Security Documentation

PreConfigure<OpenIddictBuilder>(builder =>
{
    builder.AddValidation(options =>
    {
        options.AddAudiences("Shop");
        options.UseLocalServer();
        options.UseAspNetCore();
    });
});

// Production certificate configuration
if (!hostingEnvironment.IsDevelopment())
{
    PreConfigure<OpenIddictServerBuilder>(serverBuilder =>
    {
        serverBuilder.AddProductionEncryptionAndSigningCertificate(
            "openiddict.pfx",
            "f49b2364-8c08-491c-ba29-16c17d2e91a8"
        );
    });
}

CREATE TABLE LoginAttempts (
    Id UNIQUEIDENTIFIER PRIMARY KEY,
    UserId UNIQUEIDENTIFIER NULL,
    UserNameOrEmail NVARCHAR(256) NOT NULL,
    IpAddress NVARCHAR(45) NULL,
    UserAgent NVARCHAR(512) NULL,
    IsSuccessful BIT NOT NULL,
    FailureReason NVARCHAR(256) NULL,
    AttemptTime DATETIME2 NOT NULL,
    CreationTime DATETIME2 NOT NULL
);

// Require authentication
[Authorize]
public class OrderAppService : ApplicationService
{
    // Only authenticated users can access
}

// Require specific role
[Authorize(Roles = "Admin")]
public class AdminDashboardAppService : ApplicationService
{
    // Only admins can access
}

// Check role programmatically
if (CurrentUser.IsInRole("Admin"))
{
    // Admin-specific logic
}

public class ShopPermissions
{
    public const string GroupName = "Shop";

    public static class Products
    {
        public const string Default = GroupName + ".Products";
        public const string Create = Default + ".Create";
        public const string Edit = Default + ".Edit";
        public const string Delete = Default + ".Delete";
    }

    public static class Orders
    {
        public const string Default = GroupName + ".Orders";
        public const string Create = Default + ".Create";
        public const string Edit = Default + ".Edit";
        public const string Cancel = Default + ".Cancel";
    }
}

// Permission usage
[Authorize(ShopPermissions.Products.Create)]
public async Task<ProductDto> CreateAsync(CreateProductDto input)
{
    // Only users with Products.Create permission can execute
}

public class EnhancedRateLimitService : IRateLimitService
{
    private readonly Dictionary<string, RateLimitRule> _endpointRules = new()
    {
        ["/api/auth/login/phone-otp"] = new(3, TimeSpan.FromHours(1)),
        ["/api/auth/verify/phone-otp"] = new(5, TimeSpan.FromMinutes(15)),
        ["/api/products"] = new(60, TimeSpan.FromMinutes(1)),
        ["/api/cart"] = new(120, TimeSpan.FromMinutes(1)),
        ["/api/files/upload"] = new(10, TimeSpan.FromHours(1))
    };

    public async Task<RateLimitResult> CheckLimitAsync(
        string endpoint,
        string identifier,
        ClaimsPrincipal? user = null)
    {
        var rule = GetRuleForEndpoint(endpoint);

        // Apply role-based multiplier
        if (user?.IsInRole("Admin") == true)
        {
            rule = new RateLimitRule(rule.Limit * 3, rule.Window);
        }

        // Check and update counter in Redis cache
        var cacheKey = $"ratelimit:{endpoint}:{identifier}";
        var currentCount = await _cache.GetStringAsync(cacheKey);

        if (currentCount >= rule.Limit)
        {
            return new RateLimitResult
            {
                IsAllowed = false,
                RetryAfter = rule.Window
            };
        }

        // Increment counter
        await _cache.SetStringAsync(cacheKey,
            (currentCount + 1).ToString(),
            new DistributedCacheEntryOptions
            {
                AbsoluteExpirationRelativeToNow = rule.Window
            });

        return new RateLimitResult { IsAllowed = true };
    }
}

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 45
X-RateLimit-Reset: 1609459200
Retry-After: 60

public class AuditLog : CreationAuditedAggregateRoot<Guid>
{
    public Guid? UserId { get; set; }
    public string? UserName { get; set; }
    public string ActionType { get; set; }
    public string? EntityType { get; set; }
    public string? EntityId { get; set; }
    public string? HttpMethod { get; set; }
    public string? Url { get; set; }
    public string? IpAddress { get; set; }
    public string? UserAgent { get; set; }
    public int? DurationMs { get; set; }
    public int? StatusCode { get; set; }
    public string? ErrorMessage { get; set; }
    public string? AdditionalInfo { get; set; }
    public bool IsSuccessful { get; set; }
}

public class CreateProductDto
{
    [Required]
    [StringLength(256)]
    public string Name { get; set; }

    [Required]
    [StringLength(256)]
    [RegularExpression(@"^[a-z0-9-]+$")]
    public string Slug { get; set; }

    [Range(0, double.MaxValue)]
    public decimal Price { get; set; }

    [Range(0, int.MaxValue)]
    public int Stock { get; set; }

    [EmailAddress]
    public string? ContactEmail { get; set; }

    [Url]
    public string? MainImageUrl { get; set; }
}