Secure Task Manager API

This is a backend API for a task management system built with ASP.NET Core (.NET 8). It allows users to register, log in, and manage their own tasks. The main focus of this project is to implement correct authentication and authorization patterns without relying on complex external identity providers.

In many web applications, a common security vulnerability is Insecure Direct Object References (IDOR). This happens when an API allows a user to access data that belongs to someone else simply by changing an ID in the URL. For example, if User A can delete User B's task by guessing the task ID, the system is insecure. This project solves that problem by ensuring strict data isolation between users.

The API is built using a Clean Architecture approach. It exposes RESTful endpoints for authentication and task management. It uses a SQLite database to store user credentials and task data.

• Core Layer: Contains the business logic and data structures (Entities, DTOs).
• Infrastructure Layer: Handles database connections and user identity management.
• API Layer: Manages the HTTP requests and responses.

Authentication is handled using JWT (JSON Web Tokens). When a user logs in, they receive a token that acts as their digital ID card. This token must be included in the headers of subsequent requests.

Authorization is enforced at the controller level. Every time a request is made to access, update, or delete a task, the API checks two things:

1. Is the valid user logged in?
2. Does the task being requested belong to the user who is asking for it?

If a user tries to access a task ID that belongs to someone else, the API returns a 403 Forbidden response. This ensures that users can never see or modify data that isn't theirs.

You can verify the security rules using the built-in Swagger UI.

1. Register two users: Register User A and User B using the Register endpoint.
2. Login as User A: Get the JWT token for User A.
3. Add a Task: Use User A's token to add a task. Note the ID of the new task.
4. Login as User B: Get the JWT token for User B.
5. Try to Access the Task: Use User B's token to try and get the task details using the ID from step 3.
6. Result: The API will return a 403 Forbidden status, proving that User B cannot access User A's data.

The project includes a suite of integration tests that automatically verify these rules. The tests run against an in-memory database to simulate real API requests.

The test suite specifically covers:

• Successful task production.
• Blocking access when a user tries to read another user's task.

PREREQUISITES: You need the .NET 8 SDK installed.

1. Clone the repository.
2. Navigate to the project folder.
3. Run the project using the command: dotnet run --project src/SecureTaskManager.API
4. Open your browser to the URL shown in the console (usually http://localhost:5243/swagger).

This project uses SQLite for simplicity, so no external database installation is required. Data is stored in a local file named secure_task_manager.db.