E-commerce Inventory API with JWT Auth

Project roadmap

1. 01

   Set up the API and data model

   ~2h

   Create an ASP.NET Core Web API (.NET 8 or newer) with Entity Framework Core and a database provider (PostgreSQL or SQLite). Define Category, Product (name, SKU unique, price, reorder threshold, current stock) and StockMovement (product, quantity change, reason, user, time) entities. Create the initial migration and seed a few categories and products. Done when: dotnet ef database update creates the schema with seed data.

2. 02

   Register users and issue JWTs

   ~2.5h

   Add a User entity with a unique email, a password hash (use PasswordHasher<T> from ASP.NET Core Identity) and a role (Admin or Viewer). Add POST /auth/register (creates viewers only) and POST /auth/login, which returns a signed JWT with the user id and role claims and a 60-minute expiry. Keep the signing key in configuration or user secrets, never in code. Done when: logging in returns a token whose claims decode correctly, for example on jwt.io.

3. 03

   Protect the endpoints with roles

   ~2h

   Configure JWT bearer authentication (issuer, audience, signing key and lifetime validation). Define two authorization policies, CanRead (Admin or Viewer) and CanWrite (Admin only), and apply them with [Authorize(Policy = ...)]. Seed one admin account from configuration. Done when: a request without a token gets 401, a viewer calling a write endpoint gets 403, and an admin succeeds.

4. 04

   Manage products and categories

   ~2h

   Implement GET /products (with category filter and pagination), GET /products/{id}, POST, PUT and DELETE /products, and the same for categories. Validate input with data annotations (required name, price above 0, a non-negative threshold) and return ProblemDetails for errors. Deleting a category that still has products returns 409. Done when: all endpoints work for admins and return correct validation errors.

5. 05

   Record stock movements

   ~2.5h

   Add POST /products/{id}/stock-movements with a quantity change and a reason (Received, Sold, Adjustment). In one transaction, insert the movement and update the product's stock, rejecting any movement that would make stock negative. Add a concurrency token (a RowVersion column) to Product so two simultaneous movements can't produce a wrong total; retry once on a conflict. Add GET /products/{id}/stock-movements. Done when: stock always equals the sum of its movements.

6. 06

   List low-stock products

   ~1h

   Add GET /inventory/low-stock, returning products whose stock is at or below their reorder threshold, sorted by how far below they are, with the quantity needed to get back above it. Allow a ?category= filter. Done when: after recording sales, the products that drop below their threshold appear in the list.

7. 07

   Write integration tests

   ~2.5h

   Using WebApplicationFactory and xUnit with a test database, test that: anonymous requests get 401, viewers can read but get 403 on every write endpoint, admins can write, stock can't go negative, and the low-stock list is correct. Create tokens for the tests by calling the login endpoint. Done when: dotnet test passes.

Resources

• DocsASP.NET Core authentication overview
• DocsPolicy-based authorization in ASP.NET Core
• DocsEntity Framework Core
• DocsHandling concurrency conflicts in EF Core
• DocsIntegration tests in ASP.NET Core