Forem: Paul Welter

Blazilla: FluentValidation Integration for Blazor Forms

Paul Welter — Wed, 17 Sep 2025 17:00:00 +0000

Form validation is a critical aspect of any web application, and Blazor developers have long sought a clean, powerful way to integrate FluentValidation with Blazor's EditForm component. Enter Blazilla - a library that bridges this gap perfectly, providing seamless integration between FluentValidation and Blazor forms.

What is Blazilla?

Blazilla is a lightweight .NET library designed specifically to integrate FluentValidation's robust validation capabilities with Blazor's EditForm component. Whether you're building Blazor Server or Blazor WebAssembly applications, Blazilla provides a clean, efficient way to implement client-side validation using FluentValidation's expressive syntax.

Why Another FluentValidation for Blazor Library?

You might be wondering: "There are already FluentValidation integrations for Blazor out there, so why create another one?" The answer lies in the complex integration challenges that existing solutions don't fully address. Blazilla was built to solve specific technical problems that arise when bridging FluentValidation with Blazor's component model.

The FieldIdentifier Challenge

One of the most significant hurdles in integrating FluentValidation with Blazor is the mismatch between how Blazor identifies form fields and how FluentValidation references properties. Blazor uses FieldIdentifier objects to track form fields, while FluentValidation uses string-based property paths.

Blazilla automatically handles this conversion through sophisticated object tree analysis:

Simple Properties: { Model = person, FieldName = "FirstName" } → "FirstName"
Nested Properties: { Model = address, FieldName = "Street" } → "Address.Street"
Collection Items: { Model = phoneNumber, FieldName = "Number" } → "PhoneNumbers[0].Number"

This automatic path conversion ensures that validation messages from FluentValidation rules are correctly associated with their corresponding Blazor input components, regardless of object complexity.

Blazor's Async Validation Limitations

Blazor's built-in validation system has fundamental limitations when it comes to asynchronous validation:

OnValidSubmit Timing Issue: The OnValidSubmit event fires immediately after synchronous validation passes, without waiting for async validation operations to complete. This means forms can prematurely submit while async validation is still running, potentially allowing invalid data through.
EditContext.Validate() Limitations: The standard EditContext.Validate() method only performs synchronous validation and doesn't trigger or wait for async validation rules.

These limitations affect all validation libraries attempting to integrate with Blazor, not just FluentValidation. Many existing solutions simply don't address these issues properly, leading to forms that can submit with incomplete validation results.

Blazilla solves this by:

Providing an opt-in AsyncMode parameter that allows proper async validation handling when needed
Extending EditContext with a ValidateAsync() method that properly waits for all async operations
Offering clear guidance on when to use OnSubmit vs OnValidSubmit

Performance Optimization Through Expression Trees

Form validation can be a performance bottleneck, especially in complex applications. Blazilla addresses this through:

Compiled Expression Trees: Validation contexts are created using compiled expressions for optimal performance
Singleton Validator Pattern: Proper DI registration guidance ensures validators are stateless and cached
Smart Async Handling: Only enables async overhead when actually needed

Real-World Integration Complexity

Existing FluentValidation integrations often work well for simple scenarios but fall short when dealing with:

Complex nested object hierarchies
Dynamic form scenarios with rule sets
Mixed sync/async validation requirements
Custom validator selector needs
Performance-critical applications

Blazilla was designed from the ground up to handle these real-world complexities while maintaining a clean, intuitive API.

Developer Experience Focus

Rather than just providing basic FluentValidation integration, Blazilla prioritizes developer experience by:

Seamless Integration: Works with existing Blazor validation patterns without breaking changes
Clear Error Messages: Provides helpful guidance when configuration issues arise
Comprehensive Documentation: Includes detailed examples for complex scenarios
Best Practice Guidance: Built-in patterns that encourage proper architecture
Extensive Unit Tests: The library includes comprehensive unit test coverage ensuring reliability and stability across different scenarios
Sample Complex Forms: Real-world examples demonstrate advanced features like nested validation, async rules, and rule sets in action

Blazilla isn't just another validation library—it's a comprehensive solution to the real integration challenges developers face when building production Blazor applications with FluentValidation.

Try It Live

Want to see Blazilla in action before diving into the code? The library includes live interactive sample forms that showcase all the key features in a real Blazor application. Visit https://loresoft.com/Blazilla/ to explore:

Basic Form Validation: Simple examples showing real-time validation in action
Async Validation Demos: See how async validation rules work with database lookups and API calls
Nested Object Forms: Complex forms with nested properties and collection validation
Rule Set Examples: Dynamic validation scenarios using different rule sets
Performance Benchmarks: Live examples demonstrating the performance optimizations

These interactive samples are not just demos—they're fully functional examples with complete source code that you can reference when implementing similar features in your own applications. Each sample includes detailed explanations of the validation rules and implementation patterns used.

Key Features

Blazilla brings a comprehensive set of features that make form validation in Blazor applications both powerful and developer-friendly:

Real-time Validation: Fields are validated as users type or change values, providing immediate feedback without requiring form submission.
Form-level Validation: Complete model validation occurs on form submission, ensuring data integrity before processing.
Nested Object Validation: Full support for complex object hierarchies, allowing validation of deeply nested properties.
Asynchronous Validation: Built-in support for async validation rules, perfect for database lookups or API calls during validation.
Rule Sets: Execute specific groups of validation rules based on context (e.g., "Create" vs "Update" scenarios).
Custom Validator Selectors: Fine-grained control over which validation rules execute in different situations.
Dependency Injection Integration: Automatic validator resolution from the DI container, following .NET best practices.
Performance Optimized: Uses compiled expression trees for fast validation context creation, ensuring minimal performance overhead.

Installation

Getting started with Blazilla is straightforward. Install the package via NuGet:

dotnet add package Blazilla

Or via Package Manager Console:

Install-Package Blazilla

Quick Start Guide

Let's walk through a complete example to see how easy it is to get started with Blazilla.

1. Create Your Model

public class Person
{
    public string? FirstName { get; set; }
    public string? LastName { get; set; }
    public int Age { get; set; }
    public string? EmailAddress { get; set; }
}

2. Create a FluentValidation Validator

using FluentValidation;

public class PersonValidator : AbstractValidator<Person>
{
    public PersonValidator()
    {
        RuleFor(p => p.FirstName)
            .NotEmpty().WithMessage("First name is required")
            .MaximumLength(50).WithMessage("First name cannot exceed 50 characters");

        RuleFor(p => p.LastName)
            .NotEmpty().WithMessage("Last name is required")
            .MaximumLength(50).WithMessage("Last name cannot exceed 50 characters");

        RuleFor(p => p.Age)
            .GreaterThanOrEqualTo(0).WithMessage("Age must be greater than or equal to 0")
            .LessThan(150).WithMessage("Age must be less than 150");

        RuleFor(p => p.EmailAddress)
            .NotEmpty().WithMessage("Email address is required")
            .EmailAddress().WithMessage("Please provide a valid email address");
    }
}

3. Register the Validator

Blazor Server (`Program.cs`)

using FluentValidation;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddRazorPages();
builder.Services.AddServerSideBlazor();

// Register FluentValidation validators as singletons for better performance
builder.Services.AddSingleton<IValidator<Person>, PersonValidator>();

var app = builder.Build();
// ... rest of configuration

Blazor WebAssembly (`Program.cs`)

using FluentValidation;
using Microsoft.AspNetCore.Components.Web;
using Microsoft.AspNetCore.Components.WebAssembly.Hosting;

var builder = WebAssemblyHostBuilder.CreateDefault(args);
builder.RootComponents.Add<App>("#app");
builder.RootComponents.Add<HeadOutlet>("head::after");

// Register FluentValidation validators as singletons for better performance
builder.Services.AddSingleton<IValidator<Person>, PersonValidator>();

await builder.Build().RunAsync();

4. Use in Your Blazor Component

@page "/person-form"

<h3>Person Form</h3>

<EditForm Model="@person" OnValidSubmit="@HandleValidSubmit">
    <FluentValidator />
    <ValidationSummary />

    <div class="mb-3">
        <label for="firstName" class="form-label">First Name</label>
        <InputText id="firstName" class="form-control" @bind-Value="person.FirstName" />
        <ValidationMessage For="@(() => person.FirstName)" />
    </div>

    <div class="mb-3">
        <label for="lastName" class="form-label">Last Name</label>
        <InputText id="lastName" class="form-control" @bind-Value="person.LastName" />
        <ValidationMessage For="@(() => person.LastName)" />
    </div>

    <div class="mb-3">
        <label for="age" class="form-label">Age</label>
        <InputNumber id="age" class="form-control" @bind-Value="person.Age" />
        <ValidationMessage For="@(() => person.Age)" />
    </div>

    <div class="mb-3">
        <label for="email" class="form-label">Email</label>
        <InputText id="email" class="form-control" @bind-Value="person.EmailAddress" />
        <ValidationMessage For="@(() => person.EmailAddress)" />
    </div>

    <button type="submit" class="btn btn-primary">Submit</button>
</EditForm>

@code {
    private Person person = new();

    private async Task HandleValidSubmit()
    {
        // Handle successful form submission
        Console.WriteLine("Form submitted successfully!");
    }
}

That's it! With just a few lines of code, you have a fully functional form with real-time validation powered by FluentValidation.

Advanced Features

Asynchronous Validation

One of Blazilla's standout features is its support for asynchronous validation. This is particularly useful for scenarios like checking username availability or validating data against external APIs.

public class PersonValidator : AbstractValidator<Person>
{
    public PersonValidator()
    {
        RuleFor(p => p.EmailAddress)
            .NotEmpty().WithMessage("Email is required")
            .EmailAddress().WithMessage("Please provide a valid email address")
            .MustAsync(async (email, cancellation) => 
            {
                // Simulate async validation (e.g., database check)
                await Task.Delay(500, cancellation);
                return !email?.Equals("admin@example.com", StringComparison.OrdinalIgnoreCase) ?? true;
            }).WithMessage("This email address is not available");
    }
}

When using async validation, you'll need to handle form submission differently:

<EditForm Model="@person" OnSubmit="@HandleSubmit">
    <FluentValidator AsyncMode="true" />
    <ValidationSummary />

    <!-- form fields -->

    <button type="submit" class="btn btn-primary" disabled="@isSubmitting">
        @(isSubmitting ? "Validating..." : "Submit")
    </button>
</EditForm>

@code {
    private Person person = new();
    private bool isSubmitting = false;

    private async Task HandleSubmit(EditContext editContext)
    {
        isSubmitting = true;
        StateHasChanged();

        try
        {
            // Use ValidateAsync to ensure all async validation completes
            var isValid = await editContext.ValidateAsync();

            if (isValid)
            {
                // Form is valid, proceed with submission
                await ProcessValidForm();
            }
        }
        finally
        {
            isSubmitting = false;
            StateHasChanged();
        }
    }

    private async Task ProcessValidForm()
    {
        Console.WriteLine("Form submitted successfully!");
        await Task.Delay(1000); // Simulate form processing
    }
}

Rule Sets

Rule sets allow you to execute specific groups of validation rules based on context:

public class PersonValidator : AbstractValidator<Person>
{
    public PersonValidator()
    {
        // Default rules (always executed)
        RuleFor(p => p.FirstName).NotEmpty();

        // Rules in specific rule sets
        RuleSet("Create", () =>
        {
            RuleFor(p => p.EmailAddress)
                .NotEmpty()
                .EmailAddress();
        });

        RuleSet("Update", () =>
        {
            RuleFor(p => p.LastName).NotEmpty();
        });
    }
}

Then use specific rule sets in your component:

<!-- Execute only the "Create" rule set -->
<FluentValidator RuleSets="@(new[] { "Create" })" />

<!-- Execute all rules including those in rule sets -->
<FluentValidator AllRules="true" />

Nested Object Validation

Blazilla excels at validating complex objects with nested properties:

public class Person
{
    public string? FirstName { get; set; }
    public string? LastName { get; set; }
    public Address? Address { get; set; }
}

public class Address
{
    public string? Street { get; set; }
    public string? City { get; set; }
    public string? PostalCode { get; set; }
}

public class AddressValidator : AbstractValidator<Address>
{
    public AddressValidator()
    {
        RuleFor(a => a.Street).NotEmpty().WithMessage("Street is required");
        RuleFor(a => a.City).NotEmpty().WithMessage("City is required");
        RuleFor(a => a.PostalCode).NotEmpty().WithMessage("Postal code is required");
    }
}

public class PersonValidator : AbstractValidator<Person>
{
    public PersonValidator()
    {
        RuleFor(p => p.FirstName).NotEmpty();
        RuleFor(p => p.LastName).NotEmpty();

        // Validate nested Address object
        RuleFor(p => p.Address!)
            .SetValidator(new AddressValidator())
            .When(p => p.Address is not null);
    }
}

Component Parameters

The FluentValidator component provides several parameters for customization:

Parameter	Type	Default	Description
`Validator`	`IValidator?`	null	Custom validator instance to use instead of DI resolution
`RuleSets`	`IEnumerable<string>?`	null	Specific rule sets to execute
`AllRules`	`bool`	false	Execute all rules including those in rule sets
`AsyncMode`	`bool`	false	Enable asynchronous validation mode
`Selector`	`IValidatorSelector?`	null	Custom validator selector for advanced scenarios

Performance Considerations

Blazilla is designed with performance in mind:

Singleton Registration: Validators should be registered as singletons in the DI container since they are stateless
Expression Tree Compilation: Validation contexts are created using compiled expression trees for optimal performance
Async Optimization: Only enable AsyncMode when you have actual async validation rules to avoid unnecessary overhead

Conclusion

Blazilla represents a significant step forward for Blazor form validation. By bridging the gap between FluentValidation's powerful rule system and Blazor's component model, it provides developers with a clean, efficient, and feature-rich solution for form validation.

Whether you're building simple forms or complex multi-step wizards with nested validation, Blazilla provides the tools you need to create robust, user-friendly forms in your Blazor applications.

The library is actively maintained, well-documented, and designed with real-world usage in mind. If you're working with Blazor forms and want to leverage FluentValidation's capabilities, Blazilla is definitely worth adding to your toolkit.

Resources

Live Demo: https://loresoft.com/Blazilla/
GitHub Repository: https://github.com/loresoft/Blazilla
NuGet Package: https://www.nuget.org/packages/Blazilla/
FluentValidation: https://fluentvalidation.net/
License: MIT License

Ready to get started? Install Blazilla today and experience the power of seamless FluentValidation integration in your Blazor applications!

HashGate - HMAC Authentication Implementation

Paul Welter — Mon, 25 Aug 2025 14:07:26 +0000

In today's microservices landscape, secure server-to-server communication is more critical than ever. While OAuth and JWT tokens are popular choices for user authentication, they often introduce unnecessary complexity and dependencies for service-to-service communication. That's where HashGate comes in - a lightweight, powerful HMAC authentication library designed specifically for ASP.NET Core applications.

https://github.com/loresoft/HashGate

What is HashGate?

HashGate is a comprehensive HMAC (Hash-based Message Authentication Code) authentication system that provides both server-side authentication middleware and client-side HTTP handlers. Inspired by AWS Signature Version 4 and Azure HMAC Authentication, HashGate ensures that every HTTP request is cryptographically signed, providing request integrity and authenticity without the overhead of traditional token-based systems.

Why Choose HMAC Authentication?

Before diving into HashGate's features, let's explore why HMAC authentication is particularly well-suited for modern distributed systems:

Enhanced Security

No credentials in transit: Unlike bearer tokens, HMAC signatures are computed from request data, meaning the actual secret never travels over the network
Request integrity: Each request is cryptographically signed, ensuring the payload hasn't been tampered with during transmission
Replay attack protection: Built-in timestamp validation prevents malicious replaying of captured requests

Microservices Architecture Benefits

Stateless authentication: No need for centralized token stores or session management across services
Service-to-service isolation: Each service can have unique HMAC keys, limiting blast radius if one service is compromised
Zero-dependency authentication: No reliance on external identity providers or token validation services

Operational Advantages

High performance: HMAC computation is fast and doesn't require network calls to validate authenticity
Reduced infrastructure: No need for token refresh endpoints, session stores, or identity service dependencies
Deterministic debugging: Failed requests can be reproduced locally since signatures are deterministic
Language agnostic: Any programming language can call HMAC-authenticated endpoints - Python, JavaScript, Java, Go, PHP, Ruby, and more can all generate the required HMAC signatures using standard cryptographic libraries

Key Features

HashGate brings enterprise-grade HMAC authentication to your .NET applications with these features:

Secure HMAC-SHA256 authentication with timestamp validation
Easy integration with ASP.NET Core authentication system
Client library included for .NET HttpClient integration
Request replay protection with configurable time windows
Highly configurable key providers and validation options

Getting Started

Getting HashGate up and running is straightforward. The library provides separate NuGet packages for server and client implementations:

Installation

For your ASP.NET Core server:

dotnet add package HashGate.AspNetCore

For your .NET client applications:

dotnet add package HashGate.HttpClient

Server Setup

Setting up HMAC authentication on your ASP.NET Core server:

using HashGate.AspNetCore;

var builder = WebApplication.CreateBuilder(args);

// Add HMAC authentication
builder.Services
    .AddAuthentication()
    .AddHmacAuthentication();

builder.Services.AddAuthorization();

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();

// Your protected endpoints
app.MapGet("/api/secure", () => "Hello, authenticated user!")
    .RequireAuthorization();

app.Run();

Configure your HMAC secrets in appsettings.json:

{
    "HmacSecrets": {
        "MyClientId": "your-secret-key-here",
        "AnotherClient": "another-secret-key"
    }
}

Note: For advanced scenarios requiring custom key storage or validation logic (such as database-backed keys, key rotation, or custom claims), implement the IHmacKeyProvider interface. This allows you to control how keys are retrieved and what claims are generated for authenticated clients. See the Advanced Features section for detailed implementation examples.

Client Setup

The client side is equally straightforward:

using HashGate.HttpClient;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;

var builder = Host.CreateApplicationBuilder(args);

// Add HMAC authentication services
builder.Services.AddHmacAuthentication();

// Configure HttpClient with HMAC authentication
builder.Services
    .AddHttpClient("SecureApi", client => client.BaseAddress = new Uri("https://api.example.com"))
    .AddHttpMessageHandler<HmacAuthenticationHttpHandler>();

var app = builder.Build();

// Make authenticated requests
var httpClientFactory = app.Services.GetRequiredService<IHttpClientFactory>();
var httpClient = httpClientFactory.CreateClient("SecureApi");
var response = await httpClient.GetAsync("/api/secure");

Client configuration in appsettings.json:

{
    "HmacAuthentication": {
        "Client": "MyClientId",
        "Secret": "your-secret-key-here"
    }
}

How It Works

HashGate implements a straightforward authentication flow that ensures request integrity and authenticity:

Authentication Flow Overview

Client Credentials: Each client has a unique identifier and secret key
Request Signing: Client calculates HMAC signature of request details
Headers Added: Authentication headers are added to the request
Server Validation: Server validates the signature using the shared secret

Required Headers

Every authenticated request must include these four essential headers:

Host: Internet host and port number (e.g., api.example.com)
x-timestamp: Unix timestamp in seconds when the request was created (must be within server's time tolerance window, typically 5 minutes)
x-content-sha256: Base64-encoded SHA256 hash of the request body (required even for requests with empty bodies)
Authorization: HMAC authentication information containing client ID, signed headers, and signature

String-to-Sign Construction

The heart of HMAC authentication is the canonical string-to-sign format, which must be constructed precisely:

{HTTP_METHOD_UPPERCASE}\n{PATH_WITH_QUERY}\n{SEMICOLON_SEPARATED_HEADER_VALUES}

Construction Rules

HTTP Method: Must be uppercase (GET, POST, PUT, DELETE, etc.)
Path with Query: Full path including query string parameters in their original order
Header Values: Semicolon-separated values in the exact order specified by the SignedHeaders parameter
Encoding: Use UTF-8 encoding and consistent newline characters (\n, not \r\n)

Examples

GET request with query parameters:

GET\n/api/users?page=1&limit=10\napi.example.com;1640995200;47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=

POST request with body:

POST\n/api/users\napi.example.com;1640995201;jZKwqY8QqKqzQe7xJKwqY8QqKqzQe7xKwqY8QqKqzQe=

Authorization Header Format

The authorization header follows a specific structure:

HMAC Client={CLIENT_ID}&SignedHeaders={HEADER_NAMES}&Signature={BASE64_SIGNATURE}

Component Breakdown

Scheme Name: Always starts with HMAC (case-sensitive)
Client Parameter: Your unique client identifier (e.g., demo-client)
SignedHeaders Parameter: Semicolon-separated list of header names included in the signature (e.g., host;x-timestamp;x-content-sha256)
Signature Parameter: Base64-encoded HMAC-SHA256 signature of the string-to-sign

Example Authorization Headers

Basic authorization header:

HMAC Client=demo-client&SignedHeaders=host;x-timestamp;x-content-sha256&Signature=abc123def456ghi789jkl012mno345pqr678stu901vwx234yz567890=

With custom headers:

HMAC Client=mobile-app&SignedHeaders=host;x-timestamp;x-content-sha256;content-type&Signature=xyz789abc123def456ghi789jkl012mno345pqr678stu901vwx234yz=

Cryptographic Operations

HashGate performs two key cryptographic operations:

Content Hash: SHA256 hash of UTF-8 encoded request body, then Base64 encode (required even for empty bodies)
Signature Generation: HMAC-SHA256 of the string-to-sign using UTF-8 encoded secret key, then Base64 encode

Implementation Algorithm

The complete algorithm follows these steps:

Extract host from request URL
Generate current Unix timestamp
Calculate SHA256 hash of request body (use empty content hash constant for empty bodies)
Create header values array in order: [host, timestamp, content_hash]
Create string-to-sign: "METHOD\nPATH\nheader_values_joined_by_semicolon"
Generate HMAC-SHA256 signature of string-to-sign using secret key
Base64 encode the signature
Create authorization header with client ID, signed headers, and signature
Add all required headers to request

Validation on Server

The server performs these validation steps:

Timestamp: Must be within server's time tolerance window
Content Hash: Must match actual request body hash
Signature: Must match server's calculated signature using the same algorithm
Headers: All signed headers must be present and match signed values

This comprehensive approach ensures that any tampering with the request will be detected, and only clients with valid credentials can successfully authenticate.

Advanced Features

Custom Key Providers

HashGate allows you to implement custom key providers for advanced scenarios:

public class DatabaseKeyProvider : IHmacKeyProvider
{
    private readonly IKeyRepository _keyRepository;

    public DatabaseKeyProvider(IKeyRepository keyRepository)
    {
        _keyRepository = keyRepository;
    }

    public async ValueTask<string?> GetSecretAsync(string client, CancellationToken cancellationToken = default)
    {
        var key = await _keyRepository.GetKeyAsync(client, cancellationToken);
        return key?.Secret;
    }

    public async ValueTask<ClaimsIdentity> GenerateClaimsAsync(string client, string? scheme = null, CancellationToken cancellationToken = default)
    {
        var identity = new ClaimsIdentity(scheme);
        identity.AddClaim(new Claim(ClaimTypes.Name, client));

        // Add additional claims based on your requirements
        var model = await _keyRepository.GetClientAsync(client, cancellationToken);
        if (model != null)
        {
            identity.AddClaim(new Claim("display_name", model.DisplayName));
            // Add role claims, permissions, etc. as needed
        }

        return identity;
    }
}

// Register the custom key provider
builder.Services
    .AddAuthentication()
    .AddHmacAuthentication<DatabaseKeyProvider>();

Configuration Options

HashGate provides extensive configuration options:

// Server configuration with custom options
builder.Services
    .AddAuthentication()
    .AddHmacAuthentication(options =>
    {
        options.ToleranceWindow = 10; // 10 minutes timestamp tolerance
        options.SecretSectionName = "MyHmacSecrets"; // Custom config section
    });

// Client configuration with custom options
services.AddHmacAuthentication(options =>
{
    options.Client = "MyClientId";
    options.Secret = "my-secret-key";
    options.SignedHeaders = ["host", "x-timestamp", "x-content-sha256", "content-type"];
});

Sample Implementations

HashGate includes comprehensive sample implementations to help you get started quickly:

Sample.MinimalApi: ASP.NET Core minimal API with protected endpoints
Sample.Client: .NET client using HttpClient with HMAC authentication
Sample.Bruno: Bruno API collection for testing HMAC endpoints
Sample.JavaScript: JavaScript/Node.js client implementation
Sample.Python: Python client implementation demonstrating HMAC authentication

Security Considerations

When implementing HashGate in production, keep these security best practices in mind:

Always use HTTPS in production environments
Protect HMAC secret keys - never expose them in client-side code
Monitor timestamp tolerance - shorter windows provide better security
Rotate keys regularly with proper key rotation policies
Log authentication failures to monitor for potential attacks
Validate all inputs, especially timestamp and signature formats

Use Cases Where HashGate Excels

HashGate is particularly well-suited for:

Internal API gateways communicating with backend services
Microservice mesh where services need to authenticate each other
Webhook validation from external systems
Background job services accessing protected APIs
IoT device communication where OAuth flows are impractical

Conclusion

HashGate represents a modern approach to service-to-service authentication that prioritizes security, performance, and simplicity. By implementing proven HMAC authentication patterns used by major cloud providers, HashGate provides a robust foundation for securing your distributed applications.

Whether you're building a microservices architecture, need secure webhook validation, or want to eliminate dependencies on external identity providers, HashGate offers a compelling solution that's both powerful and easy to implement.

The library is open source and available on GitHub at https://github.com/loresoft/HashGate, with comprehensive documentation and sample implementations to help you get started quickly.

Privileged: A Powerful Authorization Library for .NET

Paul Welter — Sat, 23 Aug 2025 04:17:45 +0000

Privileged, a .NET authorization library that makes implementing rule-based permissions both simple and powerful. Whether you're building a basic web application or a complex enterprise system, Privileged provides the flexibility to scale from simple claim-based authorization to a fully-featured subject and attribute-based authorization system.

https://github.com/loresoft/Privileged

What is Privileged?

Privileged is an authorization library that operates on rules defining what a user can actually do in your application. It's designed to be incrementally adoptable - you can start simple and add complexity as your authorization requirements grow.

The library is built around three core concepts:

Action - What the user wants to do (e.g., read, write, delete)
Subject - The resource being accessed (e.g., Post, User, Document)
Qualifiers - Field-level restrictions for fine-grained control (e.g., title, content)

Key Features

Versatile: Incrementally adoptable and easily scales between simple claim-based and fully-featured authorization
Isomorphic: Works on both frontend and backend with complementary packages
Declarative: Serializable rules that can be shared between UI and API
Rule-based: Support for both allow and forbid rules with precedence
Aliases: Create reusable aliases for actions, subjects, and qualifiers
Field-level permissions: Fine-grained control with qualifier support
ASP.NET Core Integration: Seamless integration with attribute-based policies
Blazor Integration: Ready-to-use components for conditional rendering
Performance Optimized: Efficient rule evaluation and matching algorithms

Getting Started

Install the core package via NuGet:

dotnet add package Privileged

For ASP.NET Core applications, also install the authorization package:

dotnet add package Privileged.Authorization

For Blazor applications, add the components package:

dotnet add package Privileged.Components

Basic Usage

Here's how to create and use basic authorization rules:

var context = new PrivilegeBuilder()
    .Allow("read", "Post")
    .Allow("write", "User")
    .Forbid("delete", "User")
    .Build();

// Check permissions
bool canReadPost = context.Allowed("read", "Post");      // true
bool canWriteUser = context.Allowed("write", "User");    // true
bool canDeleteUser = context.Allowed("delete", "User");  // false
bool canReadUser = context.Allowed("read", "User");      // false (not explicitly allowed)

Wildcard Rules

Use wildcards for broader permissions:

var context = new PrivilegeBuilder()
    .Allow("test", PrivilegeRule.Any)     // Allow 'test' action on any subject
    .Allow(PrivilegeRule.Any, "Post")     // Allow any action on 'Post'
    .Forbid("publish", "Post")            // Forbid overrides allow
    .Build();

Field-Level Permissions

Use qualifiers for fine-grained, field-level control:

var context = new PrivilegeBuilder()
    .Allow("read", "Post", ["title", "id"])   // Only allow reading specific fields
    .Allow("read", "User")                    // Allow reading all User fields
    .Build();

// Check field-specific permissions
context.Allowed("read", "Post", "title").Should().BeTrue();   // Allowed
context.Allowed("read", "Post", "content").Should().BeFalse(); // Not allowed

ASP.NET Core Integration

The Privileged.Authorization package provides seamless integration with ASP.NET Core's authorization system.

Setup

Configure the authorization services in your Program.cs:

using Privileged.Authorization;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthentication(/* your auth setup */);
builder.Services.AddAuthorization();

// Register privilege services
builder.Services.AddPrivilegeAuthorization();
builder.Services.AddScoped<IPrivilegeContextProvider, YourPrivilegeContextProvider>();

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();

Using the Privilege Attribute

Use the [Privilege] attribute to declaratively specify authorization requirements:

[ApiController]
[Route("api/[controller]")]
public class PostsController : ControllerBase
{
    [HttpGet]
    [Privilege("read", "Post")]
    public IActionResult GetPosts() => Ok();

    [HttpPost]
    [Privilege("create", "Post")]
    public IActionResult CreatePost([FromBody] CreatePostRequest request) => Ok();

    [HttpPut("{id}/title")]
    [Privilege("update", "Post", "title")]  // Field-level permission
    public IActionResult UpdatePostTitle(int id, [FromBody] string title) => Ok();
}

Minimal API Support

The library also works great with minimal APIs:

// Simple attribute usage
app.MapGet("/api/posts", [Privilege("read", "Post")] () => 
    Results.Ok(new[] { new { Id = 1, Title = "Hello" } }));

// Using RequirePrivilege extension
app.MapPut("/api/posts/{id}/title", (int id, string title) =>
{
    return Results.Ok();
}).RequirePrivilege("update", "Post", "title");

Blazor Integration

The Privileged.Components package provides components for building privilege-aware UIs.

Conditional Rendering

Use the PrivilegeView component to conditionally show content:

<PrivilegeView Action="read" Subject="Post">
    <p>You can read posts!</p>
</PrivilegeView>

<PrivilegeView Action="delete" Subject="Post">
    <Allowed>
        <button class="btn btn-danger">Delete Post</button>
    </Allowed>
    <Forbidden>
        <span class="text-muted">Delete not allowed</span>
    </Forbidden>
</PrivilegeView>

Privilege-Aware Navigation

The PrivilegeLink component extends NavLink with privilege checking:

<nav class="navbar">
    <PrivilegeLink Subject="Post" Action="read" href="/posts" class="nav-link">
        Posts
    </PrivilegeLink>
    <PrivilegeLink Subject="User" Action="manage" href="/users" class="nav-link">
        Users
    </PrivilegeLink>
</nav>

Smart Input Components

Privilege-aware input components automatically handle read/write permissions:

@* Becomes read-only if user can't update *@
<PrivilegeInputText @bind-Value="@model.Title"
                    Subject="Post"
                    Field="title" />

@* Disables if user can't update *@
<PrivilegeInputSelect @bind-Value="@model.Status"
                      Subject="Post"
                      Field="status">
    <option value="draft">Draft</option>
    <option value="published">Published</option>
</PrivilegeInputSelect>

Advanced Features

Aliases

Create reusable aliases for common permission groups:

var context = new PrivilegeBuilder()
    .Alias("Manage", ["Create", "Update", "Delete"], PrivilegeMatch.Action)
    .Allow("Manage", "Project")  // Allows all actions in the "Manage" alias
    .Build();

Multiple Actions and Subjects

Use extension methods for bulk rule creation:

var context = new PrivilegeBuilder()
    .Allow(["read", "update"], "Post")              // Multiple actions, single subject
    .Allow("read", ["Post", "User"])                // Single action, multiple subjects
    .Allow(["create", "read"], ["Post", "Comment"]) // Multiple actions and subjects
    .Build();

Implementation Strategy

IPrivilegeContextProvider

Implement IPrivilegeContextProvider to load permissions from your data source:

public class DatabasePrivilegeContextProvider : IPrivilegeContextProvider
{
    public async ValueTask<PrivilegeContext> GetContextAsync(ClaimsPrincipal? claimsPrincipal = null)
    {
        var user = claimsPrincipal;

        if (user?.Identity?.IsAuthenticated != true)
            return PrivilegeContext.Empty;

        var userId = user.FindFirst(ClaimTypes.NameIdentifier)?.Value;
        var permissions = await _permissionService.GetUserPermissionsAsync(userId);

        return new PrivilegeContext(permissions);
    }
}

Why Choose Privileged?

Simple to Start: Begin with basic allow/forbid rules and grow complexity as needed
Framework Integration: First-class support for ASP.NET Core and Blazor
Declarative: Rules can be serialized and shared between services
Performance: Optimized for efficient rule evaluation
Flexible: Supports everything from simple permissions to complex field-level authorization
Type Safe: Strongly-typed APIs with comprehensive IntelliSense support

Conclusion

Privileged provides a clean, powerful approach to authorization that grows with your application. Whether you need simple role-based permissions or complex field-level authorization, the library provides the tools to implement it elegantly.

The combination of declarative rules, seamless framework integration, and incremental adoption makes it an excellent choice for .NET applications that need robust authorization capabilities.

Resources

GitHub: https://github.com/loresoft/Privileged
NuGet Packages:
- Privileged (Core library)
- Privileged.Authorization (ASP.NET Core integration)
- Privileged.Components (Blazor components)
- Privileged.Endpoint (Minimal API extensions)

Arbiter Project: A Modern Take on the Mediator Pattern in .NET

Paul Welter — Mon, 04 Aug 2025 17:00:00 +0000

Discover the Arbiter project - a modern implementation of the Mediator pattern for .NET applications embracing clean architecture and CQRS principles.

What is the Arbiter Project?

The Arbiter project is a comprehensive suite of libraries that implements the Mediator pattern and Command Query Responsibility Segregation (CQRS) in .NET. At its core lies the Arbiter.Mediation library, which serves as the foundation for building loosely coupled, testable applications using clean architectural patterns like Vertical Slice Architecture and CQRS.

Why Another Mediator Library?

While libraries like MediatR have dominated the .NET mediator space, Arbiter.Mediation brings several distinctive features to the table:

Lightweight and Extensible: Designed with performance and extensibility in mind
Modern .NET Support: Built specifically for contemporary .NET applications
Clean Architecture Focus: Explicitly designed for Vertical Slice Architecture and CQRS patterns
Comprehensive Ecosystem: Part of a larger suite that includes Entity Framework, MongoDB, and communication libraries

Key Features of Arbiter.Mediation

Request/Response Pattern

The library supports the classic request/response pattern using IRequest<TResponse> and IRequestHandler<TRequest, TResponse> interfaces:

public class Ping : IRequest<Pong>
{
    public string? Message { get; set; }
}

public class PingHandler : IRequestHandler<Ping, Pong>
{
    public async ValueTask<Pong> Handle(
        Ping request,
        CancellationToken cancellationToken = default)
    {
        // Simulate some work
        await Task.Delay(100, cancellationToken);
        return new Pong { Message = $"{request.Message} Pong" };
    }
}

Event Notifications

For scenarios requiring event-driven architecture, Arbiter.Mediation provides notification support through INotification and INotificationHandler<TNotification>:

public class OrderCreatedEvent : INotification
{
    public int OrderId { get; set; }
    public DateTime CreatedAt { get; set; }
}

public class OrderCreatedHandler : INotificationHandler<OrderCreatedEvent>
{
    public async ValueTask Handle(
        OrderCreatedEvent notification,
        CancellationToken cancellationToken = default)
    {
        // Handle the order created event
        // Send email, update inventory, etc.
    }
}

Pipeline Behaviors

One of the most powerful features is the pipeline behavior system, which acts like middleware for your requests:

public class PingBehavior : IPipelineBehavior<Ping, Pong>
{
    public async ValueTask<Pong> Handle(
        Ping request,
        RequestHandlerDelegate<Pong> next,
        CancellationToken cancellationToken = default)
    {
        // Pre-processing logic
        Console.WriteLine($"Before handling: {request.Message}");

        var response = await next(cancellationToken);

        // Post-processing logic
        Console.WriteLine($"After handling: {response.Message}");

        return response;
    }
}

This pattern enables cross-cutting concerns like logging, validation, caching, and performance monitoring without cluttering your business logic.

Setting Up Arbiter.Mediation

Getting started is straightforward. Install the NuGet package:

dotnet add package Arbiter.Mediation

// Register Mediator services
services.AddMediator();

// Register handlers
services.TryAddTransient<IRequestHandler<Ping, Pong>, PingHandler>();

// Optionally register pipeline behaviors
services.AddTransient<IPipelineBehavior<Ping, Pong>, PingBehavior>();

Then inject and use the mediator in your controllers or services:

public class PingController : ControllerBase
{
    private readonly IMediator _mediator;

    public PingController(IMediator mediator)
    {
        _mediator = mediator;
    }

    [HttpGet]
    public async Task<IActionResult> Get(
        string? message = null,
        CancellationToken cancellationToken = default)
    {
        var request = new Ping { Message = message };
        var response = await _mediator.Send<Ping, Pong>(request, cancellationToken);
        return Ok(response);
    }
}

Observability with OpenTelemetry

Modern applications require comprehensive observability. Arbiter.Mediation addresses this with the Arbiter.Mediation.OpenTelemetry package, providing built-in tracing and metrics:

// Install: dotnet add package Arbiter.Mediation.OpenTelemetry

services.AddMediatorDiagnostics();
services.AddOpenTelemetry()
    .WithTracing(tracing => tracing
        .AddMediatorInstrumentation()
        .AddConsoleExporter()
    )
    .WithMetrics(metrics => metrics
        .AddMediatorInstrumentation()
        .AddConsoleExporter()
    );

This integration allows you to monitor request performance, track handler execution, and identify bottlenecks in your application.

The Broader Arbiter Ecosystem

While Arbiter.Mediation forms the core, the Arbiter project extends far beyond basic mediation:

Arbiter.CommandQuery: CQRS framework with base commands and queries for CRUD operations
Arbiter.CommandQuery.EntityFramework: Entity Framework Core handlers for database operations
Arbiter.CommandQuery.MongoDB: MongoDB handlers for document-based storage
Arbiter.CommandQuery.Endpoints: Minimal API endpoints for your commands and queries
Arbiter.Communication: Message template communication for email and SMS services

This comprehensive ecosystem enables you to build complete applications using consistent patterns across different layers and technologies.

When to Choose Arbiter.Mediation

Arbiter.Mediation is particularly well-suited for:

Clean Architecture Applications: When you're implementing Vertical Slice Architecture or onion architecture patterns
CQRS Systems: Applications that benefit from command-query separation
Microservices: Services that need clear request/response boundaries and event handling
Modern .NET Applications: Projects targeting recent .NET versions that want to leverage contemporary patterns

Performance Considerations

While specific benchmarks aren't publicly available, Arbiter.Mediation is designed with performance in mind. The use of ValueTask<T> instead of Task<T> in handler interfaces suggests attention to allocation efficiency, particularly for synchronous operations that complete immediately.

The dependency injection-based resolution and pipeline behavior system provide flexibility without sacrificing performance, making it suitable for high-throughput applications.

Conclusion

The Arbiter project, with Arbiter.Mediation at its core, represents a modern, thoughtful approach to implementing the Mediator pattern in .NET applications. Its focus on clean architecture, comprehensive ecosystem, and built-in observability support make it a compelling choice for developers building maintainable, scalable applications.

Whether you're starting a new project or looking to refactor existing code toward cleaner architecture patterns, Arbiter.Mediation provides the tools and structure to implement robust, loosely coupled systems that are easy to test and maintain.

For teams already familiar with MediatR, the transition to Arbiter.Mediation should be relatively smooth, while offering additional features and a more comprehensive ecosystem for building complete applications.

Learn more about the Arbiter project and explore the source code on GitHub.

AspNetCore.SecurityKey - Security API Key Authentication Implementation for ASP.NET Core

Paul Welter — Fri, 01 Aug 2025 17:00:00 +0000

A flexible and lightweight API key authentication library for ASP.NET Core applications that supports multiple authentication patterns and integrates seamlessly with ASP.NET Core's authentication and authorization infrastructure.

Overview

AspNetCore.SecurityKey provides a complete API key authentication solution for ASP.NET Core applications with support for modern development patterns and best practices.

Key Features:

Multiple Input Sources - API keys via headers, query parameters, or cookies
Flexible Authentication - Works with ASP.NET Core's built-in authentication or as standalone middleware
Extensible Design - Custom validation and extraction logic support
Rich Integration - Controller attributes, middleware, and minimal API support
OpenAPI Support - Automatic Swagger/OpenAPI documentation generation (.NET 9+)
High Performance - Minimal overhead with optional caching
Multiple Deployment Patterns - Attribute-based, middleware, or endpoint filters

Quick Start

Install the package:

   dotnet add package AspNetCore.SecurityKey

Configure your API key in appsettings.json:

   {
     "SecurityKey": "your-secret-api-key-here"
   }

Register services and secure endpoints:

   builder.Services.AddSecurityKey();
   app.UseSecurityKey(); // Secures all endpoints

Call your API with the key:

   curl -H "X-API-KEY: your-secret-api-key-here" https://yourapi.com/endpoint

Installation

The library is available on nuget.org via package name AspNetCore.SecurityKey.

Package Manager Console

Install-Package AspNetCore.SecurityKey

.NET CLI

dotnet add package AspNetCore.SecurityKey

PackageReference

<PackageReference Include="AspNetCore.SecurityKey" />

How to Pass API Keys

AspNetCore.SecurityKey supports multiple ways to pass API keys in requests, providing flexibility for different client scenarios:

Request Headers (Recommended)

The most common and secure approach for API-to-API communication:

GET https://api.example.com/users
Accept: application/json
X-API-KEY: 01HSGVBSF99SK6XMJQJYF0X3WQ

Query Parameters

Useful for simple integrations or when headers cannot be easily modified:

GET https://api.example.com/users?X-API-KEY=01HSGVBSF99SK6XMJQJYF0X3WQ
Accept: application/json

Security Note: When using query parameters, be aware that API keys may appear in server logs, browser history, and referrer headers. Headers are generally preferred for production use.

Cookies

Ideal for browser-based applications or when API keys need persistence:

GET https://api.example.com/users
Accept: application/json
Cookie: X-API-KEY=01HSGVBSF99SK6XMJQJYF0X3WQ

Configuration

Basic Setup

Configure your API keys in appsettings.json:

{
  "SecurityKey": "01HSGVBSF99SK6XMJQJYF0X3WQ"
}

Multiple API Keys

Support multiple valid API keys using semicolon separation:

{
  "SecurityKey": "01HSGVBGWXWDWTFGTJSYFXXDXQ;01HSGVBSF99SK6XMJQJYF0X3WQ;01HSGVAH2M5WVQYG4YPT7FNK4K8"
}

Usage Patterns

AspNetCore.SecurityKey supports multiple integration patterns to fit different application architectures and security requirements.

1. Middleware Pattern (Global Protection)

Apply API key requirement to all endpoints in your application:

var builder = WebApplication.CreateBuilder(args);

// Register services
builder.Services.AddAuthorization();
builder.Services.AddSecurityKey();

var app = builder.Build();

// Apply security to ALL endpoints
app.UseSecurityKey();
app.UseAuthorization();

// All these endpoints require valid API keys
app.MapGet("/weather", () => WeatherService.GetForecast());
app.MapGet("/users", () => UserService.GetUsers()); 
app.MapGet("/products", () => ProductService.GetProducts());

app.Run();

2. Attribute Pattern (Selective Protection)

Apply API key requirement to specific controllers or actions:

[ApiController]
[Route("[controller]")]
public class UsersController : ControllerBase
{
    // This action requires API key
    [SecurityKey]
    [HttpGet]
    public IEnumerable<User> GetUsers()
    {
        return UserService.GetUsers();
    }

    // This action is public (no API key required)
    [HttpGet("public")]
    public IEnumerable<User> GetPublicUsers()
    {
        return UserService.GetPublicUsers();
    }
}

// Or apply to entire controller
[SecurityKey]
[ApiController]  
[Route("[controller]")]
public class SecureController : ControllerBase
{
    // All actions in this controller require API key
    [HttpGet]
    public IActionResult Get() => Ok();
}

3. Endpoint Filter Pattern (Minimal APIs)

Secure specific minimal API endpoints:

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddAuthorization();
builder.Services.AddSecurityKey();

var app = builder.Build();

app.UseAuthorization();

// Public endpoint (no API key required)
app.MapGet("/health", () => "Healthy");

// Secured endpoint using filter
app.MapGet("/users", () => UserService.GetUsers())
   .RequireSecurityKey();

// Multiple endpoints can be grouped
var securedGroup = app.MapGroup("/api/secure")
                     .RequireSecurityKey();

securedGroup.MapGet("/data", () => "Secured data");
securedGroup.MapPost("/action", () => "Secured action");

app.Run();

4. Authentication Scheme Pattern (Full Integration)

Integrate with ASP.NET Core's authentication system:

var builder = WebApplication.CreateBuilder(args);

// Register authentication with SecurityKey scheme
builder.Services
    .AddAuthentication()
    .AddSecurityKey();

builder.Services.AddAuthorization();
builder.Services.AddSecurityKey();

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();

// Use standard authorization attributes
app.MapGet("/users", () => UserService.GetUsers())
   .RequireAuthorization();

// Can also be combined with role-based authorization
app.MapGet("/admin", () => "Admin data")
   .RequireAuthorization("AdminPolicy");

app.Run();

Advanced Customization

Custom Security Key Validation

Implement custom validation logic by creating a class that implements ISecurityKeyValidator:

public class DatabaseSecurityKeyValidator : ISecurityKeyValidator
{
    private readonly IApiKeyRepository _repository;
    private readonly ILogger<DatabaseSecurityKeyValidator> _logger;

    public DatabaseSecurityKeyValidator(
        IApiKeyRepository repository, 
        ILogger<DatabaseSecurityKeyValidator> logger)
    {
        _repository = repository;
        _logger = logger;
    }

    public async ValueTask<bool> Validate(string? value, CancellationToken cancellationToken = default)
    {
        if (string.IsNullOrEmpty(value))
            return false;

        try
        {
            var apiKey = await _repository.GetApiKeyAsync(value, cancellationToken);

            if (apiKey == null)
            {
                _logger.LogWarning("Invalid API key attempted: {Key}", value);
                return false;
            }

            if (apiKey.IsExpired)
            {
                _logger.LogWarning("Expired API key used: {Key}", value);
                return false;
            }

            // Update last used timestamp
            await _repository.UpdateLastUsedAsync(value, DateTime.UtcNow, cancellationToken);

            return true;
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "Error validating API key");
            return false;
        }
    }

    public async ValueTask<ClaimsIdentity> Authenticate(string? value, CancellationToken cancellationToken = default)
    {
        if (string.IsNullOrEmpty(value))
            return new ClaimsIdentity();

        var apiKey = await _repository.GetApiKeyAsync(value, cancellationToken);
        if (apiKey?.User == null)
            return new ClaimsIdentity();

        var identity = new ClaimsIdentity(SecurityKeyAuthenticationDefaults.AuthenticationScheme);        
        identity.AddClaim(new Claim(ClaimTypes.Name, apiKey.User.Name));
        identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, apiKey.User.Id));

        // Add role claims
        foreach (var role in apiKey.User.Roles)
        {
            identity.AddClaim(new Claim(ClaimTypes.Role, role));
        }

        return identity;
    }
}

// Register custom validator
builder.Services.AddScoped<IApiKeyRepository, ApiKeyRepository>();
builder.Services.AddSecurityKey<DatabaseSecurityKeyValidator>();

License

This project is licensed under the MIT License

Equatable.Generator - Source generator for Equals and GetHashCode

Paul Welter — Sat, 07 Sep 2024 17:00:00 +0000

Source generator for Equals and GetHashCode

Features

Override Equals and GetHashCode
Implement IEquatable<T>
Support class, record and struct types
Support EqualityComparer per property
Attribute based control of equality implementation
Comparers supported: String, Sequence, Dictionary, HashSet, Reference, and Custom
No runtime dependencies. Library is compile time dependence only.

Usage

Add package

Add the nuget package to your projects.

dotnet add package Equatable.Generator

Prevent including Equatable.Generator as a dependency

<PackageReference Include="Equatable.Generator" PrivateAssets="all" />

Requirements

This library requires:

Target framework .NET Standard 2.0 or greater
Project C# LangVersion 8.0 or higher

Equatable Attributes

Place equatable attribute on a class, record or struct. The source generator will create a partial with overrides for Equals and GetHashCode.

[Equatable] Marks the class to generate overrides for Equals and GetHashCode

The default comparer used in the implementation of Equals and GetHashCode is EqualityComparer<T>.Default. Customize the comparer used with the following attributes.

[IgnoreEquality] Ignore property in Equals and GetHashCode implementations
[StringEquality] Use specified StringComparer when comparing strings
[SequenceEquality] Use Enumerable.SequenceEqual to determine whether enumerables are equal
[DictionaryEquality] Use to determine if dictionaries are equal
[HashSetEquality] Use ISet<T>.SetEquals to determine whether enumerables are equal
[ReferenceEquality] Use Object.ReferenceEquals to determines whether instances are the same instance
[EqualityComparer] Use the specified EqualityComparer

Example Usage

Example of using the attributes to customize the source generation of Equals and GetHashCode

[Equatable]
public partial class UserImport
{
    [StringEquality(StringComparison.OrdinalIgnoreCase)]
    public string EmailAddress { get; set; } = null!;

    public string? DisplayName { get; set; }

    public string? FirstName { get; set; }

    public string? LastName { get; set; }

    public DateTimeOffset? LockoutEnd { get; set; }

    public DateTimeOffset? LastLogin { get; set; }

    [IgnoreEquality]
    public string FullName => $"{FirstName} {LastName}";

    [HashSetEquality]
    public HashSet<string>? Roles { get; set; }

    [DictionaryEquality]
    public Dictionary<string, int>? Permissions { get; set; }

    [SequenceEquality]
    public List<DateTimeOffset>? History { get; set; }
}

Injectio - Source Generator for Dependency Injection

Paul Welter — Tue, 01 Nov 2022 17:00:00 +0000

Source generator that helps register discovered services in the dependency injection container

Features

Transient, Singleton, Scoped service registration
Factory registration
Module method registration
Duplicate Strategy - Skip,Replace,Append
Registration Strategy - Self, Implemented Interfaces, Self With Interfaces

Usage

Add package

Add the nuget package project to your projects.

dotnet add package Injectio

Prevent dependances from including Injectio

<PackageReference Include="Injectio" PrivateAssets="all" />

Registration Attributes

Place registration attribute on class. The class will be discovered and registered.

[RegisterSingleton] Marks the class as a singleton service
[RegisterScoped] Marks the class as a scoped service
[RegisterTransient] Marks the class as a transient service
[RegisterServices] Marks the method to be called to register services

Attribute Properties

Property	Description
ImplementationType	The type that implements the service. If not set, the class the interface is on will be used.
ServiceType	The type of the service. If not set, the Registration property used to determine what is registered.
Factory	Name of a factory method to create new instances of the service implementation.
Duplicate	How the generator handles duplicate registrations. See Duplicate Strategy
Registration	How the generator determines what to register. See Registration Strategy

Duplicate Strategy

Value	Description
Skip	Skips registrations for services that already exists
Replace	Replaces existing service registrations
Append	Appends a new registration for existing services

Registration Strategy

Value	Description
Self	Registers each matching concrete type as itself
ImplementedInterfaces	Registers each matching concrete type as all of its implemented interfaces
SelfWithInterfaces	Registers each matching concrete type as all of its implemented interfaces and itself

Singleton services

[RegisterSingleton]
public class SingletonService : IService { }

Explicit service type

[RegisterSingleton(ServiceType = typeof(IService))]
public class SingletonService : IService { }

Scoped Services

[RegisterScoped]
public class ScopedService : IService { }

Transient Services

[RegisterTransient]
public class TransientService : IService { }

Factories

[RegisterTransient(Factory = nameof(ServiceFactory))]
public class FactoryService : IFactoryService
{
    private readonly IService _service;

    public FactoryService(IService service)
    { 
        _service = service;
    }

    public static IFactoryService ServiceFactory(IServiceProvider serviceProvider)
    {
        return new FactoryService(serviceProvider.GetService<IService>());
    }
}

Open Generic

[RegisterSingleton(ImplementationType = typeof(OpenGeneric<>), ServiceType = typeof(IOpenGeneric<>))]
public class OpenGeneric<T> : IOpenGeneric<T> { }

Register Method

When the service registration is complex, use the RegisterServices attribute on a method that has a parameter of IServiceCollection or ServiceCollection

public class RegistrationModule
{
    [RegisterServices]
    public static void Register(IServiceCollection services)
    {
        services.TryAddTransient<IModuleService, ModuleService>();
    }
}

Add to container

The source generator creates an extension method with all the discovered services registered. Call the generated extension method to add the services to the container. The method will be called Add[AssemblyName]. The assembly name will have the dots removed.

var services = new ServiceCollection();
services.AddInjectioTestsConsole();

Override the extension method name by using the InjectioName MSBuild property.

<PropertyGroup>
  <InjectioName>Library</InjectioName>
</PropertyGroup>

var services = new ServiceCollection();
services.AddLibrary();

Entity Framework Core Generator - Generating a model from an existing database

Paul Welter — Wed, 14 Nov 2018 18:00:00 +0000

Overview

.NET Core command-line (CLI) tool to generate Entity Framework Core model from an existing database.

NuGet: https://nuget.org/packages/EntityFrameworkCore.Generator
Source: http://github.com/loresoft/EntityFrameworkCore.Generator
Documentation: https://efg.loresoft.com

Features

Entity Framework Core database first model generation
Safe regeneration via region replacement
Safe Renaming via mapping file parsing
Optionally generate read, create and update models from entity
Optionally generate validation and object mapper classes

Documentation

Entity Framework Core Generator documentation is available via Read the Docs

Installation

To install EntityFrameworkCore.Generator tool, run the following command in the console

dotnet tool install --global EntityFrameworkCore.Generator

After the tool has been install, the efg command line will be available. Run efg --help for command line options

Generate Command

Entity Framework Core Generator (efg) creates source code files from a database schema. To generate the files with no configuration, run the following

efg generate -c <ConnectionString>

Replace <ConnectionString> with a valid database connection string.

Generation Output

The generate command will create the follow files and directory structure by default. The root directory defaults to the current working directory. Most of the output names and locations can be customized in the configuration file

Data Context Output

The EntityFramework DbContext file will be created in the root directory.

Entities Output

The entities directory will contain the generated source file for entity class representing each table.

Mapping Output

The mapping directory contains a fluent mapping class to map each entity to its table.

Initialize Command

The initialize command is used to create the configuration yaml file and optionally set the connection string. The configuration file has many options to configure the generated output. See the configuration file documentation for more details.

The following command will create an initial generation.yaml configuration file as well as setting a user secret to store the connection string.

efg initialize -c <ConnectionString>

When a generation.yaml configuration file exists, you can run efg generate in the same directory to generate the source using that configuration file.

Regeneration

Entity Framework Core Generator supports safe regeneration via region replacement and source code parsing. A typical workflow for a project requires many database changes and updates. Being able to regenerate the entities and associated files is a huge time saver.

Region Replacement

All the templates output a region on first generation. On future regeneration, only the regions are replaced. This keeps any other changes you've made to the source file.

Example of a generated entity class

public partial class Status
{
    public Status()
    {
        #region Generated Constructor
        Tasks = new HashSet<Task>();
        #endregion
    }

    #region Generated Properties
    public int Id { get; set; }

    public string Name { get; set; }

    public string Description { get; set; }

    public int DisplayOrder { get; set; }

    public bool IsActive { get; set; }

    public DateTimeOffset Created { get; set; }

    public string CreatedBy { get; set; }

    public DateTimeOffset Updated { get; set; }

    public string UpdatedBy { get; set; }

    public Byte[] RowVersion { get; set; }
    #endregion

    #region Generated Relationships
    public virtual ICollection<Task> Tasks { get; set; }
    #endregion
}

When the generate command is re-run, the Generated Constructor, Generated Properties and Generated Relationships regions will be replace with the current output of the template. Any other changes outside those regions will be safe.

Source Parsing

In order to capture and preserve Entity, Property and DbContext renames, the generate command parses any existing mapping and DbContext class to capture how things are named. This allows you to use the full extend of Visual Studio's refactoring tools to rename things as you like. Then, when regenerating, those changes won't be lost.

Database Providers

Entity Framework Core Generator supports the following databases.

SQL Server
PostgreSQL Coming Soon
MySQL Coming Soon
Sqlite Coming Soon

The provider can be set via command line or via the configuration file.

Set via command line

efg generate -c <ConnectionString> -p <Provider>

Set in configuration file

database:
  connectionString: 'Data Source=(local);Initial Catalog=Tracker;Integrated Security=True'
  provider: SqlServer

Database Schema

The database schema is loaded from the metadata model factory implementation of IDatabaseModelFactory. Entity Framework Core Generator uses the implemented interface from each of the supported providers similar to how ef dbcontext scaffold works.

View Models

Entity Framework Core Generator supports generating Read, Create and Update view models from an entity. Many projects rely on view models to shape data. The model templates can be used to quickly get the basic view models created. The model templates also support regeneration so any database change can easily be sync'd to the view models.

EntityChange - Library to compare two entity object graphs

Paul Welter — Mon, 28 Nov 2016 18:00:00 +0000

Overview

Library to compare two entity object graphs detecting changes

Features

Compare complete entity graph including child entities, collections and dictionaries
Collection compare by index or element equality
Dictionary compare by key
Custom value string formatter
Custom entity equality compare
Markdown or Html change report formatter

Download

The EntityChange library is available on nuget.org via package name EntityChange.

To install EntityChange, run the following command in the Package Manager Console

Install-Package EntityChange

NuGet: https://nuget.org/packages/EntityChange
Source: http://github.com/loresoft/EntityChange

Configuration

Configure the Contact properties and collections.

EntityChange.Configuration.Default.Configure(config => config
    .Entity<Contact>(e =>
    {
        // set the FirstName display name
        e.Property(p => p.FirstName).Display("First Name");
        // compare the Roles collection by string equality
        e.Collection(p => p.Roles)
            .CollectionComparison(CollectionComparison.ObjectEquality)
            .ElementEquality(StringEquality.OrdinalIgnoreCase);
        // set how to format the EmailAddress entity as a string
        e.Collection(p => p.EmailAddresses).ElementFormatter(v =>
        {
            var address = v as EmailAddress;
            return address?.Address;
        });
    })
    .Entity<EmailAddress>(e =>
    {
        e.Property(p => p.Address).Display("Email Address");
    })
);

Comparison

Compare to Contact entities

// create comparer using default configuration
var comparer = new EntityComparer();

// compare original and current instances generating change list 
var changes = comparer.Compare(original, current).ToList();

Change Report

Sample output from the MarkdownFormatter

OUTPUT

Removed Administrator from Roles
Changed Email Address from user@Personal.com to user@gmail.com
Added user@home.com to Email Addresses
Changed Status from New to Verified
Changed Updated from 5/17/2016 8:51:59 PM to 5/17/2016 8:52:00 PM
Changed Zip from 10026 to 10027
Changed Number from 888-555-1212 to 800-555-1212
Added Blah to Categories
Changed Data from 1 to 2
Changed Data from ./home to ./path

Forem: Paul Welter

Blazilla: FluentValidation Integration for Blazor Forms

What is Blazilla?

Why Another FluentValidation for Blazor Library?

The FieldIdentifier Challenge

Blazor's Async Validation Limitations

Performance Optimization Through Expression Trees

Real-World Integration Complexity

Developer Experience Focus

Try It Live

Key Features

Installation

Quick Start Guide

1. Create Your Model

2. Create a FluentValidation Validator

3. Register the Validator

Blazor Server (Program.cs)

Blazor WebAssembly (Program.cs)

4. Use in Your Blazor Component

Advanced Features

Asynchronous Validation

Rule Sets

Nested Object Validation

Component Parameters

Performance Considerations

Conclusion

Resources

HashGate - HMAC Authentication Implementation

What is HashGate?

Why Choose HMAC Authentication?

Enhanced Security

Microservices Architecture Benefits

Operational Advantages

Key Features

Getting Started

Installation

Server Setup

Client Setup

How It Works

Authentication Flow Overview

Required Headers

String-to-Sign Construction

Construction Rules

Examples

Authorization Header Format

Component Breakdown

Example Authorization Headers

Cryptographic Operations

Implementation Algorithm

Validation on Server

Advanced Features

Custom Key Providers

Configuration Options

Sample Implementations

Security Considerations

Use Cases Where HashGate Excels

Conclusion

Privileged: A Powerful Authorization Library for .NET

What is Privileged?

Key Features

Getting Started

Basic Usage

Wildcard Rules

Field-Level Permissions

ASP.NET Core Integration

Setup

Using the Privilege Attribute

Minimal API Support

Blazor Integration

Conditional Rendering

Privilege-Aware Navigation

Smart Input Components

Advanced Features

Aliases

Multiple Actions and Subjects

Implementation Strategy

IPrivilegeContextProvider

Why Choose Privileged?

Conclusion

Resources

Blazor Server (`Program.cs`)

Blazor WebAssembly (`Program.cs`)