feat: backend foundation — auth, response envelopes, error handling #5
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "feat/backend-foundation"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Phase 1: Backend Foundation
Implements the security and response contract that all subsequent API endpoints will build on.
What's included
Static Bearer Token Auth (ADR-0003)
StaticBearerTokenAuthMiddlewarevalidatesAuthorization: Bearer <token>on all/api/*routes/healthremains unauthenticatedCryptographicOperations.FixedTimeEqualsto prevent timing attacksDOUJIN_MANAGER_AUTH_TOKENenvironment variableapplication/problem+jsonon auth failureResponse Envelopes (ADR-0007)
ResourceResponse<T>— single resource:{ data, links, actions }CollectionResponse<T>— collection:{ data, page, links, actions }Link— navigational affordance (href, method, type)HypermediaAction— command affordance (name, title, method, href, type, encType)PageInfo— pagination metadata (page, pageSize, totalItems, totalPages)ErrorResponse+ValidationErrorResponse— RFC 7807 problem+json with field-level errorsGlobal Exception Handling
GlobalExceptionMiddlewarecatches unhandled exceptions and returns 500 with consistent error envelopeClean DI Registration
AddRestAdapter(token)— registers auth token holderUseRestAdapterMiddleware()— wires exception + auth middleware in correct orderChanges
Microsoft.AspNetCore.AppframeworkMicrosoft.AspNetCore.Mvc.Testingto CPM for test-host support_ProjectMarker.csplaceholderProgram.csreadsDOUJIN_MANAGER_AUTH_TOKEN(throws on startup if missing)Tests (13 new, 70 total)
All 70 tests pass. 0 warnings, 0 errors.
Summary
Summary
Coverage
DoujinManager.ApplicationCore - 76.7%
DoujinManager.Infrastructure - 21.8%
pshot
DoujinManager.RestAdapter - 94.6%
DoujinManager.Server - 0%
🤖 Hermes automated review: changes requested
Thanks for the backend foundation work. I found one blocking security/configuration issue and one non-blocking regression while reviewing PR #5.
Blocking findings
backend/src/DoujinManager.Server/Program.cs:12,backend/src/DoujinManager.RestAdapter/RestAdapterExtensions.cs:17)DOUJIN_MANAGER_AUTH_TOKENisnull. If the variable is set to""or whitespace, the app starts with a weak/empty shared secret. Because this is the only protection for/api/*, startup/DI should fail closed for empty or whitespace tokens.string.IsNullOrWhiteSpace(authToken)beforeAddRestAdapter, and ideally also guard insideAddRestAdapter(string authToken)so tests/other hosts cannot register an empty token.Minor findings
backend/src/DoujinManager.Server/Program.cs:45-47)app.MapOpenApi()still runs in Development, butbuilder.Services.AddOpenApi()was removed from service registration. In a local runtime smoke test with Development enabled,/openapi/v1.jsonreturned404 No OpenAPI document with the name 'v1' was found.builder.Services.AddOpenApi();unless intentionally dropping the development OpenAPI endpoint.Checks performed
ValidToken = "test-token-12345", which I treated as a test fixture rather than a secret.dotnet build --no-restore: initially failed because restored assets did not yet include the newly added TestHost package.dotnet restore, thendotnet build --no-restore: passed with 0 warnings/errors.dotnet test --no-restore --no-build: passed all 70 tests./healthreturned 200; unauthenticated/api/...returned 401; Development/openapi/v1.jsonreturned the 404 noted above.Automated daily review. I never merge PRs.
Both findings addressed in commit
81cef08.1. Empty/whitespace auth tokens (Major) — fixed
Program.csnow checksstring.IsNullOrWhiteSpace(authToken)after reading the env var, beforeAddRestAdapter.AddRestAdapter(string authToken)itself also validates viaArgumentException— any caller (tests, other hosts) is protected.null,""," ","\t", and a valid-token acceptance test.2.
AddOpenApi()accidentally removed (Minor) — fixedbuilder.Services.AddOpenApi();inProgram.csafter theAddRestAdapter()call./openapi/v1.jsonwill work again in Development.75 tests pass (5 new), 0 warnings, 0 errors.