics; repository/service contracts (IApiDataItemRepository, IUserRepository, ITokenRepository, IApiIntegrationService, ICacheService, ITokenBlacklistService); caching interface and MediatR CachingBehavior + ICacheable.
Core Application: Mapping & Models
Core/Application/Common/Mapping/ApiDataMapper.cs, Core/Application/Common/Profiles/ApiDataMappingProfile.cs, Core/Application/Common/Models/Result.cs
Dynamic API-to-domain mapper, AutoMapper profile, and generic Result type.
Core Application: Features (Auth & SampleData)
Core/Application/Features/Authentication/*, Core/Application/Features/SampleData/*
CQRS commands/queries and handlers for Login, BlacklistToken, IsTokenBlacklisted, GetTokenBlacklistStats; sample-data queries with mapping and sync handlers.
Infrastructure: Data & Repos
Infrastructure/Data/*, Infrastructure/Data/Configurations/*, Infrastructure/Repositories/*
ApplicationDbContext with audit/soft-delete behavior, DatabaseSettings, ApiDataItem EF configuration, EF Core repositories for ApiDataItem, User, Token.
Infrastructure: Services, Security & Caching
Infrastructure/Security/JwtTokenGenerator.cs, Infrastructure/Services/*, Infrastructure/Caching/*, Infrastructure/Handlers/ApiKeyHandler.cs, Infrastructure/Middleware/JwtBlacklistValidationMiddleware.cs
JwtTokenGenerator, ApiIntegrationService, TokenBlacklistService, CacheService and SampleCache, HTTP ApiKey handler, and JWT blacklist validation middleware with extension.
Docs & README
README.md, docs/APIDesign/API_CONTRACTS_EXAMPLES.md
Comprehensive project documentation and API contract examples.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant AuthController
    participant MediatR
    participant LoginHandler
    participant IUserRepo
    participant JwtTokenGenerator
    participant ITokenRepo

    Client->>AuthController: POST /api/v1/auth/login (credentials)
    AuthController->>MediatR: Send(LoginUserCommand)
    MediatR->>LoginHandler: Handle
    LoginHandler->>IUserRepo: GetByUsernameAsync
    IUserRepo-->>LoginHandler: User
    LoginHandler->>JwtTokenGenerator: GenerateToken(...)
    JwtTokenGenerator-->>LoginHandler: JWT
    LoginHandler->>ITokenRepo: AddAsync(Token)
    LoginHandler->>ITokenRepo: SaveChangesAsync()
    LoginHandler-->>MediatR: Result.Ok(LoginResponseDto)
    MediatR-->>AuthController: Result
    AuthController-->>Client: 200 {token, metadata}
Loading
sequenceDiagram
    participant Client
    participant Middleware
    participant MediatR
    participant IsTokenBlacklistedHandler
    participant ITokenBlacklistService
    participant Response

    Client->>Middleware: Request with Authorization: Bearer <jwt>
    Middleware->>MediatR: Send(IsTokenBlacklistedQuery)
    MediatR->>IsTokenBlacklistedHandler: Handle
    IsTokenBlacklistedHandler->>ITokenBlacklistService: IsTokenBlacklistedAsync
    alt cached
        ITokenBlacklistService-->>IsTokenBlacklistedHandler: cached status
    else not cached
        ITokenBlacklistService->>ITokenRepo: query repository
        ITokenBlacklistService-->>IsTokenBlacklistedHandler: status
    end
    IsTokenBlacklistedHandler-->>Middleware: Result(TokenBlacklistStatusDto)
    alt blacklisted
        Middleware->>Response: 401 Unauthorized (payload)
        Response-->>Client: 401
    else valid
        Middleware->>Response: pass through
        Response-->>Client: proceed
    end
Loading

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120+ minutes

Specific areas to focus during review:

  • Domain entity invariants, soft-delete and audit timestamp handling (BaseEntity, ApiDataItem, Token, User).
  • Token lifecycle and security: JwtTokenGenerator, Token.Create/Revoke/MarkAsExpired, TokenRepository, TokenBlacklistService and cache synchronization.
  • Middleware ordering and behavior: JwtBlacklistValidationMiddleware placement (after authentication, before authorization) and error-handling paths.
  • CQRS handlers correctness, consistent use of Result, and MediatR pipeline registration (CachingBehavior and generic handler registrations).
  • EF Core configurations and indexes (ApiDataItemConfiguration) and ApplicationDbContext SaveChanges audit logic.
  • ApiDataMapper and AutoMapper profile correctness for dynamic and typed mapping, edge-case null handling.
  • DI lifetimes in InfrastructureServiceExtensions and PresentationServiceExtensions, and HttpClient Polly policies.

Poem

🐰
From burrows deep I nibble code,
Clean layers stitched in tidy mode.
Tokens guarded, caches bright,
Blacklist keeps the night polite.
Hops of joy — the build takes flight! 🥕✨

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)
Check name Status Explanation Resolution
Title check ⚠️ Warning The title 'Merging into Marter Branch' is vague and generic; it does not describe the actual changes in the PR (CI/CD workflows, Docker setup, frontend redesign, project cleanup). Use a descriptive title that summarizes the main change, such as 'Add CI/CD pipelines, Docker deployment, and frontend updates' or 'Setup GitHub Actions workflows and Docker deployment infrastructure'.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage ✅ Passed Docstring coverage is 94.74% which is sufficient. The required threshold is 80.00%.

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between f1689b4 and 0a449e3.

📒 Files selected for processing (95)
  • .dockerignore (1 hunks)
  • .github/workflows/azure-deploy.yml (1 hunks)
  • .github/workflows/docker-publish.yml (1 hunks)
  • .gitignore (1 hunks)
  • BlueTreadApp.csproj (0 hunks)
  • BlueTreadApp.slnx (0 hunks)
  • Components/App.razor (1 hunks)
  • Components/Layout/MainLayout.razor (1 hunks)
  • Components/Pages/Error.razor (1 hunks)
  • Components/Pages/Home.razor (1 hunks)
  • Components/Pages/Home.razor.css (1 hunks)
  • Components/Routes.razor (1 hunks)
  • Components/_Imports.razor (1 hunks)
  • Core/Application/Common/Behaviors/CachingBehavior.cs (1 hunks)
  • Core/Application/Common/Behaviors/ICacheable.cs (1 hunks)
  • Core/Application/Common/DTOs/ApiCollectionResponseDto.cs (1 hunks)
  • Core/Application/Common/DTOs/ApiDataItemDto.cs (1 hunks)
  • Core/Application/Common/DTOs/ApiDataStatisticsDto.cs (1 hunks)
  • Core/Application/Common/DTOs/ApiItemDto.cs (1 hunks)
  • Core/Application/Common/DTOs/LoginResponseDto.cs (1 hunks)
  • Core/Application/Common/DTOs/PaginatedResponseDto.cs (1 hunks)
  • Core/Application/Common/DTOs/TokenBlacklistStatisticsDto.cs (1 hunks)
  • Core/Application/Common/DTOs/TokenBlacklistStatusDto.cs (1 hunks)
  • Core/Application/Common/Interfaces/IApiDataItemRepository.cs (1 hunks)
  • Core/Application/Common/Interfaces/IApiIntegrationService.cs (1 hunks)
  • Core/Application/Common/Interfaces/ICacheService.cs (1 hunks)
  • Core/Application/Common/Interfaces/ITokenBlacklistService.cs (1 hunks)
  • Core/Application/Common/Interfaces/ITokenRepository.cs (1 hunks)
  • Core/Application/Common/Interfaces/IUserRepository.cs (1 hunks)
  • Core/Application/Common/Mapping/ApiDataMapper.cs (1 hunks)
  • Core/Application/Common/Models/Result.cs (1 hunks)
  • Core/Application/Common/Profiles/ApiDataMappingProfile.cs (1 hunks)
  • Core/Application/Features/Authentication/Commands/BlacklistTokenCommand.cs (1 hunks)
  • Core/Application/Features/Authentication/Commands/BlacklistTokenCommandHandler.cs (1 hunks)
  • Core/Application/Features/Authentication/Commands/LoginUserCommand.cs (1 hunks)
  • Core/Application/Features/Authentication/Commands/LoginUserCommandHandler.cs (1 hunks)
  • Core/Application/Features/Authentication/Queries/GetTokenBlacklistStatsQuery.cs (1 hunks)
  • Core/Application/Features/Authentication/Queries/GetTokenBlacklistStatsQueryHandler.cs (1 hunks)
  • Core/Application/Features/Authentication/Queries/IsTokenBlacklistedQuery.cs (1 hunks)
  • Core/Application/Features/Authentication/Queries/IsTokenBlacklistedQueryHandler.cs (1 hunks)
  • Core/Application/Features/SampleData/Queries/GetApiDataByIdQuery.cs (1 hunks)
  • Core/Application/Features/SampleData/Queries/GetApiDataByIdQueryHandler.cs (1 hunks)
  • Core/Application/Features/SampleData/Queries/GetApiDataQuery.cs (1 hunks)
  • Core/Application/Features/SampleData/Queries/GetApiDataQueryHandler.cs (1 hunks)
  • Core/Application/Features/SampleData/Queries/GetApiDataWithMappingQuery.cs (1 hunks)
  • Core/Application/Features/SampleData/Queries/GetApiDataWithMappingQueryHandler.cs (1 hunks)
  • Core/Domain/Common/IAggregateRoot.cs (1 hunks)
  • Core/Domain/Entities/ApiDataItem.cs (1 hunks)
  • Core/Domain/Entities/BaseEntity.cs (1 hunks)
  • Core/Domain/Entities/Token.cs (1 hunks)
  • Core/Domain/Entities/User.cs (1 hunks)
  • Core/Domain/Enums/DataStatus.cs (1 hunks)
  • Core/Domain/Enums/TokenStatus.cs (1 hunks)
  • Core/Domain/Enums/TokenType.cs (1 hunks)
  • Core/Domain/Enums/UserStatus.cs (1 hunks)
  • Core/Domain/Events/BaseDomainEvent.cs (1 hunks)
  • Core/Domain/Events/IDomainEvent.cs (1 hunks)
  • Core/Domain/Events/TokenRevokedEvent.cs (1 hunks)
  • Core/Domain/Events/UserRegisteredEvent.cs (1 hunks)
  • Core/Domain/Exceptions/DomainException.cs (1 hunks)
  • Core/Domain/ValueObjects/Email.cs (1 hunks)
  • Core/Domain/ValueObjects/Role.cs (1 hunks)
  • Core/Domain/ValueObjects/ValueObject.cs (1 hunks)
  • Dockerfile (1 hunks)
  • Dockerfile.original (1 hunks)
  • Infrastructure/Caching/CacheService.cs (1 hunks)
  • Infrastructure/Caching/SampleCache.cs (1 hunks)
  • Infrastructure/Data/ApplicationDbContext.cs (1 hunks)
  • Infrastructure/Data/Configurations/ApiDataItemConfiguration.cs (1 hunks)
  • Infrastructure/Data/DatabaseSettings.cs (1 hunks)
  • Infrastructure/Handlers/ApiKeyHandler.cs (1 hunks)
  • Infrastructure/Middleware/JwtBlacklistValidationMiddleware.cs (1 hunks)
  • Infrastructure/Repositories/ApiDataItemRepository.cs (1 hunks)
  • Infrastructure/Repositories/TokenRepository.cs (1 hunks)
  • Infrastructure/Repositories/UserRepository.cs (1 hunks)
  • Infrastructure/Security/JwtTokenGenerator.cs (1 hunks)
  • Infrastructure/Services/ApiIntegrationService.cs (1 hunks)
  • Infrastructure/Services/TokenBlacklistService.cs (1 hunks)
  • Models/SampleModel.cs (1 hunks)
  • Pages/_Host.cshtml (1 hunks)
  • Presentation/Controllers/v1/AuthController.cs (1 hunks)
  • Presentation/Controllers/v1/SampleController.cs (1 hunks)
  • Presentation/Controllers/v1/TokenBlacklistController.cs (1 hunks)
  • Presentation/Extensions/DependencyInjection/ApplicationServiceExtensions.cs (1 hunks)
  • Presentation/Extensions/DependencyInjection/InfrastructureServiceExtensions.cs (1 hunks)
  • Presentation/Extensions/DependencyInjection/PresentationServiceExtensions.cs (1 hunks)
  • Presentation/Extensions/HttpPipeline/WebApplicationExtensions.cs (1 hunks)
  • Program.cs (1 hunks)
  • Properties/launchSettings.json (1 hunks)
  • README.md (1 hunks)
  • SecureCleanApiWaf.csproj (1 hunks)
  • SecureCleanApiWaf.slnx (1 hunks)
  • appsettings.Development.json (1 hunks)
  • appsettings.json (1 hunks)
  • docker-compose.yml (1 hunks)

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request introduces comprehensive CI/CD automation, enhanced application configuration, and improved frontend presentation for the SecureCleanApiWaf project. The changes focus on deployment readiness, configuration clarity, and user experience improvements.

Key Changes:

  • Added GitHub Actions workflows for Azure deployment and Docker publishing with security scanning
  • Enhanced configuration files with extensive documentation and best practices guidance
  • Redesigned home page with improved user experience and API documentation access

Reviewed changes

Copilot reviewed 95 out of 130 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
docs/APIDesign/API_CONTRACTS_EXAMPLES.md New comprehensive API contracts documentation with examples for user management, authentication, and Blazor integration
docker-compose.yml New Docker Compose configuration with detailed inline documentation for local development
appsettings.json Enhanced base configuration with security warnings and comprehensive inline documentation
appsettings.Development.json Development-specific settings with security guidance and extended documentation
SecureCleanApiWaf.slnx New solution file for project structure
SecureCleanApiWaf.csproj New project file with package references and Docker configuration
README.md Comprehensive project documentation including architecture, deployment guides, and feature overview
Properties/launchSettings.json Launch profiles including new Swagger and Docker configurations
Program.cs Application entry point with extensive inline documentation explaining DI and pipeline configuration
Multiple service and infrastructure files New implementations with detailed documentation for repositories, services, and middleware

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@@ -0,0 +1,832 @@
# API Contracts Examples - SecureCleanApiWaf

> "Well-defined API contracts are the foundation of successful collaboration between backend and frontend teams�clear examples drive efficient development and seamless integration."
Copy link

Copilot AI Nov 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Corrected encoding issue: corrupted character in quote replaced with proper em dash.

Suggested change
> "Well-defined API contracts are the foundation of successful collaboration between backend and frontend teamsclear examples drive efficient development and seamless integration."
> "Well-defined API contracts are the foundation of successful collaboration between backend and frontend teamsclear examples drive efficient development and seamless integration."

Copilot uses AI. Check for mistakes.
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Nov 21, 2025

Note

Docstrings generation - SUCCESS
Generated docstrings for this pull request at #2

Docstrings generation was requested by @dariemcarlosdev.

* #1 (comment)

The following files were modified:

* `Core/Application/Common/Behaviors/CachingBehavior.cs`
* `Core/Application/Common/DTOs/TokenBlacklistStatusDto.cs`
* `Core/Application/Common/Interfaces/IApiDataItemRepository.cs`
* `Core/Application/Common/Interfaces/IApiIntegrationService.cs`
* `Core/Application/Common/Interfaces/ICacheService.cs`
* `Core/Application/Common/Interfaces/ITokenBlacklistService.cs`
* `Core/Application/Common/Interfaces/ITokenRepository.cs`
* `Core/Application/Common/Interfaces/IUserRepository.cs`
* `Core/Application/Common/Mapping/ApiDataMapper.cs`
* `Core/Application/Common/Models/Result.cs`
* `Core/Application/Common/Profiles/ApiDataMappingProfile.cs`
* `Core/Application/Features/Authentication/Commands/BlacklistTokenCommand.cs`
* `Core/Application/Features/Authentication/Commands/BlacklistTokenCommandHandler.cs`
* `Core/Application/Features/Authentication/Commands/LoginUserCommand.cs`
* `Core/Application/Features/Authentication/Commands/LoginUserCommandHandler.cs`
* `Core/Application/Features/Authentication/Queries/GetTokenBlacklistStatsQuery.cs`
* `Core/Application/Features/Authentication/Queries/GetTokenBlacklistStatsQueryHandler.cs`
* `Core/Application/Features/Authentication/Queries/IsTokenBlacklistedQuery.cs`
* `Core/Application/Features/Authentication/Queries/IsTokenBlacklistedQueryHandler.cs`
* `Core/Application/Features/SampleData/Queries/GetApiDataByIdQuery.cs`
* `Core/Application/Features/SampleData/Queries/GetApiDataByIdQueryHandler.cs`
* `Core/Application/Features/SampleData/Queries/GetApiDataQuery.cs`
* `Core/Application/Features/SampleData/Queries/GetApiDataQueryHandler.cs`
* `Core/Application/Features/SampleData/Queries/GetApiDataWithMappingQuery.cs`
* `Core/Application/Features/SampleData/Queries/GetApiDataWithMappingQueryHandler.cs`
* `Core/Domain/Entities/ApiDataItem.cs`
* `Core/Domain/Entities/BaseEntity.cs`
* `Core/Domain/Entities/Token.cs`
* `Core/Domain/Entities/User.cs`
* `Core/Domain/Events/BaseDomainEvent.cs`
* `Core/Domain/Events/TokenRevokedEvent.cs`
* `Core/Domain/Events/UserRegisteredEvent.cs`
* `Core/Domain/Exceptions/DomainException.cs`
* `Core/Domain/ValueObjects/Email.cs`
* `Core/Domain/ValueObjects/Role.cs`
* `Core/Domain/ValueObjects/ValueObject.cs`
* `Infrastructure/Caching/CacheService.cs`
* `Infrastructure/Caching/SampleCache.cs`
* `Infrastructure/Data/ApplicationDbContext.cs`
* `Infrastructure/Data/Configurations/ApiDataItemConfiguration.cs`
* `Infrastructure/Data/DatabaseSettings.cs`
* `Infrastructure/Handlers/ApiKeyHandler.cs`
* `Infrastructure/Middleware/JwtBlacklistValidationMiddleware.cs`
* `Infrastructure/Repositories/ApiDataItemRepository.cs`
* `Infrastructure/Repositories/TokenRepository.cs`
* `Infrastructure/Repositories/UserRepository.cs`
* `Infrastructure/Security/JwtTokenGenerator.cs`
* `Infrastructure/Services/ApiIntegrationService.cs`
* `Infrastructure/Services/TokenBlacklistService.cs`
* `Presentation/Controllers/v1/AuthController.cs`
* `Presentation/Controllers/v1/SampleController.cs`
* `Presentation/Controllers/v1/TokenBlacklistController.cs`
* `Presentation/Extensions/DependencyInjection/ApplicationServiceExtensions.cs`
* `Presentation/Extensions/DependencyInjection/InfrastructureServiceExtensions.cs`
* `Presentation/Extensions/DependencyInjection/PresentationServiceExtensions.cs`
* `Presentation/Extensions/HttpPipeline/WebApplicationExtensions.cs`
@coderabbitai coderabbitai bot mentioned this pull request Nov 21, 2025
@dariemcarlosdev dariemcarlosdev merged commit 723b991 into master Nov 21, 2025
2 of 3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants