Library Management System - Blazor Server (.NET 10)

Overview

This is a comprehensive Blazor Server application built with ASP.NET Core Identity, implementing a library management system with advanced user management, approval workflows, and book cataloging features.

Features

1. User Registration & Authentication

• Custom user registration with email confirmation
• Password strength validation using FluentValidation
• Rate limiting (3 registration attempts per minute per IP)
• Users start with status WaitingApproval
• Admin notification on new registration
• Login using username or email
• Account lockout after 5 failed attempts (15 minutes)
• Login count and last login date tracking

2. User Status Management

User statuses:

• WaitingApproval: Pending admin approval after registration
• Active: Fully functional account
• Banned: Blocked by admin
• Deleted: Soft deleted (account remains in database)
• Hibernated: Temporarily disabled by user

Only Active users with confirmed emails can log in.

3. Role-Based Authorization

Three roles:

• Admin: Full system access, can approve registrations, ban users, and approve all content
• Moderator: Can approve/reject book submissions (except their own)
• User: Basic access, can create books (pending approval)

Authorization policies:

• ActiveUser: Requires active status
• AdminOnly: Admin role only
• ModeratorOrAdmin: Admin or Moderator roles
• CanApprove: Moderators cannot approve their own submissions

4. Admin Panel

Accessible only by Admins, showing:

• Pending user registrations (approve/reject)
• Pending book approvals
• Pending update/delete requests

All decisions are logged in audit logs and users are notified via email.

5. Book Management

• Create books with multiple authors and translators (many-to-many relationships)
• ISBN-based auto-fill using OpenLibrary API
• Approval workflow:
  • Admin: Auto-approved
  • Moderator: Requires admin approval
  • User: Requires admin or moderator approval
• Books visible only after approval
• Soft delete support

6. Account Management

Users can:

• Upload profile image
• Reset password via email
• Hibernate account (temporary disable)
• Delete account (soft delete)
• View roles and account status
• View login history

7. Private Messaging System

• Send/receive messages between users
• Message threads with parent/child relationships
• Unread notification count
• Soft delete per user (sender delete ≠ recipient delete)
• Only sender and recipient can read messages

8. Audit Logging

All critical actions logged:

• User registrations
• Login attempts (success/failure)
• Account status changes
• Approval decisions
• Password resets

Logs include: UserId, Action, Details, Timestamp, IP Address

9. External API Integration

• OpenLibrary API: Auto-fill book info by ISBN
• Currency Exchange Rate API: Get exchange rates
• Caching with IMemoryCache
• Error handling and logging

10. Security Features

• Email confirmation required
• Lockout after 5 failed attempts (configurable to 15 minutes)
• Rate limiting middleware (100 requests/minute per IP)
• Password requirements: min 8 chars, uppercase, lowercase, number, special char
• Soft delete for data retention
• Authorization handlers for policy enforcement

Database Schema

Tables:

1. AspNetUsers (extended ApplicationUser)

   • StatusId, ProfileImage, LastLoginDate, LoginCount, CreatedDate, IsDeleted, DeletedDate

2. Books

   • Title, ISBN, Description, PublishDate, Publisher, IsApproved, CreatedByUserId, IsDeleted

3. BookAuthors (many-to-many)

   • BookId, AuthorId

4. BookTranslators (many-to-many)

   • BookId, TranslatorId

5. Approvals

   • Type (UserRegistration, BookCreation, BookUpdate, BookDelete)
   • Status (Pending, Approved, Rejected)
   • RequestedByUserId, ApprovedByUserId, BookId, Reason

6. AuditLogs

   • UserId, Action, Details, Timestamp, IpAddress

7. Messages

   • SenderId, RecipientId, Subject, Body, IsReadByRecipient
   • IsDeletedBySender, IsDeletedByRecipient, ParentMessageId

Project Structure

LibraryWeb/
├── Data/
│   ├── Enums/
│   │   ├── UserStatus.cs
│   │   ├── ApprovalType.cs
│   │   └── ApprovalStatus.cs
│   ├── Models/
│   │   ├── Book.cs
│   │   ├── BookAuthor.cs
│   │   ├── BookTranslator.cs
│   │   ├── Approval.cs
│   │   ├── AuditLog.cs
│   │   └── Message.cs
│   ├── ApplicationUser.cs
│   └── ApplicationDbContext.cs
├── Models/
│   ├── RegisterViewModel.cs
│   ├── LoginViewModel.cs
│   ├── CreateBookViewModel.cs
│   └── SendMessageViewModel.cs
├── Validators/
│   ├── RegisterViewModelValidator.cs
│   └── LoginViewModelValidator.cs
├── Authorization/
│   ├── ActiveUserHandler.cs
│   └── ModeratorCannotApproveSelfHandler.cs
├── Services/
│   ├── AccountService.cs
│   ├── ApprovalService.cs
│   ├── AuditService.cs
│   ├── BookService.cs
│   ├── MessageService.cs
│   ├── EmailService.cs
│   ├── ExternalApiService.cs
│   └── RoleSeedService.cs
├── Components/
│   └── Pages/
│       ├── Register.razor
│       ├── Login.razor
│       ├── AdminPanel.razor
│       ├── AccountManagement.razor
│       ├── CreateBook.razor
│       └── Messages.razor
└── Program.cs

Setup Instructions

1. Prerequisites

• .NET 10 SDK
• SQL Server (or SQL Server Express)
• Visual Studio 2022 or VS Code

2. Configure Database

Update appsettings.json with your SQL Server connection string:

{
  "ConnectionStrings": {
    "DefaultConnection": "Server=(localdb)\\mssqllocaldb;Database=LibraryDb;Trusted_Connection=true;MultipleActiveResultSets=true"
  }
}

3. Apply Migrations

dotnet ef database update

4. Seed Initial Admin (Optional)

In Program.cs, uncomment and configure the admin seeding:

using (var scope = app.Services.CreateScope())
{
    var roleSeedService = scope.ServiceProvider.GetRequiredService<RoleSeedService>();
    await roleSeedService.SeedRolesAsync();
    await roleSeedService.SeedDefaultAdminAsync("admin@library.com", "admin", "Admin@123");
}

5. Run Application

dotnet run

Access the application at: https://localhost:5001

Usage

Creating First Admin User

1. Register a new account at /register
2. Manually set user status to Active and assign Admin role in database
3. Confirm email (or skip confirmation for testing)
4. Login and access Admin Panel at /admin/panel

Workflow Examples

User Registration Flow:

1. User registers → Status = WaitingApproval
2. Admin receives notification
3. Admin reviews in Admin Panel
4. Admin approves → Status = Active, user can login
5. OR Admin rejects → Status = Deleted

Book Creation Flow:

1. Admin creates book → Auto-approved
2. Moderator creates book → Pending admin approval
3. User creates book → Pending approval
4. Approver reviews in Admin Panel
5. Book visible after approval

API Endpoints

External APIs Used:

• OpenLibrary: https://openlibrary.org/api/books?bibkeys=ISBN:{isbn}&format=json&jscmd=data
• Exchange Rate: https://api.exchangerate-api.com/v4/latest/{currency}

Security Considerations

1. Email Confirmation: Required before login
2. Lockout: 5 failed attempts = 15-minute lockout
3. Rate Limiting: 100 requests/minute per IP
4. Soft Delete: Data retention for compliance
5. Authorization: Role and policy-based access control
6. Audit Logging: All critical actions tracked

Testing

Test Scenarios:

1. Register with weak password (should fail validation)
2. Register 4+ times from same IP in 1 minute (should be rate limited)
3. Login with wrong password 5 times (should lock account)
4. Login with WaitingApproval status (should be denied)
5. Moderator tries to approve own book (should be denied)
6. Create book with ISBN to test API integration

Future Enhancements

• Email service integration (SendGrid, SMTP)
• File upload for profile images and book covers
• Advanced search and filtering
• Book reviews and ratings
• Borrowing/lending system
• Notification system (SignalR)
• Two-factor authentication
• Password reset via email link

Troubleshooting

Common Issues:

1. Migration Error: Delete Migrations folder and recreate:

   dotnet ef migrations add InitialCreate
   dotnet ef database update

2. Login Fails: Check user status is Active and email is confirmed

3. Rate Limiting: Wait 1 minute or clear rate limit cache

4. Authorization Fails: Ensure user has correct role assigned

License

MIT License

Contributing

Contributions are welcome! Please create a pull request with detailed description.