🎬 Movie.API

Movie.API is an ASP.NET Core Web API built using Domain-Driven Design (DDD) principles, focused on managing movie ratings and reviews with proper authentication, authorization, and reporting capabilities. Users can create accounts, authenticate, and perform full CRUD operations on movies. Certain features, such as report generation, are restricted to privileged users via role-based authorization.

---

🚀 Features

• User registration and authentication
• JWT-based authentication with ASP.NET Core Identity
• Role-based authorization (e.g. VIP users)
• CRUD operations for movies
• PDF and Excel report generation (VIP only)
• Swagger UI configured with JWT Authorization
• Clean and layered architecture (DDD-oriented)

---

📦 Endpoints Overview

Authentication

• POST /api/Login – Authenticate and receive a JWT token ✅

Users

• POST /api/Users – Create a new user ✅
• DELETE /api/Users – Delete user ✅
• PUT /api/Users – Update user data ✅
• PATCH /api/Users/Password – Update User Password ✅
• PATCH /api/Users – Update user as VIP ✅
• GET /api/Users – Get all logged user data ✅

Movies

• GET(ALL Movies) /api/Movies ✅
• GET /api/Movies/{id} ✅
• POST /api/Movies ✅
• PUT /api/Movies/{id} ✅
• DELETE /api/Movies/{id} ✅

Reports (VIP only)

• GET /api/Reports/movies-pdf ✅

  • With query params: GET /api/Reports/movies-pdf?stars=3

• GET /api/Reports/movies-excel ✅

  • With query params: GET /api/Reports/movies-excel?stars=5

---

🔐 Authentication & Authorization

This API uses ASP.NET Core Identity combined with JWT Bearer Tokens to provide a secure authentication.

Authentication Flow

1. User logs in via /api/Login
2. A JWT token is generated and returned
3. The token must be sent in the Authorization header.

🧪 Swagger (OpenAPI)

Swagger (OpenAPI 3.0) is enabled and fully configured to support JWT authentication.

Usage:

1. Create an user through /api/users
2. Call /api/Login to obtain a token
3. Click Authorize in Swagger UI
4. Paste the token using the Bearer YoUrAw3s0m3T0k3nJWT scheme
5. Access secured endpoints directly from Swagger.

📃 Swagger Preview

📃 Excel Preview

📃 PDF Preview

🛠️ Tech Stack

• ASP.NET Core – API development.
• MySQL – Database for persistence.
• Entity Framework Core – Modern ORM for .NET, used for database access, migrations, and data management.
• MySql - DB
• xUnit – Unit and integration testing.
• Shoudly - Tests assertion.
• MOQ - Tests assertion.
• EF Core SQLite In-Memory. - In Memory DB for integration testing
• Bogus – Fake data generation for testing scenarios.
• ClosedXML - Generates a custom Excel.
• QuestPDF - Generates a custom PDF.
• JWT Bearer Authentication
• Swagger

📂 Architecture

• Domain → Entities, aggregates, and business rules.
• Application → Use cases and application services.
• Infrastructure → Concrete implementations (repositories, persistence, MySQL integration).
• Presentation (API) → Controllers, middlewares, and endpoints.
• Communication → Defines DTOs (Data Transfer Objects) for handling input (requests) and output (responses), ensuring separation between API contracts and domain models.
• Exception Handling → Centralized management of errors, including exception filters, standardized error messages, and resource files for multi-language support.

Authorization

• Claims and roles are embedded in the JWT
• Endpoints are protected using [Authorize]
• Role-based access is enforced using [Authorize(Roles = "Vip")] No cookies or sessions are used.

🎭 Exception Filters

• Centralized error handling with standardized responses.
• Improves API consumer experience by avoiding inconsistent error messages.

🌍 Resource Files Languages

• Error and validation messages in multiple languages.
• Based on the Accept-Language header, allowing support for different cultures.

🧪 Testing

• Unit Tests: validated with xUnit, ensuring business rules work in isolation.
• Bogus: generates fake data to simulate real-world scenarios.

Testing improvements include:

• Unit tests using in-memory providers
• Integration tests with in-memory sqlite database
• Coverage for:
  • Application services
  • Authentication and authorization flows
  • API controllers

✅ Implemented Unit Tests

Login:

• Login Use Case - User Login. ✅

Users:

• Add User Use Case – Creates a new user. ✅
• Delete User Use Case – Delete user ✅
• Get All User Data Use Case – Returns all logged user data ✅
• Patch Vip User Use Case – Updates user role to VIP ✅
• Update User Use Case – Updates user data ✅
• Update User Password Use Case – Update user Password ✅
• Add User Validator – Validates user request body params. ✅
• Password Validator – Validates user password body params. ✅

Movies:

• Add Movie Use Case – Create a new movie. ✅
• Delete Movie Use Case - Delete a movie. ✅
• Get All Movies Retrieve all movies. ✅
• Get Movie By ID Use Case – Retrieve a movie and validate localized not-found errors. ✅
• Update Movie Use Case – Update and commit movie data; validate localized errors without committing invalid changes. ✅
• MoviesValidator - Validates movie request body params. ✅

Reports:

• Generate Movies PDF Use Case – Verify non-empty or empty results and forwarding of user and star filter to the repository. ✅
• Generate Movies Excel Use Case – Verify non-empty or empty results and forwarding of user and star filter to the repository. ✅

✅ Implemented Integration Tests

Users:

• POST /api/Users – Creates a new user ✅
• DELETE /api/Users – Delete the logged user and their movies, preserving other users' data ✅
• PUT /api/Users – Update the logged user's name; validate localized errors and unchanged data on failure ✅
• PATCH /api/Users/password – Update the password, verify hashing and login; validate localized password rules ✅
• PATCH /api/Users – Upgrade to VIP and verify the new token grants report access ✅
• GET /api/Users – Retrieve only the logged user's public account data ✅

Login:

• POST /api/Login – Authenticate and receive a JWT token ✅
• POST /api/Login – Unregistered email returns 400 with EMAIL_OR_PASSWORD_INVALID ✅
• POST /api/Login – Incorrect password returns 400 with EMAIL_OR_PASSWORD_INVALID ✅

Movies:

• POST /api/Movies – Create a movie with authenticated user ✅
• GET /api/Movies – Retrieve only the user's movies; return 204 when empty ✅
• GET /api/Movies/{id} – Retrieve a movie; validate localized errors for missing or other users' movies ✅
• PUT /api/Movies/{id} – Update a movie; validate localized input and ownership errors ✅
• DELETE /api/Movies/{id} – Delete a movie; validate localized errors for missing or other users' movies ✅

Reports (VIP Only):

• GET /api/Reports/movies-pdf – Verify success with non-empty content, empty results and VIP access ✅
• GET /api/Reports/movies-excel – Verify success with non-empty content, empty results and VIP access ✅

🖥️ Running Locally

Follow these steps to run the API locally with automatic migrations/seed data:

1. Install prerequisites:

   • .NET 8.0 SDK
   • MySQL Server 8.0.42 (or compatible)
   • Docker (Optional)

2. Installing/Connecting to MySQL Server using Docker (OPTIONAL):

   • Download the Oficial MYSQL Docker Image: mysql

   

   • Create a Docker container for MySQL, use the following command to run the container with MySQL 8.0 (Debian) and map the default port:

   docker run --name mySqlApp -e MYSQL_ROOT_PASSWORD=YOURPASSWORD -p 3306:3306 -d mysql:8.0-debian

3. Update the appsettings.Development.json file (inside src/RateMovie.Api/appsettings.Development.json) with your local MySQL credentials.

{
  "ConnectionStrings": {
    "ConnectionMYSQL": "server=localhost;user=root;password=YOURPASSWORD;database=CashFlowDB"
  }
}

4. Execute through the startup project RateMovie.Api