T3: Identity API controller + JWT auth

src/Services/Identity/Identity.API/Controllers/IdentityController.cs

@@ -1,29 +1,63 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Identity.Domain.DTOs;
+using Identity.Domain.Interfaces;
 
 namespace Identity.API.Controllers;
 
 [ApiController]
 [Route("api/[controller]")]
 public class IdentityController : ControllerBase
 {
-    private readonly ILogger<IdentityController> _logger;
+    private readonly IIdentityService _identityService;
 
-    public IdentityController(ILogger<IdentityController> logger)
+    public IdentityController(IIdentityService identityService)
     {
-        _logger = logger;
+        _identityService = identityService;
     }
 
-    [HttpGet]
-    public IActionResult GetAll()
+    [HttpPost("register")]
+    [ProducesResponseType(typeof(AppUserDto), StatusCodes.Status201Created)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    public async Task<IActionResult> Register([FromBody] RegisterRequest request)
     {
-        // TODO: Implement — migrate logic from monolith's IdentityController
-        return Ok(new { service = "Identity", status = "scaffold" });
+        var result = await _identityService.RegisterAsync(request);
+        if (!result.Success)
+            return BadRequest(new { error = result.ErrorMessage });
+        return CreatedAtAction(nameof(GetById), new { id = result.User!.Id }, result.User);
     }
 
-    [HttpGet("{id}")]
-    public IActionResult GetById(int id)
+    [HttpPost("login")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    public async Task<IActionResult> Login([FromBody] LoginRequest request)
     {
-        // TODO: Implement — migrate logic from monolith
-        return Ok(new { service = "Identity", id });
+        var result = await _identityService.LoginAsync(request);
+        if (!result.Success)
+            return Unauthorized(new { error = result.ErrorMessage });
+        return Ok(new { token = result.Token });
+    }
+
+    [HttpGet("users")]
+    [Authorize]
+    [ProducesResponseType(typeof(IEnumerable<AppUserDto>), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    public async Task<IActionResult> GetUsers()
+    {
+        var users = await _identityService.GetAllUsersAsync();
+        return Ok(users);
+    }
+
+    [HttpGet("users/{id:guid}")]
+    [Authorize]
+    [ProducesResponseType(typeof(AppUserDto), StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [ProducesResponseType(StatusCodes.Status401Unauthorized)]
+    public async Task<IActionResult> GetById(Guid id)
+    {
+        var user = await _identityService.GetUserByIdAsync(id);
+        if (user == null)
+            return NotFound();
+        return Ok(user);
     }
 }

src/Services/Identity/Identity.API/Identity.API.csproj

@@ -11,7 +11,10 @@
     <ProjectReference Include="..\..\Shared\Shared.Infrastructure\Shared.Infrastructure.csproj" />
   </ItemGroup>
   <ItemGroup>
+    <PackageReference Include="BCrypt.Net-Next" Version="4.*" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.*" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.*" />
     <PackageReference Include="Swashbuckle.AspNetCore" Version="7.*" />
+    <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.*" />
   </ItemGroup>
 </Project>

src/Services/Identity/Identity.API/Program.cs

@@ -1,4 +1,9 @@
+using System.Text;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.IdentityModel.Tokens;
+using Identity.Domain.Interfaces;
 using Identity.Infrastructure.Data;
+using Identity.Infrastructure.Services;
 using Microsoft.EntityFrameworkCore;
 
 var builder = WebApplication.CreateBuilder(args);
@@ -8,9 +13,34 @@
 builder.Services.AddSwaggerGen();
 builder.Services.AddHealthChecks();
 
+// JWT Authentication
+builder.Services.AddAuthentication(options =>
+{
+    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
+    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
+})
+.AddJwtBearer(options =>
+{
+    options.TokenValidationParameters = new TokenValidationParameters
+    {
+        ValidateIssuer = true,
+        ValidateAudience = true,
+        ValidateLifetime = true,
+        ValidateIssuerSigningKey = true,
+        ValidIssuer = builder.Configuration["Jwt:Issuer"],
+        ValidAudience = builder.Configuration["Jwt:Audience"],
+        IssuerSigningKey = new SymmetricSecurityKey(
+            Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Secret"]!))
+    };
+});
+
+builder.Services.AddAuthorization();
+
 builder.Services.AddDbContext<IdentityDbContext>(options =>
     options.UseNpgsql(builder.Configuration.GetConnectionString("DefaultConnection")));
 
+builder.Services.AddScoped<IIdentityService, IdentityService>();
+
 var app = builder.Build();
 
 using (var scope = app.Services.CreateScope())
@@ -25,6 +55,9 @@
     app.UseSwaggerUI();
 }
 
+app.UseAuthentication();
+app.UseAuthorization();
+
 app.MapControllers();
 app.MapHealthChecks("/healthz");
 

src/Services/Identity/Identity.API/appsettings.json

@@ -7,5 +7,11 @@
   },
   "ConnectionStrings": {
     "DefaultConnection": "Host=localhost;Database=identitydb;Username=postgres;Password=postgres"
+  },
+  "Jwt": {
+    "Secret": "QuickApp_Microservices_SuperSecret_Key_For_Dev_Only_Min_32_Chars!",
+    "Issuer": "quickapp-identity",
+    "Audience": "quickapp-api",
+    "ExpirationMinutes": 60
   }
 }

src/Services/Identity/Identity.Infrastructure/Identity.Infrastructure.csproj

@@ -8,7 +8,10 @@
     <ProjectReference Include="..\Identity.Domain\Identity.Domain.csproj" />
   </ItemGroup>
   <ItemGroup>
+    <PackageReference Include="BCrypt.Net-Next" Version="4.*" />
     <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.*" />
+    <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.*" />
     <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.*" />
+    <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="8.*" />
   </ItemGroup>
 </Project>

src/Services/Identity/Identity.Infrastructure/Services/IdentityService.cs

@@ -0,0 +1,131 @@
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Text;
+using Identity.Domain.DTOs;
+using Identity.Domain.Entities;
+using Identity.Domain.Interfaces;
+using Identity.Infrastructure.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Configuration;
+using Microsoft.IdentityModel.Tokens;
+
+namespace Identity.Infrastructure.Services;
+
+public class IdentityService : IIdentityService
+{
+    private readonly IdentityDbContext _context;
+    private readonly IConfiguration _configuration;
+
+    public IdentityService(IdentityDbContext context, IConfiguration configuration)
+    {
+        _context = context;
+        _configuration = configuration;
+    }
+
+    public async Task<RegisterResult> RegisterAsync(RegisterRequest request)
+    {
+        if (await _context.Users.AnyAsync(u => u.UserName == request.UserName))
+        {
+            return new RegisterResult { Success = false, ErrorMessage = "Username is already taken." };
+        }
+
+        if (await _context.Users.AnyAsync(u => u.Email == request.Email))
+        {
+            return new RegisterResult { Success = false, ErrorMessage = "Email is already registered." };
+        }
+
+        var user = new AppUser
+        {
+            Id = Guid.NewGuid(),
+            UserName = request.UserName,
+            Email = request.Email,
+            PasswordHash = BCrypt.Net.BCrypt.HashPassword(request.Password),
+            FullName = request.FullName,
+            JobTitle = request.JobTitle,
+            IsEnabled = true,
+            CreatedAt = DateTime.UtcNow,
+            UpdatedAt = DateTime.UtcNow
+        };
+
+        _context.Users.Add(user);
+        await _context.SaveChangesAsync();
+
+        return new RegisterResult
+        {
+            Success = true,
+            User = MapToDto(user)
+        };
+    }
+
+    public async Task<LoginResult> LoginAsync(LoginRequest request)
+    {
+        var user = await _context.Users.FirstOrDefaultAsync(u => u.UserName == request.UserName);
+
+        if (user == null || !BCrypt.Net.BCrypt.Verify(request.Password, user.PasswordHash))
+        {
+            return new LoginResult { Success = false, ErrorMessage = "Invalid username or password." };
+        }
+
+        if (!user.IsEnabled)
+        {
+            return new LoginResult { Success = false, ErrorMessage = "This account has been disabled." };
+        }
+
+        var token = GenerateJwtToken(user);
+
+        return new LoginResult { Success = true, Token = token };
+    }
+
+    public async Task<AppUserDto?> GetUserByIdAsync(Guid id)
+    {
+        var user = await _context.Users.FindAsync(id);
+        return user == null ? null : MapToDto(user);
+    }
+
+    public async Task<IEnumerable<AppUserDto>> GetAllUsersAsync()
+    {
+        var users = await _context.Users.ToListAsync();
+        return users.Select(MapToDto);
+    }
+
+    private string GenerateJwtToken(AppUser user)
+    {
+        var secret = _configuration["Jwt:Secret"]!;
+        var issuer = _configuration["Jwt:Issuer"];
+        var audience = _configuration["Jwt:Audience"];
+        var expirationMinutes = int.Parse(_configuration["Jwt:ExpirationMinutes"]!);
+
+        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secret));
+        var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
+
+        var claims = new[]
+        {
+            new Claim(JwtRegisteredClaimNames.Sub, user.Id.ToString()),
+            new Claim(JwtRegisteredClaimNames.Name, user.UserName),
+            new Claim(JwtRegisteredClaimNames.Email, user.Email),
+            new Claim(ClaimTypes.Role, "User")
+        };
+
+        var token = new JwtSecurityToken(
+            issuer: issuer,
+            audience: audience,
+            claims: claims,
+            expires: DateTime.UtcNow.AddMinutes(expirationMinutes),
+            signingCredentials: credentials);
+
+        return new JwtSecurityTokenHandler().WriteToken(token);
+    }
+
+    private static AppUserDto MapToDto(AppUser user)
+    {
+        return new AppUserDto
+        {
+            Id = user.Id,
+            UserName = user.UserName,
+            Email = user.Email,
+            FullName = user.FullName,
+            JobTitle = user.JobTitle,
+            IsEnabled = user.IsEnabled
+        };
+    }
+}