Seed Data Management
Relevant source files
The following files were used as context for generating this wiki page:
- WebApplications/Identity.WebApi/SeedData/IdentitySeedData.cs
- Aspire.AppHost/AppHost.cs
- Aspire.AppHost/WorktreeSlot.cs
- claude.md
- WebApplications/Identity.WebApi/Migrations/ConfigurationDb/20260420185220_InitialIdentityServerConfigurationDbMigration.cs
- WebApplications/Identity.WebApi/Migrations/PersistedGrantDb/20260420185231_InitialIdentityServerPersistedGrantDbMigration.cs
Seed Data Management in this project facilitates the automated provisioning of essential data required for development and testing environments. It primarily focuses on the Identity.WebApi service, ensuring that the OIDC authority (Duende IdentityServer) and ASP.NET Core Identity are pre-configured with necessary users, roles, and OAuth clients upon application startup.
The seeding process is environment-aware, executing only when the application environment is set to "Development". It leverages Entity Framework Core Migrations to ensure the database schema is current before applying data. Furthermore, the system is "slot-aware," allowing multiple developers or worktrees to run isolated instances with unique redirect URIs and database suffixes.
Sources: IdentitySeedData.cs:27-35, claude.md:104-106, WorktreeSlot.cs:11-16
Seeding Architecture
The core logic resides in the IdentitySeedData class, which implements IHostedService. This ensures the seeding logic runs exactly once during the application's startup sequence.
Database Contexts and Migrations
The seeding service manages three distinct database contexts for the Identity service:
- IdentityDbContext: Handles ASP.NET Core Identity (Users and Roles).
- ConfigurationDbContext: Manages IdentityServer resources (Clients, Scopes, Identity Resources).
- PersistedGrantDbContext: Stores operational data like authorization codes and refresh tokens.
The service uses MigrateAsync() for all contexts, which is idempotent and safe for multi-context initialization. This method ensures that the __EFMigrationsHistory tables are managed correctly for each context.
Sources: IdentitySeedData.cs:14-16, IdentitySeedData.cs:41-52, InitialIdentityServerConfigurationDbMigration.cs:11-15, InitialIdentityServerPersistedGrantDbMigration.cs:11-15
Initialization Flow
The following diagram illustrates the sequential steps taken during the seeding process:
The seeding flow ensures infrastructure is ready before populating application-specific data.
Sources: IdentitySeedData.cs:27-60
User and Role Provisioning
The system seeds a set of standard administrative and clinical roles and users to facilitate role-based access control (RBAC) testing.
Defined Roles
| Role Name | Description |
|---|---|
Admin | Full system administrative access. |
Doctor | Clinical access for patient management. |
Nurse | Supporting clinical access. |
Sources: IdentitySeedData.cs:78-83
Seeded Test Users
All test users are created with a default password (e.g., Admin123!, Doctor123!) and have their email confirmed by default.
| Role | |
|---|---|
admin@test.com | Admin |
nurse@test.com | Nurse |
doctor@test.com | Doctor |
Sources: IdentitySeedData.cs:93-138
Worktree Slot Isolation
To support concurrent development in different git worktrees or by different agents, the project implements "Worktree Slots." This system isolates ports, database names, and seed data.
Slot-Aware Seeding logic
The IdentitySeedData class reads a worktree-slot configuration value (defaulting to 1). This slot number is passed to the IdentityServer configuration seeding logic to ensure that client redirect URIs and CORS origins match the specific ports assigned to that slot.
// Read the worktree slot so this Identity instance seeds only its own slot's URLs.
var slot = int.TryParse(_configuration["worktree-slot"], out var s) ? s : 1;
await SeedIdentityServerConfigurationAsync(scope.ServiceProvider, slot);
Sources: IdentitySeedData.cs:57-60, AppHost.cs:176-177
Database Suffixing
The AppHost (Aspire orchestrator) rewrites connection strings for slots 2–5 by appending an _S{slot} suffix to the Initial Catalog. This ensures that seeding for one worktree does not overwrite the data of another.
| Slot | Port Offset | Database Suffix |
|---|---|---|
| 1 | +0 | (None) |
| 2 | +100 | _S2 |
| 3 | +200 | _S3 |
Sources: WorktreeSlot.cs:11-16, WorktreeSlot.cs:56-70, AppHost.cs:202-212
IdentityServer Configuration Seeding
The service populates the ConfigurationDbContext with standard OIDC resources.
Seeded Resources
- Identity Resources: Standard OIDC scopes such as
openid,profile,email, androles. - API Scopes: Scopes specific to the internal APIs (e.g., Scheduling and Billing).
- Clients: OAuth2 clients configured for the frontend applications (Angular/Blazor). These are generated dynamically based on the active
slotto ensure correctRedirectUris,PostLogoutRedirectUris, andAllowedCorsOrigins.
Sources: IdentitySeedData.cs:141-171, InitialIdentityServerConfigurationDbMigration.cs:49-165
Summary
Seed Data Management is a critical component of the project's development workflow, providing a zero-configuration "clone-and-run" experience. By integrating EF Migrations, IdentityServer configuration, and user provisioning into a single environment-aware hosted service, the project ensures consistency across developer machines while maintaining isolation through the worktree slot system.
Sources: IdentitySeedData.cs, AppHost.cs, claude.md:104-110