@ngxtm/devkit 3.4.0 → 3.5.0

package/rules/dotnet/razor-pages/SKILL.md

@@ -0,0 +1,124 @@
+---
+name: Razor Pages
+description: ASP.NET Core Razor Pages patterns for server-rendered web apps.
+metadata:
+  labels: [razor, mvc, aspnet, web]
+  triggers:
+    files: ['**/*.cshtml', '**/*.cshtml.cs']
+    keywords: [PageModel, OnGet, OnPost, asp-for, asp-action]
+---
+
+# Razor Pages
+
+## **Priority: P1 (OPERATIONAL)**
+
+ASP.NET Core Razor Pages patterns for server-rendered web applications.
+
+## Implementation Guidelines
+
+- **PageModel**: Keep logic in PageModel, not in `.cshtml`. Use handlers (`OnGet`, `OnPost`).
+- **Model Binding**: Use `[BindProperty]` for form data. `[FromQuery]` for query params.
+- **Tag Helpers**: Use `asp-for`, `asp-action`, `asp-route-*` for type-safe HTML.
+- **Partial Views**: Reusable UI components with `<partial>` tag helper.
+- **View Components**: Complex reusable UI with server logic.
+- **Layout**: Shared layout in `_Layout.cshtml`. Use sections for page-specific content.
+- **TempData**: Flash messages with PRG (Post-Redirect-Get) pattern.
+
+## Anti-Patterns
+
+- **No logic in `.cshtml`**: Move to PageModel or View Components.
+- **No `ViewBag`/`ViewData`**: Use strongly-typed models.
+- **No inline CSS/JS**: Use external files with bundling.
+- **No form without anti-forgery**: Always include `@Html.AntiForgeryToken()` or use `asp-antiforgery`.
+
+## Code
+
+```csharp
+// Pages/Users/Create.cshtml.cs
+public class CreateModel(IUserService userService, ILogger<CreateModel> logger) : PageModel
+{
+    [BindProperty]
+    public CreateUserInput Input { get; set; } = new();
+
+    public List<SelectListItem> Roles { get; set; } = [];
+
+    public async Task OnGetAsync()
+    {
+        Roles = await GetRolesAsync();
+    }
+
+    public async Task<IActionResult> OnPostAsync()
+    {
+        if (!ModelState.IsValid)
+        {
+            Roles = await GetRolesAsync();
+            return Page();
+        }
+
+        var result = await userService.CreateAsync(Input);
+
+        if (!result.IsSuccess)
+        {
+            ModelState.AddModelError(string.Empty, result.Error!);
+            Roles = await GetRolesAsync();
+            return Page();
+        }
+
+        TempData["Success"] = "User created successfully";
+        return RedirectToPage("./Index");
+    }
+}
+```
+
+```html
+@* Pages/Users/Create.cshtml *@
+@page
+@model CreateModel
+
+<h2>Create User</h2>
+
+@if (TempData["Error"] is string error)
+{
+    <div class="alert alert-danger">@error</div>
+}
+
+<form method="post">
+    <div asp-validation-summary="ModelOnly" class="text-danger"></div>
+
+    <div class="mb-3">
+        <label asp-for="Input.Name" class="form-label"></label>
+        <input asp-for="Input.Name" class="form-control" />
+        <span asp-validation-for="Input.Name" class="text-danger"></span>
+    </div>
+
+    <div class="mb-3">
+        <label asp-for="Input.Email" class="form-label"></label>
+        <input asp-for="Input.Email" class="form-control" type="email" />
+        <span asp-validation-for="Input.Email" class="text-danger"></span>
+    </div>
+
+    <div class="mb-3">
+        <label asp-for="Input.RoleId" class="form-label"></label>
+        <select asp-for="Input.RoleId" asp-items="Model.Roles" class="form-select">
+            <option value="">Select a role</option>
+        </select>
+        <span asp-validation-for="Input.RoleId" class="text-danger"></span>
+    </div>
+
+    <button type="submit" class="btn btn-primary">Create</button>
+    <a asp-page="./Index" class="btn btn-secondary">Cancel</a>
+</form>
+
+@section Scripts {
+    <partial name="_ValidationScriptsPartial" />
+}
+```
+
+## Reference & Examples
+
+For page conventions, view components, and AJAX patterns:
+See [references/REFERENCE.md](references/REFERENCE.md).
+
+## Related Topics
+
+aspnet-core | blazor | security

package/rules/dotnet/razor-pages/references/REFERENCE.md

@@ -0,0 +1,321 @@
+# Razor Pages Reference
+
+Page conventions, view components, and form handling patterns.
+
+## References
+
+- [**Page Conventions**](page-conventions.md) - Routing and authorization.
+- [**View Components**](view-components.md) - Reusable UI components.
+- [**Forms**](forms.md) - Form handling and validation.
+
+## Page Routing Conventions
+
+```csharp
+// Program.cs - Custom conventions
+builder.Services.AddRazorPages(options =>
+{
+    // Authorization
+    options.Conventions.AuthorizeFolder("/Admin");
+    options.Conventions.AuthorizeAreaFolder("Identity", "/Account/Manage");
+    options.Conventions.AllowAnonymousToPage("/Public/Index");
+
+    // Custom routes
+    options.Conventions.AddPageRoute("/Products/Details", "/p/{id}");
+
+    // Page model conventions
+    options.Conventions.AddFolderApplicationModelConvention("/Blog",
+        model => model.Filters.Add(new BlogPageFilter()));
+});
+```
+
+## View Components
+
+```csharp
+// ViewComponents/ShoppingCartViewComponent.cs
+public class ShoppingCartViewComponent(ICartService cartService) : ViewComponent
+{
+    public async Task<IViewComponentResult> InvokeAsync()
+    {
+        var cart = await cartService.GetCurrentCartAsync(
+            HttpContext.User.Identity?.Name);
+
+        return View(new ShoppingCartViewModel
+        {
+            ItemCount = cart?.Items.Count ?? 0,
+            Total = cart?.Total ?? 0
+        });
+    }
+}
+```
+
+```html
+@* Views/Shared/Components/ShoppingCart/Default.cshtml *@
+@model ShoppingCartViewModel
+
+<div class="cart-widget">
+    <a asp-page="/Cart/Index">
+        <span class="badge">@Model.ItemCount</span>
+        Cart: @Model.Total.ToString("C")
+    </a>
+</div>
+
+@* Usage in layout *@
+<nav>
+    @await Component.InvokeAsync("ShoppingCart")
+</nav>
+
+@* Or with tag helper *@
+<vc:shopping-cart></vc:shopping-cart>
+```
+
+## Handler Methods
+
+```csharp
+public class ProductsModel : PageModel
+{
+    [BindProperty(SupportsGet = true)]
+    public string? SearchTerm { get; set; }
+
+    [BindProperty(SupportsGet = true)]
+    public int PageNumber { get; set; } = 1;
+
+    public List<ProductDto> Products { get; set; } = [];
+
+    // GET /Products
+    public async Task OnGetAsync()
+    {
+        Products = await _service.SearchAsync(SearchTerm, PageNumber);
+    }
+
+    // GET /Products?handler=Export
+    public async Task<IActionResult> OnGetExportAsync()
+    {
+        var csv = await _service.ExportToCsvAsync(SearchTerm);
+        return File(csv, "text/csv", "products.csv");
+    }
+
+    // POST /Products (add to cart)
+    public async Task<IActionResult> OnPostAddToCartAsync(int productId)
+    {
+        await _cartService.AddItemAsync(productId);
+        return RedirectToPage();
+    }
+
+    // POST /Products?handler=Delete
+    public async Task<IActionResult> OnPostDeleteAsync(int id)
+    {
+        await _service.DeleteAsync(id);
+        TempData["Success"] = "Product deleted";
+        return RedirectToPage();
+    }
+}
+```
+
+```html
+@* Multiple forms on same page *@
+<form method="get">
+    <input asp-for="SearchTerm" placeholder="Search..." />
+    <button type="submit">Search</button>
+</form>
+
+<a asp-page-handler="Export" asp-route-searchTerm="@Model.SearchTerm">
+    Export to CSV
+</a>
+
+@foreach (var product in Model.Products)
+{
+    <div class="product">
+        <h3>@product.Name</h3>
+
+        <form method="post" asp-page-handler="AddToCart">
+            <input type="hidden" name="productId" value="@product.Id" />
+            <button type="submit">Add to Cart</button>
+        </form>
+
+        <form method="post" asp-page-handler="Delete"
+              onsubmit="return confirm('Are you sure?')">
+            <input type="hidden" name="id" value="@product.Id" />
+            <button type="submit" class="btn-danger">Delete</button>
+        </form>
+    </div>
+}
+```
+
+## AJAX with Razor Pages
+
+```csharp
+// PageModel
+public class ContactModel : PageModel
+{
+    [BindProperty]
+    public ContactForm Form { get; set; } = new();
+
+    public async Task<IActionResult> OnPostAsync()
+    {
+        if (!ModelState.IsValid)
+        {
+            // Return validation errors for AJAX
+            return new JsonResult(new
+            {
+                success = false,
+                errors = ModelState.ToDictionary(
+                    kvp => kvp.Key,
+                    kvp => kvp.Value?.Errors.Select(e => e.ErrorMessage))
+            });
+        }
+
+        await _emailService.SendContactFormAsync(Form);
+
+        return new JsonResult(new { success = true });
+    }
+}
+```
+
+```html
+@* AJAX form submission *@
+<form id="contactForm" method="post">
+    @Html.AntiForgeryToken()
+
+    <input asp-for="Form.Name" />
+    <input asp-for="Form.Email" />
+    <textarea asp-for="Form.Message"></textarea>
+
+    <button type="submit">Send</button>
+</form>
+
+<div id="result"></div>
+
+@section Scripts {
+<script>
+document.getElementById('contactForm').addEventListener('submit', async (e) => {
+    e.preventDefault();
+
+    const form = e.target;
+    const formData = new FormData(form);
+
+    const response = await fetch(form.action, {
+        method: 'POST',
+        body: formData
+    });
+
+    const result = await response.json();
+
+    if (result.success) {
+        document.getElementById('result').innerHTML =
+            '<div class="alert alert-success">Message sent!</div>';
+        form.reset();
+    } else {
+        // Display validation errors
+        console.log(result.errors);
+    }
+});
+</script>
+}
+```
+
+## Partial Views with Model
+
+```csharp
+// Partial with strongly-typed model
+// Pages/Shared/_ProductCard.cshtml
+@model ProductDto
+
+<div class="card">
+    <img src="@Model.ImageUrl" alt="@Model.Name" />
+    <h5>@Model.Name</h5>
+    <p>@Model.Price.ToString("C")</p>
+    <a asp-page="/Products/Details" asp-route-id="@Model.Id">View</a>
+</div>
+```
+
+```html
+@* Usage *@
+@foreach (var product in Model.Products)
+{
+    <partial name="_ProductCard" model="product" />
+}
+
+@* Or with tag helper *@
+<partial name="_ProductCard" model="Model.FeaturedProduct" />
+
+@* Pass additional ViewData *@
+<partial name="_ProductCard" model="product"
+         view-data='new ViewDataDictionary(ViewData) { { "ShowActions", true } }' />
+```
+
+## Areas Organization
+
+```
+Areas/
+├── Admin/
+│   ├── Pages/
+│   │   ├── _ViewStart.cshtml      @{ Layout = "_AdminLayout"; }
+│   │   ├── Dashboard/
+│   │   │   └── Index.cshtml
+│   │   └── Users/
+│   │       ├── Index.cshtml
+│   │       └── Edit.cshtml
+│   └── _AdminLayout.cshtml
+└── Identity/
+    └── Pages/
+        └── Account/
+            ├── Login.cshtml
+            └── Register.cshtml
+```
+
+```html
+@* Link to area page *@
+<a asp-area="Admin" asp-page="/Dashboard/Index">Admin Dashboard</a>
+<a asp-area="Identity" asp-page="/Account/Login">Login</a>
+```
+
+## TempData and Flash Messages
+
+```csharp
+// Set messages
+TempData["Success"] = "Record saved successfully";
+TempData["Error"] = "An error occurred";
+TempData["Warning"] = "Please review your changes";
+
+// In PageModel
+public IActionResult OnPostDelete(int id)
+{
+    var result = _service.Delete(id);
+
+    if (result.IsSuccess)
+    {
+        TempData["Success"] = $"Item {id} deleted";
+        return RedirectToPage("./Index");
+    }
+
+    TempData["Error"] = result.Error;
+    return RedirectToPage();
+}
+```
+
+```html
+@* _Layout.cshtml - Flash message partial *@
+@if (TempData["Success"] is string success)
+{
+    <div class="alert alert-success alert-dismissible fade show">
+        @success
+        <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
+    </div>
+}
+
+@if (TempData["Error"] is string error)
+{
+    <div class="alert alert-danger alert-dismissible fade show">
+        @error
+        <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
+    </div>
+}
+
+@if (TempData["Warning"] is string warning)
+{
+    <div class="alert alert-warning alert-dismissible fade show">
+        @warning
+        <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
+    </div>
+}
+```

package/rules/dotnet/security/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: .NET Security
+description: Security standards for .NET applications based on OWASP guidelines.
+metadata:
+  labels: [security, auth, owasp, dotnet]
+  triggers:
+    files: ['**/*.cs', '**/appsettings*.json']
+    keywords: [Authorize, Authentication, Identity, JWT, CORS, password]
+---
+
+# .NET Security
+
+## **Priority: P0 (CRITICAL)**
+
+Security standards for .NET applications based on OWASP guidelines.
+
+## Implementation Guidelines
+
+- **Authentication**: ASP.NET Identity for users, JWT Bearer for APIs, Cookie auth for web apps.
+- **Authorization**: Policy-based over role-based. Resource-based for fine-grained control.
+- **Input Validation**: `FluentValidation` or `DataAnnotations`. Validate at API boundaries.
+- **SQL Injection**: Always use parameterized queries. EF Core and Dapper handle this automatically.
+- **XSS Prevention**: Razor auto-encodes by default. Use `HtmlEncoder` for manual encoding.
+- **CSRF**: Anti-forgery tokens for forms. `SameSite=Strict` cookies.
+- **Secrets**: Never hardcode. Use User Secrets (dev), Azure Key Vault (prod).
+- **HTTPS**: Always `UseHttpsRedirection()`. Enable HSTS in production.
+- **Headers**: Use security headers middleware (CSP, X-Frame-Options, etc.).
+- **Rate Limiting**: Use built-in `RateLimiter` middleware (.NET 7+).
+
+## Anti-Patterns
+
+- **No hardcoded secrets**: Never commit API keys, connection strings, passwords.
+- **No `[AllowAnonymous]` on sensitive endpoints**: Review all anonymous access.
+- **No raw SQL with interpolation**: `$"SELECT * FROM Users WHERE Id = {id}"` is vulnerable.
+- **No `*` CORS in production**: Specify allowed origins explicitly.
+- **No disabled SSL validation**: Never `ServerCertificateCustomValidationCallback = (_, _, _, _) => true`.
+
+## Code
+
+```csharp
+// JWT Bearer configuration
+builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+    .AddJwtBearer(options =>
+    {
+        options.TokenValidationParameters = new TokenValidationParameters
+        {
+            ValidateIssuer = true,
+            ValidateAudience = true,
+            ValidateLifetime = true,
+            ValidateIssuerSigningKey = true,
+            ValidIssuer = builder.Configuration["Jwt:Issuer"],
+            ValidAudience = builder.Configuration["Jwt:Audience"],
+            IssuerSigningKey = new SymmetricSecurityKey(
+                Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]!))
+        };
+    });
+
+// Policy-based authorization
+builder.Services.AddAuthorization(options =>
+{
+    options.AddPolicy("AdminOnly", policy => policy.RequireRole("Admin"));
+    options.AddPolicy("CanEditOrder", policy =>
+        policy.Requirements.Add(new ResourceOwnerRequirement()));
+});
+
+// Parameterized query (safe from SQL injection)
+var user = await connection.QuerySingleAsync<User>(
+    "SELECT * FROM Users WHERE Id = @Id AND Status = @Status",
+    new { Id = userId, Status = "Active" });
+
+// Rate limiting
+builder.Services.AddRateLimiter(options =>
+{
+    options.AddFixedWindowLimiter("api", cfg =>
+    {
+        cfg.Window = TimeSpan.FromMinutes(1);
+        cfg.PermitLimit = 100;
+    });
+});
+```
+
+## Reference & Examples
+
+For JWT patterns, Identity configuration, and security headers:
+See [references/REFERENCE.md](references/REFERENCE.md).
+
+## Related Topics
+
+language | best-practices | aspnet-core