@ngxtm/devkit 3.3.0 → 3.4.1

package/rules/dotnet/razor-pages/references/REFERENCE.md

@@ -0,0 +1,321 @@
+# Razor Pages Reference
+
+Page conventions, view components, and form handling patterns.
+
+## References
+
+- [**Page Conventions**](page-conventions.md) - Routing and authorization.
+- [**View Components**](view-components.md) - Reusable UI components.
+- [**Forms**](forms.md) - Form handling and validation.
+
+## Page Routing Conventions
+
+```csharp
+// Program.cs - Custom conventions
+builder.Services.AddRazorPages(options =>
+{
+    // Authorization
+    options.Conventions.AuthorizeFolder("/Admin");
+    options.Conventions.AuthorizeAreaFolder("Identity", "/Account/Manage");
+    options.Conventions.AllowAnonymousToPage("/Public/Index");
+
+    // Custom routes
+    options.Conventions.AddPageRoute("/Products/Details", "/p/{id}");
+
+    // Page model conventions
+    options.Conventions.AddFolderApplicationModelConvention("/Blog",
+        model => model.Filters.Add(new BlogPageFilter()));
+});
+```
+
+## View Components
+
+```csharp
+// ViewComponents/ShoppingCartViewComponent.cs
+public class ShoppingCartViewComponent(ICartService cartService) : ViewComponent
+{
+    public async Task<IViewComponentResult> InvokeAsync()
+    {
+        var cart = await cartService.GetCurrentCartAsync(
+            HttpContext.User.Identity?.Name);
+
+        return View(new ShoppingCartViewModel
+        {
+            ItemCount = cart?.Items.Count ?? 0,
+            Total = cart?.Total ?? 0
+        });
+    }
+}
+```
+
+```html
+@* Views/Shared/Components/ShoppingCart/Default.cshtml *@
+@model ShoppingCartViewModel
+
+<div class="cart-widget">
+    <a asp-page="/Cart/Index">
+        <span class="badge">@Model.ItemCount</span>
+        Cart: @Model.Total.ToString("C")
+    </a>
+</div>
+
+@* Usage in layout *@
+<nav>
+    @await Component.InvokeAsync("ShoppingCart")
+</nav>
+
+@* Or with tag helper *@
+<vc:shopping-cart></vc:shopping-cart>
+```
+
+## Handler Methods
+
+```csharp
+public class ProductsModel : PageModel
+{
+    [BindProperty(SupportsGet = true)]
+    public string? SearchTerm { get; set; }
+
+    [BindProperty(SupportsGet = true)]
+    public int PageNumber { get; set; } = 1;
+
+    public List<ProductDto> Products { get; set; } = [];
+
+    // GET /Products
+    public async Task OnGetAsync()
+    {
+        Products = await _service.SearchAsync(SearchTerm, PageNumber);
+    }
+
+    // GET /Products?handler=Export
+    public async Task<IActionResult> OnGetExportAsync()
+    {
+        var csv = await _service.ExportToCsvAsync(SearchTerm);
+        return File(csv, "text/csv", "products.csv");
+    }
+
+    // POST /Products (add to cart)
+    public async Task<IActionResult> OnPostAddToCartAsync(int productId)
+    {
+        await _cartService.AddItemAsync(productId);
+        return RedirectToPage();
+    }
+
+    // POST /Products?handler=Delete
+    public async Task<IActionResult> OnPostDeleteAsync(int id)
+    {
+        await _service.DeleteAsync(id);
+        TempData["Success"] = "Product deleted";
+        return RedirectToPage();
+    }
+}
+```
+
+```html
+@* Multiple forms on same page *@
+<form method="get">
+    <input asp-for="SearchTerm" placeholder="Search..." />
+    <button type="submit">Search</button>
+</form>
+
+<a asp-page-handler="Export" asp-route-searchTerm="@Model.SearchTerm">
+    Export to CSV
+</a>
+
+@foreach (var product in Model.Products)
+{
+    <div class="product">
+        <h3>@product.Name</h3>
+
+        <form method="post" asp-page-handler="AddToCart">
+            <input type="hidden" name="productId" value="@product.Id" />
+            <button type="submit">Add to Cart</button>
+        </form>
+
+        <form method="post" asp-page-handler="Delete"
+              onsubmit="return confirm('Are you sure?')">
+            <input type="hidden" name="id" value="@product.Id" />
+            <button type="submit" class="btn-danger">Delete</button>
+        </form>
+    </div>
+}
+```
+
+## AJAX with Razor Pages
+
+```csharp
+// PageModel
+public class ContactModel : PageModel
+{
+    [BindProperty]
+    public ContactForm Form { get; set; } = new();
+
+    public async Task<IActionResult> OnPostAsync()
+    {
+        if (!ModelState.IsValid)
+        {
+            // Return validation errors for AJAX
+            return new JsonResult(new
+            {
+                success = false,
+                errors = ModelState.ToDictionary(
+                    kvp => kvp.Key,
+                    kvp => kvp.Value?.Errors.Select(e => e.ErrorMessage))
+            });
+        }
+
+        await _emailService.SendContactFormAsync(Form);
+
+        return new JsonResult(new { success = true });
+    }
+}
+```
+
+```html
+@* AJAX form submission *@
+<form id="contactForm" method="post">
+    @Html.AntiForgeryToken()
+
+    <input asp-for="Form.Name" />
+    <input asp-for="Form.Email" />
+    <textarea asp-for="Form.Message"></textarea>
+
+    <button type="submit">Send</button>
+</form>
+
+<div id="result"></div>
+
+@section Scripts {
+<script>
+document.getElementById('contactForm').addEventListener('submit', async (e) => {
+    e.preventDefault();
+
+    const form = e.target;
+    const formData = new FormData(form);
+
+    const response = await fetch(form.action, {
+        method: 'POST',
+        body: formData
+    });
+
+    const result = await response.json();
+
+    if (result.success) {
+        document.getElementById('result').innerHTML =
+            '<div class="alert alert-success">Message sent!</div>';
+        form.reset();
+    } else {
+        // Display validation errors
+        console.log(result.errors);
+    }
+});
+</script>
+}
+```
+
+## Partial Views with Model
+
+```csharp
+// Partial with strongly-typed model
+// Pages/Shared/_ProductCard.cshtml
+@model ProductDto
+
+<div class="card">
+    <img src="@Model.ImageUrl" alt="@Model.Name" />
+    <h5>@Model.Name</h5>
+    <p>@Model.Price.ToString("C")</p>
+    <a asp-page="/Products/Details" asp-route-id="@Model.Id">View</a>
+</div>
+```
+
+```html
+@* Usage *@
+@foreach (var product in Model.Products)
+{
+    <partial name="_ProductCard" model="product" />
+}
+
+@* Or with tag helper *@
+<partial name="_ProductCard" model="Model.FeaturedProduct" />
+
+@* Pass additional ViewData *@
+<partial name="_ProductCard" model="product"
+         view-data='new ViewDataDictionary(ViewData) { { "ShowActions", true } }' />
+```
+
+## Areas Organization
+
+```
+Areas/
+├── Admin/
+│   ├── Pages/
+│   │   ├── _ViewStart.cshtml      @{ Layout = "_AdminLayout"; }
+│   │   ├── Dashboard/
+│   │   │   └── Index.cshtml
+│   │   └── Users/
+│   │       ├── Index.cshtml
+│   │       └── Edit.cshtml
+│   └── _AdminLayout.cshtml
+└── Identity/
+    └── Pages/
+        └── Account/
+            ├── Login.cshtml
+            └── Register.cshtml
+```
+
+```html
+@* Link to area page *@
+<a asp-area="Admin" asp-page="/Dashboard/Index">Admin Dashboard</a>
+<a asp-area="Identity" asp-page="/Account/Login">Login</a>
+```
+
+## TempData and Flash Messages
+
+```csharp
+// Set messages
+TempData["Success"] = "Record saved successfully";
+TempData["Error"] = "An error occurred";
+TempData["Warning"] = "Please review your changes";
+
+// In PageModel
+public IActionResult OnPostDelete(int id)
+{
+    var result = _service.Delete(id);
+
+    if (result.IsSuccess)
+    {
+        TempData["Success"] = $"Item {id} deleted";
+        return RedirectToPage("./Index");
+    }
+
+    TempData["Error"] = result.Error;
+    return RedirectToPage();
+}
+```
+
+```html
+@* _Layout.cshtml - Flash message partial *@
+@if (TempData["Success"] is string success)
+{
+    <div class="alert alert-success alert-dismissible fade show">
+        @success
+        <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
+    </div>
+}
+
+@if (TempData["Error"] is string error)
+{
+    <div class="alert alert-danger alert-dismissible fade show">
+        @error
+        <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
+    </div>
+}
+
+@if (TempData["Warning"] is string warning)
+{
+    <div class="alert alert-warning alert-dismissible fade show">
+        @warning
+        <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
+    </div>
+}
+```

package/rules/dotnet/security/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: .NET Security
+description: Security standards for .NET applications based on OWASP guidelines.
+metadata:
+  labels: [security, auth, owasp, dotnet]
+  triggers:
+    files: ['**/*.cs', '**/appsettings*.json']
+    keywords: [Authorize, Authentication, Identity, JWT, CORS, password]
+---
+
+# .NET Security
+
+## **Priority: P0 (CRITICAL)**
+
+Security standards for .NET applications based on OWASP guidelines.
+
+## Implementation Guidelines
+
+- **Authentication**: ASP.NET Identity for users, JWT Bearer for APIs, Cookie auth for web apps.
+- **Authorization**: Policy-based over role-based. Resource-based for fine-grained control.
+- **Input Validation**: `FluentValidation` or `DataAnnotations`. Validate at API boundaries.
+- **SQL Injection**: Always use parameterized queries. EF Core and Dapper handle this automatically.
+- **XSS Prevention**: Razor auto-encodes by default. Use `HtmlEncoder` for manual encoding.
+- **CSRF**: Anti-forgery tokens for forms. `SameSite=Strict` cookies.
+- **Secrets**: Never hardcode. Use User Secrets (dev), Azure Key Vault (prod).
+- **HTTPS**: Always `UseHttpsRedirection()`. Enable HSTS in production.
+- **Headers**: Use security headers middleware (CSP, X-Frame-Options, etc.).
+- **Rate Limiting**: Use built-in `RateLimiter` middleware (.NET 7+).
+
+## Anti-Patterns
+
+- **No hardcoded secrets**: Never commit API keys, connection strings, passwords.
+- **No `[AllowAnonymous]` on sensitive endpoints**: Review all anonymous access.
+- **No raw SQL with interpolation**: `$"SELECT * FROM Users WHERE Id = {id}"` is vulnerable.
+- **No `*` CORS in production**: Specify allowed origins explicitly.
+- **No disabled SSL validation**: Never `ServerCertificateCustomValidationCallback = (_, _, _, _) => true`.
+
+## Code
+
+```csharp
+// JWT Bearer configuration
+builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+    .AddJwtBearer(options =>
+    {
+        options.TokenValidationParameters = new TokenValidationParameters
+        {
+            ValidateIssuer = true,
+            ValidateAudience = true,
+            ValidateLifetime = true,
+            ValidateIssuerSigningKey = true,
+            ValidIssuer = builder.Configuration["Jwt:Issuer"],
+            ValidAudience = builder.Configuration["Jwt:Audience"],
+            IssuerSigningKey = new SymmetricSecurityKey(
+                Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]!))
+        };
+    });
+
+// Policy-based authorization
+builder.Services.AddAuthorization(options =>
+{
+    options.AddPolicy("AdminOnly", policy => policy.RequireRole("Admin"));
+    options.AddPolicy("CanEditOrder", policy =>
+        policy.Requirements.Add(new ResourceOwnerRequirement()));
+});
+
+// Parameterized query (safe from SQL injection)
+var user = await connection.QuerySingleAsync<User>(
+    "SELECT * FROM Users WHERE Id = @Id AND Status = @Status",
+    new { Id = userId, Status = "Active" });
+
+// Rate limiting
+builder.Services.AddRateLimiter(options =>
+{
+    options.AddFixedWindowLimiter("api", cfg =>
+    {
+        cfg.Window = TimeSpan.FromMinutes(1);
+        cfg.PermitLimit = 100;
+    });
+});
+```
+
+## Reference & Examples
+
+For JWT patterns, Identity configuration, and security headers:
+See [references/REFERENCE.md](references/REFERENCE.md).
+
+## Related Topics
+
+language | best-practices | aspnet-core

package/rules/dotnet/security/references/REFERENCE.md

@@ -0,0 +1,295 @@
+# .NET Security Reference
+
+Authentication, authorization, and security headers configuration.
+
+## References
+
+- [**JWT Authentication**](jwt-authentication.md) - Token generation and validation.
+- [**Identity Configuration**](identity-configuration.md) - Password rules, lockout settings.
+- [**Security Headers**](security-headers.md) - CSP, HSTS, X-Frame-Options.
+
+## JWT Token Generation
+
+```csharp
+public class TokenService(IOptions<JwtSettings> options)
+{
+    private readonly JwtSettings _settings = options.Value;
+
+    public string GenerateToken(User user)
+    {
+        var claims = new[]
+        {
+            new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
+            new Claim(ClaimTypes.Email, user.Email),
+            new Claim(ClaimTypes.Role, user.Role),
+            new Claim("tenant_id", user.TenantId.ToString())
+        };
+
+        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_settings.Key));
+        var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
+
+        var token = new JwtSecurityToken(
+            issuer: _settings.Issuer,
+            audience: _settings.Audience,
+            claims: claims,
+            expires: DateTime.UtcNow.AddHours(_settings.ExpiryHours),
+            signingCredentials: credentials);
+
+        return new JwtSecurityTokenHandler().WriteToken(token);
+    }
+
+    public ClaimsPrincipal? ValidateToken(string token)
+    {
+        var handler = new JwtSecurityTokenHandler();
+        try
+        {
+            return handler.ValidateToken(token, new TokenValidationParameters
+            {
+                ValidateIssuer = true,
+                ValidateAudience = true,
+                ValidateLifetime = true,
+                ValidateIssuerSigningKey = true,
+                ValidIssuer = _settings.Issuer,
+                ValidAudience = _settings.Audience,
+                IssuerSigningKey = new SymmetricSecurityKey(
+                    Encoding.UTF8.GetBytes(_settings.Key)),
+                ClockSkew = TimeSpan.Zero
+            }, out _);
+        }
+        catch
+        {
+            return null;
+        }
+    }
+}
+```
+
+## ASP.NET Identity Configuration
+
+```csharp
+// Program.cs
+builder.Services.AddIdentity<ApplicationUser, IdentityRole>(options =>
+{
+    // Password requirements
+    options.Password.RequiredLength = 12;
+    options.Password.RequireDigit = true;
+    options.Password.RequireLowercase = true;
+    options.Password.RequireUppercase = true;
+    options.Password.RequireNonAlphanumeric = true;
+    options.Password.RequiredUniqueChars = 4;
+
+    // Lockout settings
+    options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(15);
+    options.Lockout.MaxFailedAccessAttempts = 5;
+    options.Lockout.AllowedForNewUsers = true;
+
+    // User settings
+    options.User.RequireUniqueEmail = true;
+    options.SignIn.RequireConfirmedEmail = true;
+})
+.AddEntityFrameworkStores<AppDbContext>()
+.AddDefaultTokenProviders();
+
+// Password hasher upgrade (Argon2id recommended for new apps)
+builder.Services.Configure<PasswordHasherOptions>(options =>
+{
+    options.IterationCount = 310000; // OWASP recommendation
+});
+```
+
+## Security Headers Middleware
+
+```csharp
+// Using a middleware class
+public class SecurityHeadersMiddleware(RequestDelegate next)
+{
+    public async Task InvokeAsync(HttpContext context)
+    {
+        // Prevent clickjacking
+        context.Response.Headers.Append("X-Frame-Options", "DENY");
+
+        // Prevent MIME sniffing
+        context.Response.Headers.Append("X-Content-Type-Options", "nosniff");
+
+        // XSS protection (legacy, CSP is better)
+        context.Response.Headers.Append("X-XSS-Protection", "1; mode=block");
+
+        // Referrer policy
+        context.Response.Headers.Append("Referrer-Policy", "strict-origin-when-cross-origin");
+
+        // Content Security Policy
+        context.Response.Headers.Append("Content-Security-Policy",
+            "default-src 'self'; " +
+            "script-src 'self' 'unsafe-inline'; " +
+            "style-src 'self' 'unsafe-inline'; " +
+            "img-src 'self' data: https:; " +
+            "font-src 'self'; " +
+            "frame-ancestors 'none';");
+
+        // Permissions Policy
+        context.Response.Headers.Append("Permissions-Policy",
+            "geolocation=(), microphone=(), camera=()");
+
+        await next(context);
+    }
+}
+
+// Usage in Program.cs
+app.UseMiddleware<SecurityHeadersMiddleware>();
+app.UseHsts(); // Strict-Transport-Security
+```
+
+## CORS Configuration
+
+```csharp
+// Development (allow specific origins)
+builder.Services.AddCors(options =>
+{
+    options.AddPolicy("Development", policy =>
+    {
+        policy.WithOrigins("http://localhost:3000", "http://localhost:5173")
+              .AllowAnyHeader()
+              .AllowAnyMethod()
+              .AllowCredentials();
+    });
+
+    options.AddPolicy("Production", policy =>
+    {
+        policy.WithOrigins(
+                builder.Configuration.GetSection("Cors:AllowedOrigins").Get<string[]>()!)
+              .WithHeaders("Authorization", "Content-Type", "X-Requested-With")
+              .WithMethods("GET", "POST", "PUT", "DELETE")
+              .AllowCredentials()
+              .SetPreflightMaxAge(TimeSpan.FromMinutes(10));
+    });
+});
+
+// Usage
+app.UseCors(builder.Environment.IsDevelopment() ? "Development" : "Production");
+```
+
+## Resource-Based Authorization
+
+```csharp
+// Requirement
+public class ResourceOwnerRequirement : IAuthorizationRequirement { }
+
+// Handler
+public class ResourceOwnerHandler : AuthorizationHandler<ResourceOwnerRequirement, Order>
+{
+    protected override Task HandleRequirementAsync(
+        AuthorizationHandlerContext context,
+        ResourceOwnerRequirement requirement,
+        Order resource)
+    {
+        var userId = context.User.FindFirstValue(ClaimTypes.NameIdentifier);
+
+        if (resource.UserId.ToString() == userId ||
+            context.User.IsInRole("Admin"))
+        {
+            context.Succeed(requirement);
+        }
+
+        return Task.CompletedTask;
+    }
+}
+
+// Registration
+builder.Services.AddScoped<IAuthorizationHandler, ResourceOwnerHandler>();
+
+// Usage in controller
+public async Task<IActionResult> UpdateOrder(int id, UpdateOrderDto dto)
+{
+    var order = await _orderService.GetByIdAsync(id);
+    if (order is null) return NotFound();
+
+    var authResult = await _authService.AuthorizeAsync(
+        User, order, new ResourceOwnerRequirement());
+
+    if (!authResult.Succeeded) return Forbid();
+
+    await _orderService.UpdateAsync(order, dto);
+    return NoContent();
+}
+```
+
+## Rate Limiting (.NET 7+)
+
+```csharp
+builder.Services.AddRateLimiter(options =>
+{
+    // Fixed window: 100 requests per minute
+    options.AddFixedWindowLimiter("fixed", cfg =>
+    {
+        cfg.Window = TimeSpan.FromMinutes(1);
+        cfg.PermitLimit = 100;
+        cfg.QueueLimit = 10;
+        cfg.QueueProcessingOrder = QueueProcessingOrder.OldestFirst;
+    });
+
+    // Sliding window: smoother rate limiting
+    options.AddSlidingWindowLimiter("sliding", cfg =>
+    {
+        cfg.Window = TimeSpan.FromMinutes(1);
+        cfg.PermitLimit = 100;
+        cfg.SegmentsPerWindow = 6; // 10-second segments
+    });
+
+    // Token bucket: burst allowance
+    options.AddTokenBucketLimiter("token", cfg =>
+    {
+        cfg.TokenLimit = 100;
+        cfg.ReplenishmentPeriod = TimeSpan.FromSeconds(10);
+        cfg.TokensPerPeriod = 20;
+    });
+
+    // Per-user limiting
+    options.AddPolicy("per-user", context =>
+        RateLimitPartition.GetFixedWindowLimiter(
+            context.User.Identity?.Name ?? context.Connection.RemoteIpAddress?.ToString() ?? "anonymous",
+            _ => new FixedWindowRateLimiterOptions
+            {
+                Window = TimeSpan.FromMinutes(1),
+                PermitLimit = 50
+            }));
+
+    options.OnRejected = async (context, token) =>
+    {
+        context.HttpContext.Response.StatusCode = StatusCodes.Status429TooManyRequests;
+        await context.HttpContext.Response.WriteAsJsonAsync(new
+        {
+            error = "Too many requests. Please try again later."
+        }, token);
+    };
+});
+
+// Usage
+app.UseRateLimiter();
+
+app.MapGet("/api/data", () => "Hello")
+   .RequireRateLimiting("fixed");
+```
+
+## Secrets Management
+
+```csharp
+// Development: User Secrets
+// dotnet user-secrets init
+// dotnet user-secrets set "Database:Password" "secret123"
+
+// Production: Azure Key Vault
+builder.Configuration.AddAzureKeyVault(
+    new Uri($"https://{builder.Configuration["KeyVault:Name"]}.vault.azure.net/"),
+    new DefaultAzureCredential());
+
+// Environment variables (Docker/K8s)
+builder.Configuration.AddEnvironmentVariables(prefix: "APP_");
+
+// Never do this:
+// ❌ var password = "hardcoded_password";
+// ❌ var connString = "Server=...;Password=secret;";
+
+// Always do this:
+// ✅ var password = builder.Configuration["Database:Password"];
+// ✅ var connString = builder.Configuration.GetConnectionString("Default");
+```