QDG CMS API

A .NET 9 Web API that provides content management services for QDG and affiliated sites. Authentication is not owned locally — it is delegated to the centralized QDBAuth service, with this API managing only opaque session cookies.

Architecture

Clean/onion architecture with four projects in QDG-CMS-BE.sln:

• QDG.CMS.API — ASP.NET Core entry point: controllers, Serilog bootstrap logging, Swagger/OpenAPI, API versioning (Asp.Versioning), CORS, and the custom session authentication handler.
• QDG.CMS.Application — application layer: DTOs, service interfaces/implementations, settings (AuthSettings, WasabiSettings), and mapping/parsing helpers.
• QDG.CMS.Domain — domain entities/enums (currently a skeleton, no entities defined yet).
• QDG.CMS.Infrastructure — data access (Dapper via IDbConnectionFactory/DbConnectionFactory, snake_case-to-PascalCase column mapping), health checks, and external service clients.

Authentication model

• Login/TOTP verification is proxied to the external QDBAuth service via IAuthServiceClient (AuthServiceClient), sending a shared X-QDB-Client-Secret header.
• On successful TOTP verification, the API issues its own opaque session cookie (qdg_session, HttpOnly, Secure, SameSite=Lax, path /api) — no JWTs are used or exposed to clients.
• SessionAuthenticationHandler/SessionAuthenticationOptions implement a custom AuthenticationScheme that validates the session cookie against an in-memory ISessionCache (SessionCache), refreshing against QDBAuth as needed.
• Endpoints: POST /api/v1/auth/login, POST /api/v1/auth/totp-verify, GET /api/v1/auth/me, POST /api/v1/auth/logout (see AuthController.cs).
• Swagger UI documents the cookie scheme directly (withCredentials: true) so "Try it out" carries the session automatically after login + totp-verify.

Data & storage

• MySQL via Dapper, connection built from ConnectionStrings:DefaultConnection, health-checked by MySqlHealthCheck.
• Wasabi (S3-compatible) object storage configured via WasabiSettings; WasabiHealthCheck verifies connectivity. The storage service implementation (IStorageService/WasabiStorageService) is registered but currently commented out pending implementation.

Cross-cutting

• Structured logging via Serilog (console sink, bootstrap + request logging).
• /health endpoint returns a JSON report of tagged checks (db, ready, storage).
• CORS locked to an AllowedOrigins allow-list, credentials enabled.

Deployment

Manual workflow_dispatch GitHub Actions pipeline (.github/workflows/deploy.yml) builds the dev branch as a self-contained win-x64 publish and deploys to an on-prem IIS site (QdgCmsApi), with pre-deploy backup, post-deploy /health check, and automatic rollback to the latest backup on failure. Runs on a self-hosted Windows runner.