User & Admin Roles

Relevant source files

The following files were used as context for generating this wiki page:

• Models/User.cs
• Models/Admin.cs
• Configuration/UserConfiguration.cs
• Configuration/AdminConfiguration.cs
• Data/UserDBContext.cs
• Controllers/Login/UserController.cs
• Seeders/DatabaseSeeder.cs
• Migrations/UserDBContextModelSnapshot.cs

The WEBAPI project defines two distinct entities for managing access and identity: User and Admin. These entities are managed using Entity Framework Core, with separate models, database tables, and configurations. The User entity represents standard application users (customers), while the Admin entity represents administrators with potentially elevated privileges.

Role differentiation is primarily achieved through two separate database tables, User and Admins. The User model also contains a boolean Role property, which may be used for further permission granularity within the standard user scope. User lifecycle operations, including registration, login, and password recovery, are handled through the UserController.

Data Models

The system uses two C# classes, User and Admin, to model the entities. These classes are mapped to database tables by Entity Framework Core.

User Entity

The User class defines the structure for standard users or customers. It includes properties for authentication, identification, and role assignment. It also contains fields for password reset functionality.

Sources: Models/User.cs, Migrations/UserDBContextModelSnapshot.cs:194-228

Property	Type	Description	Constraints
Id	int	Primary Key for the User table.	Auto-incrementing identity column.
Email	string	User's email address.	Required, Max length 100.
UserName	string	User's unique username.	Required, Max length 50.
Password	string	User's password. Stored as a string.	Required, Max length 256.
Role	bool	A boolean flag indicating the user's role. false for standard users.	Required.
ResetToken	string	A token for password reset requests.	Nullable.
ResetTokenExpiration	DateTime?	The expiration date and time for the ResetToken.	Nullable.

Admin Entity

The Admin class defines the structure for administrators. It is a separate entity from User and is stored in its own table.

Sources: Models/Admin.cs, Migrations/UserDBContextModelSnapshot.cs:23-45

Property	Type	Description	Constraints
AdminID	int	Primary Key for the Admins table.	Auto-incrementing identity column.
FullName	string	The full name of the administrator.	Required, Max length 150.
Email	string	Administrator's email address.	Required, Max length 100.
Password	string	Administrator's password.	Required, Max length 256.
IsAdmin	bool	A flag to indicate if the account is an admin.	Required.

Database Schema and Configuration

Entity Framework Core is used to define the database schema. The UserDBContext applies specific configurations for both User and Admin entities.

The following diagram illustrates the database schema for the User and Admin entities and the relationship between User and Orders.

User Configuration

The UserConfiguration class specifies the database mapping for the User entity.

• Table Name: The entity is mapped to the User table.
• Primary Key: The Id property is set as the primary key.
• Property Constraints: Email, UserName, Password, and Role are marked as required fields, with specified maximum lengths for string properties.

Sources: Configuration/UserConfiguration.cs:9-29

Admin Configuration

Similarly, the AdminConfiguration class defines the mapping for the Admin entity.

• Table Name: The entity is mapped to the Admins table.
• Primary Key: The AdminID property is set as the primary key.
• Property Constraints: FullName, Email, and Password are marked as required fields with specified maximum lengths.

Sources: Configuration/AdminConfiguration.cs:9-27

DbContext Integration

The UserDBContext class registers these configurations and exposes DbSet properties for User and Admin, allowing them to be queried and managed.

// Data/UserDBContext.cs
protected override void OnModelCreating(ModelBuilder modelBuilder)
{
    // Apply all configurations
    modelBuilder.ApplyConfiguration(new UserConfiguration());
    // ...
    modelBuilder.ApplyConfiguration(new AdminConfiguration());
    // ...
}

// ...

public DbSet<User> User { get; set; }
public DbSet<Admin> Admins { get; set; }

Sources: Data/UserDBContext.cs:15-18, Data/UserDBContext.cs:33-34

Role Management and Seeding

Role management is handled differently for Users and Admins.

• Admins: The existence of a record in the Admins table signifies an administrator. The IsAdmin property on the Admin model further confirms this status.
• Users: The User model has a boolean Role property. During registration via the API, this is hardcoded to false. However, the database seeder creates an initial user with Role set to true, suggesting this flag may grant special permissions to certain standard users.

// Seeders/DatabaseSeeder.cs:12-20
modelBuilder.Entity<User>().HasData(
    new User()
    {
        Id = 1,
        Email = "chihtt123@gmail.com",
        UserName = "chi",
        Password = "123",
        Role = true
    }
);

Sources: Seeders/DatabaseSeeder.cs:12-20, Controllers/Login/UserController.cs:79-80, Models/User.cs:11, Models/Admin.cs:9

User Authentication API

The UserController provides RESTful endpoints for managing the user lifecycle. There are no equivalent API endpoints exposed in the provided files for managing Admin entities.

Key Endpoints

Method	Endpoint	Description
POST	/api/v1/user/register	Registers a new user. Sets Role to false by default.
POST	/api/v1/user/login	Authenticates a user and returns user details, including their Role.
GET	/api/v1/user	Retrieves a list of all users.
GET	/api/v1/user/{id}	Retrieves a single user by their ID.
POST	/api/v1/user/forgot-password	Initiates the password reset process by sending a token to the user's email.
POST	/api/v1/user/reset-password	Resets the user's password using a valid token.

Sources: Controllers/Login/UserController.cs

User Registration Flow

The diagram below shows the sequence of events when a new user registers.

User Login Flow

The login process validates credentials and returns user information, including their role.

Summary

The application maintains a clear separation between standard User accounts and Admin accounts by using distinct data models and database tables. The User entity includes a flexible boolean Role property, which is seeded as true for an initial user but set to false for all new API registrations. All user-facing authentication and management logic is encapsulated within the UserController and UserService, providing a clear entry point for user lifecycle operations.