feat: add auth feature endpoints and cqrs dispatch (#22)

Author: marciomyst

.agents/mcp/postgres-mcp.ps1

@@ -0,0 +1,50 @@
+$ErrorActionPreference = "Stop"
+
+function Get-PostgresUrlFromDocker {
+    $docker = Get-Command docker -ErrorAction SilentlyContinue
+    if ($null -eq $docker) {
+        return $null
+    }
+
+    $envLines = & docker inspect smartmoviecatalog-postgres-1 --format '{{range .Config.Env}}{{println .}}{{end}}' 2>$null
+    if ($LASTEXITCODE -ne 0 -or $null -eq $envLines) {
+        return $null
+    }
+
+    $containerEnv = @{}
+    foreach ($line in $envLines) {
+        $parts = $line.Split("=", 2)
+        if ($parts.Length -eq 2) {
+            $containerEnv[$parts[0]] = $parts[1]
+        }
+    }
+
+    $user = $containerEnv["POSTGRES_USER"]
+    $password = $containerEnv["POSTGRES_PASSWORD"]
+    $database = $containerEnv["POSTGRES_DB"]
+
+    if ([string]::IsNullOrWhiteSpace($user) -or
+        [string]::IsNullOrWhiteSpace($password) -or
+        [string]::IsNullOrWhiteSpace($database)) {
+        return $null
+    }
+
+    $escapedUser = [uri]::EscapeDataString($user)
+    $escapedPassword = [uri]::EscapeDataString($password)
+    $escapedDatabase = [uri]::EscapeDataString($database)
+
+    return "postgresql://${escapedUser}:${escapedPassword}@localhost:5432/${escapedDatabase}"
+}
+
+$connectionString = $env:SMARTMOVIECATALOG_POSTGRES_URL
+if ([string]::IsNullOrWhiteSpace($connectionString)) {
+    $connectionString = Get-PostgresUrlFromDocker
+}
+
+if ([string]::IsNullOrWhiteSpace($connectionString)) {
+    [Console]::Error.WriteLine("SMARTMOVIECATALOG_POSTGRES_URL is not set and smartmoviecatalog-postgres-1 could not provide PostgreSQL settings.")
+    exit 1
+}
+
+& npx -y @modelcontextprotocol/server-postgres $connectionString
+exit $LASTEXITCODE

.env.example

@@ -9,3 +9,16 @@ POSTGRES_DB=smart_movie_catalog
 POSTGRES_USER=smartmovie
 POSTGRES_PASSWORD=smartmovie_dev_password
 POSTGRES_PORT=5432
+
+DATABASE_URL = postgresql://smartmovie:smartmovie_dev_password@localhost:5432/smart_movie_catalog?schema=public
+
+JWT_ISSUER=SmartMovieCatalog
+JWT_AUDIENCE=SmartMovieCatalog.Api
+JWT_SIGNING_KEY=replace-with-local-development-signing-key-at-least-32-characters
+JWT_ACCESS_TOKEN_LIFETIME_MINUTES=60
+
+# Optional admin seed. Leave blank to disable.
+# Do not commit real admin credentials.
+ADMIN_SEED_EMAIL=
+ADMIN_SEED_PASSWORD=
+ADMIN_SEED_NAME=

.github/workflows/sonar.yml

@@ -58,7 +58,8 @@ jobs:
             /d:sonar.qualitygate.timeout=300 \
             /d:sonar.cs.opencover.reportsPaths="**/coverage.opencover.xml" \
             /d:sonar.javascript.lcov.reportPaths="frontend/coverage/smartmoviecatalog.angular/lcov.info" \
-            /d:sonar.exclusions="**/bin/**,**/obj/**,**/node_modules/**,**/dist/**,**/.angular/**"
+            /d:sonar.exclusions="**/bin/**,**/obj/**,**/node_modules/**,**/dist/**,**/.angular/**" \
+            /d:sonar.coverage.exclusions="**/Migrations/**,**/*ModelSnapshot.cs,**/Program.cs,**/DependencyInjection.cs,**/DatabaseBootstrapper.cs,**/HealthCheckRunner.cs,**/Persistence/Configurations/**"
 
       - name: Restore backend
         run: dotnet restore SmartMovieCatalog.slnx

.gitignore

@@ -3,6 +3,9 @@ bin/
 obj/
 dist/
 out/
+.artifacts/
+.dotnet-cli-home/
+restore*.log
 
 # .NET
 *.user

.specify/inputs/github-issues/21-backend-authentication-with-jwt-and-current-user-context.md

@@ -0,0 +1,132 @@
+# GitHub Issue Context
+
+## Source
+
+- Repository: marciomyst/SmartMovieCatalog
+- Issue: #21
+- URL: https://github.com/marciomyst/SmartMovieCatalog/issues/21
+- State: OPEN
+- Created: 05/03/2026 00:59:57
+- Updated: 05/03/2026 01:00:54
+- Milestone: M1 — Core Movie Catalog
+
+## Title
+
+Backend authentication with JWT and current user context
+
+## Labels
+
+- type:feature
+- priority:high
+- area:api
+- area:backend
+- area:database
+- area:architecture
+- area:security
+- needs:adr
+
+## Assignees
+
+- marciomyst
+
+
+
+## Issue Body
+
+## Descricao
+Implementar autenticacao backend no SmartMovieCatalog com `POST /api/auth/authenticate` e `GET /api/auth/me`, adaptando o desenho analisado em `MercaSafra` para a arquitetura Clean Architecture deste repositorio.
+
+O escopo e somente backend API. Nao incluir frontend Angular nesta issue.
+
+## Escopo Tecnico
+- Aceitar a estrategia de autenticacao em `docs/adr/0002-authentication-strategy.md`: autenticacao local com email/senha e JWT bearer.
+- Aceitar a estrategia de persistencia em `docs/adr/0003-database-strategy.md`: EF Core com PostgreSQL usando `ConnectionStrings:DefaultConnection`.
+- Definir/atualizar contrato de erro em `docs/adr/0004-api-error-contract.md`.
+- Adicionar entidade/aggregate de usuario no dominio, abstracoes de aplicacao e implementacoes de infraestrutura.
+- Configurar EF Core, migrations iniciais, hashing de senha, geracao JWT e leitura do usuario autenticado.
+- Configurar `AddAuthentication().AddJwtBearer(...)` e `UseAuthentication()` antes de `UseAuthorization()`.
+
+## API Contracts
+### `POST /api/auth/authenticate`
+Request:
+```json
+{ "email": "user@example.com", "password": "Password123!" }
+```
+
+Responses:
+- `200 OK`: `{ userId, email, accessToken, accessTokenExpiresAtUtc }`
+- `400 Bad Request`: entrada invalida
+- `401 Unauthorized`: credenciais invalidas, usuario inexistente ou inativo
+
+### `GET /api/auth/me`
+Requer bearer token.
+
+Responses:
+- `200 OK`: `{ userId, email, name, roles, mustChangePasswordOnFirstLogin }`
+- `401 Unauthorized`: token ausente/invalido ou usuario inexistente/inativo
+
+## Fora De Escopo
+- Frontend login/session UI.
+- Refresh token.
+- Registro de usuario.
+- Recuperacao de senha.
+- Provedor externo de identidade.
+- Organizacoes/tenancy.
+- Autorizacao granular alem de roles basicas no token.
+
+## Documentacao
+Atualizar:
+- `docs/adr/0002-authentication-strategy.md`
+- `docs/adr/0003-database-strategy.md`
+- `docs/adr/0004-api-error-contract.md`
+- `docs/API.md`
+- `docs/SECURITY.md`
+- `README.md`
+- `backend/src/SmartMovieCatalog.Api/SmartMovieCatalog.Api.http`
+
+## Testes
+Application tests:
+- autenticacao valida retorna token;
+- senha invalida retorna falha nao autenticada;
+- usuario inexistente/inativo nao autentica;
+- contexto atual exige usuario autenticado;
+- contexto atual rejeita usuario removido/inativo.
+
+API tests:
+- `POST /api/auth/authenticate` cobre `200`, `400`, `401`;
+- `GET /api/auth/me` cobre `200` com token e `401` sem token.
+
+Verificacao final:
+- `dotnet build SmartMovieCatalog.slnx`
+- executar testes backend adicionados.
+
+## Assumptions
+- PostgreSQL e o provider escolhido porque ja existe em `docker-compose.yml`.
+- Segredos JWT ficam em environment variables ou user-secrets, nunca em arquivos versionados.
+- O scaffold `WeatherForecast` pode ser removido quando os endpoints reais forem introduzidos.
+
+## Comments
+
+_No comments_
+
+## Instructions for Spec Kit
+
+Use this GitHub issue as the primary source of truth.
+
+Convert the issue into a Spec Kit feature specification before creating the implementation plan.
+
+Preserve:
+
+- business goal;
+- user stories;
+- acceptance criteria;
+- technical constraints;
+- non-goals;
+- dependencies;
+- open questions.
+
+If information is missing, add it under a clearly marked **Clarifications Needed** section instead of inventing requirements.
+
+If the issue conflicts with existing project documentation, explicitly call out the conflict.
+
+Prefer a small, incremental implementation plan aligned with the repository's existing architecture, folder structure, language, framework, and conventions.

.vscode/settings.json

@@ -10,6 +10,8 @@
     "**/.husky": true,
     "**/.agents": true,
     "**/.github": true,
+    "**/.artifacts": true,
+    "**/.dotnet-cli-home": true,
   },
 
   "search.exclude": {

AGENTS.md

@@ -127,6 +127,8 @@ Do not read, modify, or base analysis on generated/vendor output unless explicit
   - `test:`
 
 <!-- SPECKIT START -->
+Current Spec Kit plan: `specs/021-backend-authentication-with-jwt-and-current-user-context/plan.md`.
+
 Before using Spec Kit skills, read `.specify/memory/constitution.md`.
 If the spec, plan, or implementation touches backend, API, contracts, domain,
 application, infrastructure, security, persistence, or server runtime behavior,

Directory.Build.props

@@ -0,0 +1,5 @@
+<Project>
+  <PropertyGroup>
+    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+  </PropertyGroup>
+</Project>

Directory.Packages.props

@@ -0,0 +1,21 @@
+<Project>
+  <ItemGroup>
+    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.7" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.7" />
+    <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.7" />
+    <PackageVersion Include="Microsoft.AspNetCore.SpaProxy" Version="10.0.7" />
+    <PackageVersion Include="Microsoft.VisualStudio.Azure.Containers.Tools.Targets" Version="1.23.0" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.7" />
+    <PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.7" />
+    <PackageVersion Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.1" />
+    <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.18.0" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.7" />
+    <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.7" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.5.1" />
+    <PackageVersion Include="coverlet.collector" Version="6.0.4" />
+    <PackageVersion Include="xunit" Version="2.9.3" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
+    <PackageVersion Include="FluentValidation" Version="12.1.1" />
+    <PackageVersion Include="WolverineFx" Version="5.32.0" />
+  </ItemGroup>
+</Project>

README.md

@@ -86,9 +86,12 @@ This starts:
 - ASP.NET Core API on `http://localhost:5048`.
 - PostgreSQL on `localhost:5432`.
 
-The API container receives `ConnectionStrings__DefaultConnection` through environment variables. The current scaffold does not use persistence yet.
+The API container receives `ConnectionStrings__DefaultConnection` and JWT settings through environment variables. Set `JWT_SIGNING_KEY` in `.env` or your shell before starting the API; do not commit real signing keys or database credentials.
 
-The current runnable vertical slice is still the scaffold `/weatherforecast` endpoint consumed by the Angular app.
+The backend auth endpoints are:
+
+- `POST /api/auth/authenticate`
+- `GET /api/auth/me`
 
 Health check:
 
@@ -119,9 +122,39 @@ docker compose exec postgres pg_isready -U smartmovie -d smart_movie_catalog
 docker compose exec postgres psql -U smartmovie -d smart_movie_catalog -c "select version();"
 ```
 
+Apply EF Core migrations after configuring the local connection string:
+
+```bash
+dotnet ef database update --project backend/src/SmartMovieCatalog.Infrastructure --startup-project backend/src/SmartMovieCatalog.Api
+```
+
+On API startup, non-test environments apply EF Core migrations and can seed an optional admin user by supplying non-versioned configuration:
+
+- `ADMIN_SEED_EMAIL`
+- `ADMIN_SEED_PASSWORD`
+- `ADMIN_SEED_NAME`
+
+These `.env` keys are mapped by the local scripts and Docker Compose to `AdminSeedUser:*` configuration. Leave `ADMIN_SEED_EMAIL` and `ADMIN_SEED_PASSWORD` empty to disable the seed. Never commit real admin credentials.
+
+Example local admin seed:
+
+```env
+ADMIN_SEED_EMAIL=admin@example.com
+ADMIN_SEED_PASSWORD=Password123!
+ADMIN_SEED_NAME=Admin
+```
+
+The seed runs only during API startup. After changing `.env`, restart the API process or recreate the Docker Compose API container:
+
+```powershell
+.\scripts\run-local.ps1
+docker compose up -d --force-recreate api
+```
+
 ## Development Notes
 - Backend entry point: `backend/src/SmartMovieCatalog.Api/Program.cs`.
-- Backend API scaffold: `backend/src/SmartMovieCatalog.Api/Controllers`.
+- Backend HTTP endpoints: Minimal API feature slices under `backend/src/SmartMovieCatalog.Api/Features`.
+- Auth endpoint mapping: `backend/src/SmartMovieCatalog.Api/Features/Auth`.
 - Frontend application: `frontend/src/app`.
 - Frontend visual system: `frontend/DESIGN.md`.
 - Root design policy: `DESIGN.md`.